Uploaded image for project: 'OpenShift Pipelines'
  1. OpenShift Pipelines
  2. SRVKP-9204

Operator panic when validating v1beta1 pipeline matrix with invalid variable substitution

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • Pipelines 1.20.0, Pipelines 1.18.1, Pipelines 1.19.3
    • Tekton Pipelines
    • QE Confirmed, Customer Reported

      Description of problem:

      A matrixed v1beta1 Pipeline which includes certain invalid variable substitutions causes the Operator Webhook to panic and crash.

      Workaround

      Converting the v1beta1 pipeline to v1 pipeline allows the pipeline to be created.

      Prerequisites (if any, like setup, operators/versions):

      Have a cluster running Openshift Pipelines at any version

      Steps to Reproduce

       - Create the following Pipeline:

      ---
      apiVersion: tekton.dev/v1beta1
      kind: Pipeline
      metadata:
        name: matrixed-pipeline-with-err
      spec:
          tasks:
            - name: echo-result
              taskSpec:
                results:
                  - name: output
                    type: string
                steps:
                  - name: emit-a-result
                    image: mirror.gcr.io/bash
                    script: |
                      #!/usr/bin/env bash
                      echo -n "some data" | tee $(results.output.path)
            - name: consume-result
              matrix:
                params:
                  - name: version
                    value: ["1", "2"]
              params:
                - name: bad-input
                  value: "$(tasks)-$(tasks.echo-result.results.output)"
              taskSpec:
                params:
                  - name: bad-input
                steps:
                  - name: consume-the-result
                    image: mirror.gcr.io/bash
                    script: |
                      #!/usr/bin/env bash
                      echo -n "input: $(params.bad-input)"
      

      Actual results:

      Create fails: 

      $  kubectl apply -f bad-task-ref.yaml
      Error from server (InternalError): error when creating "bad-task-ref.yaml": Internal error occurred: failed calling webhook "validation.webhook.pipeline.tekton.dev": failed to call webhook: Post "https://tekton-pipelines-webhook.tekton-pipelines.svc:443/resource-validation?timeout=10s": EOF 

      And webhook panics:

