Mutable tag subscriptions are rejected on apply

[remi-gelinas]

Checklist

• [x] I've searched the issue queue to verify this is not a duplicate bug report.
• [x] I've included steps to reproduce the bug.
• [x] I've pasted the output of kargo version.
• [x] I've pasted logs, if applicable.

Description

When subscribing to an image repository with mutable tags, the Kargo admission webhook rejects image subscriptions with the semverConstraint field containing the mutable tag name (described in the docs). As far as I can tell, this means v1.3.0 fully breaks support for mutable tag subscriptions.

EDIT: This is also present on v1.2.3

Steps to Reproduce

Apply a Warehouse with an image subscription listening to new digests from a mutable tag:

---
apiVersion: kargo.akuity.io/v1alpha1
kind: Warehouse
metadata:
  name: image
spec:
  subscriptions:
    - image:
        repoURL: <any valid repo>
        imageSelectionStrategy: Digest
        semverConstraint: main # Any mutable tag

It will be rejected by the Kargo admissions webhook because the semverConstraint value is not valid:

 one or more objects failed to apply, reason: admission webhook "warehouse.kargo.akuity.io" denied the request: Warehouse.kargo.akuity.io "image" is invalid: spec.subscriptions[0].image.semverConstraint: Invalid value: "main"

Version

{
  "Version": "v1.3.0",
  "BuildDate": "2025-02-25T20:20:33Z",
  "GitCommit": "f645f54c5cc72efc122ffd602544eec1bdee1656",
  "GitTreeDirty": false,
  "GoVersion": "go1.24.0",
  "Compiler": "gc",
  "Platform": "linux/amd64"
}

Logs

Paste any relevant application logs here.

[krancour]

Ugh. I hate that we're using semverConstraint in this unintuitive way. (Even though historically, this was probably my doing in the very early days of the project. 🤦‍♂)

We really ought to introduce a more generically named constraint field whose value is interpreted appropriately for whichever image selection strategy you're using.

We should probably deprecate semverConstraint, although I don't see any real need to ever actually remove it. We can simply look at it only when no constraint is specified.

cc @hiddeco. I assume you'd probably agree with this, but lmk.

[remi-gelinas]

I figured it probably just slipped through as it's not a recommended use case at all. Unfortunately, I've got a few legacy projects using Kargo that do publish to mutable tags, and I appreciated that Kargo did at least support the use case.

Is there any known workaround for v1.3.0 @krancour, or should I be looking to roll back my upgrade to keep feature parity until something is figured out?

[krancour]

should I be looking to roll back my upgrade to keep feature parity until something is figured out?

That's you call, but I will try to have this resolved in v1.3.1. No promises, but I don't imagine that being released longer than a week from now.

[remi-gelinas]

@krancour No worries, I appreciate the attention. For reference as well, I just rolled our release back to v1.2.3, and I get the exact same issue - so I don't think this issue was introduced in 1.3.0

[krancour]

so I don't think this issue was introduced in 1.3.0

I hadn't actually gotten as far as seeing when it was introduced (or if it's been there all along). I took your original issue title at its word. 😉

Thank you for the clarification.

[krancour]

I believe the sensible approach here is to deprecate (and eventually remove) the semverConstraint field in favor of a more generically named constraint field where the exact behavior of the field is dependent upon the selection strategy. In light up this being a bit on the disruptive side, I'm going to move it out from a patch release and into a minor.

[johnpekcan]

Same issue here using latest instead of main.

[krancour]

@nitishfy if you're still looking for Kargo issues to work on, this would be a good one and I'd be grateful for you taking this off my plate.

[nitishfy]

Thank you Kent for letting me know. I'll take this up from here.

[krancour]

Thanks @nitishfy. Ping me offline if you need any further context.

[jessesuen]

https://github.com/akuity/kargo/pull/5208 introduced a bug which caused constraint to be non-optional. Reopening.