Exclude fn-config from owning function's input in fn render

Signed-off-by: Aravindhan Ayyanathan <aravindhan.a@est.tech>

Author: aravindtga

api/kptfile/v1/types.go

@@ -338,9 +338,9 @@ type Function struct {
 	Exec string `yaml:"exec,omitempty" json:"exec,omitempty"`
 
 	// `ConfigPath` specifies a slash-delimited relative path to a file in the current directory
-	// containing a KRM resource used as the function config. This resource is
-	// excluded when resolving 'sources', and as a result cannot be operated on
-	// by the pipeline.
+	// containing a KRM resource used as the function config. The function will
+	// not see this resource in its input items — it is passed as configuration
+	// only. Other functions in the pipeline can still see and modify the file.
 	ConfigPath string `yaml:"configPath,omitempty" json:"configPath,omitempty"`
 
 	// `ConfigMap` is a convenient way to specify a function config of kind ConfigMap.

documentation/content/en/book/04-using-functions/_index.md

@@ -281,6 +281,8 @@ The `functionConfig` field is an optional meta resource containing the arguments
 
 The general way to provide a `functionConfig` of the arbitrary kind (core or custom resources) is to declare the resource in a separate file, in the same directory as the `Kptfile`, and refer to it using the `configPath` field.
 
