Cannot use Image PipelineResource for input in tekton task

[g000444555]

Expected Behavior

Find the contents of the input Image PipelineResource under the /workspace directory.

Actual Behavior

No error is thrown and the Image content is not available under the /workspace directory.

Steps to Reproduce the Problem

As documented in https://github.com/tektoncd/pipeline/blob/master/docs/resources.md I have configured an Image PipelineResource:

apiVersion: tekton.dev/v1alpha1
kind: PipelineResource
metadata:
  name: my-image
spec:
  type: image
  params:
    - name: url
      value: image-registry.openshift-image-registry.svc:5000/default/my

Now when I am using the above PipelineResource as an input to a task:

apiVersion: tekton.dev/v1alpha1
kind: Task
metadata:
  name: my-task
spec:
  inputs:
    resources:
      - name: my-image
        type: image
  steps:
    - name: print-info
      image: image-registry.openshift-image-registry.svc:5000/default/my-task-runner-image:latest
      imagePullPolicy: Always
      command: ["/bin/sh"]
      args:
        - "-c"
        - >
          echo "List the contents of /workspace, expecting to find the image in there" &&
          ls -R /workspace

I cannot find the contents of the image under the /workspace directory or any other directory.

The documentation states that an Image PipelineResource is usually used as a Task output for Tasks that build images.

Does this mean that an Image PipelineResource cannot be used as a Task input instead of output?

[ghost]

Hey, I believe this is right (from reading through the image resource code). I don't think the image resource really does anything if it's used as an input, other than act as a container of data. (Happy to be told different though if anyone else knows!)

Pipeline Resources are not being promoted to beta for reasons such as this - their behaviour is a bit confusing and opaque.

[g000444555]

other than act as a container of data

This is exactly what I am trying to use it for. I simply need easy access to the contents of the container image. However, this doesn't seem to work as the contents of the image are not copied/mounted, so I am now considering an option of exporting the image to a tar bar, for example: docker export image-registry.openshift-image-registry.svc:5000/default/my > contents.tar

[vdemeester]

Hey, I believe this is right (from reading through the image resource code). I don't think the image resource really does anything if it's used as an input, other than act as a container of data. (Happy to be told different though if anyone else knows!)

No, it doesn't act as a container of data. It doesn't mount the flattened content of the image in a volume (it's not something k8s supports as far as I know). As of today, images as input are only useful when using it with variable interpolation, it doesn't add anything to the Pod itself.

[vdemeester]

This is exactly what I am trying to use it for. I simply need easy access to the contents of the container image. However, this doesn't seem to work as the contents of the image are not copied/mounted, so I am now considering an option of exporting the image to a tar bar, for example: docker export image-registry.openshift-image-registry.svc:5000/default/my > contents.tar

Indeed. Although this command (with docker) means you need to have access to a docker daemon somwhere (which is not the case on OpenShift 4.x for example). Another way to do this would be using podman (which is rootless):

$ podman export image-registry.openshift-image-registry.svc:5000/default/my > contents.tar

[ghost]

oops, yeah sorry i should have specified - i meant that it holds the "tekton data" (digest / url) in the resource object but you're both right - it never gets mounted or otherwise injected into the container without variable interpolation.

here's an example of variable interpolation to bring that "data" into the container:

apiVersion: tekton.dev/v1alpha1                                                                                                                              
kind: TaskRun                                                                                                                                                
metadata:                                                                                                                                                    
  generateName: print-image-digest-                                                                                                                           
spec:                                                                                                                                                        
  taskSpec:                                                                                                                                                  
    inputs:                                                                                                                                                  
      resources:                                                                                                                                             
      - name: my-image                                                                                                                                       
        type: image                                                                                                                                          
    steps:                                                                                                                                                   
    - name: print-digest                                                                                                                                     
      image: ubuntu                                                                                                                                          
      script: |                                                                                                                                              
        DIGEST=$(inputs.resources.my-image.digest)                                                                                                           
        echo "hello, my digest is $DIGEST"                                                                                                                   
  inputs:                                                                                                                                                    
    resources:                                                                                                                                               
    - name: my-image                                                                                                                                         
      resourceSpec:                                                                                                                                          
        type: image                                                                                                                                          
        params:                                                                                                                                              
        - name: "URL"                                                                                                                                        
          value: "url/to/container/image"                                                                                                                    
        - name: "Digest"                                                                                                                                     
          value: "foobarbazdigest"

[g000444555]

As of today, images as input are only useful when using it with variable interpolation, it doesn't add anything to the Pod itself.

Thank you for letting me know. This is the information I was looking for.

it's not something k8s supports as far as I know

Not sure about k8s, however, OpenShift's build configs do support Image inputs:
https://docs.openshift.com/container-platform/4.2/builds/creating-build-inputs.html#image-source_creating-build-inputs This is why it was very surprising to see that Tekton does not support it, as I already had a chained build with multiple Image inputs and wanted to use the resulting container image as input to a Tekton pipeline.

[vdemeester]

Not sure about k8s, however, OpenShift's build configs do support Image inputs:
https://docs.openshift.com/container-platform/4.2/builds/creating-build-inputs.html#image-source_creating-build-inputs This is why it was very surprising to see that Tekton does not support it, as I already had a chained build with multiple Image inputs and wanted to use the resulting container image as input to a Tekton pipeline.

Right, the way Image Source work is quite different from what PipelineResource are in Tekton. We may have something like this at some point but it will need to wait the PipelineResource redesign