Skip to content

mcp: add readonly guard to config add/remove handlers#3708

Open
Elvand-Lie wants to merge 2 commits into
knative:mainfrom
Elvand-Lie:fix/mcp-config-readonly-guard
Open

mcp: add readonly guard to config add/remove handlers#3708
Elvand-Lie wants to merge 2 commits into
knative:mainfrom
Elvand-Lie:fix/mcp-config-readonly-guard

Conversation

@Elvand-Lie
Copy link
Copy Markdown
Contributor

@Elvand-Lie Elvand-Lie commented May 12, 2026 •
edited
Loading

The deploy and delete handlers check s.readonly and refuse to act in readonly mode. However, the six config mutation handlers (configEnvsAdd, configEnvsRemove, configLabelsAdd, configLabelsRemove, configVolumesAdd, configVolumesRemove) execute unconditionally, allowing an AI agent to modify func.yaml even when readonly mode is active.

Add the same readonly guard to all six config mutation handlers, consistent with deploy and delete.

Changes

  • Add s.readonly guard to configEnvsAddHandler and configEnvsRemoveHandler
  • Add s.readonly guard to configLabelsAddHandler and configLabelsRemoveHandler
  • Add s.readonly guard to configVolumesAddHandler and configVolumesRemoveHandler

Fixes #3704

Release Note

NONE

Docs

NONE

@Elvand-Lie
mcp: add readonly guard to config add/remove handlers
2201903 
The deploy and delete handlers check s.readonly and refuse to act in readonly mode. However, the six config mutation handlers (envs add/remove, labels add/remove, volumes add/remove) execute unconditionally, allowing an AI agent to modify func.yaml even in readonly mode.

Add the same readonly guard to all six config mutation handlers.

Signed-off-by: elvandlie@gmail.com <elvandlie@gmail.com>
@knative-prow knative-prow Bot requested review from dsimansk and jrangelramos May 12, 2026 14:15
@knative-prow knative-prow Bot added size/S 🤖 PR changes 10-29 lines, ignoring generated files. needs-ok-to-test 🤖 Needs an org member to approve testing labels May 12, 2026
@knative-prow
Copy link
Copy Markdown

knative-prow Bot commented May 12, 2026

Hi @Elvand-Lie. Thanks for your PR.

I'm waiting for a knative member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@codecov
Copy link
Copy Markdown

codecov Bot commented May 12, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.94%. Comparing base (2b6fb02) to head (762cc09).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #3708      +/-   ##
==========================================
+ Coverage   56.91%   56.94%   +0.03%     
==========================================
  Files         181      181              
  Lines       20928    20952      +24     
==========================================
+ Hits        11912    11932      +20     
- Misses       7808     7811       +3     
- Partials     1208     1209       +1
Flag Coverage Δ
e2e 36.10% <0.00%> (-0.06%) ⬇️
e2e go 32.71% <0.00%> (-0.04%) ⬇️
e2e node 28.45% <0.00%> (-0.04%) ⬇️
e2e python 33.07% <0.00%> (-0.05%) ⬇️
e2e quarkus 28.59% <0.00%> (-0.04%) ⬇️
e2e rust 27.99% <0.00%> (-0.04%) ⬇️
e2e springboot 26.49% <0.00%> (-0.02%) ⬇️
e2e typescript 28.55% <0.00%> (-0.04%) ⬇️
e2e-config-ci 17.86% <0.00%> (-0.03%) ⬇️
integration 17.40% <0.00%> (-0.04%) ⬇️
unit macos-14 45.05% <100.00%> (+0.06%) ⬆️
unit macos-latest 45.05% <100.00%> (+0.06%) ⬆️
unit ubuntu-24.04-arm 45.22% <100.00%> (+0.06%) ⬆️
unit ubuntu-latest 45.90% <100.00%> (+0.06%) ⬆️
unit windows-latest 45.03% <100.00%> (+0.06%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@Elvand-Lie
mcp: add readonly guard tests for config mutation handlers
762cc09 
Signed-off-by: elvandlie@gmail.com <elvandlie@gmail.com>
@knative-prow knative-prow Bot added size/L 🤖 PR changes 100-499 lines, ignoring generated files. and removed size/S 🤖 PR changes 10-29 lines, ignoring generated files. labels May 12, 2026
@gauron99
Copy link
Copy Markdown
Contributor

gauron99 commented May 15, 2026

/ok-to-test
/lgtm
/approve

@knative-prow knative-prow Bot added ok-to-test 🤖 Non-member PR verified by an org member that is safe to test. lgtm 🤖 PR is ready to be merged. and removed needs-ok-to-test 🤖 Needs an org member to approve testing labels May 15, 2026
@knative-prow
Copy link
Copy Markdown

knative-prow Bot commented May 15, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Elvand-Lie, gauron99

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@knative-prow knative-prow Bot added the approved 🤖 PR has been approved by an approver from all required OWNERS files. label May 15, 2026
@gauron99
Copy link
Copy Markdown
Contributor

gauron99 commented May 15, 2026

/hold for @lkingland input

@knative-prow knative-prow Bot added the do-not-merge/hold 🤖 PR should not merge because someone has issued a /hold command. label May 15, 2026
@gauron99
Copy link
Copy Markdown
Contributor

gauron99 commented May 15, 2026

/retest

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dsimansk dsimansk Awaiting requested review from dsimansk

@jrangelramos jrangelramos Awaiting requested review from jrangelramos

Assignees

@gauron99 gauron99

Labels

approved 🤖 PR has been approved by an approver from all required OWNERS files. do-not-merge/hold 🤖 PR should not merge because someone has issued a /hold command. lgtm 🤖 PR is ready to be merged. ok-to-test 🤖 Non-member PR verified by an org member that is safe to test. size/L 🤖 PR changes 100-499 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

mcp: config add/remove handlers bypass readonly guard

2 participants

@Elvand-Lie @gauron99