Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
80 changes: 80 additions & 0 deletions pkg/tkn/compute_families_test.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,80 @@
package tkn

import (
"os"
"path/filepath"
"strings"
"testing"
)

// Tasks that have a compute-sizes conditional in their script and must also
// conditionally pass --compute-families in the else branch.
var tasksWithComputeFamiliesScript = map[string]struct{}{
"infra-aws-rhel.yaml": {},
"infra-aws-ocp-snc.yaml": {},
"infra-aws-fedora.yaml": {},
"infra-aws-rhel-ai.yaml": {},
"infra-aws-eks.yaml": {},
"infra-aws-kind.yaml": {},
"infra-aws-windows-server.yaml": {},
}

// mac uses dedicated host provisioning — CLI does not accept --compute-families.
var tasksWithoutComputeFamiliesParam = map[string]struct{}{
"infra-aws-mac.yaml": {},
}

func TestComputeFamiliesParamDefined(t *testing.T) {
root := moduleRoot(t)
for _, dir := range []string{"tkn", filepath.Join("tkn", "template")} {
entries, err := os.ReadDir(filepath.Join(root, dir))
if err != nil {
t.Fatal(err)
}
for _, entry := range entries {
name := entry.Name()
if !isAWSInfraTask(name) {
continue
}
if _, skip := tasksWithoutComputeFamiliesParam[name]; skip {
continue
}
path := filepath.Join(root, dir, name)
data, err := os.ReadFile(path)
if err != nil {
t.Fatal(err)
}
if !strings.Contains(string(data), "name: compute-families") {
t.Errorf("%s: missing 'compute-families' param definition", path)
}
}
}
}

func TestComputeFamiliesPassedInScript(t *testing.T) {
root := moduleRoot(t)
for _, dir := range []string{"tkn", filepath.Join("tkn", "template")} {
entries, err := os.ReadDir(filepath.Join(root, dir))
if err != nil {
t.Fatal(err)
}
for _, entry := range entries {
name := entry.Name()
if _, ok := tasksWithComputeFamiliesScript[name]; !ok {
continue
}
path := filepath.Join(root, dir, name)
data, err := os.ReadFile(path)
if err != nil {
t.Fatal(err)
}
if !strings.Contains(string(data), "--compute-families") {
t.Errorf("%s: missing '--compute-families' flag in script", path)
}
}
}
}

func isAWSInfraTask(name string) bool {
return strings.HasSuffix(name, ".yaml") && strings.HasPrefix(name, "infra-aws-")
}
19 changes: 19 additions & 0 deletions tkn/infra-aws-eks.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,18 @@ spec:
- name: load-balancer-controller
description: Install AWS Load Balancer Controller (default false)
default: 'false'
- name: compute-sizes
description: Comma seperated list of sizes for the machines to be requested. If set this takes precedence over compute by args
default: ""
- name: compute-families
description: Comma-separated allowlist of AWS instance family prefixes (e.g. m5,m6i,m7i). Empty means no restriction. Only used when compute-sizes is not set.
default: ""
- name: cpus
description: Number of CPUs for the cloud instance (default 8)
default: '8'
- name: memory
description: Amount of RAM for the cloud instance in GiB (default 64)
default: '64'

# Spot params
- name: spot
Expand Down Expand Up @@ -216,6 +228,13 @@ spec:
cmd+="--conn-details-output /opt/cluster-info "
cmd+="--version $(params.k8s-version) "
cmd+="--arch $(params.arch) "
if [[ $(params.compute-sizes) != "" ]]; then
cmd+="--compute-sizes '$(params.compute-sizes)' "
else
cmd+="--cpus '$(params.cpus)' "
cmd+="--memory '$(params.memory)' "
cmd+="--compute-families '$(params.compute-families)' "
fi
cmd+="--workers-desired $(params.workers-desired) "
cmd+="--workers-max $(params.workers-max) "
cmd+="--workers-min $(params.workers-min) "
Expand Down
4 changes: 4 additions & 0 deletions tkn/infra-aws-fedora.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,9 @@ spec:
- name: compute-sizes
description: Comma seperated list of sizes for the machines to be requested. If set this takes precedence over compute by args
default: ""
- name: compute-families
description: Comma-separated allowlist of AWS instance family prefixes (e.g. m5,m6i,m7i). Empty means no restriction. Only used when compute-sizes is not set.
default: ""
- name: cpus
description: Number of CPUs for the cloud instance (default 8)
default: "8"
Expand Down Expand Up @@ -255,6 +258,7 @@ spec:
cmd+="--memory '$(params.memory)' "
cmd+="--gpus '$(params.gpus)' "
cmd+="--gpu-manufacturer '$(params.gpu-manufacturer)' "
cmd+="--compute-families '$(params.compute-families)' "
fi
if [[ "$(params.nested-virt)" == "true" ]]; then
cmd+="--nested-virt "
Expand Down
15 changes: 13 additions & 2 deletions tkn/infra-aws-kind.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,12 @@ spec:
- name: memory
description: Amount of RAM for the cloud instance in GiB (default 64)
default: '64'
- name: compute-sizes
description: Comma seperated list of sizes for the machines to be requested. If set this takes precedence over compute by args
default: ""
- name: compute-families
description: Comma-separated allowlist of AWS instance family prefixes (e.g. m5,m6i,m7i). Empty means no restriction. Only used when compute-sizes is not set.
default: ""
- name: nested-virt
description: Use cloud instance that has nested virtualization support
default: 'false'
Expand Down Expand Up @@ -220,8 +226,13 @@ spec:
if [[ $(params.operation) == "create" ]]; then
cmd+="--conn-details-output /opt/cluster-info "
cmd+="--arch $(params.arch) "
cmd+="--cpus $(params.cpus) "
cmd+="--memory $(params.memory) "
if [[ $(params.compute-sizes) != "" ]]; then
cmd+="--compute-sizes '$(params.compute-sizes)' "
else
cmd+="--cpus '$(params.cpus)' "
cmd+="--memory '$(params.memory)' "
cmd+="--compute-families '$(params.compute-families)' "
fi
if [[ $(params.nested-virt) == "true" ]]; then
cmd+="--nested-virt "
fi
Expand Down
4 changes: 1 addition & 3 deletions tkn/infra-aws-ocp-snc.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -271,9 +271,7 @@ spec:
cmd+="--memory '$(params.memory)' "
cmd+="--gpus '$(params.gpus)' "
cmd+="--gpu-manufacturer '$(params.gpu-manufacturer)' "
if [[ "$(params.compute-families)" != "" ]]; then
cmd+="--compute-families '$(params.compute-families)' "
fi
cmd+="--compute-families '$(params.compute-families)' "

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

payload="m5'; printf 'INJECTED\n'; #"
cmd="printf '%s\n' --compute-families '$payload' "

if eval "$cmd" | grep -qx 'INJECTED'; then
  echo "raw single-quoting is unsafe"
  exit 1
fi

Repository: redhat-developer/mapt

Length of output: 188


🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

files=(
  tkn/infra-aws-ocp-snc.yaml
  tkn/template/infra-aws-ocp-snc.yaml
  tkn/infra-aws-rhel.yaml
  tkn/template/infra-aws-rhel.yaml
)

for f in "${files[@]}"; do
  echo "===== $f ====="
  wc -l "$f"
  rg -n -C 8 --fixed-strings \
    'cmd+="--compute-families' "$f"
  rg -n -C 8 'eval|compute-families|params.compute-families' "$f"
done

echo "===== related declarations and invocation patterns ====="
rg -n -C 5 'compute-families|cmd\+=|cmd=\(|"\$\{cmd|\beval\b' \
  tkn README.md .github 2>/dev/null || true

echo "===== template/generated comparison ====="
diff -u tkn/template/infra-aws-ocp-snc.yaml tkn/infra-aws-ocp-snc.yaml | head -200 || true
diff -u tkn/template/infra-aws-rhel.yaml tkn/infra-aws-rhel.yaml | head -200 || true

Repository: redhat-developer/mapt

Length of output: 50378


🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path

pairs = [
    ("tkn/template/infra-aws-ocp-snc.yaml", "tkn/infra-aws-ocp-snc.yaml", 250, 330),
    ("tkn/template/infra-aws-rhel.yaml", "tkn/infra-aws-rhel.yaml", 260, 325),
]
for template, generated, start, end in pairs:
    a = Path(template).read_text().splitlines()
    b = Path(generated).read_text().splitlines()
    print(f"===== {template} vs {generated} =====")
    for line in range(start, end + 1):
        if a[line - 1] != b[line - 1]:
            print(f"line {line}:")
            print(" template :", a[line - 1])
            print(" generated:", b[line - 1])
    print("affected blocks equal:",
          a[start - 1:end] == b[start - 1:end])
PY

echo "===== consumer references ====="
rg -n -C 5 --glob '!tkn/**' --glob '!**/*.yaml' \
  'compute-families|compute_families' . 2>/dev/null || true

echo "===== focused shell behavior ====="
bash -c '
set -euo pipefail
payload="m5'\''; printf '\''INJECTED\n'\''; #"
cmd="printf "%s\n" --compute-families '\''$payload'\'' "
printf "command source: %s\n" "$cmd"
printf "eval output:\n"
eval "$cmd"
'

