Validate TaskRun compatibility with the Affinity Assistant

A TaskRun that mount more than one PVC-backed workspace is incompatible
with the Affinity Assistant. But there is no validation if the TaskRun
is compatible - so the TaskRun Pod is stuck with little information on why
to the user.

This commit adds validation of TaskRuns. When a TaskRun is associated with
an Affinity Assistant, it is checked that not more than one PVC workspace
is used - if so, the TaskRun will fail with a TaskRunValidationFailed condition.

Proposed in tektoncd#2829 (comment)
Closes tektoncd#2864

pkg/reconciler/taskrun/taskrun.go

@@ -294,6 +294,12 @@ func (c *Reconciler) prepare(ctx context.Context, tr *v1beta1.TaskRun) (*v1beta1
  return nil, nil, controller.NewPermanentError(err)
  }
 
+ if err := validateWorkspaceCompatibilityWithAffinityAssistant(tr); err != nil {
+ logger.Errorf("TaskRun %q workspaces are invalid: %v", tr.Name, err)
+ tr.Status.MarkResourceFailed(podconvert.ReasonFailedValidation, err)
+ return nil, nil, controller.NewPermanentError(err)
+ }
+
  // Initialize the cloud events if at least a CloudEventResource is defined
  // and they have not been initialized yet.
  // FIXME(afrittoli) This resource specific logic will have to be replaced
@@ -702,3 +708,26 @@ func storeTaskSpec(ctx context.Context, tr *v1beta1.TaskRun, ts *v1beta1.TaskSpe
  }
  return nil
 }
+
+// validateWorkspaceCompatibilityWithAffinityAssistant validates the TaskRun's compatibility
+// with the Affinity Assistant - if associated with an Affinity Assistant.
+// No more than one PVC-backed workspace can be used for a TaskRun that is associated with an
+// Affinity Assistant.
+func validateWorkspaceCompatibilityWithAffinityAssistant(tr *v1beta1.TaskRun) error {
+ _, isAssociatedWithAnAffinityAssistant := tr.Annotations[workspace.AnnotationAffinityAssistantName]
+ if !isAssociatedWithAnAffinityAssistant {
+ return nil
+ }
+
+ pvcWorkspaces := 0
+ for _, w := range tr.Spec.Workspaces {
+ if w.PersistentVolumeClaim != nil || w.VolumeClaimTemplate != nil {
+ pvcWorkspaces++
+ }
+ }
+
+ if pvcWorkspaces > 1 {
+ return fmt.Errorf("TaskRun mounts more than one PersistentVolumeClaim - that is forbidden when the Affinity Assistant is enabled")
+ }
+ return nil
+}

pkg/reconciler/taskrun/taskrun_test.go

@@ -38,6 +38,7 @@ import (
  "github.com/tektoncd/pipeline/pkg/reconciler/volumeclaim"
  "github.com/tektoncd/pipeline/pkg/system"
  "github.com/tektoncd/pipeline/pkg/timeout"
+ "github.com/tektoncd/pipeline/pkg/workspace"
  test "github.com/tektoncd/pipeline/test"
  "github.com/tektoncd/pipeline/test/diff"
  "github.com/tektoncd/pipeline/test/names"
@@ -2820,6 +2821,73 @@ func TestReconcileTaskResourceResolutionAndValidation(t *testing.T) {
  }
 }
 
+// TestReconcileWithWorkspacesIncompatibleWithAffinityAssistant tests that a TaskRun used with an associated
+// Affinity Assistant is validated and that the validation fails for a TaskRun that is incompatible with
+// Affinity Assistant; e.g. using more than one PVC-backed workspace.
+func TestReconcileWithWorkspacesIncompatibleWithAffinityAssistant(t *testing.T) {
+ taskWithTwoWorkspaces := tb.Task("test-task-two-workspaces", tb.TaskNamespace("foo"),
+ tb.TaskSpec(
+ tb.TaskWorkspace("ws1", "task workspace", "", true),
+ tb.TaskWorkspace("ws2", "another workspace", "", false),
+ ))
+ taskRun := tb.TaskRun("taskrun-with-two-workspaces", tb.TaskRunNamespace("foo"), tb.TaskRunSpec(
+ tb.TaskRunTaskRef(taskWithTwoWorkspaces.Name, tb.TaskRefAPIVersion("a1")),
+ tb.TaskRunWorkspacePVC("ws1", "", "pvc1"),
+ tb.TaskRunWorkspaceVolumeClaimTemplate("ws2", "", &corev1.PersistentVolumeClaim{
+ ObjectMeta: metav1.ObjectMeta{
+ Name: "pvc2",
+ },
+ Spec: corev1.PersistentVolumeClaimSpec{},
+ }),
+ ))
+
+ // associate the TaskRun with a dummy Affinity Assistant
+ taskRun.Annotations[workspace.AnnotationAffinityAssistantName] = "dummy-affinity-assistant"
+
+ d := test.Data{
+ Tasks: []*v1beta1.Task{taskWithTwoWorkspaces},
+ TaskRuns: []*v1beta1.TaskRun{taskRun},
+ ClusterTasks: nil,
+ PipelineResources: nil,
+ }
+ names.TestingSeed()
+ testAssets, cancel := getTaskRunController(t, d)
+ defer cancel()
+ clients := testAssets.Clients
+
+ t.Logf("Creating SA %s in %s", "default", "foo")
+ if _, err := clients.Kube.CoreV1().ServiceAccounts("foo").Create(&corev1.ServiceAccount{
+ ObjectMeta: metav1.ObjectMeta{
+ Name: "default",
+ Namespace: "foo",
+ },
+ }); err != nil {
+ t.Fatal(err)
+ }
+
+ _ = testAssets.Controller.Reconciler.Reconcile(context.Background(), getRunName(taskRun))
+
+ _, err := clients.Pipeline.TektonV1beta1().Tasks(taskRun.Namespace).Get(taskWithTwoWorkspaces.Name, metav1.GetOptions{})
+ if err != nil {
+ t.Fatalf("krux: %v", err)
+ }
+
+ ttt, err := clients.Pipeline.TektonV1beta1().TaskRuns(taskRun.Namespace).Get(taskRun.Name, metav1.GetOptions{})
+ if err != nil {
+ t.Fatalf("expected TaskRun %s to exist but instead got error when getting it: %v", taskRun.Name, err)
+ }
+
+ if len(ttt.Status.Conditions) != 1 {
+ t.Errorf("unexpected number of Conditions, expected 1 Condition")
+ }
+
+ for _, cond := range ttt.Status.Conditions {
+ if cond.Reason != podconvert.ReasonFailedValidation {
+ t.Errorf("unexpected Reason on the Condition, expected: %s, got: %s", podconvert.ReasonFailedValidation, cond.Reason)
+ }
+ }
+}
+
 // TestReconcileWorkspaceWithVolumeClaimTemplate tests a reconcile of a TaskRun that has
 // a Workspace with VolumeClaimTemplate and check that it is translated to a created PersistentVolumeClaim.
 func TestReconcileWorkspaceWithVolumeClaimTemplate(t *testing.T) {