+A function will not modify its own `configPath` resource. The resource is passed to the function as configuration only — it will not appear as one of the input resources that the function acts upon. Other functions in the pipeline can still see and modify the file.
+
 For example:
 
 ```yaml

e2e/testdata/fn-render/fnconfig-ancestorfn-not-mutate-subpkg-config/.expected/diff.patch

@@ -1,5 +1,5 @@
 diff --git a/Kptfile b/Kptfile
-index 8d8916e..67d2002 100644
+index 8d8916e..af76fa0 100644
 --- a/Kptfile
 +++ b/Kptfile
 @@ -7,3 +7,22 @@ pipeline:
@@ -16,7 +16,7 @@ index 8d8916e..67d2002 100644
 +      - image: ghcr.io/kptdev/krm-functions-catalog/set-labels:latest
 +        exitCode: 0
 +        results:
-+          - message: set 4 labels in total
++          - message: set 3 labels in total
 +            severity: info
 +      - image: ghcr.io/kptdev/krm-functions-catalog/set-namespace:latest
 +        exitCode: 0
@@ -39,15 +39,13 @@ index f4f3c67..456cee5 100644
    mutators:
      - image: ghcr.io/kptdev/krm-functions-catalog/set-labels:latest
 diff --git a/db/labelconfig.yaml b/db/labelconfig.yaml
-index 22d2de2..f4d597f 100644
+index 22d2de2..3c63796 100644
 --- a/db/labelconfig.yaml
 +++ b/db/labelconfig.yaml
-@@ -15,5 +15,8 @@ apiVersion: v1
+@@ -15,5 +15,6 @@ apiVersion: v1
  kind: ConfigMap
  metadata:
    name: label-config
-+  labels:
-+    tier: db
 +  namespace: staging
  data:
    tier: db

e2e/testdata/fn-render/fnconfig-in-subdir/.expected/diff.patch

@@ -1,5 +1,5 @@
 diff --git a/Kptfile b/Kptfile
-index f244e01..9f79949 100644
+index f244e01..7de4df7 100644
 --- a/Kptfile
 +++ b/Kptfile
 @@ -2,7 +2,21 @@ apiVersion: kpt.dev/v1
@@ -22,20 +22,8 @@ index f244e01..9f79949 100644
 +      - image: ghcr.io/kptdev/krm-functions-catalog/set-labels:latest
 +        exitCode: 0
 +        results:
-+          - message: set 5 labels in total
++          - message: set 4 labels in total
 +            severity: info
-diff --git a/db/labelconfig.yaml b/db/labelconfig.yaml
-index 22d2de2..19e0746 100644
---- a/db/labelconfig.yaml
-+++ b/db/labelconfig.yaml
-@@ -15,5 +15,7 @@ apiVersion: v1
- kind: ConfigMap
- metadata:
-   name: label-config
-+  labels:
-+    tier: db
- data:
-   tier: db
 diff --git a/resources.yaml b/resources.yaml
 index f2eec52..8ea86f0 100644
 --- a/resources.yaml

e2e/testdata/fn-render/fnconfig-pkgfn-refers-subdir/.expected/diff.patch

@@ -1,5 +1,5 @@
 diff --git a/Kptfile b/Kptfile
-index 34f24da..f5bcf7c 100644
+index 34f24da..ba374a1 100644
 --- a/Kptfile
 +++ b/Kptfile
 @@ -2,7 +2,21 @@ apiVersion: kpt.dev/v1
@@ -22,20 +22,8 @@ index 34f24da..f5bcf7c 100644
 +      - image: ghcr.io/kptdev/krm-functions-catalog/set-labels:latest
 +        exitCode: 0
 +        results:
-+          - message: set 5 labels in total
++          - message: set 4 labels in total
 +            severity: info
-diff --git a/confs/labelconfig.yaml b/confs/labelconfig.yaml
-index 22d2de2..19e0746 100644
---- a/confs/labelconfig.yaml
-+++ b/confs/labelconfig.yaml
-@@ -15,5 +15,7 @@ apiVersion: v1
- kind: ConfigMap
- metadata:
-   name: label-config
-+  labels:
-+    tier: db
- data:
-   tier: db
 diff --git a/resources.yaml b/resources.yaml
 index f2eec52..8ea86f0 100644
 --- a/resources.yaml

e2e/testdata/fn-render/fnconfig/.expected/diff.patch

@@ -1,5 +1,5 @@
 diff --git a/Kptfile b/Kptfile
-index cd1b1e5..a14e2ce 100644
+index cd1b1e5..fa0fdfa 100644
 --- a/Kptfile
 +++ b/Kptfile
 @@ -2,6 +2,8 @@ apiVersion: kpt.dev/v1
@@ -44,7 +44,7 @@ index cd1b1e5..a14e2ce 100644
 +      - image: ghcr.io/kptdev/krm-functions-catalog/set-labels:latest
 +        exitCode: 0
 +        results:
-+          - message: set 8 labels in total
++          - message: set 7 labels in total
 +            severity: info
 diff --git a/db/Kptfile b/db/Kptfile
 index a0e6f2d..5e0e30a 100644
@@ -79,16 +79,14 @@ index dabe43c..25f77c1 100644
 +      app: backend
 +      tier: db
 diff --git a/labelconfig.yaml b/labelconfig.yaml
-index 22d2de2..8712cbf 100644
+index 22d2de2..3c63796 100644
 --- a/labelconfig.yaml
 +++ b/labelconfig.yaml
-@@ -15,5 +15,8 @@ apiVersion: v1
+@@ -15,5 +15,6 @@ apiVersion: v1
  kind: ConfigMap
  metadata:
    name: label-config
 +  namespace: staging
-+  labels:
-+    tier: db
  data:
    tier: db
 diff --git a/resources.yaml b/resources.yaml

e2e/testdata/fn-render/modify-path-annotation/.expected/diff.patch

@@ -23,15 +23,3 @@ diff --git a/deployment.yaml b/newfilename.yaml
