ValidateParamArrayIndex for taskSpec should check beta flag.

[Yongxuanzhang]

Expected Behavior

pipeline/pkg/apis/pipeline/v1/task_validation.go

Lines 611 to 615 in a0fb784

	func (ts *TaskSpec) ValidateParamArrayIndex(ctx context.Context, params Params) error {
	cfg := config.FromContextOrDefaults(ctx)
	if cfg.FeatureFlags.EnableAPIFields != config.AlphaAPIFields {
	return nil
	}

should check beta flag instead of alpha flag.

Thanks @dibyom for catching this bug.

Actual Behavior

taskSpec's ValidateParamArrayIndex checks alpha flag.

Additional Info

Array indexing (Tep 76) is promoted by #6103, yet the feature flag check for taskSpec's ValidateParamArrayIndex is not updated. The resulting consequence is that the validation is skipped for taskSpec when this feature is used and the api feature flag is set to beta

• Kubernetes version:

  Output of kubectl version:

(paste your output here)

• Tekton Pipeline version:

Version since v0.46

[Yongxuanzhang]

/assign

[lbernick]

This is a bit more complicated; see #6616 for more detail.

Here's what I think the logic should look like:

• If a task uses indexing into array params, we should validate in the webhook that "enable-api-fields" is set to a value that permits using this feature
• If we cannot validate in the webhook since the task is e.g. stored in git, we should validate in the reconciler that "enable-api-fields" is set to a value that permits using this feature before converting the task to v1beta1 (or honestly we could skip this validation)
• if the task's array param indexes are out of bounds based on the params provided, we should validate this in the reconciler, separately from the value of "enable-api-fields"

[dibyom]

If we cannot validate in the webhook since the task is e.g. stored in git, we should validate in the reconciler that "enable-api-fields" is set to a value that permits using this feature before converting the task to v1beta1 (or honestly we could skip this validation)

wouldn't skipping the validation result in referenced pipelines and in cluster pipelines being validated differently?