feat: make layers with label prefix "pebble-" reserved

internals/overlord/planstate/manager.go

@@ -208,8 +208,10 @@ func (m *PlanManager) SetServiceArgs(serviceArgs map[string][]string) error {
 	defer m.planLock.Unlock()
 
 	newLayer := &plan.Layer{
-		// Labels with "pebble-*" prefix are (will be) reserved, see:
+		// Labels with "pebble-*" prefix are reserved, see:
 		// https://github.com/canonical/pebble/issues/220
+		// Validation for layer labels has been added, so after so after creating the
+		// Layer directly (not parsing from raw data), it won't need to be validated.
 		Label:    "pebble-service-args",
 		Services: make(map[string]*plan.Service),
 	}
@@ -229,10 +231,5 @@ func (m *PlanManager) SetServiceArgs(serviceArgs map[string][]string) error {
 		}
 	}
 
-	err := newLayer.Validate()
-	if err != nil {
-		return err
-	}
-
 	return m.appendLayer(newLayer)
 }

internals/plan/plan.go

@@ -819,6 +819,12 @@ func (layer *Layer) Validate() error {
 		}
 	}
 
+	if strings.HasPrefix(layer.Label, "pebble-") {
+		return &FormatError{
+			Message: fmt.Sprintf("cannot use reserved layer label %q", layer.Label),
+		}
+	}
+
 	return nil
 }
 

internals/plan/plan_test.go

@@ -1933,3 +1933,9 @@ func (s *S) TestMergeServiceContextOverrides(c *C) {
 		WorkingDir:  "/working/dir",
 	})
 }
+
+func (s *S) TestParseLayerReservedLabel(c *C) {
+	// Validate fails if layer label has the reserved prefix "pebble-"
+	_, err := plan.ParseLayer(0, "pebble-service-args", []byte("{}"))
+	c.Check(err, ErrorMatches, `cannot use reserved layer label "pebble-service-args"`)
+}