## Description The Kubernetes executor's `*_overwrite_allowed` settings that take a regular expression (`namespace_overwrite_allowed`, `service_account_overwrite_allowed`, `pod_labels_overwrite_allowed`, `pod_annotations_overwrite_allowed`, `node_selector_overwrite_allowed` and `node_tolerations_overwrite_allowed`) match any part of the value a job requests: - [`overwriteRegexCheck`](https://gitlab.com/gitlab-org/gitlab-runner/-/blob/b7759a45b904cf12f83b832624d145fdbd700537/executors/kubernetes/overwrites.go#L682-692) compiles the expression as written and accepts the value when `MatchString` finds a match anywhere in it. - For pod labels, pod annotations, node selectors and node tolerations, [`evaluateMapOverwrite`](https://gitlab.com/gitlab-org/gitlab-runner/-/blob/b7759a45b904cf12f83b832624d145fdbd700537/executors/kubernetes/overwrites.go#L743-745) runs that check on the whole variable value, so the expression is matched against `key=value`, or `key=value:effect` for a toleration. So `namespace_overwrite_allowed = "ci-.*"` also allows `review-ci-apps`, and `node_selector_overwrite_allowed = "kubernetes.io/arch=.*"` also allows `beta.kubernetes.io/arch=amd64`. To match the whole value, an administrator has to anchor the expression with `^` and `$`. !7661 documents this behaviour and adds `TestOverwritesAllowedPatternMatching`, which pins it, without changing it. Matching the whole value by default, for example by compiling each expression as `^(?:expression)$`, would make unanchored expressions behave as they often read, but it would also change what existing configurations accept, so it is a breaking change: - An expression written for substring matching would stop accepting values it accepts today. - The [Buildah rootless tutorial](https://gitlab.com/gitlab-org/gitlab/-/blob/89a5e8384512f0304d9103d6cc82c663725bd9d4/doc/ci/docker/buildah_rootless_tutorial.md#L98) in gitlab-org/gitlab sets `service_account_overwrite_allowed = "buildah-*"` and runs its job with the `buildah-sa` service account. Unanchored, `buildah-*` accepts `buildah-sa`. Matched against the whole value, it accepts only `buildah` followed by zero or more hyphens, so the tutorial's own job would be refused. gitlab-org/gitlab!263433 proposes anchoring that example as `^buildah-sa$`. An expression that is already anchored around its whole body, such as `^(ci-builds|ci-review)$`, matches the same values either way. ## Proposal Make whole-value matching available behind a feature flag that defaults to the current behaviour: - Add a flag to `helpers/featureflags/flags.go`, for example `FF_KUBERNETES_ANCHOR_OVERWRITE_ALLOWED` (named like `FF_KUBERNETES_HONOR_ENTRYPOINT`), with `DefaultValue: false`. With the flag on, each of the six settings is matched against the whole value, as if it were written `^(?:expression)$`. With the flag off, nothing changes. - Because the flag decides what a job may request, read it from the runner configuration only, as [`FF_RESOLVE_FULL_TLS_CHAIN`](https://gitlab.com/gitlab-org/gitlab-runner/-/blob/b7759a45b904cf12f83b832624d145fdbd700537/network/gitlab.go#L692) is. Otherwise [`populateFeatureFlags`](https://gitlab.com/gitlab-org/gitlab-runner/-/blob/b7759a45b904cf12f83b832624d145fdbd700537/common/build_settings.go#L284-300) lets a job set the flag in its own variables unless `[runners.feature_flags]` defines it, and once the default flips, a job could turn whole-value matching off for itself. - Extend `TestOverwritesAllowedPatternMatching` to run each case in both modes: the unanchored cases keep today's result with the flag off and are matched against the whole value with it on, and the anchored cases give the same result in both. - Regenerate the feature flags table with `make update_feature_flags_docs`, and describe the flag in the "Regular expressions in overwrite settings" section that !7661 adds to the Kubernetes executor page. - Publish a deprecation note before the default flips, so that administrators can anchor their expressions, or set the flag to `false` in `[runners.feature_flags]`, before the release that changes the default. ## Links to related issues and merge requests / references - !7661 documents how the overwrite allow lists match values and pins it in a test. - #40156 is the documentation issue that !7661 closes. - The [review note on !7661](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/7661#note_4060211451) that suggested this approach. - gitlab-org/gitlab!263433 proposes anchoring the service account example in the Buildah rootless tutorial.