Skip to content

Add baseImage validation, status field, and documentation#396

Open
ivanauth wants to merge 3 commits intoauthzed:mainfrom
ivanauth:fix/baseimage-validation
Open

Add baseImage validation, status field, and documentation#396
ivanauth wants to merge 3 commits intoauthzed:mainfrom
ivanauth:fix/baseimage-validation

Conversation

@ivanauth
Copy link

@ivanauth ivanauth commented Dec 9, 2025

Summary

Improvements to the alternative container registry feature (PR #367):

  • Validate baseImage format: Reject tags (:tag) and digests (@sha256:...) in baseImage field, while correctly allowing port numbers in registry URLs (e.g., registry:5000/image)
  • Add CEL validation: Early validation at Kubernetes API level for faster feedback
  • Surface resolved base image in status: New status.resolvedBaseImage field for debugging
  • Add documentation and examples: User-facing docs with common use cases and pitfalls

Relates to #387

Changes

  • Add validation in pkg/config/config.go to reject invalid baseImage values
  • Add ResolvedBaseImage field to ClusterStatus in pkg/apis/authzed/v1alpha1/types.go
  • Add CEL validation rules to CRDs
  • Add examples/alternative-registry/ with README and example manifests
  • Add comprehensive tests for validation edge cases

@ivanauth ivanauth force-pushed the fix/baseimage-validation branch from 04effaa to e6ded22 Compare December 13, 2025 02:17
baseImage: "my-registry.company.com/authzed/spicedb"

# The operator will append the appropriate tag based on the version/channel
version: "v1.33.0"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this example makes it unclear why you'd use this instead of just setting the full image - you still get the update graph, so you can just specify a channel instead

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point - updated the example.

@ivanauth ivanauth force-pushed the fix/baseimage-validation branch from 25db2cc to 641c590 Compare March 5, 2026 20:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants