NVIDIA / nodewright / 28208720818

push

github

fix(api)!: reject inline tags and digests in package image (#283)

Package image must be a bare registry/repository reference. The version field is the operator's ordering key for upgrade/downgrade detection, and containerSHA pins the exact bytes the kubelet pulls, so neither a tag nor a digest may be embedded in image.

Previously an inline tag was silently absorbed (stripped on unmarshal) as a migration off the pre-semver scheme, while an inline digest was accepted but produced an unpullable reference like repo@sha256:...:1.2.2. That migration is complete and has been removed: the webhook now rejects any inline tag or digest via a single splitImageReference parse and points users at version/containerSHA.

BREAKING CHANGE: re-applying a Skyhook manifest that embeds a tag or digest in a package image is now rejected by the webhook. Drop the tag (the package version supplies it) and pin digests via the containerSHA field. Existing stored CRs are unaffected; their tags were already stripped on write.

Refs #282

Signed-off-by: Brian Lockwood <lockwobr@gmail.com>

24 of 25 new or added lines in 2 files covered. (96.0%)

8124 of 9925 relevant lines covered (81.85%)

9.3 hits per line