tektoncd / tektoncd/chains

Failure to connect to storage backends should fail readiness probe

Open
#1,094 2 comments 2 reactions 1 assignee View on GitHub

@waveywaves is already working on this.

Since Aug 19, 2025.

kind/feature
Dominant language
Go
Stars
277
Forks
164
Avg merge
2d 3h
Merged PRs (30d)
61

Description

Feature request

one of the basic functionalities of chains is to sign and attest workloads and push these somewhere which is defined by the storage backends like tekton, oci, gcs, docdb, grafeas.

when chains cannot connect to these storage backends to push signatures, attestations, etc, that violates one of the fundamental guarantees that chains provides and the readiness probe (or liveness???) should fail in such a case.

Use case

2 users have reported that they use mongo DB as a storage backend (via artifacts.taskrun.storage: docdb) but when the creds to connect to mongo DB were rotated, they expected chains to fail a probe and start restarting the chains controller pod so they could do remediation - instead chains continued throwing errors that it was not able to connect to mongo but did not start failing while not pushing any signatures, etc to mongo DB.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.