vector validate --no-environment skips template confinement check

[thomasqueirozb]

A note for the community

• Please vote on this issue by adding a 👍 reaction to the original issue to help the maintainers prioritize
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

A clear and concise description of the bug

The template path-confinement check introduced in #25820 (fix(sinks)!: confine routing-field templates to prevent injection) only runs during the component-build phase of vector validate. That phase is gated behind the environment checks, so vector validate --no-environment silently passes configurations that will fail to boot.

Confinement is a purely static, environment-independent validation — it is lexical analysis of the template string and needs no filesystem, network, or credentials. But because it lives in SinkConfig::build() (e.g. src/sinks/aws_s3/config.rs:279, key_prefix.confine(...)), and that build path is only reached via validate_environment → validate_components, it is skipped whenever --no-environment is passed (src/validate.rs:172).

Impact: vector validate --no-environment is a common pre-flight/CI check meant to catch config errors without touching the runtime environment. Today it reports a confinement-violating config as valid, and the operator only discovers the error when Vector crash-loops at boot (ERROR vector::topology::builder: Configuration error ... has no literal string prefix to derive a confinement base from). This was hit for real in the helm-charts 0.57.0 release CI.

Configuration

data_dir: /tmp
healthchecks:
  enabled: false
sources:
  generator:
    type: demo_logs
    format: json
sinks:
  s3:
    type: aws_s3
    inputs: [generator]
    bucket: logs-archive
    # Starts with an event-field reference and has no literal prefix -> unconfined.
    key_prefix: '{{kubernetes.pod_name}}/%Y/%m/%d/'
    compression: gzip
    encoding:
      codec: json
    region: us-east-1

Version

vector 0.57.0

Debug output

# vector validate --no-environment --config-yaml config.yaml
√ Loaded ["config.yaml"]
√ Transforms configuration
------------------------------------
                           Validated       # <-- WRONG: passes

# vector validate --config-yaml config.yaml   (default, environment checks on)
√ Loaded ["config.yaml"]
√ Transforms configuration
Component errors
----------------
x Sink "s3": template references event fields (...) but has no literal string prefix
  to derive a confinement base from. ...

# vector --config-yaml config.yaml            (actual boot)
ERROR vector::topology::builder: Configuration error. error=Sink "s3": template
references event fields (...) but has no literal string prefix to derive a
confinement base from. ...

Example Data

No response

Additional Context

Reproduced against docker.io/timberio/vector:0.57.0-distroless-libc.

Suggested fix

Move (or additionally run) the template-confinement validation into an environment-independent phase of vector validate — e.g. alongside validate_transforms / the config-load phase — so vector validate --no-environment catches it. The check requires no environment access, so gating it behind !opts.no_environment is unnecessary and surprising.

References

• fix(sinks)!: confine routing-field templates to prevent injection #25820 (introduced the confinement check)
• fix(sinks): confinement follow-ups from #25820 codex review #25830 (confinement follow-ups)

Component(s)

sink: aws_s3 (and all sinks/sources using routing-field template confinement)

Confirmation

• I have searched the issues and this is a new bug report.