OCPBUGS-43353: fix(nodepool): validate registry entries in image config

[reedcort]

Summary

• Add validation for registry entries in blockedRegistries, allowedRegistries, and insecureRegistries using the MCO sourceRegex pattern
• Invalid entries (e.g. with tags like :latest or digests like @sha256:...) are now rejected at webhook admission time and surfaced via ValidHostedClusterConfiguration and ValidMachineConfig conditions
• Fixes OCPBUGS-43353: Invalid registry entries silently generate broken /etc/containers/policy.json, causing nodes to fail to join

Changes

File	Change
support/globalconfig/image.go	Add ValidateRegistrySources() with MCO regex
support/globalconfig/image_test.go	11 unit tests covering valid/invalid entries
hostedcluster_webhook.go	Reject invalid entries at create/update time
hostedcluster_controller.go	Surface errors via ValidHostedClusterConfiguration
nodepool/config.go	Surface errors via ValidMachineConfig condition

Bug Reproduction

Confirmed the bug still exists on OCP 4.21.5 (ROSA HCP staging cluster):

• Applied trusted.com/myrepo:latest as a blocked registry
• ValidMachineConfig reported True despite the invalid entry
• Nodes would fail to join on replacement due to invalid policy.json

Test plan

• Unit tests pass (go test ./support/globalconfig/ -v — 11/11)
• All modified packages compile (go build)
• make verify passes
• CI e2e tests

🤖 Generated with Claude Code

Summary by CodeRabbit

Release Notes

• New Features

  • Added validation for image registry sources in HostedCluster configurations to ensure registry entries follow the required format (hostname[:port][/path]) and prevent invalid entries containing image tags or digests. Validation is enforced for both creation and update operations.

• Tests

  • Added comprehensive test coverage for registry source validation with multiple test scenarios.

[openshift-ci-robot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 831da47f-41b4-4678-b060-5631d0d441a0

📥 Commits

Reviewing files that changed from the base of the PR and between 825ff5a and 2df02b6.

📒 Files selected for processing (5)

• hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go
• hypershift-operator/controllers/hostedcluster/hostedcluster_webhook.go
• hypershift-operator/controllers/nodepool/config.go
• support/globalconfig/image.go
• support/globalconfig/image_test.go

---

📝 Walkthrough

Walkthrough

The changes introduce validation for OpenShift image registry sources across multiple components of the hosted cluster infrastructure. A new ValidateRegistrySources function was added to validate registry source entries against a hostname pattern (rejecting entries with image tags or digests). This validation is now integrated into three locations: the hosted cluster admission webhook for create/update requests, the hosted cluster controller's configuration validation, and the node pool's global configuration generation. Comprehensive test coverage validates the behavior of the registry source validation function.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: reedcort
Once this PR has been reviewed and has the lgtm label, please assign cblecker for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[reedcort]

/hold

[reedcort]

/test all

[reedcort]

/test e2e-azure-self-managed

[openshift-ci-robot]

@reedcort: This pull request references Jira Issue OCPBUGS-43353, which is invalid:

• expected the bug to target the "4.22.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• Add validation for registry entries in blockedRegistries, allowedRegistries, and insecureRegistries using the MCO sourceRegex pattern
• Invalid entries (e.g. with tags like :latest or digests like @sha256:...) are now rejected at webhook admission time and surfaced via ValidHostedClusterConfiguration and ValidMachineConfig conditions
• Fixes OCPBUGS-43353: Invalid registry entries silently generate broken /etc/containers/policy.json, causing nodes to fail to join

Changes

File	Change
support/globalconfig/image.go	Add ValidateRegistrySources() with MCO regex
support/globalconfig/image_test.go	11 unit tests covering valid/invalid entries
hostedcluster_webhook.go	Reject invalid entries at create/update time
hostedcluster_controller.go	Surface errors via ValidHostedClusterConfiguration
nodepool/config.go	Surface errors via ValidMachineConfig condition

Bug Reproduction

Confirmed the bug still exists on OCP 4.21.5 (ROSA HCP staging cluster):

• Applied trusted.com/myrepo:latest as a blocked registry
• ValidMachineConfig reported True despite the invalid entry
• Nodes would fail to join on replacement due to invalid policy.json

Test plan

• Unit tests pass (go test ./support/globalconfig/ -v — 11/11)
• All modified packages compile (go build)
• make verify passes
• CI e2e tests

🤖 Generated with Claude Code

Summary by CodeRabbit

Release Notes

• New Features

• Added validation for image registry sources in HostedCluster configurations to ensure registry entries follow the required format (hostname[:port][/path]) and prevent invalid entries containing image tags or digests. Validation is enforced for both creation and update operations.

• Tests

• Added comprehensive test coverage for registry source validation with multiple test scenarios.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[joshbranham]

/jira refresh

[openshift-ci-robot]

@joshbranham: This pull request references Jira Issue OCPBUGS-43353, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @xiuwang

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[joshbranham]

/test e2e-azure-self-managed

[openshift-ci]

@reedcort: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[enxebre]

please fix this in the canonical API https://github.com/openshift/api/blob/30c2ef7a272e592fd836c6bedbd4394b3ed15042/config/v1/types_image.go#L56 with CEL
self.all(r, r.matches('^your-regex$'))",message="each entry must match ^your-regex$"

[openshift-ci-robot]

@reedcort: This pull request references Jira Issue OCPBUGS-43353. The bug has been updated to no longer refer to the pull request using the external bug tracker. All external bug links have been closed. The bug has been moved to the NEW state.

Details

In response to this:

Summary

• Add validation for registry entries in blockedRegistries, allowedRegistries, and insecureRegistries using the MCO sourceRegex pattern
• Invalid entries (e.g. with tags like :latest or digests like @sha256:...) are now rejected at webhook admission time and surfaced via ValidHostedClusterConfiguration and ValidMachineConfig conditions
• Fixes OCPBUGS-43353: Invalid registry entries silently generate broken /etc/containers/policy.json, causing nodes to fail to join

Changes

File	Change
support/globalconfig/image.go	Add ValidateRegistrySources() with MCO regex
support/globalconfig/image_test.go	11 unit tests covering valid/invalid entries
hostedcluster_webhook.go	Reject invalid entries at create/update time
hostedcluster_controller.go	Surface errors via ValidHostedClusterConfiguration
nodepool/config.go	Surface errors via ValidMachineConfig condition

Bug Reproduction

Confirmed the bug still exists on OCP 4.21.5 (ROSA HCP staging cluster):

• Applied trusted.com/myrepo:latest as a blocked registry
• ValidMachineConfig reported True despite the invalid entry
• Nodes would fail to join on replacement due to invalid policy.json

Test plan

• Unit tests pass (go test ./support/globalconfig/ -v — 11/11)
• All modified packages compile (go build)
• make verify passes
• CI e2e tests

🤖 Generated with Claude Code

Summary by CodeRabbit

Release Notes

• New Features

• Added validation for image registry sources in HostedCluster configurations to ensure registry entries follow the required format (hostname[:port][/path]) and prevent invalid entries containing image tags or digests. Validation is enforced for both creation and update operations.

• Tests

• Added comprehensive test coverage for registry source validation with multiple test scenarios.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.