Repository: redhat-developer/mapt

Length of output: 4754


🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "===== compute-family implementation references ====="
rg -n -C 6 \
  'computeFamilies|compute-families|ComputeFamil|compute family|family prefix' \
  cmd pkg internal 2>/dev/null | head -300

echo "===== relevant file outlines ====="
for f in $(rg -l 'computeFamilies|compute-families|ComputeFamil' cmd pkg internal 2>/dev/null | head -20); do
  echo "--- $f"
  wc -l "$f"
  ast-grep outline "$f" 2>/dev/null | head -80 || true
done

Repository: redhat-developer/mapt

Length of output: 17620


Replace string-based eval execution with safe argument handling.

All four sites insert $(params.compute-families) into a command string and execute it with eval "${cmd}". A crafted value executes injected shell code. Build the complete command as an argument array, validate the documented comma-separated family-prefix format, and invoke "${cmd[@]}" directly. Update both templates and regenerate both rendered files.

📍 Affects 4 files
  • tkn/infra-aws-ocp-snc.yaml#L274-L274 (this comment)
  • tkn/template/infra-aws-ocp-snc.yaml#L274-L274
  • tkn/infra-aws-rhel.yaml#L283-L283
  • tkn/template/infra-aws-rhel.yaml#L283-L283
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tkn/infra-aws-ocp-snc.yaml` at line 274, Replace string-built commands and
eval execution at tkn/infra-aws-ocp-snc.yaml:274-274,
tkn/template/infra-aws-ocp-snc.yaml:274-274, tkn/infra-aws-rhel.yaml:283-283,
and tkn/template/infra-aws-rhel.yaml:283-283 with argument-array construction
and direct "${cmd[@]}" invocation. Validate params.compute-families against the
documented comma-separated family-prefix format before adding it to the
arguments, then apply the same changes to both templates and regenerate both
rendered files.

Source: Path instructions

fi
if [[ $(params.nested-virt) == "true" ]]; then
cmd+="--nested-virt "
Expand Down
4 changes: 4 additions & 0 deletions tkn/infra-aws-rhel-ai.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,9 @@ spec:
- name: compute-sizes
description: Comma seperated list of sizes for the machines to be requested. If set this takes precedence over compute by args
default: ""
- name: compute-families
description: Comma-separated allowlist of AWS instance family prefixes (e.g. m5,m6i,m7i). Empty means no restriction. Only used when compute-sizes is not set.
default: ""
- name: cpus
description: Number of CPUs for the cloud instance (default 8)
default: "8"
Expand Down Expand Up @@ -283,6 +286,7 @@ spec:
cmd+="--memory '$(params.memory)' "
cmd+="--gpus '$(params.gpus)' "
cmd+="--gpu-manufacturer '$(params.gpu-manufacturer)' "
cmd+="--compute-families '$(params.compute-families)' "
fi
if [[ "$(params.nested-virt)" == "true" ]]; then
cmd+="--nested-virt "
Expand Down
4 changes: 1 addition & 3 deletions tkn/infra-aws-rhel.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -280,9 +280,7 @@ spec:
cmd+="--memory '$(params.memory)' "
cmd+="--gpus '$(params.gpus)' "
cmd+="--gpu-manufacturer '$(params.gpu-manufacturer)' "
if [[ "$(params.compute-families)" != "" ]]; then
cmd+="--compute-families '$(params.compute-families)' "
fi
cmd+="--compute-families '$(params.compute-families)' "
fi
if [[ "$(params.nested-virt)" == "true" ]]; then
cmd+="--nested-virt "
Expand Down
19 changes: 19 additions & 0 deletions tkn/infra-aws-windows-server.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,18 @@ spec:
- name: disk-size
description: Disk size in GB for the cloud instance
default: '200'
- name: compute-sizes
description: Comma seperated list of sizes for the machines to be requested. If set this takes precedence over compute by args
default: ""
- name: compute-families
description: Comma-separated allowlist of AWS instance family prefixes (e.g. m5,m6i,m7i). Empty means no restriction. Only used when compute-sizes is not set.
default: ""
- name: cpus
description: Number of CPUs for the cloud instance (default 8)
default: '8'
- name: memory
description: Amount of RAM for the cloud instance in GiB (default 200)
default: '200'

