Skip to content

ROX-33874: Increase Konflux task timeouts #3015

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BradLugo merged 3 commits into from
Mar 31, 2026
+9 −8
Merged

ROX-33874: Increase Konflux task timeouts #3015

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
66a60cd
ROX-33874: Increase Konflux task timeouts
BradLugo Mar 30, 2026
9604af6
Update etch-scanner-data bundle ref for testing
BradLugo Mar 31, 2026
020777d
Revert "Update etch-scanner-data bundle ref for testing"
BradLugo Mar 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .tekton/scanner-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,11 +68,11 @@ spec:
serviceAccountName: build-pipeline-scanner

# Multiarch builds sometimes make the pipeline timeout after 1h.
# Tagged builds wait for blobs to be published which takes about 1h.
# Tagged builds wait for blobs to be published, which takes about 1h30m.
timeouts:
tasks: 3h0m
tasks: 3h30m
finally: 10m
pipeline: 3h10m
pipeline: 3h40m

pipelineRef:
name: scanner-component-pipeline
6 changes: 3 additions & 3 deletions .tekton/scanner-db-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,11 +64,11 @@ spec:
taskRunTemplate:
serviceAccountName: build-pipeline-scanner-db

# Tagged builds wait for blobs to be published which takes about 1h.
# Tagged builds wait for blobs to be published, which takes about 1h30m.
timeouts:
tasks: 2h30m
tasks: 3h0m
finally: 10m
pipeline: 2h40m
pipeline: 3h10m


pipelineRef:
Expand Down
5 changes: 3 additions & 2 deletions .tekton/scanner-slim-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,10 +68,11 @@ spec:
serviceAccountName: build-pipeline-scanner-slim

# Multiarch builds sometimes make the pipeline timeout after 1h.
# Tagged builds wait for blobs to be published, which takes about 1h30m.
timeouts:
tasks: 1h30m
tasks: 3h30m
Copy link
Copy Markdown
Contributor

@tommartensen tommartensen Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this increasing by 2 hours? Do we see frequent failures for this pipeline too?
Your PR description only mentions generate-db-dump, which I assumed concerned scanner-db* images.

Copy link
Copy Markdown
Contributor

@tommartensen tommartensen Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(not a blocker, please update the PR description before merging)

Copy link
Copy Markdown
Contributor Author

@BradLugo BradLugo Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great question. I hadn't mapped out all these dependencies before submitting these changes. It looks like we still need this because we upload the necessary artifacts ('nvd-definitions.zip', 'k8s-definitions.zip', 'repo2cpe.zip', 'genesis_manifests.json') during the upload-dumps-for-downstream job, which is dependent on generate-db-dump. I'll update the PR description with each timeout change.

Copy link
Copy Markdown
Contributor Author

@BradLugo BradLugo Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One interesting point: the current .tekton/scanner-slim-build.yaml downloads nvd-definitions.zip, k8s-definitions.zip, and repo2cpe.zip, but I don't think it needs nvd_definitions nor k8s_definitions (appears to still require repo2cpe).

Copy link
Copy Markdown
Contributor Author

@BradLugo BradLugo Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tommartensen Let me know if you have any feedback on this, and I'll create a follow-up PR if there are any action items. Thanks for the review!

finally: 10m
pipeline: 1h40m
pipeline: 3h40m

pipelineRef:
name: scanner-component-pipeline