Remove creds-init image from build and deploy

.ko.yaml

@@ -2,7 +2,6 @@ defaultBaseImage: gcr.io/distroless/static:nonroot
 baseImageOverrides:
   # These base images run as root, which is needed for how they handle SSH credentials.
   # They are produced from ./images/Dockerfile
-  github.com/tektoncd/pipeline/cmd/creds-init: gcr.io/tekton-nightly/github.com/tektoncd/pipeline/build-base:latest
   github.com/tektoncd/pipeline/cmd/git-init: gcr.io/tekton-nightly/github.com/tektoncd/pipeline/build-base:latest
 
   # GCS fetcher needs root due to workspace permissions

cmd/controller/main.go

@@ -43,7 +43,6 @@ var (
 	entrypointImage          = flag.String("entrypoint-image", "", "The container image containing our entrypoint binary.")
 	nopImage                 = flag.String("nop-image", "", "The container image used to stop sidecars")
 	gitImage                 = flag.String("git-image", "", "The container image containing our Git binary.")
-	credsImage               = flag.String("creds-image", "", "The container image for preparing our Build's credentials.")
 	kubeconfigWriterImage    = flag.String("kubeconfig-writer-image", "", "The container image containing our kubeconfig writer binary.")
 	shellImage               = flag.String("shell-image", "", "The container image containing a shell")
 	gsutilImage              = flag.String("gsutil-image", "", "The container image containing gsutil")
@@ -67,7 +66,6 @@ func main() {
 		EntrypointImage:          *entrypointImage,
 		NopImage:                 *nopImage,
 		GitImage:                 *gitImage,
-		CredsImage:               *credsImage,
 		KubeconfigWriterImage:    *kubeconfigWriterImage,
 		ShellImage:               *shellImage,
 		GsutilImage:              *gsutilImage,

cmd/entrypoint/main.go

@@ -64,7 +64,8 @@ func cp(src, dst string) error {
 }
 
 func main() {
-	// Add credential flags originally used in creds-init.
+	// Add credential flags originally introduced with our legacy credentials helper
+	// image (creds-init).
 	gitcreds.AddFlags(flag.CommandLine)
 	dockercreds.AddFlags(flag.CommandLine)
 
@@ -83,9 +84,10 @@ func main() {
 		return
 	}
 
-	// Copy creds-init credentials from secret volume mounts to /tekton/creds
-	// This is done to support the expansion of a variable, $(credentials.path), that
-	// resolves to a single place with all the stored credentials.
+	// Copy credentials we're expecting from the legacy credentials helper (creds-init)
+	// from secret volume mounts to /tekton/creds. This is done to support the expansion
+	// of a variable, $(credentials.path), that resolves to a single place with all the
+	// stored credentials.
 	builders := []credentials.Builder{dockercreds.NewBuilder(), gitcreds.NewBuilder()}
 	for _, c := range builders {
 		if err := c.Write("/tekton/creds"); err != nil {

config/controller.yaml

@@ -61,7 +61,6 @@ spec:
           # These images are built on-demand by `ko resolve` and are replaced
           # by image references by digest.
           "-kubeconfig-writer-image", "ko://github.com/tektoncd/pipeline/cmd/kubeconfigwriter",
-          "-creds-image", "ko://github.com/tektoncd/pipeline/cmd/creds-init",
           "-git-image", "ko://github.com/tektoncd/pipeline/cmd/git-init",
           "-entrypoint-image", "ko://github.com/tektoncd/pipeline/cmd/entrypoint",
           "-nop-image", "ko://github.com/tektoncd/pipeline/cmd/nop",

examples/v1beta1/taskruns/authenticating-git-commands.yaml

@@ -9,7 +9,8 @@
 # - Starts sshd and tails its log, waiting for the git commands to come in over SSH
 #
 # Two separate Steps then perform authenticated git actions against the sidecar
-# git server using the credentials mounted by creds-init:
+# git server using the credentials mounted by Tekton's credential helper
+# (aka "creds-init"):
 
 # The first step makes a git clone of the bare repository and populates it
 # with a file.

hack/nightly.sh

@@ -19,6 +19,6 @@ set -o nounset
 set -o pipefail
 
 export KO_DOCKER_REPO="gcr.io/tekton-nightly"
-  # Build the base image for creds-init and git images.
+# Build the base image for git images.
 docker build -t "${KO_DOCKER_REPO}/github.com/tektoncd/pipeline/base" -f images/Dockerfile images/
 docker push "${KO_DOCKER_REPO}/github.com/tektoncd/pipeline/base"

pkg/apis/pipeline/images.go

@@ -30,8 +30,6 @@ type Images struct {
 	NopImage string
 	// GitImage is the container image with Git that we use to implement the Git source step.
 	GitImage string
-	// CredsImage is the container image used to initialize credentials before the build runs.
-	CredsImage string
 	// KubeconfigWriterImage is the container image containing our kubeconfig writer binary.
 	KubeconfigWriterImage string
 	// ShellImage is the container image containing bash shell.
@@ -57,7 +55,6 @@ func (i Images) Validate() error {
 		{i.EntrypointImage, "entrypoint"},
 		{i.NopImage, "nop"},
 		{i.GitImage, "git"},
-		{i.CredsImage, "creds"},
 		{i.KubeconfigWriterImage, "kubeconfig-writer"},
 		{i.ShellImage, "shell"},
 		{i.GsutilImage, "gsutil"},

