Skip to content

Add baseImage validation, status field, and documentation#396

Open
ivanauth wants to merge 4 commits intoauthzed:mainfrom
ivanauth:fix/baseimage-validation
Open

Add baseImage validation, status field, and documentation#396
ivanauth wants to merge 4 commits intoauthzed:mainfrom
ivanauth:fix/baseimage-validation

Conversation

@ivanauth
Copy link
Copy Markdown

@ivanauth ivanauth commented Dec 9, 2025

Summary

Improvements to the alternative container registry feature (PR #367):

  • Validate baseImage format: Reject tags (:tag) and digests (@sha256:...) in baseImage field, while correctly allowing port numbers in registry URLs (e.g., registry:5000/image)
  • Add CEL validation: Early validation at Kubernetes API level for faster feedback
  • Surface resolved base image in status: New status.resolvedBaseImage field for debugging
  • Add documentation and examples: User-facing docs with common use cases and pitfalls

Relates to #387

Changes

  • Add validation in pkg/config/config.go to reject invalid baseImage values
  • Add ResolvedBaseImage field to ClusterStatus in pkg/apis/authzed/v1alpha1/types.go
  • Add CEL validation rules to CRDs
  • Add examples/alternative-registry/ with README and example manifests
  • Add comprehensive tests for validation edge cases

@ivanauth ivanauth force-pushed the fix/baseimage-validation branch from 04effaa to e6ded22 Compare December 13, 2025 02:17
baseImage: "my-registry.company.com/authzed/spicedb"

# The operator will append the appropriate tag based on the version/channel
version: "v1.33.0"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this example makes it unclear why you'd use this instead of just setting the full image - you still get the update graph, so you can just specify a channel instead

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point - updated the example.

@ivanauth ivanauth force-pushed the fix/baseimage-validation branch from 25db2cc to 641c590 Compare March 5, 2026 20:52
The two-secret credentials test was not updated when ResolvedBaseImage
was added to MigrationConfig. Update the expected status to include
ResolvedBaseImage and the correct migration hash, and use the same
tlsSecretName as other test cases for consistent hashing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants