Skip to content

Commit 8bf896f

Browse files
committed
Validate networking annotations on RevisionTemplateSpec
Add validation to reject unknown networking.knative.dev/* annotations on the RevisionTemplate early at Service creation time, rather than failing silently when creating the ServerlessService.
1 parent 5fbd94e commit 8bf896f

File tree

2 files changed

+53
-0
lines changed

2 files changed

+53
-0
lines changed

pkg/apis/serving/v1/revision_validation.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525

2626
"k8s.io/apimachinery/pkg/api/resource"
2727
"k8s.io/apimachinery/pkg/api/validation"
28+
"knative.dev/networking/pkg/apis/networking"
2829
"knative.dev/pkg/apis"
2930
"knative.dev/pkg/kmap"
3031
"knative.dev/pkg/kmp"
@@ -66,6 +67,7 @@ func (rts *RevisionTemplateSpec) Validate(ctx context.Context) *apis.FieldError
6667
errs := rts.Spec.Validate(apis.WithinSpec(ctx)).ViaField("spec")
6768
errs = errs.Also(autoscaling.ValidateAnnotations(ctx, config.FromContextOrDefaults(ctx).Autoscaler,
6869
rts.GetAnnotations()).ViaField("metadata.annotations"))
70+
errs = errs.Also(networking.ValidateAnnotations(rts.GetAnnotations()).ViaField("metadata.annotations"))
6971

7072
// If the RevisionTemplateSpec has a name specified, then check that
7173
// it follows the requirements on the name.

pkg/apis/serving/v1/revision_validation_test.go

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1092,6 +1092,57 @@ func TestRevisionTemplateSpecValidation(t *testing.T) {
10921092
Message: "progress-deadline=-1m3s must be positive",
10931093
Paths: []string{serving.ProgressDeadlineAnnotationKey},
10941094
}).ViaField("metadata.annotations"),
1095+
}, {
1096+
name: "invalid networking.knative.dev/visibility annotation",
1097+
rts: &RevisionTemplateSpec{
1098+
ObjectMeta: metav1.ObjectMeta{
1099+
Annotations: map[string]string{
1100+
"networking.knative.dev/visibility": "cluster-local",
1101+
},
1102+
},
1103+
Spec: RevisionSpec{
1104+
PodSpec: corev1.PodSpec{
1105+
Containers: []corev1.Container{{
1106+
Image: "helloworld",
1107+
}},
1108+
},
1109+
},
1110+
},
1111+
want: apis.ErrInvalidKeyName("networking.knative.dev/visibility", "metadata.annotations"),
1112+
}, {
1113+
name: "invalid unknown networking.knative.dev annotation",
1114+
rts: &RevisionTemplateSpec{
1115+
ObjectMeta: metav1.ObjectMeta{
1116+
Annotations: map[string]string{
1117+
"networking.knative.dev/foo": "bar",
1118+
},
1119+
},
1120+
Spec: RevisionSpec{
1121+
PodSpec: corev1.PodSpec{
1122+
Containers: []corev1.Container{{
1123+
Image: "helloworld",
1124+
}},
1125+
},
1126+
},
1127+
},
1128+
want: apis.ErrInvalidKeyName("networking.knative.dev/foo", "metadata.annotations"),
1129+
}, {
1130+
name: "valid networking.knative.dev/ingress.class annotation",
1131+
rts: &RevisionTemplateSpec{
1132+
ObjectMeta: metav1.ObjectMeta{
1133+
Annotations: map[string]string{
1134+
"networking.knative.dev/ingress.class": "istio.ingress.networking.knative.dev",
1135+
},
1136+
},
1137+
Spec: RevisionSpec{
1138+
PodSpec: corev1.PodSpec{
1139+
Containers: []corev1.Container{{
1140+
Image: "helloworld",
1141+
}},
1142+
},
1143+
},
1144+
},
1145+
want: nil,
10951146
}}
10961147

10971148
for _, test := range tests {

0 commit comments

Comments
 (0)