Support enabling network access when using `kpt fn run --image`

[dflemstr]

Since there is no place to declare function behavior in this situation, I would suggest supporting a command-line flag for enabling access.

Maybe we could trust --network ultimately in case --image is already set?

[pwittrock]

@phanimarupaka I think this may already be supported, would you confirm?

[phanimarupaka]

@dflemstr This feature is already supported in kpt. You can find the usage by running "kpt fn run -h" and scroll though flags section.

[dflemstr]

Thanks for getting back to me! I saw the flags in that section, but despite that I keep getting errors.

Some examples:

# A simple kpt function that simply pipes objects to kubeval
$ kpt fn source ... | kpt fn run --network --image gcr.io/spotify-declarative-infra/kubeval
ERR  - stdin: Failed initalizing schema https://...: Get https://...: dial tcp: lookup kubernetesjsonschema.dev on 1.1.1.1:53: dial udp 1.1.1.1:53: connect: network is unreachable

Adding --network-name doesn't make a difference.

However, running the exact same function with this config works:

apiVersion: v1
kind: ConfigMap
metadata:
  name: kpt-fn-2
  annotations:
    config.k8s.io/function: |
      container:
        image: gcr.io/spotify-declarative-infra/kubeval
        network:
          required: true

The image is private, let me know if I should create a test case that can be reproduced publicly.

[pwittrock]

@phanimarupaka ideas?

[pwittrock]

The issue is that network is only enabled if the function requests. This is possible for declarative functions, but not for ones specified on the cli. There is a TODO for this:

https://github.com/kubernetes-sigs/kustomize/blob/master/cmd/config/internal/commands/run-fns.go#L85

The solution is to add request for network on line 89.

if r.Network {
    err = fn.PipeE(
        yaml.LookupCreate(yaml.MappingNode, "container", "network"),
        yaml.SetField("required", yaml.NewScalarRNode("true")))
    if err != nil {
        return nil, err
    }
}

[phanimarupaka]

@dflemstr The issue has been fixed in the new release. Can you please pull the latest kpt version and check if the issue is resolved. Thanks for your patience.

[dflemstr]

Yes, I can confirm that the issue is now fixed!