Skip to content

Validate function tag literals before execution #4503

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AkashKumar7902 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Validate function tag literals before execution #4503

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a260134
Validate function tag literals before execution
AkashKumar7902 Apr 24, 2026
b47453b
Clarify image tag validation error
AkashKumar7902 Apr 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions pkg/fn/runtime/tag_resolution.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ package runtime
import (
"context"
"fmt"
"regexp"
"slices"
"strings"

Expand All @@ -25,6 +26,10 @@ import (
"k8s.io/klog/v2"
)

const imageTagError = "must start with an alphanumeric character or underscore, followed by at most 127 alphanumeric characters, underscores, periods, or dashes"

var imageTagRegex = regexp.MustCompile(`^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$`)

// TagLister is an interface for listing tags for/from a function runtime/runner
type TagLister interface {
Name() string
Expand Down Expand Up @@ -85,10 +90,22 @@ func (tr *TagResolver) ResolveFunctionImage(ctx context.Context, image, tag stri
ref.Tag = allFilteredVersions[0].Original()
return ref.CommonName(), nil
} else {
resolvedImage, tagErr := imageWithLiteralTag(ref, tag)
if tagErr != nil {
return "", tagErr
}
klog.Warningf("Tag %q could not be parsed as a semantic version (\"%s\") or constraint (\"%s\"), will use it literally",
tag, versionErr, constraintErr)
return resolvedImage, nil
}

return imageWithLiteralTag(ref, tag)
}

func imageWithLiteralTag(ref regclientref.Ref, tag string) (string, error) {
if !imageTagRegex.MatchString(tag) {
return "", fmt.Errorf("`function.tag` %q must be a valid image tag: %s", tag, imageTagError)
}
ref.Tag = tag
return ref.CommonName(), nil
}
Expand Down
12 changes: 12 additions & 0 deletions pkg/fn/runtime/tag_resolution_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,12 @@ func TestResolveFunctionImage(t *testing.T) {
repoTags: tagSet,
expectedTag: "v0.3.1",
},
"exact semver tag with invalid image tag syntax": {
functionImage: image,
functionTag: "v0.3.1+build",
repoTags: tagSet,
expectedErr: "`function.tag` \"v0.3.1+build\" must be a valid image tag",
},
"no listing with exact semver tag": {
functionImage: image,
functionTag: "v0.3.1",
Expand All @@ -164,6 +170,12 @@ func TestResolveFunctionImage(t *testing.T) {
repoErr: "test",
expectedTag: "master-git-38f885f",
},
"invalid non-semver tag": {
functionImage: image,
functionTag: ">>0.1",
repoTags: tagSet,
expectedErr: "`function.tag` \">>0.1\" must be a valid image tag",
},
"list failure": {
functionImage: image,
functionTag: "~0.1",
Expand Down