- name: airgap
description: |
Expand Down Expand Up @@ -234,6 +246,13 @@ spec:
cmd+="--ami-owner $(params.ami-owner) "
cmd+="--ami-lang $(params.ami-lang) "
cmd+="--disk-size $(params.disk-size) "
if [[ $(params.compute-sizes) != "" ]]; then
cmd+="--compute-sizes '$(params.compute-sizes)' "
else
cmd+="--cpus '$(params.cpus)' "
cmd+="--memory '$(params.memory)' "
cmd+="--compute-families '$(params.compute-families)' "
fi
if [[ $(params.spot) == "true" ]]; then
cmd+="--spot --spot-increase-rate $(params.spot-increase-rate) --spot-eviction-tolerance $(params.spot-eviction-tolerance) "
fi
Expand Down
19 changes: 19 additions & 0 deletions tkn/template/infra-aws-eks.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,18 @@ spec:
- name: load-balancer-controller
description: Install AWS Load Balancer Controller (default false)
default: 'false'
- name: compute-sizes
description: Comma seperated list of sizes for the machines to be requested. If set this takes precedence over compute by args
default: ""
- name: compute-families
description: Comma-separated allowlist of AWS instance family prefixes (e.g. m5,m6i,m7i). Empty means no restriction. Only used when compute-sizes is not set.
default: ""
- name: cpus
description: Number of CPUs for the cloud instance (default 8)
default: '8'
- name: memory
description: Amount of RAM for the cloud instance in GiB (default 64)
default: '64'

