GoogleContainerTools/skaffold · error

error matching allowed user: %v

Error message

error matching allowed user: %v

What it means

IsAllowedUser panics if regexp.MatchString fails while testing the current user against the allowed-users patterns from constants.AllowedUsers. MatchString only errors on an invalid pattern, so this panic indicates a malformed compile-time AllowedUserPattern/allowed-user entry — a developer bug, not user input.

Source

Thrown at pkg/skaffold/user/user.go:30

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package user

import (
	"fmt"
	"regexp"

	"github.com/GoogleContainerTools/skaffold/v2/pkg/skaffold/constants"
)

func IsAllowedUser(user string) bool {
	for allowedUser := range constants.AllowedUsers {
		matched, err := regexp.MatchString(fmt.Sprintf(constants.AllowedUserPattern, allowedUser), user)
		if err != nil {
			panic(fmt.Sprintf("error matching allowed user: %v", err))
		}

		if matched {
			return true
		}
	}

	return false
}

View on GitHub (pinned to a1189de023)

Solutions

1. Fix the invalid regex in constants.AllowedUserPattern / AllowedUsers
2. Add a unit test or regexp.Compile check at init time to validate the pattern
3. Verify with a quick Go run that regexp.MustCompile(fmt.Sprintf(pattern, user)) compiles for each allowed user

Example fix

// before
matched, err := regexp.MatchString(fmt.Sprintf(constants.AllowedUserPattern, allowedUser), user)
// after
re := regexp.MustCompile(fmt.Sprintf(constants.AllowedUserPattern, allowedUser)) // panics at startup, not mid-request
matched := re.MatchString(user)

// At package init, fail fast instead of mid-request:
var _ = func() bool {
  for u := range constants.AllowedUsers {
    if _, err := regexp.Compile(fmt.Sprintf(constants.AllowedUserPattern, u)); err != nil {
      panic(fmt.Sprintf("invalid allowed-user pattern for %q: %v", u, err))
    }
  }
  return true
}()

func patternIsValid(user string) (ok bool) {
  defer func() { if recover() != nil { ok = false } }()
  regexp.MustCompile(fmt.Sprintf(constants.AllowedUserPattern, "x"))
  return true
}

func isAllowedUserSafe(user string) (allowed bool) {
  defer func() { if recover() != nil { allowed = false } }()
  return user.IsAllowedUser(user)
}

When it happens

Trigger: constants.AllowedUserPattern combined with an allowedUser entry yields an invalid regular expression (e.g. bad escaping introduced when editing the constants), causing regexp.MatchString to return err during createMetrics' user check.

Common situations: Editing constants.AllowedUsers or AllowedUserPattern and introducing an invalid regex; regressions after refactoring the telemetry allowlist.

Related errors

• unknown panic
• %s is an invalid api version
• unable to parse output: %q
• no project id found in metrics credentials
• compiling name match regex

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/a47654f442c1b18c. Report an issue: GitHub.