Merge pull request #28 from miyunari/bumo_to_v1.0.1

Bump model-validation-cli to v1.0.1

- Use the offical released image `ghcr.io/sigstore/model-transparency-cli:v1.0.1`.
  - Update signing step in github action.
  - Update controller.

Author: miyunari

.github/workflows/sign-model.yaml

@@ -30,7 +30,7 @@ jobs:
       env:
         OIDC_TOKEN: ${{ env.OIDC_TOKEN }}
       run: |
-        docker run --rm -v $(pwd)/testdata/tensorflow_saved_model:/tensorflow_saved_model:z -w /tensorflow_saved_model ghcr.io/miyunari/model-transparency-cli:latest sign --sig_out=/tensorflow_saved_model/model.sig --model_path=/tensorflow_saved_model sigstore --identity-token "$OIDC_TOKEN"
+        docker run --rm -v $(pwd)/testdata/tensorflow_saved_model:/tensorflow_saved_model:z -w /tensorflow_saved_model ghcr.io/miyunari/model-transparency-cli:latest sign sigstore --signature="/tensorflow_saved_model/model.sig" --identity_token "$OIDC_TOKEN" /tensorflow_saved_model
 
     - name: Create tar.gz of the signed model
       run: |

manifests/deployment.yaml

@@ -19,7 +19,7 @@ spec:
       serviceAccountName: model-validation-controller-sa
       containers:
       - name: model-validation-controller
-        image: ghcr.io/miyunari/model-validation-controller:latest
+        image: ghcr.io/miyunari/model-validation-controller:v1.0.1
         ports:
         - containerPort: 8080
         volumeMounts:

manifests/kustomization.yaml

@@ -2,7 +2,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
+namespace: model-validation-controller
+
 resources:
+ - namespace.yaml
  - crd.yaml
  - clusterrole.yaml
  - service_account.yaml

manifests/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: model-validation-controller

pod_webhook.go

@@ -19,7 +19,7 @@ import (
 // NewPodInterceptorWebhook creates a new pod mutating webhook to be registered
 func NewPodInterceptorWebhook(c client.Client, decoder admission.Decoder) webhook.AdmissionHandler {
 	return &podInterceptor{
-		client: c,
+		client:  c,
 		decoder: decoder,
 	}
 }
@@ -72,23 +72,22 @@ func (p *podInterceptor) Handle(ctx context.Context, req admission.Request) admi
 		}
 	}
 
-	args := []string{"verify",
-		fmt.Sprintf("--model_path=%s", rhmv.Spec.Model.Path),
-		fmt.Sprintf("--sig_path=%s", rhmv.Spec.Model.SignaturePath),
-	}
-	args = append(args, validationConfigToArgs(logger, rhmv.Spec.Config)...)
+	args := []string{"verify"}
+	args = append(args, validationConfigToArgs(logger, rhmv.Spec.Config, rhmv.Spec.Model.SignaturePath)...)
+	args = append(args, rhmv.Spec.Model.Path)
 
 	pp := pod.DeepCopy()
 	vm := []corev1.VolumeMount{}
 	for _, c := range pod.Spec.Containers {
 		vm = append(vm, c.VolumeMounts...)
 	}
 	pp.Spec.InitContainers = append(pp.Spec.InitContainers, corev1.Container{
-		Name:    modelValidationInitContainerName,
+		Name:            modelValidationInitContainerName,
 		ImagePullPolicy: corev1.PullAlways,
-		Image:   "ghcr.io/miyunari/model-transparency-cli:latest", // TODO: get image from operator config.
-		Command: args,
-		VolumeMounts: vm,
+		Image:           "ghcr.io/sigstore/model-transparency-cli:v1.0.1", // TODO: get image from operator config.
+		Command:         []string{"/usr/local/bin/model_signing"},
+		Args:            args,
+		VolumeMounts:    vm,
 	})
 	marshaledPod, err := json.Marshal(pp)
 	if err != nil {
@@ -98,23 +97,25 @@ func (p *podInterceptor) Handle(ctx context.Context, req admission.Request) admi
 	return admission.PatchResponseFromRaw(req.Object.Raw, marshaledPod)
 }
 
-func validationConfigToArgs(logger logr.Logger, cfg v1alpha1.ValidationConfig) []string {
+func validationConfigToArgs(logger logr.Logger, cfg v1alpha1.ValidationConfig, signaturePath string) []string {
 	logger.Info("construct args")
 	res := []string{}
 	if cfg.SigstoreConfig != nil {
 		logger.Info("found sigstore config")
 		res = append(res,
 			"sigstore",
+			fmt.Sprintf("--signature=%s", signaturePath),
 			"--identity", cfg.SigstoreConfig.CertificateIdentity,
-			"--identity-provider", cfg.SigstoreConfig.CertificateOidcIssuer,
+			"--identity_provider", cfg.SigstoreConfig.CertificateOidcIssuer,
 		)
 		return res
 	}
 
 	if cfg.PrivateKeyConfig != nil {
 		logger.Info("found private-key config")
 		res = append(res,
-			"private-key",
+			"key",
+			fmt.Sprintf("--signature=%s", signaturePath),
 			"--public_key", cfg.PrivateKeyConfig.KeyPath,
 		)
 		return res
@@ -123,8 +124,9 @@ func validationConfigToArgs(logger logr.Logger, cfg v1alpha1.ValidationConfig) [
 	if cfg.PkiConfig != nil {
 		logger.Info("found pki config")
 		res = append(res,
-			"pki",
-			"--root_certs", cfg.PkiConfig.CertificateAuthority,
+			"certificate",
+			fmt.Sprintf("--signature=%s", signaturePath),
+			"--certificate_chain", cfg.PkiConfig.CertificateAuthority,
 		)
 		return res
 	}