fix: reject TaskRun taskRef with custom task kind but no apiVersion

A TaskRef that sets kind to a non-default value without apiVersion is
not recognized as a Custom Task reference (IsCustomTask requires both
fields), and the resolver ignores the kind entirely: the ref resolves
as an ordinary namespaced Task when one exists, or fails at runtime
with a confusing not-found error. Validate the pairing at admission
time in TaskRef.Validate for v1 and v1beta1, mirroring the custom task
validation Pipelines already perform, and correct the one example that
set a lowercase kind on an ordinary task reference.

Fixes #6557

Signed-off-by: Roshan <rosh.s568@gmail.com>

Author: lopster568

examples/v1/taskruns/beta/emit-array-results.yaml

@@ -36,4 +36,4 @@ metadata:
 spec:
   taskRef:
     name: write-array
-    kind: task
+    kind: Task

pkg/apis/pipeline/v1/taskref_validation.go

@@ -28,5 +28,13 @@ func (ref *TaskRef) Validate(ctx context.Context) (errs *apis.FieldError) {
 	if ref == nil {
 		return errs
 	}
-	return validateRef(ctx, ref.Name, ref.Resolver, ref.Params)
+	// A non-default Kind is only meaningful for a Custom Task reference, which
+	// requires APIVersion to be set as well (see TaskRef.IsCustomTask). Without
+	// APIVersion the kind is silently ignored at resolution: the ref resolves
+	// as an ordinary namespaced Task when one exists, or fails with a
+	// confusing not-found error.
+	if ref.Kind != "" && ref.Kind != NamespacedTaskKind && ref.APIVersion == "" {
+		errs = errs.Also(apis.ErrInvalidValue("custom task ref must specify apiVersion", "apiVersion"))
+	}
+	return errs.Also(validateRef(ctx, ref.Name, ref.Resolver, ref.Params))
 }

pkg/apis/pipeline/v1/taskref_validation_test.go

@@ -37,6 +37,12 @@ func TestTaskRef_Valid(t *testing.T) {
 	}, {
 		name:    "simple taskref",
 		taskRef: &v1.TaskRef{Name: "taskrefname"},
+	}, {
+		name:    "explicit default kind without apiversion",
+		taskRef: &v1.TaskRef{Name: "taskrefname", Kind: v1.NamespacedTaskKind},
+	}, {
+		name:    "custom task with kind and apiversion",
+		taskRef: &v1.TaskRef{Name: "taskrefname", Kind: "Example", APIVersion: "example.dev/v1"},
 	}, {
 		name:    "beta feature: valid resolver",
 		taskRef: &v1.TaskRef{ResolverRef: v1.ResolverRef{Resolver: "git"}},
@@ -85,6 +91,10 @@ func TestTaskRef_Invalid(t *testing.T) {
 		name:    "missing taskref name",
 		taskRef: &v1.TaskRef{},
 		wantErr: apis.ErrMissingField("name"),
+	}, {
+		name:    "custom task kind without apiversion",
+		taskRef: &v1.TaskRef{Name: "foo", Kind: "Example"},
+		wantErr: apis.ErrInvalidValue("custom task ref must specify apiVersion", "apiVersion"),
 	}, {
 		name:    "invalid taskref name",
 		taskRef: &v1.TaskRef{Name: "_foo"},

pkg/apis/pipeline/v1beta1/taskref_validation.go

@@ -35,6 +35,14 @@ func (ref *TaskRef) Validate(ctx context.Context) (errs *apis.FieldError) {
 	if apis.IsInCreate(ctx) && ref.Bundle != "" {
 		errs = errs.Also(apis.ErrDisallowedFields("bundle"))
 	}
+	// A non-default Kind is only meaningful for a Custom Task reference, which
+	// requires APIVersion to be set as well (see TaskRef.IsCustomTask). Without
+	// APIVersion the kind is silently ignored at resolution: the ref resolves
+	// as an ordinary namespaced Task when one exists, or fails with a
+	// confusing not-found error.
+	if ref.Kind != "" && ref.Kind != NamespacedTaskKind && ref.APIVersion == "" {
+		errs = errs.Also(apis.ErrInvalidValue("custom task ref must specify apiVersion", "apiVersion"))
+	}
 	switch {
 	case ref.Resolver != "" || ref.Params != nil:
 		if ref.Params != nil {

pkg/apis/pipeline/v1beta1/taskref_validation_test.go

@@ -37,6 +37,12 @@ func TestTaskRef_Valid(t *testing.T) {
 	}, {
 		name:    "simple taskref",
 		taskRef: &v1beta1.TaskRef{Name: "taskrefname"},
+	}, {
+		name:    "explicit default kind without apiversion",
+		taskRef: &v1beta1.TaskRef{Name: "taskrefname", Kind: v1beta1.NamespacedTaskKind},
+	}, {
+		name:    "custom task with kind and apiversion",
+		taskRef: &v1beta1.TaskRef{Name: "taskrefname", Kind: "Example", APIVersion: "example.dev/v1"},
 	}, {
 		name:    "beta feature: valid resolver",
 		taskRef: &v1beta1.TaskRef{ResolverRef: v1beta1.ResolverRef{Resolver: "git"}},
@@ -84,6 +90,10 @@ func TestTaskRef_Invalid(t *testing.T) {
 		name:    "missing taskref name",
 		taskRef: &v1beta1.TaskRef{},
 		wantErr: apis.ErrMissingField("name"),
+	}, {
+		name:    "custom task kind without apiversion",
+		taskRef: &v1beta1.TaskRef{Name: "foo", Kind: "Example"},
+		wantErr: apis.ErrInvalidValue("custom task ref must specify apiVersion", "apiVersion"),
 	}, {
 		name: "taskRef with resolver and k8s style name",
 		taskRef: &v1beta1.TaskRef{