Tell user if a duplicate "extracted" tag is seen

[squaremo]

With regexp filtering, it's possible to extract a value from each tag for the policy to consider. This is to cover a use case like giving all your tags dev-<version>, where you want the latest version but only from tags with dev-.

This creates the possibility of duplicates: if you had a pattern (dev-)?v(<version>) for example, you might extract the same value from both dev-v1.0 and v1.0. This makes behaviour unpredictable, since the tag selected by the policy may depend on the order the original tags are encountered.

[relu]

I think the way to do this would be through two non-excluding options:

1. Log it from the controller
2. Emit an event on the ImagePolicy resource

Do you have something else in mind?

[squaremo]

The sort can be made stable by sorting on the original (un-extracted) tag when there are duplicate extracted tags. That would at least remove non-determinism, i.e., it wouldn't flip-flop from one tag to another. But it does mean that one tag is chosen arbitrarily over others, and there will be many situations where that's effectively a silent failure.

I would think duplication will usually result from a mistake in the specification -- perhaps you didn't mean to admit both dev-v1.0 and v1.0, or your filter pattern didn't anticipate some tags which arrive later. In that case the most useful thing for the controller to do is mark the policy with an error condition, presumably triggering an alert or otherwise getting the attention of a human who can sort it out.

In some situations, it doesn't matter which of dev-v1.0 and v1.0 is chosen -- but I would think these are in the minority, and anyway impossible for the controller to detect. So I would default to using the error condition.

The question then is "How does the error condition get resolved?". In general the controller doesn't know whether there's an updated specification, or new tags. So it would be possible for it to skip over an image because it's ambiguous, and use a newer image. The alternative is to go into an error state if any of the extracted tags are duplicates, which might be going too far (e.g., it might mean you can't get out of the error state without deleting old, ambiguous tags :-(.