Add resolver to provide task resolution for images

Credits: Pierre Tasci
Signed-off-by: Sunil Thaha <sthaha@redhat.com>

go.mod

@@ -25,7 +25,7 @@ require (
 	github.com/mattbaird/jsonpatch v0.0.0-20171005235357-81af80346b1a // indirect
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/nbio/st v0.0.0-20140626010706-e9e8d9816f32 // indirect
-	github.com/onsi/ginkgo v1.10.1 // indirect
+	github.com/onsi/ginkgo v1.10.2 // indirect
 	github.com/onsi/gomega v1.7.0 // indirect
 	github.com/pkg/errors v0.8.1
 	github.com/prometheus/common v0.7.0 // indirect
@@ -49,7 +49,7 @@ require (
 	gopkg.in/yaml.v2 v2.2.5 // indirect
 	k8s.io/api v0.17.2
 	k8s.io/apimachinery v0.17.2
-	k8s.io/client-go v0.17.0
+	k8s.io/client-go v0.17.1
 	k8s.io/code-generator v0.17.1
 	k8s.io/gengo v0.0.0-20191108084044-e500ee069b5c // indirect
 	k8s.io/kube-openapi v0.0.0-20191107075043-30be4d16710a

go.sum

@@ -393,6 +393,8 @@ github.com/onsi/ginkgo v1.8.0 h1:VkHVNpR4iVnU8XQR6DBm8BqYjN7CRzw+xKUbVVbbW9w=
 github.com/onsi/ginkgo v1.8.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.10.1 h1:q/mM8GF/n0shIN8SaAZ0V+jnLPzen6WIVZdiwrRlMlo=
 github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.10.2 h1:uqH7bpe+ERSiDa34FDOF7RikN6RzXgduUF8yarlZp94=
+github.com/onsi/ginkgo v1.10.2/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
 github.com/onsi/gomega v1.4.3 h1:RE1xgDvH7imwFD45h+u2SgIfERHlS2yNG4DObb5BSKU=
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=

pkg/remote/oci.go

@@ -0,0 +1,110 @@
+/*
+Copyright 2019 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package remote
+
+import (
+	"fmt"
+	"io/ioutil"
+	"log"
+	"strings"
+
+	"github.com/google/go-containerregistry/pkg/authn"
+	imgname "github.com/google/go-containerregistry/pkg/name"
+	v1 "github.com/google/go-containerregistry/pkg/v1"
+	"github.com/google/go-containerregistry/pkg/v1/remote"
+	"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1alpha1"
+	"github.com/tektoncd/pipeline/pkg/client/clientset/versioned/scheme"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func init() {
+	// Add Tekton's resources to the K8s deserializer
+	schemeBuilder := runtime.NewSchemeBuilder(v1alpha1.AddToScheme)
+	err := schemeBuilder.AddToScheme(scheme.Scheme)
+	if err != nil {
+		log.Panic(err)
+	}
+}
+
+// ImageResolver will attempt to fetch Tekton resources from an OCI compliant image repository.
+type OCIResolver struct {
+	imageReference string
+}
+
+// GetTask will retrieve the specified task from the resolver's defined image and return its spec. If it cannot be
+// retrieved for any reason, an error is returned.
+func (o OCIResolver) GetTask(taskName string) (*v1alpha1.TaskSpec, error) {
+	taskContents, err := o.readImageLayer("task", taskName)
+	if err != nil {
+		return nil, err
+	}
+
+	// Deserialize the task into a valid task spec.
+	var task v1alpha1.Task
+	_, _, err = scheme.Codecs.UniversalDeserializer().Decode(taskContents, nil, &task)
+	if err != nil {
+		return nil, fmt.Errorf("Invalid remote task %s: %w", taskName, err)
+	}
+
+	return &task.Spec, nil
+}
+
+func (o OCIResolver) readImageLayer(kind string, name string) ([]byte, error) {
+	// TODO: When this is moved into the Tekton controller, authorize this
+	// pull as a Service Account in the cluster, and don't rely on the
+	// contents of ~/.docker/config.json (which won't exist).
+	imgRef, err := imgname.ParseReference(o.imageReference)
+	if err != nil {
+		return nil, fmt.Errorf("%s is an unparseable task image reference: %w", o.imageReference, err)
+	}
+
+	img, err := remote.Image(imgRef, remote.WithAuthFromKeychain(authn.DefaultKeychain))
+	if err != nil {
+		return nil, fmt.Errorf("Error pulling %q: %w", o.imageReference, err)
+	}
+
+	m, err := img.Manifest()
+	if err != nil {
+		return nil, err
+	}
+	ls, err := img.Layers()
+	if err != nil {
+		return nil, err
+	}
+	var layer v1.Layer
+	for idx, l := range m.Layers {
+		if l.Annotations["org.opencontainers.image.title"] != getLayerName(kind, name) {
+			continue
+		}
+
+		// TODO: Check for application/vnd.cdf.tekton.catalog.v1alpha1+yaml or similar as the media type.
+		layer = ls[idx]
+	}
+	if layer == nil {
+		return nil, fmt.Errorf("Resource %s/%s not found", kind, name)
+	}
+	rc, err := layer.Uncompressed()
+	if err != nil {
+		return nil, err
+	}
+	defer rc.Close()
+	return ioutil.ReadAll(rc)
+}
+
+func getLayerName(kind string, name string) string {
+	return fmt.Sprintf("%s/%s", strings.ToLower(kind), name)
+}

