kubeflow / mcp-server / 39470893998
87%

DEFAULT BRANCH: main
Ran
Jobs 3
Files 38
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 85.887% (+0.2%) from 85.701%
39470893998

push

github

web-flow 
fix(trainer): validate container image references before submission (#319)

* fix(trainer): validate container image references before submission

run_container_training() and run_custom_training() passed image to the Trainer
SDK without any check, so malformed values reached Kubernetes and only failed
later as an image-pull or container-start error.

Add validate_image_reference() in core/security.py: a charset and whitespace
check, a sha256 digest of exactly 64 hex characters, no leading or trailing
separators, no empty path components, at most one tag, and a lowercase
repository path (registry hosts and tags may use uppercase). It is not the full
OCI grammar, so real references keep working. run_custom_training treats an
empty image as unset, like the SDK; run_container_training requires one.

Rebased on main after #318 merged; squashed the earlier review rounds.

Fixes #260

Signed-off-by: pratik naik <naikp0241@gmail.com>

* fix(trainer): validate the image before resolving the namespace

Review feedback on #319: with a namespace allowlist and no namespace given,
check_namespace_allowed() resolves the default through the Trainer SDK, which
ran before a malformed image was rejected. Run the bounds and image checks
first in run_custom_training and run_container_training, as #318 does for
service_account_name, and test that the namespace is never resolved.

IPv6 registry hosts are tracked separately in #434.

Signed-off-by: pratik naik <naikp0241@gmail.com>

---------

Signed-off-by: pratik naik <naikp0241@gmail.com>

2769 of 3224 relevant lines covered (85.89%)

2.58 hits per line

Coverage Regressions

Lines Coverage ∆ File
34
85.65
0.24% trainer/api/training.py
2
98.99
0.22% core/security.py
Jobs
ID Job ID Ran Files Coverage
1 python-3.11 - 39470893998.1 38
85.89
GitHub Action Run
2 python-3.10 - 39470893998.2 38
85.89
GitHub Action Run
3 python-3.12 - 39470893998.3 38
85.89
GitHub Action Run
Source Files on build 39470893998