fix: validate taskRef.apiVersion format for custom tasks #9045
Conversation
tekton-robot
added
the
release-note-none
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
tekton-robot
added
the
size/L
|
The following is the coverage report on the affected files.
|
|
/retest |
1 similar comment
|
/retest |
waveywaves
force-pushed
the
fix-invalid-taskref-apiversion-validation
branch
from
3797773 to
e40bda6
Compare
Add validation to ensure taskRef.apiVersion follows the correct format (group/version) when specified. Previously, invalid apiVersion values like 'invalid-api-version' were accepted, causing PipelineRuns to create unhandled CustomRuns that would timeout. Now Pipeline creation fails immediately with a clear error message when an invalid apiVersion is provided. Fixes tektoncd#9044
waveywaves
force-pushed
the
fix-invalid-taskref-apiversion-validation
branch
from
e40bda6 to
cbab5ca
Compare
| // Validate apiVersion format for custom tasks | ||
| if pt.TaskRef != nil && pt.TaskRef.APIVersion != "" { | ||
| if !isValidAPIVersion(pt.TaskRef.APIVersion) { | ||
| errs = errs.Also(apis.ErrInvalidValue(fmt.Sprintf("invalid apiVersion format %q, must be in the format \"group/version\"", pt.TaskRef.APIVersion), "taskRef.apiVersion")) | ||
| } | ||
| } | ||
| if pt.TaskSpec != nil && pt.TaskSpec.APIVersion != "" { | ||
| if !isValidAPIVersion(pt.TaskSpec.APIVersion) { | ||
| errs = errs.Also(apis.ErrInvalidValue(fmt.Sprintf("invalid apiVersion format %q, must be in the format \"group/version\"", pt.TaskSpec.APIVersion), "taskSpec.apiVersion")) | ||
| } | ||
| } |
There was a problem hiding this comment.
Duplicate check 😁
| // Validate apiVersion format for custom tasks | |
| if pt.TaskRef != nil && pt.TaskRef.APIVersion != "" { | |
| if !isValidAPIVersion(pt.TaskRef.APIVersion) { | |
| errs = errs.Also(apis.ErrInvalidValue(fmt.Sprintf("invalid apiVersion format %q, must be in the format \"group/version\"", pt.TaskRef.APIVersion), "taskRef.apiVersion")) | |
| } | |
| } | |
| if pt.TaskSpec != nil && pt.TaskSpec.APIVersion != "" { | |
| if !isValidAPIVersion(pt.TaskSpec.APIVersion) { | |
| errs = errs.Also(apis.ErrInvalidValue(fmt.Sprintf("invalid apiVersion format %q, must be in the format \"group/version\"", pt.TaskSpec.APIVersion), "taskSpec.apiVersion")) | |
| } | |
| } | |
| // Validate apiVersion format for custom tasks | |
| if pt.TaskRef != nil && pt.TaskRef.APIVersion != "" { | |
| if !isValidAPIVersion(pt.TaskRef.APIVersion) { | |
| errs = errs.Also(apis.ErrInvalidValue(fmt.Sprintf("invalid apiVersion format %q, must be in the format \"group/version\"", pt.TaskRef.APIVersion), "taskRef.apiVersion")) | |
| } | |
| } |
| // isValidAPIVersion validates the format of an apiVersion string. | ||
| // Valid formats are "group/version" where group contains at least one dot. | ||
| // For custom tasks, apiVersion must always be in the "group/version" format. | ||
| func isValidAPIVersion(apiVersion string) bool { |
There was a problem hiding this comment.
Should this also validate that the apiVersion and Kind are registered in the cluster or something? A CustomRun will still be created when the apiVersion and kind dosn't exist in the cluster, however the CustomRun is simply never updated with any status so the pipelinerun times out. E.g. in the below screenshots I modified one of the examples to use a bogus apiVersion which was syntactically correct.
I suppose being registered in the cluster is not sufficient since I've seen people mistakenly use "apiVersion": "tekton.dev/v1", "kind": "Task" in a TaskRef. Maybe that level of validation should be somewhere else? WDYT?
4 participants
Changes
add validation to ensure taskRef.apiVersion follows the correct format (group/version) when specified. Previously, invalid apiVersion values like 'invalid-api-version' were accepted, causing PipelineRuns to create unhandled CustomRuns that would timeout. Now Pipeline creation fails immediately with a clear error message when an invalid apiVersion is provided.
Fixes #9044
Submitter Checklist
As the author of this PR, please check off the items in this checklist:
/kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tepRelease Notes