feat(byon): Create task and pipeline resource for image validation

[mimotej]

Resolves: #21

Tekton task, which runs script inside an image given as parameter. Script checks if there is a installed Python and checks if there are any additional pip packages. If either of these are invalid script prints message and exits with exit code 1. Otherwise Python version and pip packages can be found in results in JSON format.

[sesheta]

Hi @mimotej. Thanks for your PR.

I'm waiting for a thoth-station member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[tumido]

As a first pass this is great!

Can you please change it so it outputs to stdout only and with following format:

Validating image:
  Python:      <Not available | 3.9.4>
  Packages: <Not available | list of packages...>
  ...

[tumido]

Same as above - let's do command -v pip first, instead of checking exit status.

[tumido]

Actually, let's rather ask than reinvent stuff....

@fridex, @codificat, @pacospace do you know about any simple and native way to fetch the explicitly installed in Python packages only? Something that would skip all the nested dependencies so we can get a clean list. E.g. do not show Werkzeug if flask is installed.

I would like to avoid installing additional dependencies here if possible, so we don't compromise/modify the analyzed stack (pip-chill comes to mind). Also we need to be sure it would work with any possible python version since we should be able to analyze any imaginable stack.

[mimotej]

I was thinking that --not-required option in pip list might do the trick. According to documentation https://pip.pypa.io/en/stable/cli/pip_list/ it is used to list packages that are not dependencies of installed packages. And from my testing (picture below) it seems to do exactly what we want unless there is some catch that I didn't notice. Also I am not sure when was this option added and if it is available in older versions of pip. WDYT @tumido

[pacospace]

The problem with this solution is that we cannot identify the index from where the package has been installed (just something to consider, even though we are not worrying about index yet for this first iteration). Moreover it seems you basically want to discard the transitive dependencies right? Should we ask today? maybe the UI can hide the transitive ones unless the admin wants to see them? wdyt?

[tumido]

@pacospace We should definitely discuss this. I don't think you wan't to display transitive deps at all. The same for indexes. Mind this list is used by users on the spawner. I think they are interested in explicit deps only. The argument is - do you want to see this:

Or full pip list from the same package:

It's a very different story if you want to show user list of 159 packages compared to 2 important ones currently displayed for the same image in the UI.

The --not-required flag looks like a great find @mimotej 👍 That way the list of 159 packages shrinks to 10. Which I think is a good starting point:

[pacospace]

@mimotej --not-required is in pip since v9.0.0 (released Nov 2016) https://pip.pypa.io/en/stable/news/#v9-0-0, I think this should be safe to use slightly_smiling_face

we can do a diff between base command and this command maybe? so we don't use other packages?

[tumido]

@pacospace not sure if pipenv or thamos is the right answer. We can't assume either is installed and our validation should not fail due to them being unavailable. 🙁 Is there a binary/python version independent version of either libs that we can simply mount to the image or something?

[pacospace]

@pacospace not sure if pipenv or thamos is the right answer. We can't assume either is installed and our validation should not fail due to them being unavailable. slightly_frowning_face Is there a binary/python version independent version of either libs that we can simply mount to the image or something?

we will need to think about indexes also as pip list won't tell you from where the package came from.

cc @fridex for more info

[fridex]

We have this thread https://discuss.python.org/t/pip-installation-reports/12316 and thoth-station/micropipenv#206 I think this will be sooner-or-later implemented upstream. I hadn't time to push any implementation, but it looks like a feature that is desperately lacking in the Python community.

[fridex]

E.g. do not show Werkzeug if flask is installed.

Are these images built by AICoE-CI? AICoE-CI puts information about direct dependencies to /opt, you can eventually read that file. When it comes to pip, I don't know about any option that could be helpful in this case (if I understand your case correctly).

[tumido]

I'm not sure we want to list all the packages here.. is there a way to recognize which packages are explicitly installed and which are dependency packages?

[codificat]

/ok-to-test

[codificat]

The way this repo works for now, you will have to increase the chart version in Chart.yaml for any change that touches charts/*.

Besides that, I only have a question about privileged

[tumido]

I think nested echo $(echo) is not required.

Also recommendation messages should be provided in format:

{"severity":"X","message":"Y"}
{"severity":"X","message":"Y"}

Instead of the current (in PR):

[{"severity":"X","message":"Y"}]
[{"severity":"X","message":"Y"}]

[tumido]

/lgtm
/approve

[sesheta]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tumido

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [tumido]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment