Exclude fn-config from owning function's input in fn render

api/kptfile/v1/types.go

@@ -338,9 +338,9 @@ type Function struct {
 	Exec string `yaml:"exec,omitempty" json:"exec,omitempty"`
 
 	// `ConfigPath` specifies a slash-delimited relative path to a file in the current directory
-	// containing a KRM resource used as the function config. This resource is
-	// excluded when resolving 'sources', and as a result cannot be operated on
-	// by the pipeline.
+	// containing a KRM resource used as the function config. The function will
+	// not see this resource in its input items — it is passed as configuration
+	// only. Other functions in the pipeline can still see and modify the file.
 	ConfigPath string `yaml:"configPath,omitempty" json:"configPath,omitempty"`
 
 	// `ConfigMap` is a convenient way to specify a function config of kind ConfigMap.

documentation/content/en/book/04-using-functions/_index.md

@@ -281,6 +281,8 @@ The `functionConfig` field is an optional meta resource containing the arguments
 
 The general way to provide a `functionConfig` of the arbitrary kind (core or custom resources) is to declare the resource in a separate file, in the same directory as the `Kptfile`, and refer to it using the `configPath` field.
 
+A function will not modify its own `configPath` resource. The resource is passed to the function as configuration only — it will not appear as one of the input resources that the function acts upon. Other functions in the pipeline can still see and modify the file.
+
 For example:
 
 ```yaml

documentation/content/en/reference/schema/kptfile/kptfile.json

@@ -49,7 +49,7 @@
           "x-go-name": "ConfigMap"
         },
         "configPath": {
-          "description": "`ConfigPath` specifies a slash-delimited relative path to a file in the current directory\ncontaining a KRM resource used as the function config. This resource is\nexcluded when resolving 'sources', and as a result cannot be operated on\nby the pipeline.",
+          "description": "`ConfigPath` specifies a slash-delimited relative path to a file in the current directory\ncontaining a KRM resource used as the function config. The function will\nnot see this resource in its input items — it is passed as configuration\nonly. Other functions in the pipeline can still see and modify the file.",
           "type": "string",
           "x-go-name": "ConfigPath"
         },

documentation/content/en/reference/schema/kptfile/kptfile.yaml

@@ -28,9 +28,9 @@ definitions:
             configPath:
                 description: |-
                     `ConfigPath` specifies a slash-delimited relative path to a file in the current directory
-                    containing a KRM resource used as the function config. This resource is
-                    excluded when resolving 'sources', and as a result cannot be operated on
-                    by the pipeline.
+                    containing a KRM resource used as the function config. The function will
+                    not see this resource in its input items — it is passed as configuration
+                    only. Other functions in the pipeline can still see and modify the file.
                 type: string
                 x-go-name: ConfigPath
             exclude:

e2e/testdata/fn-render/fnconfig-ancestorfn-not-mutate-subpkg-config/.expected/diff.patch

@@ -1,5 +1,5 @@
 diff --git a/Kptfile b/Kptfile
-index 8d8916e..67d2002 100644
+index 8d8916e..af76fa0 100644
 --- a/Kptfile
 +++ b/Kptfile
 @@ -7,3 +7,22 @@ pipeline:
@@ -16,7 +16,7 @@ index 8d8916e..67d2002 100644
 +      - image: ghcr.io/kptdev/krm-functions-catalog/set-labels:latest
 +        exitCode: 0
 +        results:
-+          - message: set 4 labels in total
++          - message: set 3 labels in total
 +            severity: info
 +      - image: ghcr.io/kptdev/krm-functions-catalog/set-namespace:latest
 +        exitCode: 0
@@ -39,15 +39,13 @@ index f4f3c67..456cee5 100644
    mutators:
      - image: ghcr.io/kptdev/krm-functions-catalog/set-labels:latest
 diff --git a/db/labelconfig.yaml b/db/labelconfig.yaml
-index 22d2de2..f4d597f 100644
+index 22d2de2..3c63796 100644
 --- a/db/labelconfig.yaml
 +++ b/db/labelconfig.yaml
-@@ -15,5 +15,8 @@ apiVersion: v1
+@@ -15,5 +15,6 @@ apiVersion: v1
  kind: ConfigMap
  metadata:
    name: label-config
-+  labels:
-+    tier: db
 +  namespace: staging
  data:
    tier: db

e2e/testdata/fn-render/fnconfig-in-subdir/.expected/diff.patch

@@ -1,5 +1,5 @@
 diff --git a/Kptfile b/Kptfile
-index f244e01..9f79949 100644
+index f244e01..7de4df7 100644
 --- a/Kptfile
 +++ b/Kptfile
 @@ -2,7 +2,21 @@ apiVersion: kpt.dev/v1
@@ -22,20 +22,8 @@ index f244e01..9f79949 100644
 +      - image: ghcr.io/kptdev/krm-functions-catalog/set-labels:latest
 +        exitCode: 0
 +        results:
-+          - message: set 5 labels in total
++          - message: set 4 labels in total
 +            severity: info
-diff --git a/db/labelconfig.yaml b/db/labelconfig.yaml
-index 22d2de2..19e0746 100644
---- a/db/labelconfig.yaml
-+++ b/db/labelconfig.yaml
-@@ -15,5 +15,7 @@ apiVersion: v1
- kind: ConfigMap
- metadata:
-   name: label-config
-+  labels:
-+    tier: db
- data:
-   tier: db
 diff --git a/resources.yaml b/resources.yaml
 index f2eec52..8ea86f0 100644
 --- a/resources.yaml

e2e/testdata/fn-render/fnconfig-pkgfn-refers-subdir/.expected/diff.patch

@@ -1,5 +1,5 @@
 diff --git a/Kptfile b/Kptfile
-index 34f24da..f5bcf7c 100644
+index 34f24da..ba374a1 100644
 --- a/Kptfile
 +++ b/Kptfile
 @@ -2,7 +2,21 @@ apiVersion: kpt.dev/v1
@@ -22,20 +22,8 @@ index 34f24da..f5bcf7c 100644
 +      - image: ghcr.io/kptdev/krm-functions-catalog/set-labels:latest
 +        exitCode: 0
 +        results:
-+          - message: set 5 labels in total
++          - message: set 4 labels in total
 +            severity: info
-diff --git a/confs/labelconfig.yaml b/confs/labelconfig.yaml
-index 22d2de2..19e0746 100644
---- a/confs/labelconfig.yaml
-+++ b/confs/labelconfig.yaml
-@@ -15,5 +15,7 @@ apiVersion: v1
- kind: ConfigMap
- metadata:
-   name: label-config
-+  labels:
-+    tier: db
- data:
-   tier: db
 diff --git a/resources.yaml b/resources.yaml
 index f2eec52..8ea86f0 100644
 --- a/resources.yaml

e2e/testdata/fn-render/fnconfig/.expected/diff.patch

@@ -1,5 +1,5 @@
 diff --git a/Kptfile b/Kptfile
-index cd1b1e5..a14e2ce 100644
+index cd1b1e5..fa0fdfa 100644
 --- a/Kptfile
 +++ b/Kptfile
 @@ -2,6 +2,8 @@ apiVersion: kpt.dev/v1
@@ -44,7 +44,7 @@ index cd1b1e5..a14e2ce 100644
 +      - image: ghcr.io/kptdev/krm-functions-catalog/set-labels:latest
 +        exitCode: 0
 +        results:
-+          - message: set 8 labels in total
++          - message: set 7 labels in total
 +            severity: info
 diff --git a/db/Kptfile b/db/Kptfile
 index a0e6f2d..5e0e30a 100644
@@ -79,16 +79,14 @@ index dabe43c..25f77c1 100644
 +      app: backend
 +      tier: db
 diff --git a/labelconfig.yaml b/labelconfig.yaml
-index 22d2de2..8712cbf 100644
+index 22d2de2..3c63796 100644
 --- a/labelconfig.yaml
 +++ b/labelconfig.yaml
-@@ -15,5 +15,8 @@ apiVersion: v1
+@@ -15,5 +15,6 @@ apiVersion: v1
  kind: ConfigMap
  metadata:
    name: label-config
 +  namespace: staging
-+  labels:
-+    tier: db
  data:
    tier: db
 diff --git a/resources.yaml b/resources.yaml

e2e/testdata/fn-render/modify-path-annotation/.expected/diff.patch

@@ -23,15 +23,3 @@ diff --git a/deployment.yaml b/newfilename.yaml
 similarity index 100%
 rename from deployment.yaml
 rename to newfilename.yaml
-diff --git a/starlark-fn.yaml b/starlark-fn.yaml
-index 247c2ae..0ef906e 100644
---- a/starlark-fn.yaml
-+++ b/starlark-fn.yaml
-@@ -11,7 +11,6 @@
- # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- # See the License for the specific language governing permissions and
- # limitations under the License.
--
- apiVersion: fn.kpt.dev/v1alpha1
- kind: StarlarkRun
- metadata:

pkg/lib/kptops/render_executor.go

@@ -765,11 +765,13 @@ func (pn *pkgNode) runMutators(ctx context.Context, hctx *hydrationContext, inpu
 	for i, mutator := range mutators {
 		resultCountBeforeExec := len(hctx.fnResults.Items)
 
+		// Identify the fn-config resource for the current mutator.
+		// If found, refresh the FunctionRunner's config reference (it may
+		// have been mutated by a preceding function) and exclude it from
+		// the function's input items. A function should only receive its
+		// config via resourceList.functionConfig, not in resourceList.items.
+		var fnConfigNode *yaml.RNode
 		if pl.Mutators[i].ConfigPath != "" {
-			// functionConfigs are included in the function inputs during `render`
-			// and as a result, they can be mutated during the `render`.
-			// So functionConfigs needs be updated in the FunctionRunner instance
-			// before every run.
 			for _, r := range input {
 				pkgPath, err := pkg.GetPkgPathAnnotation(r)
 				if err != nil {
@@ -779,14 +781,23 @@ func (pn *pkgNode) runMutators(ctx context.Context, hctx *hydrationContext, inpu
 				if err != nil {
 					return nil, err
 				}
-				if pkgPath == pn.pkg.UniquePath.String() && // resource belong to current package
+				if pkgPath == pn.pkg.UniquePath.String() && // resource belongs to current package
 					currPath == pl.Mutators[i].ConfigPath { // configPath matches
 					mutator.SetFnConfig(r)
-					continue
+					fnConfigNode = r
+					break
 				}
 			}
 		}
 
+		// Remove fn-config from input before passing to the function.
+		// We'll add it back unmodified after execution.
+		if fnConfigNode != nil {
+			input = slices.DeleteFunc(input, func(node *yaml.RNode) bool {
+				return node == fnConfigNode
+			})
+		}
+
 		selectors := pl.Mutators[i].Selectors
 		exclusions := pl.Mutators[i].Exclusions
 
@@ -813,6 +824,9 @@ func (pn *pkgNode) runMutators(ctx context.Context, hctx *hydrationContext, inpu
 		}
 		err = mutation.Execute()
 		if err != nil {
+			if fnConfigNode != nil {
+				input = append(input, fnConfigNode)
+			}
 			clearAnnotationsOnMutFailure(input)
 			hctx.mutationSteps = append(hctx.mutationSteps, captureStepResult(pl.Mutators[i], hctx.fnResults, resultCountBeforeExec, err))
 			return input, err
@@ -831,6 +845,12 @@ func (pn *pkgNode) runMutators(ctx context.Context, hctx *hydrationContext, inpu
 		} else {
 			input = output.Nodes
 		}
+
+		// Add fn-config back unmodified so it remains in the resource list
+		// for subsequent functions and is not pruned from disk.
+		if fnConfigNode != nil {
+			input = append(input, fnConfigNode)
+		}
 	}
 	return input, nil
 }
@@ -852,25 +872,24 @@ func (pn *pkgNode) runValidators(ctx context.Context, hctx *hydrationContext, in
 	for i := range pl.Validators {
 		function := pl.Validators[i]
 		resultCountBeforeExec := len(hctx.fnResults.Items)
-		// validators are run on a copy of mutated resources to ensure
-		// resources are not mutated.
-		selectedResources, err := fnruntime.SelectInput(input, function.Selectors, function.Exclusions, &fnruntime.SelectionContext{RootPackagePath: hctx.root.pkg.UniquePath})
+
+		validatorInput := validatorInputWithoutOwnFnConfig(input, function.ConfigPath, pn.pkg.UniquePath.String())
+
+		selectedResources, err := fnruntime.SelectInput(
+			validatorInput, function.Selectors, function.Exclusions,
+			&fnruntime.SelectionContext{RootPackagePath: hctx.root.pkg.UniquePath})
 		if err != nil {
 			return err
 		}
-		var validator kio.Filter
-		displayResourceCount := false
-		if len(function.Selectors) > 0 || len(function.Exclusions) > 0 {
-			displayResourceCount = true
-		}
+		displayResourceCount := len(function.Selectors) > 0 || len(function.Exclusions) > 0
 		if function.Exec != "" && !hctx.runnerOptions.AllowExec {
 			hctx.validationSteps = append(hctx.validationSteps, preExecFailureStep(function, errAllowedExecNotSpecified))
 			return errAllowedExecNotSpecified
 		}
 		opts := hctx.runnerOptions
 		opts.SetPkgPathAnnotation = true
 		opts.DisplayResourceCount = displayResourceCount
-		validator, err = fnruntime.NewRunner(ctx, hctx.fileSystem, &function, pn.pkg.UniquePath, hctx.fnResults, opts, hctx.runtime)
+		validator, err := fnruntime.NewRunner(ctx, hctx.fileSystem, &function, pn.pkg.UniquePath, hctx.fnResults, opts, hctx.runtime)
 		if err != nil {
 			hctx.validationSteps = append(hctx.validationSteps, preExecFailureStep(function, err))
 			return err
@@ -885,6 +904,31 @@ func (pn *pkgNode) runValidators(ctx context.Context, hctx *hydrationContext, in
 	return nil
 }
 
+// validatorInputWithoutOwnFnConfig returns a copy of input with the fn-config resource removed
+// if configPath is non-empty and a matching resource is found. If no match is found
+// or configPath is empty, the original input is returned unmodified.
+func validatorInputWithoutOwnFnConfig(input []*yaml.RNode, configPath string, pkgUniquePath string) []*yaml.RNode {
+	if configPath == "" {
+		return input
+	}
+	for _, r := range input {
+		pkgPath, err := pkg.GetPkgPathAnnotation(r)
+		if err != nil {
+			return input
+		}
+		currPath, _, err := kioutil.GetFileAnnotations(r)
+		if err != nil {
+			return input
+		}
+		if pkgPath == pkgUniquePath && currPath == configPath {
+			return slices.DeleteFunc(slices.Clone(input), func(node *yaml.RNode) bool {
+				return node == r
+			})
+		}
+	}
+	return input
+}
+
 func cloneResources(input []*yaml.RNode) (output []*yaml.RNode) {
 	for _, resource := range input {
 		output = append(output, resource.Copy())