github-jira-proxy, prow, plugin: add plugin that checks github webhooks

[avlitman]

What this PR does / why we need it:
This pr added in order to make sure jira webhook secret url is private and no reachable by github repo maintainers outside of redhat.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Jira-ticket: https://issues.redhat.com/browse/CNV-45739

Special notes for your reviewer:
this service needs to have a public URL github can reach.

Checklist

This checklist is not enforcing, but it's a reminder of items that could be relevant to every PR.
Approvers are expected to review this list.

• Design: A design document was considered and is present (link) or not required
• PR: The PR description is expressive enough and will help future contributors
• Code: Write code that humans can understand and Keep it simple
• Refactor: You have left the code cleaner than you found it (Boy Scout Rule)
• Upgrade: Impact of this change on upgrade flows was considered and addressed if required
• Testing: New code requires new unit tests. New features and bug fixes require at least on e2e test
• Documentation: A user-guide update was considered and is present (link) or not required. You want a user-guide update if it's a user facing feature / API change.
• Community: Announcement to kubevirt-dev was considered

Release note:

none

[dhiller]

Looks good for a start @avlitman - comments inline.

Maybe @brianmcarey can chime in here on how we should configure the ingress rule - and what else is necessary to get it reachable from external sources.

[dhiller]

I think we can consume from your own GitHub repository for a start. Other than that, this folder is reserved for proper external prow plugins, which the code here doesn't match (yet). Having said that, you can either build from your public repo in the images Dockerfile, or move your code to the robots folder.

[dhiller]

This should be removed until the code matches the setup for a proper external plugin.

[kubevirt-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from dhiller. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dhiller]

/uncc @davidvossel @vladikr
/cc @brianmcarey

[brianmcarey]

Looks good @avlitman - I think it would be worth adding your pod to this list so that it is checked in the prow-deploy presubmit -

project-infra/github/ci/prow-deploy/tasks/tests.yml

Line 6 in b7565af

- name: wait for prow pods to be ready

[avlitman]

Looks good @avlitman - I think it would be worth adding your pod to this list so that it is checked in the prow-deploy presubmit -

project-infra/github/ci/prow-deploy/tasks/tests.yml

Line 6 in b7565af

- name: wait for prow pods to be ready

Added (:

[brianmcarey]

@avlitman looks like your pod is failing to reach a running state for some reason - https://prow.ci.kubevirt.io/view/gs/kubevirt-prow/pr-logs/pull/kubevirt_project-infra/3516/pull-project-infra-prow-deploy-test/1829076461068226560

You should be able to run a test deploy against a kubevirtci cluster to check out why. You probably need ansible installed though.
https://github.com/kubevirt/project-infra/blob/main/github/ci/prow-deploy/hack/test.sh

[avlitman]

@avlitman looks like your pod is failing to reach a running state for some reason - https://prow.ci.kubevirt.io/view/gs/kubevirt-prow/pr-logs/pull/kubevirt_project-infra/3516/pull-project-infra-prow-deploy-test/1829076461068226560

You should be able to run a test deploy against a kubevirtci cluster to check out why. You probably need ansible installed though.

https://github.com/kubevirt/project-infra/blob/main/github/ci/prow-deploy/hack/test.sh

So just install ansible and run it from my laptop?
Also any ideas why it failed?

[brianmcarey]

@avlitman looks like your pod is failing to reach a running state for some reason - https://prow.ci.kubevirt.io/view/gs/kubevirt-prow/pr-logs/pull/kubevirt_project-infra/3516/pull-project-infra-prow-deploy-test/1829076461068226560
You should be able to run a test deploy against a kubevirtci cluster to check out why. You probably need ansible installed though.
https://github.com/kubevirt/project-infra/blob/main/github/ci/prow-deploy/hack/test.sh

So just install ansible and run it from my laptop? Also any ideas why it failed?

The test env may be missing the necessary secrets to start the pod - I will try to run it here locally to see and let you know.

[avlitman]

@avlitman looks like your pod is failing to reach a running state for some reason - https://prow.ci.kubevirt.io/view/gs/kubevirt-prow/pr-logs/pull/kubevirt_project-infra/3516/pull-project-infra-prow-deploy-test/1829076461068226560
You should be able to run a test deploy against a kubevirtci cluster to check out why. You probably need ansible installed though.
https://github.com/kubevirt/project-infra/blob/main/github/ci/prow-deploy/hack/test.sh

So just install ansible and run it from my laptop? Also any ideas why it failed?

The test env may be missing the necessary secrets to start the pod - I will try to run it here locally to see and let you know.

Much appreciated! does it make sense to push changes to this pr to see if pull-project-infra-prow-deploy-test pass or it will abuse the ci too much?

[brianmcarey]

@avlitman looks like your pod is failing to reach a running state for some reason - https://prow.ci.kubevirt.io/view/gs/kubevirt-prow/pr-logs/pull/kubevirt_project-infra/3516/pull-project-infra-prow-deploy-test/1829076461068226560
You should be able to run a test deploy against a kubevirtci cluster to check out why. You probably need ansible installed though.
https://github.com/kubevirt/project-infra/blob/main/github/ci/prow-deploy/hack/test.sh

So just install ansible and run it from my laptop? Also any ideas why it failed?

The test env may be missing the necessary secrets to start the pod - I will try to run it here locally to see and let you know.

Much appreciated! does it make sense to push changes to this pr to see if pull-project-infra-prow-deploy-test pass or it will abuse the ci too much?

It justs the one job so you should be ok to push whatever changes you want - the lane is pretty quick too so you wouldn't be generating too much load.

[brianmcarey]

Yes it looks like it is missing a couple of secrets for the testing env

  Warning  FailedMount  30s (x9 over 2m38s)  kubelet            MountVolume.SetUp failed for volume "github-webhook-secret" : secret "github-webhook-secret" not found
  Warning  FailedMount  30s (x9 over 2m38s)  kubelet            MountVolume.SetUp failed for volume "jira-webhook-url" : secret "jira-webhook-url" not found

You can add dummy secrets here for testing - https://github.com/kubevirt/project-infra/blob/main/github/ci/prow-deploy/vars/kubevirtci-testing/secrets.yml

[brianmcarey]

Looks good @avlitman - just a couple of questions on the ingress.

[brianmcarey]

We will need to use a different host name here as prow.ci.kubevirt.io is already in use by prow.

[avlitman]

fixed in both places

[brianmcarey]

Should this be github-jira-proxy-service as that is what the service is named below?

[avlitman]

fixed

[brianmcarey]

Also can you add some details to the PR description on why we want to add this.

[avlitman]

Also can you add some details to the PR description on why we want to add this.

@brianmcarey thanks a lot brian- fixed all your comments (:

[brianmcarey]

/hold

This service should not be hosted on the kubevirt control plane cluster as there is still a risk of the mentioned secrets leaking.