Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

resources: Fail on non-string template labels. #1030

Merged
merged 1 commit into from
Apr 2, 2021

Conversation

wlynch
Copy link
Member

@wlynch wlynch commented Apr 2, 2021

Changes

Although ObjectMeta defines labels as a map[string]string, Unstructured
types allow for map[string]interface{}, which means that users can set
non-string values like ints in their configurations, and we will parse it
with no issues.

We discovered that the behavior of
unstructured.GetLabels
will silently ignore errors, returning an empty label set if a
non-string value is included. When used in triggers, this looks like we
are completely ignoring the user provided labels.

This change replaces GetLabels with it's underlying implementation, and bubbles
back the non-string error if it is encountered.

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

  • Includes tests (if functionality changed/added)
  • [n/a] Includes docs (if user facing)
  • Commit messages follow commit message best practices
  • Release notes block has been filled in or deleted (only if no user facing changes)

See the contribution guide for more details.

Release Note

NONE

Although ObjectMeta defines labels as a map[string]string, Unstructured
types allow for map[string]interface{}, which means that users can set
non-string values like ints in their configurations, and we will parse it
with no issues.

We discovered that the behavior of
[unstructured.GetLabels](https://github.com/kubernetes/apimachinery/blob/dd12c7a65e7f49c4e00b5bd5eb93de2fcbf7831d/pkg/apis/meta/v1/unstructured/unstructured.go#L395)
will silently ignore errors, returning an empty label set if a
non-string value is included. When used in triggers, this looks like we
are completely ignoring the user provided labels.

This change replaces GetLabels with it's underlying implementation, and bubbles
back the non-string error if it is encountered.
@tekton-robot tekton-robot added the do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. label Apr 2, 2021
@tekton-robot tekton-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Apr 2, 2021
@wlynch
Copy link
Member Author

wlynch commented Apr 2, 2021

/kind bug

@tekton-robot tekton-robot added the kind/bug Categorizes issue or PR as related to a bug. label Apr 2, 2021
@tekton-robot
Copy link

The following is the coverage report on the affected files.
Say /test pull-tekton-triggers-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/resources/create.go 81.8% 81.2% -0.6

@tekton-robot tekton-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. release-note-none Denotes a PR that doesnt merit a release note. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. release-note Denotes a PR that will be considered when it comes time to generate release notes. labels Apr 2, 2021
@dibyom
Copy link
Member

dibyom commented Apr 2, 2021

Nice -- one thing I was thinking was that we could do a similar check in the resourceTemplate validation as well...so that if a user creates a resource with the wrong type, we catch it at creation time vs run time. What do you think?

/approve

@tekton-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dibyom

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 2, 2021
@wlynch
Copy link
Member Author

wlynch commented Apr 2, 2021

Nice -- one thing I was thinking was that we could do a similar check in the resourceTemplate validation as well...so that if a user creates a resource with the wrong type, we catch it at creation time vs run time. What do you think?

That's probably going to be more work than I want to commit to for this PR. 😅

TriggerResourceTemplates are currently stored as runtime.RawExtensions. We likely want to convert this to an unstructured.Unstructured, and I'm not sure what the scope of this change would entail (particularly in ensuring backwards compatibility). Alternatively, we'd could unmarshal the message in the webhook and in the controller, but that seems wasteful.

Worth noting - if we move forward with #697 this validation should happen automatically.

@dibyom
Copy link
Member

dibyom commented Apr 2, 2021

Ahh, missed the runtime.RawExtension vs unstructured.Unstructured difference. I don't think it would be too bad converting them in the controller/webhook but I agree that is outside the scope of this PR.
/lgtm

@tekton-robot tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Apr 2, 2021
@tekton-robot tekton-robot merged commit a545f76 into tektoncd:main Apr 2, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. kind/bug Categorizes issue or PR as related to a bug. lgtm Indicates that a PR is ready to be merged. release-note-none Denotes a PR that doesnt merit a release note. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants