KFLUXINFRA-3980: add type guards to build-platforms CEL expressions (…#13096
Conversation
Kustomize Render DiffComparing
Total: 6 components, +143 -6 lines 📋 Full diff available in the workflow summary and as a downloadable artifact. |
|
🤖 Review · |
…ring-2) The tekton-kueue webhook CEL expressions for multi-platform resource requests call .value.map() on the build-platforms pipeline parameter, assuming it is an array. When a PipelineRun submits build-platforms as a string, the CEL runtime crashes with "got 'types.String', expected iterable type", causing HTTP 500 and rejecting the PipelineRun entirely (failurePolicy: Fail). Observed on kflux-prd-rh02 on 2026-06-09. Applies the fix to ring 2 production clusters: kflux-osp-p01, kflux-prd-rh03, stone-prod-p02. - Adds type(value) == list guards to both build-platforms CEL expressions (resource request and AWS IP), so they return [] instead of crashing when the value is a string. - Adds a validation-error annotation expression for wrong-typed build-platforms, emitted as kueue.konflux-ci.dev/validation-error (matching the VAP from the start, unlike the original dev/staging rollout — see the ring-1 PR #13059 and the dev/staging fix for that mismatch). - Adds the temporary tenant-scoped ValidatingAdmissionPolicy denying PipelineRuns carrying the validation-error annotation. Wired only into the 3 ring-2 cluster kustomizations, not the shared policies/kueue kustomization, to keep ring isolation. - kflux-osp-p01 and kflux-prd-rh03 previously inherited production/base/tekton-kueue/config.yaml; this adds temporary per-cluster config.yaml overrides (configMapGenerator behavior: replace) so the change is scoped to ring 2 only. stone-prod-p02 already had its own override, updated directly. - Adds ring-2 test cases for string-typed build-platforms to hack/test-tekton-kueue-config.py. Already deployed to dev/staging and ring 1 of production (#13059) with no issues. Ring 3 will fold the CEL change into base/tekton-kueue/config.yaml and the VAP into the shared policies/kueue/kustomization.yaml, removing the temporary per-cluster overrides created in rings 1 and 2, same as the KFLUXINFRA-3973 token-resource rollout. Contributes to: KFLUXINFRA-3980 Assisted-by: Claude Code (claude-sonnet-5) Signed-off-by: Hector Oswaldo Caballero <hcaballe@redhat.com>
ef6e986 to
78e07f1
Compare
|
🤖 Finished Review · ✅ Success · Started 10:37 AM UTC · Completed 10:44 AM UTC |
Review — KFLUXINFRA-3980: build-platforms CEL type guards (ring 2)Verdict: Approve ✅ SummaryThis PR extends the ring-2 production rollout of the AnalysisCorrectness
Ring isolation
Security
Intent & coherence
Documentation
No findings at or above the severity threshold. |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
fullsend-ai-review
Bot
added
the
ready-for-merge
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #13096 +/- ##
=======================================
Coverage 57.11% 57.11%
=======================================
Files 23 23
Lines 1455 1455
=======================================
Hits 831 831
Misses 548 548
Partials 76 76
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: hugares, oswcab The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Production Approval Record
|
🤖 Pipeline Failure AnalysisCategory: Configuration The pipeline failed during Konflux installation because the ArgoCD application 'vector-kubearchive-log-collector-in-cluster-local' became stuck in an "Unknown" state. 📋 Technical DetailsImmediate CauseThe Contributing FactorsThe failure is attributed to a configuration problem, likely within the application's deployment manifests or the specific runtime environment on the cluster, preventing the ArgoCD application from progressing. No further specific contributing factors were identified from the provided diagnostic artifacts. ImpactThe inability to install and synchronize the 🔍 Evidenceappstudio-e2e-tests/konflux-ci-install-konfluxCategory: Logs:
|
|
/test appstudio-e2e-tests |
1 similar comment
|
/test appstudio-e2e-tests |
|
PR-Agent: could not find a component named |
4 participants
…ring-2)
What
Adds
type(value) == listguards to thebuild-platformsCEL expressions in tekton-kueue (resource-request and AWS-IP expressions), plus a validation-error annotation expression and a temporary tenant-scoped ValidatingAdmissionPolicy that denies PipelineRuns carrying that annotation.Applies the fix to ring 2 production clusters:
kflux-osp-p01,kflux-prd-rh03,stone-prod-p02.stone-prod-p01andkflux-prd-rh02previously inheritedproduction/base/tekton-kueue/config.yaml; this adds temporary per-clusterconfig.yamloverrides (configMapGeneratorbehavior: replace) to scope the change to ring 1 only.kflux-ocp-p01already had its own override, updated directly.ValidatingAdmissionPolicydenyingPipelineRunscarrying the validation-error annotation. Wired only into the 3 ring-2 cluster kustomizations, not the shared policies/kueue kustomization, to keep ring isolation.kflux-osp-p01andkflux-prd-rh03previously inherited production/base/tekton-kueue/config.yaml; this adds temporary per-cluster config.yaml overrides (configMapGenerator behavior: replace) so the change is scoped to ring 2 only.stone-prod-p02already had its own override, updated directly.hack/test-tekton-kueue-config.py.base/tekton-kueue/config.yamland the VAP into the sharedpolicies/kueue/kustomization.yaml, removing the temporary overrides — same pattern as the KFLUXINFRA-3973 rollout.kueue.konflux-ci.dev/validation-error(matching the VAP from the start, unlike the original dev/staging rollout — see the ring-1 PR KFLUXINFRA-3980: add type guards to build-platforms CEL expressions (… #13059 and the dev/staging fix for that mismatch).KFLUXINFRA-3980
Why
The tekton-kueue webhook crashes with HTTP 500 (
failurePolicy: Fail) when a PipelineRun submitsbuild-platformsas a string instead of an array, rejecting the PipelineRun outright. Observed onkflux-prd-rh02on 2026-06-09 (18:12 and 18:14 UTC, 2 rejections). The guard makes the expression tolerant of the wrong type instead of crashing, and the VAP prevents malformed PipelineRuns from silently bypassing the queue while the no-skip-kueue VAP rollout is still in progress.Validation
kustomize buildpasses cleanly for all affected overlays.python hack/test-tekton-kueue-config.pypasses, including new cases covering string-typedbuild-platformsagainst the ring-2 configs.Risk Assessment
Risk Level: Low
What could go wrong: The guard only changes behavior for the previously-crashing case (string-typed
build-platforms); array-typed values take the same code path as before. The VAP is scoped to tenant namespaces and only denies PipelineRuns already carrying the validation-error annotation, so it cannot affect any currently-passing PipelineRun.Rollback: Revert this PR.
Blast radius: 3 named production clusters (ring 2 of 3); no changes to
production/baseor the shared policy kustomization, so no other production cluster is touched.