#6938 Disallow unknown keys in feature-flags configmap

pkg/apis/config/feature_flags.go

@@ -24,6 +24,7 @@ import (
 	"strings"
 
 	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/util/sets"
 )
 
 const (
@@ -128,6 +129,36 @@ const (
 	coscheduleKey                       = "coschedule"
 )
 
+var knownFeatureFlagKeys = sets.NewString(
+	KeepPodOnCancel,
+	EnableCELInWhenExpression,
+	EnableStepActions,
+	EnableParamEnum,
+
+	disableAffinityAssistantKey,
+	disableCredsInitKey,
+	runningInEnvWithInjectedSidecarsKey,
+	awaitSidecarReadinessKey,
+	requireGitSSHSecretKnownHostsKey,
+	enableTektonOCIBundles,
+	enableAPIFields,
+	sendCloudEventsForRuns,
+	enforceNonfalsifiability,
+	verificationNoMatchPolicy,
+	enableProvenanceInStatus,
+	resultExtractionMethod,
+	maxResultSize,
+	setSecurityContextKey,
+	coscheduleKey,
+
+	// TEP-0114: Remove Feature Flag enable-custom-tasks #5975 (v0.47.0)
+	"enable-custom-tasks",
+	// Used on `pkg/pod/pod.go` #2158
+	"enable-ready-annotation-on-pod-create",
+	// Used on `./testdata/feature-flags-empty.yaml`
+	"_example",
+)
+
 // DefaultFeatureFlags holds all the default configurations for the feature flags configmap.
 var DefaultFeatureFlags, _ = NewFeatureFlagsFromMap(map[string]string{})
 
@@ -174,6 +205,11 @@ func GetFeatureFlagsConfigName() string {
 
 // NewFeatureFlagsFromMap returns a Config given a map corresponding to a ConfigMap
 func NewFeatureFlagsFromMap(cfgMap map[string]string) (*FeatureFlags, error) {
+	unknownFeatureFlagKeys := sets.StringKeySet(cfgMap).Difference(knownFeatureFlagKeys)
+	if unknownFeatureFlagKeys.Len() != 0 {
+		return nil, fmt.Errorf("invalid feature flags: %q", strings.Join(unknownFeatureFlagKeys.List(), ","))
+	}
+
 	setFeature := func(key string, defaultValue bool, feature *bool) error {
 		if cfg, ok := cfgMap[key]; ok {
 			value, err := strconv.ParseBool(cfg)

pkg/apis/config/feature_flags_test.go

@@ -275,6 +275,9 @@ func TestNewFeatureFlagsConfigMapErrors(t *testing.T) {
 	}, {
 		fileName: "feature-flags-invalid-enable-cel-in-whenexpression",
 		want:     `failed parsing feature flags config "invalid": strconv.ParseBool: parsing "invalid": invalid syntax`,
+	}, {
+		fileName: "feature-flags-invalid-key",
+		want:     `invalid feature flags: "invalid"`,
 	}, {
 		fileName: "feature-flags-invalid-enable-step-actions",
 		want:     `failed parsing feature flags config "invalid": strconv.ParseBool: parsing "invalid": invalid syntax`,

pkg/apis/config/testdata/feature-flags-invalid-key.yaml

@@ -0,0 +1,21 @@
+# Copyright 2023 The Tekton Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: feature-flags
+  namespace: tekton-pipelines
+data:
+  invalid: "invalid"