set-namespace exits 0 and reports [PASS] when config is invalid

[aravindtga]

Description

When set-namespace:latest is invoked without a namespace value (empty data.namespace in ConfigMap), the function exits with code 0 and reports [PASS], but simultaneously emits an error-severity result:

  [RUNNING] "ghcr.io/kptdev/krm-functions-catalog/set-namespace:latest"
  [PASS] "ghcr.io/kptdev/krm-functions-catalog/set-namespace:latest" in 0s
  [Results]: [error] v1/ConfigMap/function-input: `data.namespace` should not be empty

Previous behaviour (v0.2.0):

  [FAIL] "ghcr.io/kptdev/krm-functions-catalog/set-namespace:v0.2.0"
  error: failed to configure function: input namespace cannot be empty
  Exit code: 1

Steps to reproduce

  cd $(mktemp -d)
  cat > resources.yaml <<EOF
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: nginx-deployment
  spec:
    replicas: 3
  EOF
  kpt fn eval -i ghcr.io/kptdev/krm-functions-catalog/set-namespace:latest
  echo "Exit code: $?"
  # Outputs: Exit code: 0

Expected behaviour

The function should exit with code 1 and report [FAIL] when configuration is invalid. Config validation errors should be fatal, not informational.

[dosubot]

This is a valid behavioral difference between set-namespace v0.2.0 and the latest version, and it stems from two separate design decisions:

1. The function changed how it reports validation errors.

In v0.2.0, an empty namespace config caused the function to exit with code 1 (hard failure). In the latest version, the function instead emits a structured result with severity: error but still exits with code 0 [1]. This is by design in the newer function architecture — it reports the problem as a structured result rather than crashing.

2. kpt determines [PASS]/[FAIL] solely from the exit code, not structured result severity.

The FunctionRunner.Filter() logic in kpt prints [PASS] whenever the function exits 0, regardless of whether the structured results contain error-severity items [2]. Error-severity results are tracked separately for reporting purposes but don't affect the pass/fail determination [3].

So the combination of these two things produces the confusing output you're seeing: [PASS] alongside [Results]: [error].

This was actually encountered during PR #4420 where E2E tests were being updated to use :latest — the missing-fn-config test expected the function to fail when config is missing, but the latest version succeeds with exit 0 instead [4].

There are two possible fixes depending on the team's preference:

• In the function: Have set-namespace exit non-zero when namespace config is empty (restoring v0.2.0 behavior for config validation failures)
• In kpt: Treat error-severity structured results as execution failures (broader change affecting all functions)

The community discussed this behavior in the context of PR #4420 and decided to keep the current function behavior for certain cases (like unknown CRs being skipped), but the specific case of an empty required config value seems like it should indeed be fatal rather than informational.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.