 similarity index 100%
 rename from deployment.yaml
 rename to newfilename.yaml
-diff --git a/starlark-fn.yaml b/starlark-fn.yaml
-index 247c2ae..0ef906e 100644
---- a/starlark-fn.yaml
-+++ b/starlark-fn.yaml
-@@ -11,7 +11,6 @@
- # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- # See the License for the specific language governing permissions and
- # limitations under the License.
--
- apiVersion: fn.kpt.dev/v1alpha1
- kind: StarlarkRun
- metadata:

pkg/lib/kptops/render_executor.go

@@ -765,11 +765,13 @@ func (pn *pkgNode) runMutators(ctx context.Context, hctx *hydrationContext, inpu
 	for i, mutator := range mutators {
 		resultCountBeforeExec := len(hctx.fnResults.Items)
 
+		// Identify the fn-config resource for the current mutator.
+		// If found, refresh the FunctionRunner's config reference (it may
+		// have been mutated by a preceding function) and exclude it from
+		// the function's input items. A function should only receive its
+		// config via resourceList.functionConfig, not in resourceList.items.
+		var fnConfigNode *yaml.RNode
 		if pl.Mutators[i].ConfigPath != "" {
-			// functionConfigs are included in the function inputs during `render`
-			// and as a result, they can be mutated during the `render`.
-			// So functionConfigs needs be updated in the FunctionRunner instance
-			// before every run.
 			for _, r := range input {
 				pkgPath, err := pkg.GetPkgPathAnnotation(r)
 				if err != nil {
@@ -779,14 +781,23 @@ func (pn *pkgNode) runMutators(ctx context.Context, hctx *hydrationContext, inpu
 				if err != nil {
 					return nil, err
 				}
-				if pkgPath == pn.pkg.UniquePath.String() && // resource belong to current package
+				if pkgPath == pn.pkg.UniquePath.String() && // resource belongs to current package
 					currPath == pl.Mutators[i].ConfigPath { // configPath matches
 					mutator.SetFnConfig(r)
-					continue
+					fnConfigNode = r
+					break
 				}
 			}
 		}
 
+		// Remove fn-config from input before passing to the function.
+		// We'll add it back unmodified after execution.
+		if fnConfigNode != nil {
+			input = slices.DeleteFunc(input, func(node *yaml.RNode) bool {
+				return node == fnConfigNode
+			})
+		}
+
 		selectors := pl.Mutators[i].Selectors
 		exclusions := pl.Mutators[i].Exclusions
 
@@ -813,6 +824,9 @@ func (pn *pkgNode) runMutators(ctx context.Context, hctx *hydrationContext, inpu
 		}
 		err = mutation.Execute()
 		if err != nil {
+			if fnConfigNode != nil {
+				input = append(input, fnConfigNode)
+			}
 			clearAnnotationsOnMutFailure(input)
 			hctx.mutationSteps = append(hctx.mutationSteps, captureStepResult(pl.Mutators[i], hctx.fnResults, resultCountBeforeExec, err))
 			return input, err
@@ -831,6 +845,12 @@ func (pn *pkgNode) runMutators(ctx context.Context, hctx *hydrationContext, inpu
 		} else {
 			input = output.Nodes
 		}
+
+		// Add fn-config back unmodified so it remains in the resource list
+		// for subsequent functions and is not pruned from disk.
+		if fnConfigNode != nil {
+			input = append(input, fnConfigNode)
+		}
 	}
 	return input, nil
 }
@@ -852,9 +872,33 @@ func (pn *pkgNode) runValidators(ctx context.Context, hctx *hydrationContext, in
 	for i := range pl.Validators {
 		function := pl.Validators[i]
 		resultCountBeforeExec := len(hctx.fnResults.Items)
+
+		// Exclude the validator's own fn-config from its input items.
+		validatorInput := input
+		if function.ConfigPath != "" {
+			for _, r := range input {
+				pkgPath, err := pkg.GetPkgPathAnnotation(r)
+				if err != nil {
+					return err
+				}
+				currPath, _, err := kioutil.GetFileAnnotations(r)
+				if err != nil {
+					return err
+				}
+				if pkgPath == pn.pkg.UniquePath.String() &&
+					currPath == function.ConfigPath {
+					// Create a filtered copy without the fn-config
+					validatorInput = slices.DeleteFunc(slices.Clone(input), func(node *yaml.RNode) bool {
+						return node == r
+					})
+					break
+				}
+			}
+		}
+
 		// validators are run on a copy of mutated resources to ensure
 		// resources are not mutated.
-		selectedResources, err := fnruntime.SelectInput(input, function.Selectors, function.Exclusions, &fnruntime.SelectionContext{RootPackagePath: hctx.root.pkg.UniquePath})
+		selectedResources, err := fnruntime.SelectInput(validatorInput, function.Selectors, function.Exclusions, &fnruntime.SelectionContext{RootPackagePath: hctx.root.pkg.UniquePath})
 		if err != nil {
 			return err
 		}