Consolidate feature flags into a single registry

cmd/executor/cmd/root.go

@@ -123,6 +123,7 @@ var RootCmd = &cobra.Command{
 			if err := logging.Configure(logLevel, logFormat, logTimestamp); err != nil {
 				return err
 			}
+			config.LogFeatureFlags()
 
 			ValidateFlags(opts)
 
@@ -212,7 +213,7 @@ var RootCmd = &cobra.Command{
 		if err := os.Chdir("/"); err != nil {
 			exit(fmt.Errorf("error changing to root dir: %w", err))
 		}
-		if opts.Cleanup && config.EnvBoolDefault("FF_KANIKO_CLEAN_KANIKO_DIR", true) {
+		if opts.Cleanup && config.FF.CleanKanikoDir {
 			defer func() {
 				if err := config.Cleanup(); err != nil {
 					logrus.Warnf("error cleaning kaniko dir: %v", err)
@@ -403,7 +404,7 @@ func checkNoDeprecatedFlags() {
 		logrus.Warn("Flag --skip-unused-stages is deprecated. This is the new default behaviour. If you want to build multiple independent stages pass them as --target instead")
 	}
 
-	if !config.EnvBool("FF_KANIKO_DEPRECATE_INTER_STAGE_RESTORE") {
+	if !config.FF.DeprecateInterStageRestore {
 		if opts.PreserveContext && !opts.PreCleanup {
 			logrus.Warn("--preserve-context without --pre-cleanup restores the original context between stages; this is deprecated and will be removed. Use --mount=type=secret for secrets. Set FF_KANIKO_DEPRECATE_INTER_STAGE_RESTORE=1 to opt into the new behaviour now.")
 		}

cmd/warmer/cmd/root.go

@@ -58,6 +58,7 @@ var RootCmd = &cobra.Command{
 		if err := logging.Configure(logLevel, logFormat, logTimestamp); err != nil {
 			return err
 		}
+		config.LogFeatureFlags()
 
 		// Allow setting --registry-maps using an environment variable.
 		// some users use warmer with --regisry-mirror before v1.21.0

golden/golden_test.go

@@ -121,6 +121,10 @@ func TestRun(t *testing.T) {
 							for k, v := range test.Env {
 								t.Setenv(k, v)
 							}
+							// Feature flags resolve once at startup; re-resolve so
+							// this subtest's env takes effect, and restore afterwards.
+							config.InitFeatureFlags()
+							t.Cleanup(config.InitFeatureFlags)
 
 							opts := config.KanikoOptions{}
 							origNewLayerCache := executor.NewLayerCache

integration/images.go

@@ -347,6 +347,8 @@ var warmerOutputChecks = map[string]func(string, []byte) error{
 var expectedWarnings = map[string]string{
 	// mz640: COPY to /kaniko (ignored path) must warn rather than silently skip.
 	"Dockerfile_test_issue_mz560": "Skipping copy targeting kaniko directory",
+	// mz793: the test disables FF_KANIKO_VOLUME_SKIP_MKDIR, which the flag registry warns about.
+	"Dockerfile_test_issue_mz793": "feature flags explicitly disabled, please create an issue for your use-case: FF_KANIKO_VOLUME_SKIP_MKDIR",
 }
 
 func checkNoWarnings(dockerfile string, out []byte) error {

pkg/util/assert.go → pkg/assert/assert.go

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package util
+package assert
 
 import (
 	"os"

pkg/cache/cache.go

@@ -196,7 +196,7 @@ func LocalSource(opts *config.CacheOptions, cacheKey string) (v1.Image, error) {
 	}
 
 	logrus.Infof("Found %s in local cache", cacheKey)
-	if config.EnvBoolDefault("FF_KANIKO_OCI_WARMER", true) {
+	if config.FF.OCIWarmer {
 		return ociCachedImageFromPath(path)
 	} else {
 		return cachedImageFromPath(path)
@@ -218,7 +218,7 @@ func (c *cachedImage) Digest() (v1.Hash, error) {
 }
 
 func (c *cachedImage) Manifest() (*v1.Manifest, error) {
-	if config.EnvBool("FF_KANIKO_IGNORE_CACHED_MANIFEST") || c.mfst == nil {
+	if config.FF.IgnoreCachedManifest || c.mfst == nil {
 		return c.Image.Manifest()
 	}
 	return c.mfst, nil

pkg/commands/add.go

@@ -22,6 +22,7 @@ import (
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/moby/buildkit/frontend/dockerfile/instructions"
+	"github.com/osscontainertools/kaniko/pkg/assert"
 	kConfig "github.com/osscontainertools/kaniko/pkg/config"
 	"github.com/osscontainertools/kaniko/pkg/dockerfile"
 	"github.com/osscontainertools/kaniko/pkg/util"
@@ -246,7 +247,7 @@ func addCmdFilesUsedFromContext(config *v1.Config, buildArgs *dockerfile.BuildAr
 	}
 