# Spot params
- name: spot
Expand Down Expand Up @@ -216,6 +228,13 @@ spec:
cmd+="--conn-details-output /opt/cluster-info "
cmd+="--version $(params.k8s-version) "
cmd+="--arch $(params.arch) "
if [[ $(params.compute-sizes) != "" ]]; then
cmd+="--compute-sizes '$(params.compute-sizes)' "
else
cmd+="--cpus '$(params.cpus)' "
cmd+="--memory '$(params.memory)' "
cmd+="--compute-families '$(params.compute-families)' "
fi
Comment thread
coderabbitai[bot] marked this conversation as resolved.
cmd+="--workers-desired $(params.workers-desired) "
cmd+="--workers-max $(params.workers-max) "
cmd+="--workers-min $(params.workers-min) "
Expand Down
4 changes: 4 additions & 0 deletions tkn/template/infra-aws-fedora.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,9 @@ spec:
- name: compute-sizes
description: Comma seperated list of sizes for the machines to be requested. If set this takes precedence over compute by args
default: ""
- name: compute-families
description: Comma-separated allowlist of AWS instance family prefixes (e.g. m5,m6i,m7i). Empty means no restriction. Only used when compute-sizes is not set.
default: ""
- name: cpus
description: Number of CPUs for the cloud instance (default 8)
default: "8"
Expand Down Expand Up @@ -255,6 +258,7 @@ spec:
cmd+="--memory '$(params.memory)' "
cmd+="--gpus '$(params.gpus)' "
cmd+="--gpu-manufacturer '$(params.gpu-manufacturer)' "
cmd+="--compute-families '$(params.compute-families)' "
fi
if [[ "$(params.nested-virt)" == "true" ]]; then
cmd+="--nested-virt "
Expand Down
15 changes: 13 additions & 2 deletions tkn/template/infra-aws-kind.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,12 @@ spec:
- name: memory
description: Amount of RAM for the cloud instance in GiB (default 64)
default: '64'
- name: compute-sizes
description: Comma seperated list of sizes for the machines to be requested. If set this takes precedence over compute by args
default: ""
- name: compute-families
description: Comma-separated allowlist of AWS instance family prefixes (e.g. m5,m6i,m7i). Empty means no restriction. Only used when compute-sizes is not set.
default: ""
- name: nested-virt
description: Use cloud instance that has nested virtualization support
default: 'false'
Expand Down Expand Up @@ -220,8 +226,13 @@ spec:
if [[ $(params.operation) == "create" ]]; then
cmd+="--conn-details-output /opt/cluster-info "
cmd+="--arch $(params.arch) "
cmd+="--cpus $(params.cpus) "
cmd+="--memory $(params.memory) "
if [[ $(params.compute-sizes) != "" ]]; then
cmd+="--compute-sizes '$(params.compute-sizes)' "
else
cmd+="--cpus '$(params.cpus)' "
cmd+="--memory '$(params.memory)' "
cmd+="--compute-families '$(params.compute-families)' "
fi
if [[ $(params.nested-virt) == "true" ]]; then
cmd+="--nested-virt "
fi
Expand Down
4 changes: 1 addition & 3 deletions tkn/template/infra-aws-ocp-snc.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -271,9 +271,7 @@ spec:
cmd+="--memory '$(params.memory)' "
cmd+="--gpus '$(params.gpus)' "
cmd+="--gpu-manufacturer '$(params.gpu-manufacturer)' "
if [[ "$(params.compute-families)" != "" ]]; then
cmd+="--compute-families '$(params.compute-families)' "
fi
cmd+="--compute-families '$(params.compute-families)' "
fi
if [[ $(params.nested-virt) == "true" ]]; then
cmd+="--nested-virt "
Expand Down
4 changes: 4 additions & 0 deletions tkn/template/infra-aws-rhel-ai.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,9 @@ spec:
- name: compute-sizes
description: Comma seperated list of sizes for the machines to be requested. If set this takes precedence over compute by args
default: ""
- name: compute-families
description: Comma-separated allowlist of AWS instance family prefixes (e.g. m5,m6i,m7i). Empty means no restriction. Only used when compute-sizes is not set.
default: ""
- name: cpus
description: Number of CPUs for the cloud instance (default 8)
default: "8"
Expand Down Expand Up @@ -283,6 +286,7 @@ spec:
cmd+="--memory '$(params.memory)' "
cmd+="--gpus '$(params.gpus)' "
cmd+="--gpu-manufacturer '$(params.gpu-manufacturer)' "
cmd+="--compute-families '$(params.compute-families)' "
fi
if [[ "$(params.nested-virt)" == "true" ]]; then
cmd+="--nested-virt "
Expand Down
4 changes: 1 addition & 3 deletions tkn/template/infra-aws-rhel.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -280,9 +280,7 @@ spec:
cmd+="--memory '$(params.memory)' "
cmd+="--gpus '$(params.gpus)' "
cmd+="--gpu-manufacturer '$(params.gpu-manufacturer)' "
if [[ "$(params.compute-families)" != "" ]]; then
cmd+="--compute-families '$(params.compute-families)' "
fi
cmd+="--compute-families '$(params.compute-families)' "
fi
if [[ "$(params.nested-virt)" == "true" ]]; then
cmd+="--nested-virt "
Expand Down
19 changes: 19 additions & 0 deletions tkn/template/infra-aws-windows-server.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,18 @@ spec:
- name: disk-size
description: Disk size in GB for the cloud instance
default: '200'
- name: compute-sizes
description: Comma seperated list of sizes for the machines to be requested. If set this takes precedence over compute by args
default: ""
- name: compute-families
description: Comma-separated allowlist of AWS instance family prefixes (e.g. m5,m6i,m7i). Empty means no restriction. Only used when compute-sizes is not set.
default: ""
- name: cpus
description: Number of CPUs for the cloud instance (default 8)
default: '8'
- name: memory
description: Amount of RAM for the cloud instance in GiB (default 200)
default: '200'
Comment thread
coderabbitai[bot] marked this conversation as resolved.

- name: airgap
description: |
Expand Down Expand Up @@ -234,6 +246,13 @@ spec:
cmd+="--ami-owner $(params.ami-owner) "
cmd+="--ami-lang $(params.ami-lang) "
cmd+="--disk-size $(params.disk-size) "
if [[ $(params.compute-sizes) != "" ]]; then
cmd+="--compute-sizes '$(params.compute-sizes)' "
else
cmd+="--cpus '$(params.cpus)' "
cmd+="--memory '$(params.memory)' "
cmd+="--compute-families '$(params.compute-families)' "
fi
if [[ $(params.spot) == "true" ]]; then
cmd+="--spot --spot-increase-rate $(params.spot-increase-rate) --spot-eviction-tolerance $(params.spot-eviction-tolerance) "
fi
Expand Down