      {"severity":"error","timestamp":"2025-10-30T13:40:19.534Z","logger":"tekton-pipelines-webhook","caller":"webhook/webhook.go:254","message":"http: panic serving 10.244.0.1:35163: runtime error: index out of range [1] with length 1\ngoroutine 1668181 [running]:\nnet/http.(*conn).serve.func1()\n\tnet/http/server.go:1947 +0xbe\npanic({0x23d0ba0?, 0xc0018bc150?})\n\truntime/panic.go:792 +0x132\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.validateMatrixedPipelineTaskConsumed({0xc00184dc40?, 0x9?, 0x2573af0?}, 0xc000afb138)\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:816 +0x377\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.findAndValidateResultRefsForMatrix({0xc0010a7c00?, 0xc000afb138?, 0xc000afaf80?}, 0xc000afb138)\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:798 +0x232\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.validateTaskResultsFromMatrixedPipelineTasksConsumed({0xc0010a7c00, 0x2, 0x2})\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:834 +0x1a5\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.validateMatrix({0x290bad0, 0xc0018583c0}, {0xc0010a7c00, 0x2, 0x2})\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:786 +0x13e\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.(*PipelineSpec).Validate(0xc0010a7b48, {0x290bad0, 0xc0018583c0})\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:96 +0x7f6\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.(*Pipeline).Validate(0xc0010a7a40, {0x290bad0, 0xc001858390})\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:60 +0xa7\nknative.dev/pkg/webhook/resourcesemantics/validation.validate({0x290bad0, 0xc001858390}, {0x290b520, 0xc0010a7a40}, 0xc000d6f1e0)\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/resourcesemantics/validation/validation_admit.go:183 +0x115\nknative.dev/pkg/webhook/resourcesemantics/validation.(*reconciler).Admit(0xc00035ac30, {0x290bad0?, 0xc001858000?}, 0xc000d6f1e0)\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/resourcesemantics/validation/validation_admit.go:79 +0x1ad\nknative.dev/pkg/webhook.New.admissionHandler.func4({0x28f75c8, 0xc0001e9960}, 0xc001b52280)\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/admission.go:123 +0x53b\nnet/http.HandlerFunc.ServeHTTP(0xc0006383a8?, {0x28f75c8?, 0xc0001e9960?}, 0x68299f?)\n\tnet/http/server.go:2294 +0x29\nnet/http.(*ServeMux).ServeHTTP(0xc00182dd70?, {0x28f75c8, 0xc0001e9960}, 0xc001b52280)\n\tnet/http/server.go:2822 +0x1c4\nknative.dev/pkg/webhook.(*Webhook).ServeHTTP(0xc000638300, {0x28f75c8, 0xc0001e9960}, 0xc001b52280)\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/webhook.go:337 +0xad\nknative.dev/pkg/network/handlers.(*Drainer).ServeHTTP(0xc000579340, {0x28f75c8, 0xc0001e9960}, 0xc001b52280)\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/network/handlers/drain.go:113 +0x150\nnet/http.serverHandler.ServeHTTP({0x28e78e8?}, {0x28f75c8?, 0xc0001e9960?}, 0x1?)\n\tnet/http/server.go:3301 +0x8e\nnet/http.(*conn).serve(0xc001800990, {0x290bad0, 0xc00061ea80})\n\tnet/http/server.go:2102 +0x625\ncreated by net/http.(*Server).Serve in goroutine 120\n\tnet/http/server.go:3454 +0x485\n","commit":"eaf7dc1","stacktrace":"knative.dev/pkg/webhook.(*zapWrapper).Write\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/webhook.go:254\nlog.(*Logger).output\n\tlog/log.go:245\nlog.(*Logger).Printf\n\tlog/log.go:268\nnet/http.(*Server).logf\n\tnet/http/server.go:3638\nnet/http.(*conn).serve.func1\n\tnet/http/server.go:1948\nruntime.gopanic\n\truntime/panic.go:792\nruntime.goPanicIndex\n\truntime/panic.go:115\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.validateMatrixedPipelineTaskConsumed\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:816\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.findAndValidateResultRefsForMatrix\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:798\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.validateTaskResultsFromMatrixedPipelineTasksConsumed\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:834\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.validateMatrix\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:786\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.(*PipelineSpec).Validate\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:96\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.(*Pipeline).Validate\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:60\nknative.dev/pkg/webhook/resourcesemantics/validation.validate\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/resourcesemantics/validation/validation_admit.go:183\nknative.dev/pkg/webhook/resourcesemantics/validation.(*reconciler).Admit\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/resourcesemantics/validation/validation_admit.go:79\nknative.dev/pkg/webhook.New.admissionHandler.func4\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/admission.go:123\nnet/http.HandlerFunc.ServeHTTP\n\tnet/http/server.go:2294\nnet/http.(*ServeMux).ServeHTTP\n\tnet/http/server.go:2822\nknative.dev/pkg/webhook.(*Webhook).ServeHTTP\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/webhook.go:337\nknative.dev/pkg/network/handlers.(*Drainer).ServeHTTP\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/network/handlers/drain.go:113\nnet/http.serverHandler.ServeHTTP\n\tnet/http/server.go:3301\nnet/http.(*conn).serve\n\tnet/http/server.go:2102"} 

      Expected results:

      Creation succeeds:

      kubectl apply -f bad-task-ref.yaml
      pipeline.tekton.dev/matrixed-pipeline-with-err created 

      Reproducibility (Always/Intermittent/Only Once): Always

      Acceptance criteria: 

      • Webhook validation should reject the pipelinerun without panicking
      • Unit tests are updated appropriately

      Definition of Done:

      Build Details:

      Additional info (Such as Logs, Screenshots, etc):

      • This was fixed for v1 Pipelines last year (PR) but the fix was not applied to v1beta1 pipelineruns.
      •  

       *

              rh-ee-shumathu Shubham Mathur
              rh-ee-athorp Andrew Thorp
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: