Skip to content

ROX-34386: Add image labels #162

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mtodor merged 6 commits into from
Jul 22, 2026
+98 −1
Merged

ROX-34386: Add image labels #162

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
bbc7460
Add labels
mtodor Jul 21, 2026
cef568a
Fix version in Labels
mtodor Jul 22, 2026
721ced8
Add correct CPE
mtodor Jul 22, 2026
460cddd
Fix version
mtodor Jul 22, 2026
876db12
Review comments
mtodor Jul 22, 2026
d078e6d
Fix release label
mtodor Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .tekton/acs-mcp-server-pull-request.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,10 @@ spec:
value: '0'
- name: clone-fetch-tags
value: 'true'
- name: extra-labels
value:
# X.Y in the cpe label must be adjusted for every version stream.
- "cpe=cpe:/a:redhat:agentic_cluster_security_suite:0.2::el9"
Comment thread
mtodor marked this conversation as resolved.

pipelineRef:
name: basic-component-pipeline
Expand Down
4 changes: 4 additions & 0 deletions .tekton/acs-mcp-server-push.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,10 @@ spec:
- linux/arm64
- linux/ppc64le
- linux/s390x
- name: extra-labels
value:
# X.Y in the cpe label must be adjusted for every version stream.
- "cpe=cpe:/a:redhat:agentic_cluster_security_suite:0.2::el9"

pipelineRef:
name: basic-component-pipeline
Expand Down
73 changes: 72 additions & 1 deletion .tekton/basic-component-pipeline.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,73 @@ spec:
workspaces:
- name: basic-auth
workspace: git-auth

- name: determine-version
Comment thread
mtodor marked this conversation as resolved.
params:
- name: SOURCE_ARTIFACT
value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)
runAfter:
- clone-repository
taskSpec:
params:
- name: SOURCE_ARTIFACT
type: string
- name: TRUSTED_ARTIFACT_IMAGE
type: string
default: "quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:9b180776a41d9a22a1c51539f1647c60defbbd55b44bbebdd4130e33512d8b0d"
- name: UBI_MINIMAL_IMAGE
type: string
default: "registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:2e8edce823a48e51858f1fad3ff4cbf6875ce8a3f86b9eecf298bc2050c8652a"
results:
- name: VERSION
description: Version string derived from git tags.
volumes:
- name: workdir
emptyDir: {}
stepTemplate:
volumeMounts:
- mountPath: /var/workdir
name: workdir
computeResources:
requests:
cpu: 100m
memory: 256Mi
limits:
memory: 512Mi
Comment on lines +188 to +193

@coderabbitai coderabbitai Bot Jul 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀 Performance & Scalability | 🟠 Major | ⚡ Quick win

Set a CPU limit for the inline task steps.

Line 188-193 defines a CPU request and memory limit, but no limits.cpu; both steps can still consume unbounded CPU on shared CI workers. Add a CPU limit using the pipeline’s standard value.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.tekton/basic-component-pipeline.yaml around lines 188 - 193, Add a
limits.cpu value alongside the existing memory limit in the computeResources
configuration for the inline task steps, using the pipeline’s established
standard CPU-limit value. Preserve the current CPU request and memory settings.

Source: Path instructions

steps:
- name: use-trusted-artifact
image: $(params.TRUSTED_ARTIFACT_IMAGE)
args:
- use
- $(params.SOURCE_ARTIFACT)=/var/workdir/source
- name: determine-version
image: $(params.UBI_MINIMAL_IMAGE)
workingDir: /var/workdir/source
Comment thread
coderabbitai[bot] marked this conversation as resolved.
script: |
#!/usr/bin/env bash
set -euo pipefail
microdnf install -y git-core
VERSION=$(git describe --tags --always)
echo "Determined version: ${VERSION}" >&2
echo -n "${VERSION}" | tee "$(results.VERSION.path)"

- name: generate-labels
params:
- name: label-templates
value:
- release=$ACTUAL_DATE_EPOCH
runAfter:
- clone-repository
taskRef:
params:
- name: name
value: generate-labels
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-generate-labels:0.1@sha256:d4ae1177fc2df0c07089bc30406ce75761cb7de21f361b254bf4dce8a5537e48
- name: kind
value: task
resolver: bundles

- name: prefetch-dependencies
params:
- name: input
Expand Down Expand Up @@ -211,6 +278,7 @@ spec:
- name: BUILD_ARGS
value:
- $(params.build-args[*])
Comment thread
coderabbitai[bot] marked this conversation as resolved.
- VERSION=$(tasks.determine-version.results.VERSION)
- name: BUILD_ARGS_FILE
value: $(params.build-args-file)
- name: PRIVILEGED_NESTED
Expand All @@ -220,7 +288,9 @@ spec:
- name: BUILDAH_FORMAT
value: $(params.buildah-format)
- name: LABELS
value: ["$(params.extra-labels[*])"]
value:
- $(tasks.generate-labels.results.labels[*])
- $(params.extra-labels[*])
- name: BUILD_TIMESTAMP
value: "$(tasks.clone-repository.results.commit-timestamp)"
- name: IMAGE_APPEND_PLATFORM
Expand Down Expand Up @@ -470,6 +540,7 @@ spec:
- name: BUILD_ARGS
value:
- $(params.build-args[*])
- VERSION=$(tasks.determine-version.results.VERSION)
- name: BUILD_ARGS_FILE
value: $(params.build-args-file)
- name: SOURCE_ARTIFACT
Expand Down
18 changes: 18 additions & 0 deletions konflux.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,24 @@ RUN dnf install -y \
# Stage 4: Runtime - Minimal runtime image
FROM ubi-micro-base

# Build arguments for labels
ARG VERSION=dev

# Define labels
LABEL \
com.redhat.component="agentic-cluster-security-suite-acs-mcp-server-container" \
com.redhat.license_terms="https://www.redhat.com/agreements" \
description="The ACS MCP Server" \
io.k8s.description="The ACS MCP Server" \
io.k8s.display-name="acs-mcp-server" \
io.openshift.tags="acs-mcp-server" \
maintainer="Red Hat, Inc." \
name="agentic-cluster-security-suite-tech-preview/acs-mcp-server-rhel9" \
source-location="https://github.com/stackrox/stackrox-mcp" \
summary="The ACS MCP Server" \
version="${VERSION}" \
release="1"

# Set default environment variables
ENV LOG_LEVEL=INFO

Expand Down
Loading