Pipeline resource validation does not account for Condition resources

[afrittoli]

Expected Behavior

It should be possible to have resources only used by a Condition. For instance the following pipeline should be valid:

apiVersion: tekton.dev/v1alpha1
kind: Pipeline
spec:
  resources:
    - name: src
      type: git
  tasks:
  - name: source-to-image-task
    taskRef:
      name: taskWithNoResources
    conditions:
      - conditionRef: conditionWithResource
        resources:
          - name: workspace
            resource: src

Actual Behavior

Validation of the pipeline fails:

Error from server (InternalError): error when creating "example.yaml": Internal error occurred: admission webhook "webhook.tekton.dev" denied the request: mutation failed: invalid value: Pipeline declared resources didn't match usage in Tasks: Provided extra values: [src]: spec.resources

Steps to Reproduce the Problem

1. Define a simple condition with a resource
2. Define a simple task that does not use the resource used by the condition
3. Define a pipeline like above

Additional Info

The validateDeclaredResource method in

pipeline/pkg/apis/pipeline/v1alpha1/pipeline_validation.go

Lines 38 to 60 in 3950521

	func validateDeclaredResources(ps *PipelineSpec) error {
	required := []string{}
	for _, t := range ps.Tasks {
	if t.Resources != nil {
	for _, input := range t.Resources.Inputs {
	required = append(required, input.Resource)
	}
	for _, output := range t.Resources.Outputs {
	required = append(required, output.Resource)
	}
	}
	}
	provided := make([]string, 0, len(ps.Resources))
	for _, resource := range ps.Resources {
	provided = append(provided, resource.Name)
	}
	err := list.IsSame(required, provided)
	if err != nil {
	return xerrors.Errorf("Pipeline declared resources didn't match usage in Tasks: %w", err)
	}
	return nil
	}

only matches resources of the pipeline with resources of the tasks, it does not account for resources used by conditions.

[vdemeester]

/kind bug
/cc @dibyom

[afrittoli]

I can propose a fix for this myself, but I want to make sure folks agree that this is a bug :)

[dibyom]

Yeah, I think this is a bug. I don't see a reason why we should limit the resources available to the condition to only the ones available to the task.

[dibyom]

/assign