pkg/remote/oci_test.go

@@ -0,0 +1,97 @@
+package remote_test
+
+import (
+	"fmt"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+
+	"github.com/ghodss/yaml"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-containerregistry/pkg/name"
+	"github.com/google/go-containerregistry/pkg/registry"
+	"github.com/google/go-containerregistry/pkg/v1/empty"
+	"github.com/google/go-containerregistry/pkg/v1/mutate"
+	remoteimg "github.com/google/go-containerregistry/pkg/v1/remote"
+	"github.com/google/go-containerregistry/pkg/v1/tarball"
+	"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1alpha1"
+	"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1"
+	"github.com/tektoncd/pipeline/pkg/remote"
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestOCIResolver(t *testing.T) {
+	// Set up a fake registry to push an image to.
+	s := httptest.NewServer(registry.New())
+	defer s.Close()
+	u, err := url.Parse(s.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	imgRef, err := name.ParseReference(fmt.Sprintf("%s/test/ociresolver", u.Host))
+	if err != nil {
+		t.Errorf("undexpected error producing image reference %s", err.Error())
+	}
+
+	// Create the image using an example task.
+	task := v1alpha1.Task{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "hello-world",
+		},
+		Spec: v1alpha1.TaskSpec{
+			TaskSpec: v1beta1.TaskSpec{
+				Steps: []v1beta1.Step{
+					{
+						Container: v1.Container{
+							Image: "ubuntu",
+						},
+						Script: "echo \"Hello World!\"",
+					},
+				},
+			},
+		},
+	}
+	taskRaw, err := yaml.Marshal(task)
+	if err != nil {
+		t.Errorf("invalid sample task def %s", err.Error())
+	}
+
+	img := empty.Image
+	layer, err := tarball.LayerFromReader(strings.NewReader(string(taskRaw)))
+	if err != nil {
+		t.Errorf("unexpected error adding task layer to image %s", err.Error())
+	}
+
+	img, err = mutate.Append(img, mutate.Addendum{
+		Layer: layer,
+		Annotations: map[string]string{
+			"org.opencontainers.image.title": "task/hello-world",
+		},
+	})
+	if err != nil {
+		t.Errorf("could not add layer to image %s", err.Error())
+	}
+
+	if err := remoteimg.Write(imgRef, img); err != nil {
+		t.Errorf("could not push example image to registry")
+	}
+
+	// Now we can call our resolver and see if the spec returned is the same.
+	digest, err := img.Digest()
+	if err != nil {
+		t.Errorf("unexpected error getting digest of image: %s", err.Error())
+	}
+	resolver := remote.NewResolver(imgRef.Context().Digest(digest.String()).String())
+
+	actual, err := resolver.GetTask("hello-world")
+	if err != nil {
+		t.Errorf("failed to fetch task hello-world: %s", err.Error())
+	}
+
+	if diff := cmp.Diff(actual, &task.Spec); diff != "" {
+		t.Error(diff)
+	}
+}

pkg/remote/resolver.go

@@ -0,0 +1,31 @@
+/*
+Copyright 2019 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package remote
+
+import "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1alpha1"
+
+// Resolver will retreive Tekton resources like Tasks from remote repositories like an OCI image repositories.
+type Resolver interface {
+	GetTask(taskName string) (*v1alpha1.TaskSpec, error)
+}
+
+// TODO: Right now, there is only one resolver type. When more are added, this will need to be updated.
+func NewResolver(imageReference string) Resolver {
+	return OCIResolver{
+		imageReference: imageReference,
+	}
+}