Skip to content

ActorTemplate: Enforce that all images must be pinned#51

Open
Taahir Ahmed (ahmedtd) wants to merge 1 commit into
agent-substrate:mainfrom
ahmedtd:actortemplate-vap
Open

ActorTemplate: Enforce that all images must be pinned#51
Taahir Ahmed (ahmedtd) wants to merge 1 commit into
agent-substrate:mainfrom
ahmedtd:actortemplate-vap

Conversation

@ahmedtd
Copy link
Copy Markdown
Collaborator

This commit adds a ValidatingAdmissionPolicy that checks that all images in an ActorTemplate must be pinned to a specific hash.

Fixes #10

@@ -0,0 +1,39 @@
# Copyright 2026 Google LLC
Copy link
Copy Markdown
Collaborator

@juli4n Julian Gutierrez Oschmann (juli4n) May 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you considered adding this validation as an XValidation in the CRD itself? The advantage is that it gets coupled to the CRD so there is no way to delete it. I don't know this, but I suspect error messages will be more precise too as the error is specific to the field.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point. We need VAP for cross-field work, but this is scoped to a single field.

https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/2876-crd-validation-expression-language/README.md

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Prevent user from creating ActorTemplates with un-pinned images

3 participants