feat(validation): add workflow image vetting (reanahub#739)

Extend `validate_workflow` to check that all
images used in workflows are authorized.
Such authorized images are specified via the
`vetted_container_images` Helm value. Also
add details of container vetting to the
`info` API endpoint.

Author: CameronMcClymont

docs/openapi.json

@@ -553,6 +553,14 @@
                     "yadage"
                   ]
                 },
+                "vetted_container_images_allowlist": {
+                  "title": "List of container images allowed in user workflows",
+                  "value": []
+                },
+                "vetted_container_images_enabled": {
+                  "title": "Whether container image vetting is enabled",
+                  "value": false
+                },
                 "workspaces_available": {
                   "title": "List of available workspaces",
                   "value": [
@@ -937,6 +945,31 @@
                   },
                   "type": "object"
                 },
+                "vetted_container_images_allowlist": {
+                  "properties": {
+                    "title": {
+                      "type": "string"
+                    },
+                    "value": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array"
+                    }
+                  },
+                  "type": "object"
+                },
+                "vetted_container_images_enabled": {
+                  "properties": {
+                    "title": {
+                      "type": "string"
+                    },
+                    "value": {
+                      "type": "boolean"
+                    }
+                  },
+                  "type": "object"
+                },
                 "workspaces_available": {
                   "properties": {
                     "title": {

reana_server/config.py

@@ -581,6 +581,14 @@ def _get_int_env_variable(env_variable: str, default: int) -> int:
 )
 """Whether users can set custom interactive session images or not."""
 
+REANA_VETTED_CONTAINER_IMAGES = json.loads(
+    os.getenv(
+        "REANA_VETTED_CONTAINER_IMAGES",
+        '{"enabled": false, "allowlist": []}',
+    )
+)
+"""Container images that users are allowed to use in their workflows."""
+
 # Kubernetes jobs timeout
 # ==================
 REANA_KUBERNETES_JOBS_TIMEOUT_LIMIT = os.getenv("REANA_KUBERNETES_JOBS_TIMEOUT_LIMIT")

reana_server/rest/info.py

@@ -34,6 +34,7 @@
     REANA_INTERACTIVE_SESSION_MAX_INACTIVITY_PERIOD,
     REANA_INTERACTIVE_SESSIONS_ENVIRONMENTS,
     REANA_INTERACTIVE_SESSIONS_ENVIRONMENTS_CUSTOM_ALLOWED,
+    REANA_VETTED_CONTAINER_IMAGES,
     DASK_ENABLED,
     DASK_AUTOSCALER_ENABLED,
     REANA_DASK_CLUSTER_DEFAULT_NUMBER_OF_WORKERS,
@@ -217,6 +218,22 @@ def info(user, **kwargs):  # noqa
                       type: string
                     type: array
                 type: object
+              vetted_container_images_enabled:
+                properties:
+                  title:
+                    type: string
+                  value:
+                    type: boolean
+                type: object
+              vetted_container_images_allowlist:
+                properties:
+                  title:
+                    type: string
+                  value:
+                    items:
+                      type: string
+                    type: array
+                type: object
               supported_workflow_engines:
                 properties:
                   title:
@@ -417,6 +434,14 @@ def info(user, **kwargs):  # noqa
                     "title": "Whether users are allowed to spawn custom interactive session images",
                     "value": "False"
                 },
+                "vetted_container_images_enabled": {
+                    "title": "Whether container image vetting is enabled",
+                    "value": false
+                },
+                "vetted_container_images_allowlist": {
+                    "title": "List of container images allowed in user workflows",
+                    "value": []
+                },
                 "supported_workflow_engines": {
                     "title": "List of supported workflow engines",
                     "value": [
@@ -583,6 +608,14 @@ def info(user, **kwargs):  # noqa
                     ]
                 ],
             ),
+            vetted_container_images_enabled=dict(
+                title="Whether container image vetting is enabled",
+                value=REANA_VETTED_CONTAINER_IMAGES["enabled"],
+            ),
+            vetted_container_images_allowlist=dict(
+                title="List of container images allowed in user workflows",
+                value=REANA_VETTED_CONTAINER_IMAGES["allowlist"],
+            ),
             supported_workflow_engines=dict(
                 title="List of supported workflow engines",
                 value=["cwl", "serial", "snakemake", "yadage"],
@@ -669,6 +702,13 @@ class StringInfoValue(Schema):
     value = fields.String(allow_none=False)
 
 
+class BooleanInfoValue(Schema):
+    """Schema for a value represented by a string."""
+
+    title = fields.String()
+    value = fields.Boolean(allow_none=False)
+
+
 class StringNullableInfoValue(Schema):
     """Schema for a value represented by a nullable string."""
 
@@ -707,6 +747,8 @@ class InfoSchema(Schema):
     kubernetes_max_memory_limit = fields.Nested(StringInfoValue)
     interactive_session_recommended_jupyter_images = fields.Nested(ListStringInfoValue)
     interactive_sessions_custom_image_allowed = fields.Nested(StringInfoValue)
+    vetted_container_images_enabled = fields.Nested(BooleanInfoValue)
+    vetted_container_images_allowlist = fields.Nested(ListStringInfoValue)
     supported_workflow_engines = fields.Nested(ListStringInfoValue)
     cwl_engine_tool = fields.Nested(StringInfoValue)
     cwl_engine_version = fields.Nested(StringInfoValue)

reana_server/validation.py

@@ -13,6 +13,7 @@
 from typing import Dict, List
 
 from reana_commons.config import WORKSPACE_PATHS
+from reana_commons.validation.images import extract_images
 from reana_commons.errors import REANAValidationError
 from reana_commons.validation.compute_backends import build_compute_backends_validator
 from reana_commons.validation.operational_options import validate_operational_options
@@ -31,8 +32,8 @@
     REANA_DASK_CLUSTER_MAX_SINGLE_WORKER_MEMORY,
     REANA_DASK_CLUSTER_DEFAULT_SINGLE_WORKER_THREADS,
     REANA_DASK_CLUSTER_MAX_SINGLE_WORKER_THREADS,
+    REANA_VETTED_CONTAINER_IMAGES,
 )
-from reana_server import utils
 
 
 def validate_parameters(reana_yaml: Dict) -> None:
@@ -112,13 +113,29 @@ def validate_inputs(reana_yaml: Dict) -> None:
             raise REANAValidationError(f"Input path declared multiple times: {path}")
         unique_paths.add(path)
 
+    from reana_server import utils
+
     for x, y in itertools.permutations(paths, r=2):
         if utils.is_relative_to(x, y):
             raise REANAValidationError(
                 f"Duplicate input paths '{y}' and '{x}' found. Please deduplicate inputs first."
             )
 
 
+def validate_images(reana_yaml: Dict) -> None:
+    """Check whether the images used in the workflow are allowed or not.
+
+    :param reana_yaml: REANA specification.
+    """
+    if not REANA_VETTED_CONTAINER_IMAGES["enabled"]:
+        return
+
+    allowed_images = REANA_VETTED_CONTAINER_IMAGES["allowlist"]
+    for image in extract_images(reana_yaml):
+        if image and image not in allowed_images:
+            raise REANAValidationError(f"Image not allowed: {image}")
+
+
 def validate_workflow(reana_yaml: Dict, input_parameters: Dict) -> Dict:
     """Validate REANA workflow specification by calling all the validation utilities.
 
@@ -137,6 +154,7 @@ def validate_workflow(reana_yaml: Dict, input_parameters: Dict) -> Dict:
     validate_compute_backends(reana_yaml)
     validate_workspace_path(reana_yaml)
     validate_inputs(reana_yaml)
+    validate_images(reana_yaml)
     return reana_yaml_warnings