Call gcloud auth activate-service-account if GOOGLE_APPLICATION_CRE…

…DENTIALS is set This used to be done by the gsutil image. When that image was replaced by the vanilla google/cloud-sdk image, this documented behavior broke. By adding this as a step added by the resource, the behavior is maintained without needing to maintain our own image to perform activation.
tektoncd · Dec 16, 2019 · a404746 · a404746
1 parent 0f20c35
commit a404746
Show file tree

Hide file tree

Showing 2 changed files with 76 additions and 23 deletions.
diff --git a/pkg/apis/pipeline/v1alpha1/gcs_resource.go b/pkg/apis/pipeline/v1alpha1/gcs_resource.go
@@ -26,8 +26,14 @@ import (
 	corev1 "k8s.io/api/core/v1"
 )
 
-var (
-	gcsSecretVolumeMountPath = "/var/secret"
+const (
+	gcsSecretVolumeMountPath     = "/var/secret"
+	activateServiceAccountScript = `#!/usr/bin/env bash
+if [[ -z "${GOOGLE_APPLICATION_CREDENTIALS}" ]]; then
+  echo GOOGLE_APPLICATION_CREDENTIALS is set, activating Service Account...
+  gcloud auth activate-service-account --key-file=$GOOGLE_APPLICATION_CREDENTIALS
+done
+`
 )
 
 // GCSResource is a GCS endpoint from which to get artifacts which is required
@@ -143,14 +149,26 @@ func (s *GCSResource) GetInputTaskModifier(ts *TaskSpec, path string) (TaskModif
 	envVars, secretVolumeMount := getSecretEnvVarsAndVolumeMounts(s.Name, gcsSecretVolumeMountPath, s.Secrets)
 	steps := []Step{
 		CreateDirStep(s.ShellImage, s.Name, path),
-		{Container: corev1.Container{
-			Name:         names.SimpleNameGenerator.RestrictLengthWithRandomSuffix(fmt.Sprintf("fetch-%s", s.Name)),
-			Image:        s.GsutilImage,
-			Command:      []string{"gsutil"},
-			Args:         args,
-			Env:          envVars,
-			VolumeMounts: secretVolumeMount,
-		}}}
+		{
+			Script: activateServiceAccountScript,
+			Container: corev1.Container{
+				Name:         names.SimpleNameGenerator.RestrictLengthWithRandomSuffix(fmt.Sprintf("activate-sa-%s", s.Name)),
+				Image:        s.GsutilImage,
+				Env:          envVars,
+				VolumeMounts: secretVolumeMount,
+			},
+		},
+		{
+			Container: corev1.Container{
+				Name:         names.SimpleNameGenerator.RestrictLengthWithRandomSuffix(fmt.Sprintf("fetch-%s", s.Name)),
+				Image:        s.GsutilImage,
+				Command:      []string{"gsutil"},
+				Args:         args,
+				Env:          envVars,
+				VolumeMounts: secretVolumeMount,
+			},
+		},
+	}
 
 	volumes := getStorageVolumeSpec(s, *ts)
 

diff --git a/pkg/apis/pipeline/v1alpha1/gcs_resource_test.go b/pkg/apis/pipeline/v1alpha1/gcs_resource_test.go
@@ -26,7 +26,14 @@ import (
 	corev1 "k8s.io/api/core/v1"
 )
 
-func Test_Invalid_NewStorageResource(t *testing.T) {
+const activateServiceAccountScript = `#!/usr/bin/env bash
+if [[ -z "${GOOGLE_APPLICATION_CREDENTIALS}" ]]; then
+  echo GOOGLE_APPLICATION_CREDENTIALS is set, activating Service Account...
+  gcloud auth activate-service-account --key-file=$GOOGLE_APPLICATION_CREDENTIALS
+done
+`
+
+func TestInvalidNewStorageResource(t *testing.T) {
 	for _, tc := range []struct {
 		name             string
 		pipelineResource *v1alpha1.PipelineResource
@@ -76,7 +83,7 @@ func Test_Invalid_NewStorageResource(t *testing.T) {
 	}
 }
 
-func Test_Valid_NewGCSResource(t *testing.T) {
+func TestValidNewGCSResource(t *testing.T) {
 	pr := tb.PipelineResource("gcs-resource", "default", tb.PipelineResourceSpec(
 		v1alpha1.PipelineResourceTypeStorage,
 		tb.PipelineResourceSpecParam("Location", "gs://fake-bucket"),
@@ -107,7 +114,7 @@ func Test_Valid_NewGCSResource(t *testing.T) {
 	}
 }
 
-func Test_GCSGetReplacements(t *testing.T) {
+func TestGCSGetReplacements(t *testing.T) {
 	gcsResource := &v1alpha1.GCSResource{
 		Name:     "gcs-resource",
 		Location: "gs://fake-bucket",
@@ -123,7 +130,7 @@ func Test_GCSGetReplacements(t *testing.T) {
 	}
 }
 
-func Test_GetParams(t *testing.T) {
+func TestGetParams(t *testing.T) {
 	pr := tb.PipelineResource("gcs-resource", "default", tb.PipelineResourceSpec(
 		v1alpha1.PipelineResourceTypeStorage,
 		tb.PipelineResourceSpecParam("Location", "gcs://some-bucket.zip"),
@@ -144,7 +151,7 @@ func Test_GetParams(t *testing.T) {
 	}
 }
 
-func Test_GetInputSteps(t *testing.T) {
+func TestGetInputSteps(t *testing.T) {
 	names.TestingSeed()
 
 	for _, tc := range []struct {
@@ -170,8 +177,22 @@ func Test_GetInputSteps(t *testing.T) {
 			Name:    "create-dir-gcs-valid-9l9zj",
 			Image:   "busybox",
 			Command: []string{"mkdir", "-p", "/workspace"},
-		}}, {Container: corev1.Container{
-			Name:    "fetch-gcs-valid-mz4c7",
+		}}, {
+			Script: activateServiceAccountScript,
+			Container: corev1.Container{
+				Name:  "activate-sa-gcs-valid-mz4c7",
+				Image: "google/cloud-sdk",
+				Env: []corev1.EnvVar{{
+					Name:  "GOOGLE_APPLICATION_CREDENTIALS",
+					Value: "/var/secret/secretName/key.json",
+				}},
+				VolumeMounts: []corev1.VolumeMount{{
+					Name:      "volume-gcs-valid-secretName",
+					MountPath: "/var/secret/secretName",
+				}},
+			},
+		}, {Container: corev1.Container{
+			Name:    "fetch-gcs-valid-mssqb",
 			Image:   "google/cloud-sdk",
 			Command: []string{"gsutil"},
 			Args:    []string{"rsync", "-d", "-r", "gs://some-bucket", "/workspace"},
@@ -202,11 +223,25 @@ func Test_GetInputSteps(t *testing.T) {
 			GsutilImage: "google/cloud-sdk",
 		},
 		wantSteps: []v1alpha1.Step{{Container: corev1.Container{
-			Name:    "create-dir-gcs-valid-mssqb",
+			Name:    "create-dir-gcs-valid-78c5n",
 			Image:   "busybox",
 			Command: []string{"mkdir", "-p", "/workspace"},
-		}}, {Container: corev1.Container{
-			Name:    "fetch-gcs-valid-78c5n",
+		}}, {
+			Script: activateServiceAccountScript,
+			Container: corev1.Container{
+				Name:  "activate-sa-gcs-valid-6nl7g",
+				Image: "google/cloud-sdk",
+				Env: []corev1.EnvVar{{
+					Name:  "GOOGLE_APPLICATION_CREDENTIALS",
+					Value: "/var/secret/secretName/key.json",
+				}},
+				VolumeMounts: []corev1.VolumeMount{{
+					Name:      "volume-gcs-valid-secretName",
+					MountPath: "/var/secret/secretName",
+				}},
+			},
+		}, {Container: corev1.Container{
+			Name:    "fetch-gcs-valid-j2tds",
 			Image:   "google/cloud-sdk",
 			Command: []string{"gsutil"},
 			Args:    []string{"cp", "gs://some-bucket", "/workspace"},
@@ -226,14 +261,14 @@ func Test_GetInputSteps(t *testing.T) {
 			if tc.wantErr && err == nil {
 				t.Fatalf("Expected error to be %t but got %v:", tc.wantErr, err)
 			}
-			if d := cmp.Diff(gotSpec.GetStepsToPrepend(), tc.wantSteps); d != "" {
-				t.Errorf("Error mismatch between download containers spec: %s", d)
+			if d := cmp.Diff(tc.wantSteps, gotSpec.GetStepsToPrepend()); d != "" {
+				t.Errorf("Diff(-want, +got): %s", d)
 			}
 		})
 	}
 }
 
-func Test_GetOutputTaskModifier(t *testing.T) {
+func TestGetOutputTaskModifier(t *testing.T) {
 	names.TestingSeed()
 
 	for _, tc := range []struct {