Expected Behavior
When a user specifies step names in debug.breakpoints.beforeSteps, those names should be validated against the actual step names in the Task spec. If a step name doesn't exist, the user should receive a validation error.
Actual Behavior
In pkg/apis/pipeline/v1/taskrun_validation.go (lines 284-290), the validation checks for duplicate beforeSteps entries but never validates that the step names actually exist in the Task spec.
A user can write:
spec:
debug:
breakpoints:
onFailure: enabled
beforeSteps:
- nonexistent-stepThis passes validation silently. At runtime, NeedsDebugBeforeStep checks against container names and no container matches, so the breakpoint never fires. The user gets zero feedback about the misconfiguration.
Proposed Fix
Validate beforeSteps entries against the resolved Task spec's step names during TaskRun validation (similar to how param names are validated against Task param declarations).
Note: This validation may need to happen at reconcile time rather than webhook time, since the Task spec may not be available during admission (e.g., when using remote resolution).
Related
/kind bug
/area api
Expected Behavior
When a user specifies step names in
debug.breakpoints.beforeSteps, those names should be validated against the actual step names in the Task spec. If a step name doesn't exist, the user should receive a validation error.Actual Behavior
In
pkg/apis/pipeline/v1/taskrun_validation.go(lines 284-290), the validation checks for duplicatebeforeStepsentries but never validates that the step names actually exist in the Task spec.A user can write:
This passes validation silently. At runtime,
NeedsDebugBeforeStepchecks against container names and no container matches, so the breakpoint never fires. The user gets zero feedback about the misconfiguration.Proposed Fix
Validate
beforeStepsentries against the resolved Task spec's step names during TaskRun validation (similar to how param names are validated against Task param declarations).Note: This validation may need to happen at reconcile time rather than webhook time, since the Task spec may not be available during admission (e.g., when using remote resolution).
Related
TaskRundebug mode #7352: [TEP-0042] Feedback for TaskRun debug mode (beta promotion tracker)breakpoints,breakpoints.onFailuretodebugand extend support to PipelineRun #5184: TEP 0097 tracking issue/kind bug
/area api