Skip to content

ActorTemplate: Enforce that all images must be pinned#51

Merged
Taahir Ahmed (ahmedtd) merged 1 commit into
agent-substrate:mainfrom
ahmedtd:actortemplate-vap
May 28, 2026
Merged

ActorTemplate: Enforce that all images must be pinned#51
Taahir Ahmed (ahmedtd) merged 1 commit into
agent-substrate:mainfrom
ahmedtd:actortemplate-vap

Conversation

@ahmedtd
Copy link
Copy Markdown
Collaborator

@ahmedtd Taahir Ahmed (ahmedtd) commented May 21, 2026

This commit adds a ValidatingAdmissionPolicy that checks that all images in an ActorTemplate must be pinned to a specific hash.

Fixes #10

juli4n
Julian Gutierrez Oschmann (juli4n) reviewed May 21, 2026
View reviewed changes
Comment thread manifests/ate-install/actortemplate-vap.yaml Outdated
@@ -0,0 +1,39 @@
# Copyright 2026 Google LLC
Copy link
Copy Markdown
Collaborator

@juli4n Julian Gutierrez Oschmann (juli4n) May 21, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you considered adding this validation as an XValidation in the CRD itself? The advantage is that it gets coupled to the CRD so there is no way to delete it. I don't know this, but I suspect error messages will be more precise too as the error is specific to the field.

Copy link
Copy Markdown
Collaborator

@BenTheElder Benjamin Elder (BenTheElder) May 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point. We need VAP for cross-field work, but this is scoped to a single field.

https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/2876-crd-validation-expression-language/README.md

Copy link
Copy Markdown
Collaborator Author

@ahmedtd Taahir Ahmed (ahmedtd) May 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done, it seems to work.

@ensemble-hcl ensemble-hcl Bot mentioned this pull request May 22, 2026
Open
juli4n
Julian Gutierrez Oschmann (juli4n) previously approved these changes May 27, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@juli4n Julian Gutierrez Oschmann (juli4n) left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You'll need to rebase on main and move this as the CRD types are under pkg/api/v1alpha1 now.

@BenTheElder Benjamin Elder (BenTheElder) added the cleanup Small fixes that are not bugs, for example a typo in a code comment label May 27, 2026
BenTheElder
Benjamin Elder (BenTheElder) reviewed May 27, 2026
View reviewed changes
Comment thread pkg/api/v1alpha1/actortemplate_types.go Outdated
@a4-a4s1 a4-a4s1 Bot mentioned this pull request May 27, 2026
Open
5 tasks
@BenTheElder
Copy link
Copy Markdown
Collaborator

Benjamin Elder (BenTheElder) commented May 28, 2026

https://github.com/agent-substrate/substrate/actions/runs/26594400905/job/78361379429?pr=51

envtest start failed: unable to install CRDs onto control plane: unable to create CRD instances: unable to create CRD "actortemplates.ate.dev": CustomResourceDefinition.apiextensions.k8s.io "actortemplates.ate.dev" is invalid: [spec.validation.openAPIV3Schema.properties[spec].properties[containers].items.x-kubernetes-validations[0].rule: Forbidden: estimated rule cost exceeds budget by factor of more than 100x (try simplifying the rule, or adding maxItems, maxProperties, and maxLength where arrays, maps, and strings are declared), spec.validation.openAPIV3Schema.properties[spec].properties[containers].items.x-kubernetes-validations[0].rule: Forbidden: contributed to estimated rule cost total exceeding cost limit for entire OpenAPIv3 schema, spec.validation.openAPIV3Schema: Forbidden: x-kubernetes-validations estimated rule cost total for entire OpenAPIv3 schema exceeds budget by factor of more than 100x (try simplifying the rule, or adding maxItems, maxProperties, and maxLength where arrays, maps, and strings are declared)]

@juli4n
Copy link
Copy Markdown
Collaborator

Julian Gutierrez Oschmann (juli4n) commented May 28, 2026

https://github.com/agent-substrate/substrate/actions/runs/26594400905/job/78361379429?pr=51

envtest start failed: unable to install CRDs onto control plane: unable to create CRD instances: unable to create CRD "actortemplates.ate.dev": CustomResourceDefinition.apiextensions.k8s.io "actortemplates.ate.dev" is invalid: [spec.validation.openAPIV3Schema.properties[spec].properties[containers].items.x-kubernetes-validations[0].rule: Forbidden: estimated rule cost exceeds budget by factor of more than 100x (try simplifying the rule, or adding maxItems, maxProperties, and maxLength where arrays, maps, and strings are declared), spec.validation.openAPIV3Schema.properties[spec].properties[containers].items.x-kubernetes-validations[0].rule: Forbidden: contributed to estimated rule cost total exceeding cost limit for entire OpenAPIv3 schema, spec.validation.openAPIV3Schema: Forbidden: x-kubernetes-validations estimated rule cost total for entire OpenAPIv3 schema exceeds budget by factor of more than 100x (try simplifying the rule, or adding maxItems, maxProperties, and maxLength where arrays, maps, and strings are declared)]

Should we set a limit in the number of containers on a given actor template spec?

@ahmedtd
Copy link
Copy Markdown
Collaborator Author

Taahir Ahmed (ahmedtd) commented May 28, 2026

Uh, I thought I tested this locally, and saw it correctly rejecting images without '@' symbols. Maybe I had forgotten to remove the VAP?

@ahmedtd Taahir Ahmed (ahmedtd) force-pushed the actortemplate-vap branch 2 times, most recently from 907f20b to fe0910c Compare May 28, 2026 20:08
@ahmedtd
Copy link
Copy Markdown
Collaborator Author

Taahir Ahmed (ahmedtd) commented May 28, 2026

OK, I've limited us to 10 containers. I also applied the check to the pause image, which has the same problem.

@ahmedtd Taahir Ahmed (ahmedtd) merged commit 9291df0 into agent-substrate:main May 28, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@juli4n Julian Gutierrez Oschmann (juli4n) juli4n left review comments

@BenTheElder Benjamin Elder (BenTheElder) BenTheElder left review comments

Assignees

@juli4n Julian Gutierrez Oschmann (juli4n)

@BenTheElder Benjamin Elder (BenTheElder)

Labels

cleanup Small fixes that are not bugs, for example a typo in a code comment

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Prevent user from creating ActorTemplates with un-pinned images

3 participants

@ahmedtd @BenTheElder @juli4n