mcp: config add/remove handlers bypass readonly guard
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
Research direction
Start at the six named config mutation handlers and compare their control flow with the existing deploy and delete handlers. Add consistent readonly behavior to each config add/remove entry point, then verify that all six refuse changes when s.readonly is enabled and continue to allow them otherwise.
Written by the indexing model from the issue text.
Description
Bug
The deploy and delete handlers check s.readonly and refuse to act when the server is in readonly mode:
if s.readonly {
err = fmt.Errorf("the server is currently in readonly mode...")
return
}
However, the six config mutation handlers have no such guard:
configEnvsAddHandlerconfigEnvsRemoveHandlerconfigLabelsAddHandlerconfigLabelsRemoveHandlerconfigVolumesAddHandlerconfigVolumesRemoveHandler
These tools are annotated with ReadOnlyHint: false and some with DestructiveHint: ptr(true), correctly declaring them as mutative, but the handlers execute unconditionally regardless of s.readonly.
Impact
In readonly mode, an AI agent can freely modify func.yaml by adding or removing environment variables, labels, and volumes. This directly contradicts the purpose of readonly mode.
Fix
Add the same s.readonly guard to all six config mutation handlers, consistent with the deploy and delete handlers.
- Dominant language
- Go
- Stars
- 365
- Forks
- 223
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 25
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from knative/func
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
lifecycle/stale
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
setServiceOptions: %f format produces invalid autoscaling annotation values with trailing zeros Openlifecycle/stale
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 84/100
-
enhancement needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
kind/cleanup
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
kubernetes-sigs/kueue#15947 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
sympozium-ai/sympozium#627 ·
-
priority: p3
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
googleapis/librarian#7636 ·