Controller is stuck on invalid regex pattern

[iExalt]

Describe the bug

I had inadvertently created an ImagePolicy with an invalid pattern pattern: '^develop-continuous-(?<buildnumber>\d+)$' (omitting the p between the ? and the <) . When trying to reconcile the policy, it was stuck in the following state:

NAME    READY   MESSAGE                         LATEST IMAGE
<name>  False   waiting to be reconciled

Given the message, I tried flux reconcile image repository and flux reconcile kustomization several times to no avail. I looked in the image-reflector-controller logs and sure enough there was an error informing me that my regex was invalid.

It would be nice to bubble that information upwards as an explicit error message in flux get image policy or an event on the ImagePolicy API object so that users would have a better idea of what went wrong.

As an aside, perhaps it's possible to validate the spec.filterTags.pattern field at creation time with a ValidatingAdmissionWebhook instead of at runtime?

To Reproduce

1. Create an ImagePolicy with an invalid regex
2. flux get image policy

Expected behavior

I would have liked a more precise message in flux get image policy for ImagePolicies with invalid regexes. While it's technically true that the ImagePolicy was waiting to be reconciled, the message makes it seem like running flux reconcile is be obvious (but incorrect) action to take.

Additional context

N/A

flux version 0.13.1

► checking prerequisites
✔ kubectl 1.21.0 >=1.18.0-0
✔ Kubernetes 1.20.4 >=1.16.0-0
► checking controllers
✔ helm-controller: deployment ready
► ghcr.io/fluxcd/helm-controller:v0.10.0
✔ image-automation-controller: deployment ready
► ghcr.io/fluxcd/image-automation-controller:v0.9.0
✔ image-reflector-controller: deployment ready
► ghcr.io/fluxcd/image-reflector-controller:v0.9.0
✔ kustomize-controller: deployment ready
► ghcr.io/fluxcd/kustomize-controller:v0.11.1
✔ notification-controller: deployment ready
► ghcr.io/fluxcd/notification-controller:v0.13.0
✔ source-controller: deployment ready
► ghcr.io/fluxcd/source-controller:v0.12.1
✔ all checks passed

[kadzielawa]

I had experienced the same error, thanks for raising this one. Finally, did you fix regexp for your policy? What was the problem?

[stefanprodan]

The CLI does validation:

$ flux create image policy test --image-ref=test --select-numeric=asc \
--filter-regex='^develop-continuous-(?<buildnumber>\d+)$' \
--export

 ✗ --filter-regex is an invalid regex pattern

[relu]

Admission validation would prevent invalid spec resources to be applied. We have an issue for that but never had the time to work on it myself: #69

[iExalt]

@kadzielawa I missed the P in front of the named capture group

[iExalt]

The CLI does validation:

$ flux create image policy test --image-ref=test --select-numeric=asc \
--filter-regex='^develop-continuous-(?<buildnumber>\d+)$' \
--export

 ✗ --filter-regex is an invalid regex pattern

Ah, I didn't know that! I thought the CLI was just an easy way to template a Flux yaml. Good to know that it would perform validation on the inputs as well.