 	// Remote URLs and tar archives are filtered out, so the result cannot exceed the source count.
-	util.Assert("add.files-count", len(files) <= len(srcs), "addCmdFilesUsedFromContext: result exceeds source count (srcs=%d, files=%d)", len(srcs), len(files))
+	assert.Assert("add.files-count", len(files) <= len(srcs), "addCmdFilesUsedFromContext: result exceeds source count (srcs=%d, files=%d)", len(srcs), len(files))
 	logrus.Infof("Using files from context: %v", files)
 	return files, nil
 }

pkg/commands/cmd.go

@@ -21,8 +21,8 @@ import (
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/moby/buildkit/frontend/dockerfile/instructions"
+	"github.com/osscontainertools/kaniko/pkg/assert"
 	"github.com/osscontainertools/kaniko/pkg/dockerfile"
-	"github.com/osscontainertools/kaniko/pkg/util"
 )
 
 type CmdCommand struct {
@@ -44,7 +44,7 @@ func (c *CmdCommand) ExecuteCommand(config *v1.Config, buildArgs *dockerfile.Bui
 		}
 
 		newCommand = append(shell, strings.Join(c.cmd.CmdLine, " "))
-		util.Assert("cmd.command-nonempty", len(newCommand) > 0, "CMD shell form produced an empty command")
+		assert.Assert("cmd.command-nonempty", len(newCommand) > 0, "CMD shell form produced an empty command")
 	} else {
 		newCommand = c.cmd.CmdLine
 	}

pkg/commands/copy.go

@@ -25,6 +25,7 @@ import (
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/moby/buildkit/frontend/dockerfile/instructions"
+	"github.com/osscontainertools/kaniko/pkg/assert"
 	kConfig "github.com/osscontainertools/kaniko/pkg/config"
 	"github.com/osscontainertools/kaniko/pkg/dockerfile"
 	"github.com/osscontainertools/kaniko/pkg/util"
@@ -58,7 +59,7 @@ func (c *CopyCommand) ExecuteCommand(config *v1.Config, buildArgs *dockerfile.Bu
 		}
 	} else {
 		user := config.User
-		if kConfig.EnvBool("FF_KANIKO_COPY_AS_ROOT") {
+		if kConfig.FF.CopyAsRoot {
 			// According to spec: https://docs.docker.com/reference/dockerfile/#copy---chown---chmod
 			//   All files and directories copied from the build context
 			//   are created with a default UID and GID of 0.
@@ -343,7 +344,7 @@ func copyCmdFilesUsedFromContext(
 		files = append(files, fullPath)
 	}
 
-	util.Assert("copy.files-count", len(files) <= len(srcs), "copyCmdFilesUsedFromContext: result cannot exceed source count (srcs=%d, files=%d)", len(srcs), len(files))
+	assert.Assert("copy.files-count", len(files) <= len(srcs), "copyCmdFilesUsedFromContext: result cannot exceed source count (srcs=%d, files=%d)", len(srcs), len(files))
 	logrus.Debugf("Using files from context: %v", files)
 
 	return files, nil

pkg/commands/env.go

@@ -37,7 +37,7 @@ func (e *EnvCommand) ExecuteCommand(config *v1.Config, buildArgs *dockerfile.Bui
 		return err
 	}
 	// 3344: An ENV declared after an ARG of the same name overrides it.
-	if kConfig.EnvBoolDefault("FF_KANIKO_BUILDKIT_ARG_ENV_PRECEDENCE", true) {
+	if kConfig.FF.BuildkitArgEnvPrecedence {
 		for _, keyVal := range newEnvs {
 			buildArgs.RemoveArg(keyVal.Key)
 		}

pkg/commands/expose.go

@@ -22,6 +22,7 @@ import (
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/moby/buildkit/frontend/dockerfile/instructions"
+	"github.com/osscontainertools/kaniko/pkg/assert"
 	"github.com/osscontainertools/kaniko/pkg/dockerfile"
 	"github.com/osscontainertools/kaniko/pkg/util"
 	"github.com/sirupsen/logrus"
@@ -53,7 +54,7 @@ func (r *ExposeCommand) ExecuteCommand(config *v1.Config, buildArgs *dockerfile.
 			p = p + "/tcp"
 		}
 		parts := strings.Split(p, "/")
-		util.Assert("expose.parts-count", len(parts) >= 2, "port string must contain '/' after normalization")
+		assert.Assert("expose.parts-count", len(parts) >= 2, "port string must contain '/' after normalization")
 		protocol := parts[1]
 		if !validProtocol(protocol) {
 			return fmt.Errorf("invalid protocol: %s", protocol)
@@ -62,7 +63,7 @@ func (r *ExposeCommand) ExecuteCommand(config *v1.Config, buildArgs *dockerfile.
 		existingPorts[p] = struct{}{}
 	}
 	config.ExposedPorts = existingPorts
-	util.Assert("expose.port-count-monotone", len(config.ExposedPorts) >= prevPortCount, "EXPOSE must not remove ports: count went from %d to %d", prevPortCount, len(config.ExposedPorts))
+	assert.Assert("expose.port-count-monotone", len(config.ExposedPorts) >= prevPortCount, "EXPOSE must not remove ports: count went from %d to %d", prevPortCount, len(config.ExposedPorts))
 	return nil
 }
 

pkg/commands/label.go

@@ -19,6 +19,7 @@ package commands
 import (
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/moby/buildkit/frontend/dockerfile/instructions"
+	"github.com/osscontainertools/kaniko/pkg/assert"
 	"github.com/osscontainertools/kaniko/pkg/dockerfile"
 	"github.com/osscontainertools/kaniko/pkg/util"
 	"github.com/sirupsen/logrus"
@@ -61,7 +62,7 @@ func updateLabels(labels []instructions.KeyValuePair, config *v1.Config, buildAr
 	}
 
 	config.Labels = existingLabels
-	util.Assert("label.count-monotone", len(config.Labels) >= prevLabelCount, "LABEL must not remove labels: count went from %d to %d", prevLabelCount, len(config.Labels))
+	assert.Assert("label.count-monotone", len(config.Labels) >= prevLabelCount, "LABEL must not remove labels: count went from %d to %d", prevLabelCount, len(config.Labels))
 	return nil
 }
 

pkg/commands/run.go

@@ -29,6 +29,7 @@ import (
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/moby/buildkit/frontend/dockerfile/instructions"
+	"github.com/osscontainertools/kaniko/pkg/assert"
 	kConfig "github.com/osscontainertools/kaniko/pkg/config"
 	"github.com/osscontainertools/kaniko/pkg/constants"
 	"github.com/osscontainertools/kaniko/pkg/dockerfile"
@@ -59,7 +60,7 @@ func (r *RunCommand) ExecuteCommand(config *v1.Config, buildArgs *dockerfile.Bui
 }
 
 func runCommandWithFlags(config *v1.Config, buildArgs *dockerfile.BuildArgs, cmdRun *instructions.RunCommand, fileContext util.FileContext, secrets kConfig.SecretOptions) (reterr error) {
-	ff_bind := kConfig.EnvBoolDefault("FF_KANIKO_RUN_MOUNT_BIND", true)
+	ff_bind := kConfig.FF.RunMountBind
 	for _, f := range cmdRun.FlagsUsed {
 		if f != "mount" {
 			logrus.Warnf("#969 kaniko does not support '--%s' flags in RUN statements - relying on unsupported flags can lead to invalid builds", f)
@@ -320,7 +321,7 @@ func runCommandInExec(config *v1.Config, buildArgs *dockerfile.BuildArgs, cmdRun
 				continue
 			}
 			// Replacement envs must be in KEY=VALUE form.
-			util.Assert("run.path-separator", len(entry) == 2, "replacement env matching \"PATH\" has no '=' separator")
+			assert.Assert("run.path-separator", len(entry) == 2, "replacement env matching \"PATH\" has no '=' separator")
 			oldPath := os.Getenv("PATH")
 			err := os.Setenv("PATH", entry[1])
 			if err != nil {
@@ -334,11 +335,11 @@ func runCommandInExec(config *v1.Config, buildArgs *dockerfile.BuildArgs, cmdRun
 		}
 	}
 
-	util.Assert("run.command-nonempty", len(newCommand) > 0, "runCommandInExec: newCommand is empty")
+	assert.Assert("run.command-nonempty", len(newCommand) > 0, "runCommandInExec: newCommand is empty")
 	logrus.Infof("Cmd: %s", newCommand[0])
 	logrus.Infof("Args: %s", newCommand[1:])
 
-	if kConfig.EnvBool("FF_KANIKO_RUN_VIA_TINI") {
+	if kConfig.FF.RunViaTini {
 		newCommand = append([]string{kConfig.TiniExec, "-s", "--"}, newCommand...)
 	}
 
@@ -376,7 +377,7 @@ func runCommandInExec(config *v1.Config, buildArgs *dockerfile.BuildArgs, cmdRun
 	if err := cmd.Start(); err != nil {
 		return fmt.Errorf("starting command: %w", err)
 	}
-	util.Assert("run.process-set", cmd.Process != nil, "cmd.Process must be set after a successful Start()")
+	assert.Assert("run.process-set", cmd.Process != nil, "cmd.Process must be set after a successful Start()")
 
 	pgid, err := syscall.Getpgid(cmd.Process.Pid)
 	if err != nil {
@@ -529,7 +530,7 @@ func runCmdFilesUsedFromContext(
 	config *v1.Config, buildArgs *dockerfile.BuildArgs, cmd *instructions.RunCommand,
 	fileContext util.FileContext,
 ) ([]string, error) {
-	ff_bind := kConfig.EnvBoolDefault("FF_KANIKO_RUN_MOUNT_BIND", true)
+	ff_bind := kConfig.FF.RunMountBind
 	if !ff_bind || len(cmd.FlagsUsed) == 0 {
 		return []string{}, nil
 	}

pkg/commands/volume.go

@@ -22,6 +22,7 @@ import (
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/moby/buildkit/frontend/dockerfile/instructions"
+	"github.com/osscontainertools/kaniko/pkg/assert"
 	kconfig "github.com/osscontainertools/kaniko/pkg/config"
 	"github.com/osscontainertools/kaniko/pkg/dockerfile"
 	"github.com/osscontainertools/kaniko/pkg/util"
@@ -51,7 +52,7 @@ func (v *VolumeCommand) ExecuteCommand(config *v1.Config, buildArgs *dockerfile.
 		existingVolumes[volume] = x
 		util.AddVolumePathToIgnoreList(volume)
 
-		if !kconfig.EnvBoolDefault("FF_KANIKO_VOLUME_SKIP_MKDIR", true) {
+		if !kconfig.FF.VolumeSkipMkdir {
 			// Only create and snapshot the dir if it didn't exist already
 			if _, err := os.Stat(volume); os.IsNotExist(err) {
 				logrus.Infof("Creating directory %s", volume)
@@ -62,7 +63,7 @@ func (v *VolumeCommand) ExecuteCommand(config *v1.Config, buildArgs *dockerfile.
 		}
 	}
 	config.Volumes = existingVolumes
-	util.Assert("volume.count-monotone", len(config.Volumes) >= prevVolumeCount, "VOLUME must not remove volumes: count went from %d to %d", prevVolumeCount, len(config.Volumes))
+	assert.Assert("volume.count-monotone", len(config.Volumes) >= prevVolumeCount, "VOLUME must not remove volumes: count went from %d to %d", prevVolumeCount, len(config.Volumes))
 	return nil
 }
 

pkg/commands/workdir.go

@@ -23,6 +23,7 @@ import (
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/moby/buildkit/frontend/dockerfile/instructions"
+	"github.com/osscontainertools/kaniko/pkg/assert"
 	kConfig "github.com/osscontainertools/kaniko/pkg/config"
 	"github.com/osscontainertools/kaniko/pkg/dockerfile"
 	"github.com/osscontainertools/kaniko/pkg/util"
@@ -46,7 +47,7 @@ func ToAbsPath(path string, workdir string) string {
 		}
 		result = filepath.Join(workdir, path)
 	}
-	util.Assert("workdir.abs-path", filepath.IsAbs(result), "ToAbsPath must return an absolute path, got %q (path=%q, workdir=%q)", result, path, workdir)
+	assert.Assert("workdir.abs-path", filepath.IsAbs(result), "ToAbsPath must return an absolute path, got %q (path=%q, workdir=%q)", result, path, workdir)
 	return result
 }