pkg/apis/pipeline/images_test.go

@@ -11,7 +11,6 @@ func TestValidate(t *testing.T) {
 		EntrypointImage:          "set",
 		NopImage:                 "set",
 		GitImage:                 "set",
-		CredsImage:               "set",
 		KubeconfigWriterImage:    "set",
 		ShellImage:               "set",
 		GsutilImage:              "set",
@@ -27,7 +26,6 @@ func TestValidate(t *testing.T) {
 		EntrypointImage:          "set",
 		NopImage:                 "set",
 		GitImage:                 "", // unset!
-		CredsImage:               "set",
 		KubeconfigWriterImage:    "set",
 		ShellImage:               "", // unset!
 		GsutilImage:              "set",

pkg/apis/pipeline/paths.go

@@ -23,6 +23,7 @@ const (
 	DefaultResultPath = "/tekton/results"
 	// HomeDir is the HOME directory of PipelineResources
 	HomeDir = "/tekton/home"
-	// CredsDir is the directory where credentials are placed to meet the creds-init contract
+	// CredsDir is the directory where credentials are placed to meet the legacy credentials
+	// helpers image (aka "creds-init") contract
 	CredsDir = "/tekton/creds"
 )

pkg/apis/pipeline/v1alpha1/task_validation_test.go

@@ -262,7 +262,7 @@ func TestTaskSpecValidate(t *testing.T) {
 			}}},
 		},
 	}, {
-		name: "valid creds-init path variable",
+		name: "valid legacy credential helper (creds-init) path variable",
 		fields: fields{
 			Steps: []v1alpha1.Step{{Container: corev1.Container{
 				Name:  "mystep",

pkg/apis/pipeline/v1beta1/task_validation_test.go

@@ -164,7 +164,7 @@ func TestTaskSpecValidate(t *testing.T) {
 			}}},
 		},
 	}, {
-		name: "valid creds-init path variable",
+		name: "valid path variable for legacy credential helper (aka creds-init)",
 		fields: fields{
 			Steps: []v1beta1.Step{{Container: corev1.Container{
 				Name:  "mystep",

pkg/apis/resource/v1alpha1/storage/build_gcs_test.go

@@ -34,7 +34,6 @@ var images = pipeline.Images{
 	EntrypointImage:          "override-with-entrypoint:latest",
 	NopImage:                 "override-with-nop:latest",
 	GitImage:                 "override-with-git:latest",
-	CredsImage:               "override-with-creds:latest",
 	KubeconfigWriterImage:    "override-with-kubeconfig-writer:latest",
 	ShellImage:               "busybox",
 	GsutilImage:              "gcr.io/google.com/cloudsdktool/cloud-sdk",

pkg/artifacts/artifact_storage_test.go

@@ -40,7 +40,6 @@ var (
 		EntrypointImage:          "override-with-entrypoint:latest",
 		NopImage:                 "override-with-nop:latest",
 		GitImage:                 "override-with-git:latest",
-		CredsImage:               "override-with-creds:latest",
 		KubeconfigWriterImage:    "override-with-kubeconfig-writer:latest",
 		ShellImage:               "busybox",
 		GsutilImage:              "gcr.io/google.com/cloudsdktool/cloud-sdk",

pkg/credentials/initialize.go

@@ -40,7 +40,8 @@ const (
 	credsFilePermissions = 0600
 )
 
-// CredsInitCredentials is the complete list of credentials that creds-init can write to /tekton/creds.
+// CredsInitCredentials is the complete list of credentials that the legacy credentials
+// helper (aka "creds-init") can write to /tekton/creds.
 var CredsInitCredentials = []string{".docker", ".gitconfig", ".git-credentials", ".ssh"}
 
 // VolumePath is the path where build secrets are written.

pkg/pod/creds_init_test.go

@@ -159,7 +159,7 @@ func TestCredsInit(t *testing.T) {
 		}},
 		ctx: context.Background(),
 	}, {
-		desc: "disabling creds-init via feature-flag results in no args or volumes",
+		desc: "disabling legacy credential helper (creds-init) via feature-flag results in no args or volumes",
 		objs: []runtime.Object{
 			&corev1.ServiceAccount{
 				ObjectMeta: metav1.ObjectMeta{Name: serviceAccountName, Namespace: namespace},

pkg/pod/pod.go

@@ -170,9 +170,9 @@ func (b *Builder) Build(ctx context.Context, taskRun *v1beta1.TaskRun, taskSpec
 	for i, s := range stepContainers {
 		// Mount /tekton/creds with a fresh volume for each Step. It needs to
 		// be world-writeable and empty so creds can be initialized in there. Cant
-		// guarantee what UID container runs with. If creds-init is disabled via
-		// feature flag then these can be nil since we don't want to mount the
-		// automatic credential volume.
+		// guarantee what UID container runs with. If legacy credential helper (creds-init)
+		// is disabled via feature flag then these can be nil since we don't want to mount
+		// the automatic credential volume.
 		v, vm := getCredsInitVolume(ctx)
 		if v != nil && vm != nil {
 			volumes = append(volumes, *v)