feat: add ctlog-monitor component #320
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Reviewer's GuideAdds a new Konflux Application configuration for the rekor-monitor project, defining Application, Components, and ImageRepositories for both rekor-monitor and ctlog-monitor, wired into kustomize. Sequence diagram for image build and SBOM webhook for rekor-monitor and ctlog-monitorsequenceDiagram
actor Developer
participant GitHub as GitHub_repo_securesign_rekor_monitor
participant AppStudio as Konflux_AppStudio
participant Pipeline as BuildPipeline_docker_build_oci_ta
participant Registry as Quay_rhtas_tenant
participant Bombino as Bombino_API
Developer->>GitHub: Push changes to main
GitHub-->>AppStudio: Notify commit on securesign/rekor-monitor
AppStudio->>Pipeline: Trigger build for rekor-monitor component
AppStudio->>Pipeline: Trigger build for ctlog-monitor component
Pipeline->>Registry: Push image rhtas-tenant/rekor-monitor
Pipeline->>Registry: Push image rhtas-tenant/ctlog-monitor
Registry-->>Bombino: repo_push webhook for rekor-monitor SBOM
Registry-->>Bombino: repo_push webhook for ctlog-monitor SBOM
Bombino-->>Registry: Acknowledge SBOM event reception
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes - here's some feedback:
- There are trailing spaces after
kind: ImageRepositoryinimagerepository.yaml; removing them will avoid noisy diffs and potential formatting issues with strict tooling. - The Bombino webhook notification block is duplicated for both
rekor-monitorandctlog-monitorimage repositories; consider extracting this into a shared kustomize component or base to keep the configuration DRY and easier to maintain.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- There are trailing spaces after `kind: ImageRepository` in `imagerepository.yaml`; removing them will avoid noisy diffs and potential formatting issues with strict tooling.
- The Bombino webhook notification block is duplicated for both `rekor-monitor` and `ctlog-monitor` image repositories; consider extracting this into a shared kustomize component or base to keep the configuration DRY and easier to maintain.
## Individual Comments
### Comment 1
<location> `konflux-configs/base/application/rekor-monitor/base/imagerepository.yaml:4` </location>
<code_context>
+---
+
+apiVersion: appstudio.redhat.com/v1alpha1
+kind: ImageRepository
+metadata:
+ name: rekor-monitor
</code_context>
<issue_to_address>
**issue (bug_risk):** Remove trailing whitespace from the `kind` value to avoid potential API deserialization issues.
`kind` is set to `ImageRepository ` with a trailing space. Kubernetes does exact string matching on `kind`, so this may cause the resource to be rejected as an unknown type. Please remove the trailing space so it reads `ImageRepository`.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| --- | ||
|
|
||
| apiVersion: appstudio.redhat.com/v1alpha1 | ||
| kind: ImageRepository |
There was a problem hiding this comment.
issue (bug_risk): Remove trailing whitespace from the kind value to avoid potential API deserialization issues.
kind is set to ImageRepository with a trailing space. Kubernetes does exact string matching on kind, so this may cause the resource to be rejected as an unknown type. Please remove the trailing space so it reads ImageRepository.
Configuration Diff4 document(s) impacted: + 0 added
- 0 removed
! 4 modifiedDiff@@ spec.description @@
# projctl.konflux.dev/v1beta1/Project/rhtas-tenant/rekor-monitor
! ± value change in multiline text (one insert, one deletion)
- Rekor Monitor provides monitoring capabilities for Rekor transparency log.
+ Rekor Monitor provides monitoring capabilities for the Rekor and Certificate transparency logs.
@@ spec.resources @@
# projctl.konflux.dev/v1beta1/ProjectDevelopmentStreamTemplate/rhtas-tenant/rekor-monitor-template
! - two list entries removed:
- - apiVersion: appstudio.redhat.com/v1alpha1
- kind: Component
- metadata:
- name: {{.component}}{{.nameSuffix}}
- annotations:
- build.appstudio.openshift.io/pipeline: "{\"name\":\"docker-build-oci-ta\",\"bundle\":\"latest\"}"
- git-provider: github
- git-provider-url: "https://github.com"
- mintmaker.appstudio.redhat.com/disabled: {{.mintmakerDisabled}}
- spec:
- source:
- git:
- url: "https://github.com/securesign/rekor-monitor"
- dockerfileUrl: Dockerfile.rh
- revision: {{.branch}}
- application: {{.application}}{{.nameSuffix}}
- componentName: {{.component}}
- - apiVersion: appstudio.redhat.com/v1alpha1
- kind: ImageRepository
- metadata:
- name: imagerepository-for-{{.application}}{{.nameSuffix}}-{{.component}}
- labels:
- appstudio.redhat.com/component: {{.component}}{{.nameSuffix}}
- spec:
- image:
- name: rhtas-tenant/rekor-monitor
- visibility: public
- notifications:
- - config:
- url: "https://bombino.api.redhat.com/v1/sbom/quay/push"
- event: repo_push
- method: webhook
- title: SBOM-event-to-Bombino
! + four list entries added:
+ - apiVersion: appstudio.redhat.com/v1alpha1
+ kind: Component
+ metadata:
+ name: {{.rekor-monitor-component}}{{.nameSuffix}}
+ annotations:
+ build.appstudio.openshift.io/pipeline: "{\"name\":\"docker-build-oci-ta\",\"bundle\":\"latest\"}"
+ git-provider: github
+ git-provider-url: "https://github.com"
+ mintmaker.appstudio.redhat.com/disabled: {{.mintmakerDisabled}}
+ spec:
+ source:
+ git:
+ url: "https://github.com/securesign/rekor-monitor"
+ dockerfileUrl: Dockerfile.rekor-monitor.rh
+ revision: {{.branch}}
+ application: {{.application}}{{.nameSuffix}}
+ componentName: {{.rekor-monitor-component}}
+ - apiVersion: appstudio.redhat.com/v1alpha1
+ kind: Component
+ metadata:
+ name: {{.ctlog-monitor-component}}{{.nameSuffix}}
+ annotations:
+ build.appstudio.openshift.io/pipeline: "{\"name\":\"docker-build-oci-ta\",\"bundle\":\"latest\"}"
+ git-provider: github
+ git-provider-url: "https://github.com"
+ mintmaker.appstudio.redhat.com/disabled: {{.mintmakerDisabled}}
+ spec:
+ source:
+ git:
+ url: "https://github.com/securesign/rekor-monitor"
+ dockerfileUrl: Dockerfile.ctlog-monitor.rh
+ revision: {{.branch}}
+ application: {{.application}}{{.nameSuffix}}
+ componentName: {{.ctlog-monitor-component}}
+ - apiVersion: appstudio.redhat.com/v1alpha1
+ kind: ImageRepository
+ metadata:
+ name: imagerepository-for-{{.application}}{{.nameSuffix}}-{{.rekor-monitor-component}}
+ labels:
+ appstudio.redhat.com/component: {{.rekor-monitor-component}}{{.nameSuffix}}
+ spec:
+ image:
+ name: rhtas-tenant/rekor-monitor
+ visibility: public
+ notifications:
+ - config:
+ url: "https://bombino.api.redhat.com/v1/sbom/quay/push"
+ event: repo_push
+ method: webhook
+ title: SBOM-event-to-Bombino
+ - apiVersion: appstudio.redhat.com/v1alpha1
+ kind: ImageRepository
+ metadata:
+ name: imagerepository-for-{{.application}}{{.nameSuffix}}-{{.ctlog-monitor-component}}
+ labels:
+ appstudio.redhat.com/component: {{.ctlog-monitor-component}}{{.nameSuffix}}
+ spec:
+ image:
+ name: rhtas-tenant/ctlog-monitor
+ visibility: public
+ notifications:
+ - config:
+ url: "https://bombino.api.redhat.com/v1/sbom/quay/push"
+ event: repo_push
+ method: webhook
+ title: SBOM-event-to-Bombino
@@ spec.resources.appstudio.redhat.com/v1alpha1/Application/{{.application}}{{.nameSuffix}}.spec.displayName @@
# projctl.konflux.dev/v1beta1/ProjectDevelopmentStreamTemplate/rhtas-tenant/rekor-monitor-template
! ± value change
- {{.component}} ({{.version}})
+ {{.application}} ({{.version}})
@@ spec.variables @@
# projctl.konflux.dev/v1beta1/ProjectDevelopmentStreamTemplate/rhtas-tenant/rekor-monitor-template
! - one list entry removed:
- - name: component
- defaultValue: rekor-monitor
- description: "The component name"
! + two list entries added:
+ - name: rekor-monitor-component
+ defaultValue: rekor-monitor
+ description: "The rekor-monitor component name"
+ - name: ctlog-monitor-component
+ defaultValue: ctlog-monitor
+ description: "The ctlog-monitor component name"📦 Artifacts: base-output.yaml, head-output.yaml, dyff-output.txt |
osmman
requested changes
Nov 27, 2025
Contributor
osmman
left a comment
osmman
left a comment
There was a problem hiding this comment.
rekor-monitor application is currently managed by Project manifest because it is multistream project (1.3.x and main). Please make your changes in here https://github.com/securesign/pipelines/tree/main/konflux-configs/base/project/overlay/rekor-monitor
osmman
changed the title
osmman
approved these changes
Nov 27, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
rekor-monitor application includes rekor-monitor and ctlog-monitor components
Summary by Sourcery
Add Konflux application configuration for the rekor-monitor service and its related components.
New Features: