feat(validation): add workflow image vetting (reanahub#739)

Author: CameronMcClymont

docs/openapi.json

@@ -521,6 +521,14 @@
                     "yadage"
                   ]
                 },
+                "vetted_container_images_allowlist": {
+                  "title": "List of allowed container images",
+                  "value": []
+                },
+                "vetted_container_images_enabled": {
+                  "title": "Whether container images are vetted or not",
+                  "value": "False"
+                },
                 "workspaces_available": {
                   "title": "List of available workspaces",
                   "value": [
@@ -810,6 +818,31 @@
                   },
                   "type": "object"
                 },
+                "vetted_container_images_allowlist": {
+                  "properties": {
+                    "title": {
+                      "type": "string"
+                    },
+                    "value": {
+                      "items": {
+                        "type": "string"
+                      },
+                      "type": "array"
+                    }
+                  },
+                  "type": "object"
+                },
+                "vetted_container_images_enabled": {
+                  "properties": {
+                    "title": {
+                      "type": "string"
+                    },
+                    "value": {
+                      "type": "boolean"
+                    }
+                  },
+                  "type": "object"
+                },
                 "workspaces_available": {
                   "properties": {
                     "title": {

reana_server/config.py

@@ -466,6 +466,11 @@ def _get_rate_limit(env_variable: str, default: str) -> str:
 )
 """Whether users can set custom interactive session images or not."""
 
+REANA_VETTED_CONTAINER_IMAGES = json.loads(
+    os.getenv("REANA_VETTED_CONTAINER_IMAGES", "{}")
+)
+"""Container images that are allowed to be used in workflows."""
+
 # Kubernetes jobs timeout
 # ==================
 REANA_KUBERNETES_JOBS_TIMEOUT_LIMIT = os.getenv("REANA_KUBERNETES_JOBS_TIMEOUT_LIMIT")

reana_server/rest/info.py

@@ -27,6 +27,7 @@
     REANA_INTERACTIVE_SESSION_MAX_INACTIVITY_PERIOD,
     REANA_INTERACTIVE_SESSIONS_ENVIRONMENTS,
     REANA_INTERACTIVE_SESSIONS_ENVIRONMENTS_CUSTOM_ALLOWED,
+    REANA_VETTED_CONTAINER_IMAGES,
     DASK_ENABLED,
     DASK_AUTOSCALER_ENABLED,
     REANA_DASK_CLUSTER_DEFAULT_NUMBER_OF_WORKERS,
@@ -153,6 +154,22 @@ def info(user, **kwargs):  # noqa
                       type: string
                     type: array
                 type: object
+              vetted_container_images_enabled:
+                properties:
+                  title:
+                    type: string
+                  value:
+                    type: boolean
+                type: object
+              vetted_container_images_allowlist:
+                properties:
+                  title:
+                    type: string
+                  value:
+                    items:
+                      type: string
+                    type: array
+                type: object
               supported_workflow_engines:
                 properties:
                   title:
@@ -318,6 +335,14 @@ def info(user, **kwargs):  # noqa
                     "title": "Whether users are allowed to spawn custom interactive session images",
                     "value": "False"
                 },
+                "vetted_container_images_enabled": {
+                    "title": "Whether container images are vetted or not",
+                    "value": "False"
+                },
+                "vetted_container_images_allowlist": {
+                    "title": "List of allowed container images",
+                    "value": []
+                },
                 "supported_workflow_engines": {
                     "title": "List of supported workflow engines",
                     "value": [
@@ -452,6 +477,14 @@ def info(user, **kwargs):  # noqa
                     ]
                 ],
             ),
+            vetted_container_images_enabled=dict(
+                title="Whether container images are vetted or not",
+                value=REANA_VETTED_CONTAINER_IMAGES["enabled"],
+            ),
+            vetted_container_images_allowlist=dict(
+                title="List of allowed container images",
+                value=REANA_VETTED_CONTAINER_IMAGES["allowlist"],
+            ),
             supported_workflow_engines=dict(
                 title="List of supported workflow engines",
                 value=["cwl", "serial", "snakemake", "yadage"],
@@ -534,6 +567,13 @@ class StringInfoValue(Schema):
     value = fields.String(allow_none=False)
 
 
+class BooleanInfoValue(Schema):
+    """Schema for a value represented by a string."""
+
+    title = fields.String()
+    value = fields.Boolean(allow_none=False)
+
+
 class StringNullableInfoValue(Schema):
     """Schema for a value represented by a nullable string."""
 
@@ -558,6 +598,8 @@ class InfoSchema(Schema):
     kubernetes_max_memory_limit = fields.Nested(StringInfoValue)
     interactive_session_recommended_jupyter_images = fields.Nested(ListStringInfoValue)
     interactive_sessions_custom_image_allowed = fields.Nested(StringInfoValue)
+    vetted_container_images_enabled = fields.Nested(BooleanInfoValue)
+    vetted_container_images_allowlist = fields.Nested(ListStringInfoValue)
     supported_workflow_engines = fields.Nested(ListStringInfoValue)
     cwl_engine_tool = fields.Nested(StringInfoValue)
     cwl_engine_version = fields.Nested(StringInfoValue)

reana_server/validation.py

@@ -31,6 +31,7 @@
     REANA_DASK_CLUSTER_MAX_SINGLE_WORKER_MEMORY,
     REANA_DASK_CLUSTER_DEFAULT_SINGLE_WORKER_THREADS,
     REANA_DASK_CLUSTER_MAX_SINGLE_WORKER_THREADS,
+    REANA_VETTED_CONTAINER_IMAGES,
 )
 from reana_server import utils
 
@@ -119,6 +120,23 @@ def validate_inputs(reana_yaml: Dict) -> None:
             )
 
 
+def validate_images(reana_yaml: Dict) -> None:
+    """Check whether the images used in the workflow are allowed or not.
+
+    :param reana_yaml: REANA specification.
+    """
+    if not REANA_VETTED_CONTAINER_IMAGES["enabled"]:
+        return
+
+    allowed_images = REANA_VETTED_CONTAINER_IMAGES["allowlist"]
+    steps = reana_yaml["workflow"].get("specification", {}).get("steps", [])
+
+    for step in steps:
+        image = step.get("environment", None)
+        if image and image not in allowed_images:
+            raise REANAValidationError(f"Image not allowed: {image}")
+
+
 def validate_workflow(reana_yaml: Dict, input_parameters: Dict) -> Dict:
     """Validate REANA workflow specification by calling all the validation utilities.
 
@@ -137,6 +155,7 @@ def validate_workflow(reana_yaml: Dict, input_parameters: Dict) -> Dict:
     validate_compute_backends(reana_yaml)
     validate_workspace_path(reana_yaml)
     validate_inputs(reana_yaml)
+    validate_images(reana_yaml)
     return reana_yaml_warnings
 
 

tests/test_validation.py

@@ -12,7 +12,11 @@
 
 from reana_commons.errors import REANAValidationError
 
-from reana_server.validation import validate_inputs, validate_retention_rule
+from reana_server.validation import (
+    validate_inputs,
+    validate_images,
+    validate_retention_rule,
+)
 
 
 @pytest.mark.parametrize(
@@ -30,6 +34,61 @@ def test_validate_inputs(paths, error):
         validate_inputs({"inputs": {"directories": paths}})
 
 
+@pytest.mark.parametrize(
+    "config, images, error",
+    [
+        # Validation disabled, anything goes
+        (
+            {"enabled": False, "allowlist": []},
+            ["docker.io/bitcoin-miner:1.2.3"],
+            does_not_raise(),
+        ),
+        # Allowed image
+        (
+            {
+                "enabled": True,
+                "allowlist": ["docker.io/reanahub/reana-env-root6:6.18.04"],
+            },
+            ["docker.io/reanahub/reana-env-root6:6.18.04"],
+            does_not_raise(),
+        ),
+        # Disallowed image
+        (
+            {
+                "enabled": True,
+                "allowlist": ["docker.io/reanahub/reana-env-root6:6.18.04"],
+            },
+            ["docker.io/bitcoin-miner:1.2.3"],
+            pytest.raises(REANAValidationError, match="not allowed"),
+        ),
+        # Mixed images
+        (
+            {
+                "enabled": True,
+                "allowlist": ["docker.io/reanahub/reana-env-root6:6.18.04"],
+            },
+            [
+                "docker.io/reanahub/reana-env-root6:6.18.04",
+                "docker.io/bitcoin-miner:1.2.3",
+            ],
+            pytest.raises(REANAValidationError, match="not allowed"),
+        ),
+    ],
+)
+def test_validate_images(config, images, error):
+    with patch("reana_server.validation.REANA_VETTED_CONTAINER_IMAGES", config):
+        with error:
+            validate_images(
+                {
+                    "workflow": {
+                        "specification": {
+                            "steps": [{"environment": image} for image in images]
+                        }
+                    }
+                }
+            )
+
+
 @pytest.mark.parametrize(
     "rule, days, error",
     [