-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
Pipelines 1.20.0, Pipelines 1.18.1, Pipelines 1.19.3
Description of problem:
A matrixed v1beta1 Pipeline which includes certain invalid variable substitutions causes the Operator Webhook to panic and crash.
Workaround
Converting the v1beta1 pipeline to v1 pipeline allows the pipeline to be created.
Prerequisites (if any, like setup, operators/versions):
Have a cluster running Openshift Pipelines at any version
Steps to Reproduce
- Create the following Pipeline:
--- apiVersion: tekton.dev/v1beta1 kind: Pipeline metadata: name: matrixed-pipeline-with-err spec: tasks: - name: echo-result taskSpec: results: - name: output type: string steps: - name: emit-a-result image: mirror.gcr.io/bash script: | #!/usr/bin/env bash echo -n "some data" | tee $(results.output.path) - name: consume-result matrix: params: - name: version value: ["1", "2"] params: - name: bad-input value: "$(tasks)-$(tasks.echo-result.results.output)" taskSpec: params: - name: bad-input steps: - name: consume-the-result image: mirror.gcr.io/bash script: | #!/usr/bin/env bash echo -n "input: $(params.bad-input)"
Actual results:
Create fails:
$ kubectl apply -f bad-task-ref.yaml Error from server (InternalError): error when creating "bad-task-ref.yaml": Internal error occurred: failed calling webhook "validation.webhook.pipeline.tekton.dev": failed to call webhook: Post "https://tekton-pipelines-webhook.tekton-pipelines.svc:443/resource-validation?timeout=10s": EOF
And webhook panics:
{"severity":"error","timestamp":"2025-10-30T13:40:19.534Z","logger":"tekton-pipelines-webhook","caller":"webhook/webhook.go:254","message":"http: panic serving 10.244.0.1:35163: runtime error: index out of range [1] with length 1\ngoroutine 1668181 [running]:\nnet/http.(*conn).serve.func1()\n\tnet/http/server.go:1947 +0xbe\npanic({0x23d0ba0?, 0xc0018bc150?})\n\truntime/panic.go:792 +0x132\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.validateMatrixedPipelineTaskConsumed({0xc00184dc40?, 0x9?, 0x2573af0?}, 0xc000afb138)\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:816 +0x377\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.findAndValidateResultRefsForMatrix({0xc0010a7c00?, 0xc000afb138?, 0xc000afaf80?}, 0xc000afb138)\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:798 +0x232\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.validateTaskResultsFromMatrixedPipelineTasksConsumed({0xc0010a7c00, 0x2, 0x2})\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:834 +0x1a5\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.validateMatrix({0x290bad0, 0xc0018583c0}, {0xc0010a7c00, 0x2, 0x2})\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:786 +0x13e\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.(*PipelineSpec).Validate(0xc0010a7b48, {0x290bad0, 0xc0018583c0})\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:96 +0x7f6\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.(*Pipeline).Validate(0xc0010a7a40, {0x290bad0, 0xc001858390})\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:60 +0xa7\nknative.dev/pkg/webhook/resourcesemantics/validation.validate({0x290bad0, 0xc001858390}, {0x290b520, 0xc0010a7a40}, 0xc000d6f1e0)\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/resourcesemantics/validation/validation_admit.go:183 +0x115\nknative.dev/pkg/webhook/resourcesemantics/validation.(*reconciler).Admit(0xc00035ac30, {0x290bad0?, 0xc001858000?}, 0xc000d6f1e0)\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/resourcesemantics/validation/validation_admit.go:79 +0x1ad\nknative.dev/pkg/webhook.New.admissionHandler.func4({0x28f75c8, 0xc0001e9960}, 0xc001b52280)\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/admission.go:123 +0x53b\nnet/http.HandlerFunc.ServeHTTP(0xc0006383a8?, {0x28f75c8?, 0xc0001e9960?}, 0x68299f?)\n\tnet/http/server.go:2294 +0x29\nnet/http.(*ServeMux).ServeHTTP(0xc00182dd70?, {0x28f75c8, 0xc0001e9960}, 0xc001b52280)\n\tnet/http/server.go:2822 +0x1c4\nknative.dev/pkg/webhook.(*Webhook).ServeHTTP(0xc000638300, {0x28f75c8, 0xc0001e9960}, 0xc001b52280)\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/webhook.go:337 +0xad\nknative.dev/pkg/network/handlers.(*Drainer).ServeHTTP(0xc000579340, {0x28f75c8, 0xc0001e9960}, 0xc001b52280)\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/network/handlers/drain.go:113 +0x150\nnet/http.serverHandler.ServeHTTP({0x28e78e8?}, {0x28f75c8?, 0xc0001e9960?}, 0x1?)\n\tnet/http/server.go:3301 +0x8e\nnet/http.(*conn).serve(0xc001800990, {0x290bad0, 0xc00061ea80})\n\tnet/http/server.go:2102 +0x625\ncreated by net/http.(*Server).Serve in goroutine 120\n\tnet/http/server.go:3454 +0x485\n","commit":"eaf7dc1","stacktrace":"knative.dev/pkg/webhook.(*zapWrapper).Write\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/webhook.go:254\nlog.(*Logger).output\n\tlog/log.go:245\nlog.(*Logger).Printf\n\tlog/log.go:268\nnet/http.(*Server).logf\n\tnet/http/server.go:3638\nnet/http.(*conn).serve.func1\n\tnet/http/server.go:1948\nruntime.gopanic\n\truntime/panic.go:792\nruntime.goPanicIndex\n\truntime/panic.go:115\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.validateMatrixedPipelineTaskConsumed\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:816\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.findAndValidateResultRefsForMatrix\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:798\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.validateTaskResultsFromMatrixedPipelineTasksConsumed\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:834\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.validateMatrix\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:786\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.(*PipelineSpec).Validate\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:96\ngithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1.(*Pipeline).Validate\n\tgithub.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1/pipeline_validation.go:60\nknative.dev/pkg/webhook/resourcesemantics/validation.validate\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/resourcesemantics/validation/validation_admit.go:183\nknative.dev/pkg/webhook/resourcesemantics/validation.(*reconciler).Admit\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/resourcesemantics/validation/validation_admit.go:79\nknative.dev/pkg/webhook.New.admissionHandler.func4\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/admission.go:123\nnet/http.HandlerFunc.ServeHTTP\n\tnet/http/server.go:2294\nnet/http.(*ServeMux).ServeHTTP\n\tnet/http/server.go:2822\nknative.dev/pkg/webhook.(*Webhook).ServeHTTP\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/webhook/webhook.go:337\nknative.dev/pkg/network/handlers.(*Drainer).ServeHTTP\n\tknative.dev/pkg@v0.0.0-20250415155312-ed3e2158b883/network/handlers/drain.go:113\nnet/http.serverHandler.ServeHTTP\n\tnet/http/server.go:3301\nnet/http.(*conn).serve\n\tnet/http/server.go:2102"}
Expected results:
Creation succeeds:
kubectl apply -f bad-task-ref.yaml pipeline.tekton.dev/matrixed-pipeline-with-err created
Reproducibility (Always/Intermittent/Only Once): Always
Acceptance criteria:
- Webhook validation should reject the pipelinerun without panicking
- Unit tests are updated appropriately
Definition of Done:
Build Details:
Additional info (Such as Logs, Screenshots, etc):
- This was fixed for v1 Pipelines last year (PR) but the fix was not applied to v1beta1 pipelineruns.
*
- links to