{"record":{"id":"e964d4909a4f667b","repo":"kubernetes/kops","slug":"parsing-reference-for-q-v","errorCode":null,"errorMessage":"parsing reference for %q: %v","messagePattern":"parsing reference for %q: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/assets/assetcopy/copyimage.go","lineNumber":48,"sourceCode":"// typically used for highly secure clusters.\ntype CopyImage struct {\n\tName        string\n\tSourceImage string\n\tTargetImage string\n}\n\nfunc (e *CopyImage) Run() error {\n\tsource := e.SourceImage\n\ttarget := e.TargetImage\n\n\tsourceRef, err := name.ParseReference(source)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"parsing reference %q: %v\", source, err)\n\t}\n\n\ttargetRef, err := name.ParseReference(target)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"parsing reference for %q: %v\", target, err)\n\t}\n\n\toptions := []remote.Option{remote.WithAuthFromKeychain(authn.DefaultKeychain)}\n\n\tdesc, err := remote.Get(sourceRef, options...)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"fetching %q: %v\", source, err)\n\t}\n\n\ttargetDesc, err := remote.Get(targetRef, options...)\n\tif err == nil && desc.Digest.String() == targetDesc.Digest.String() {\n\t\tklog.Infof(\"no need to copy image from %v to %v\", sourceRef, targetRef)\n\t\treturn nil\n\t}\n\n\tswitch desc.MediaType {\n\tcase types.OCIImageIndex, types.DockerManifestList:\n\t\t// Handle indexes separately.","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/assets/assetcopy/copyimage.go#L30-L66","documentation":"Same parse failure as the source-side error but for the TARGET image: name.ParseReference rejected e.TargetImage inside CopyImage.Run. The wrapper text is \"parsing reference for %q: %v\" so you know the destination registry/repository string, not the source, is malformed.","triggerScenarios":"CopyImage.Run called with TargetImage that violates the container reference grammar: empty value, illegal characters, malformed tag/digest suffix, or invalid registry host (bad port, underscore, scheme prefix like 'https://').","commonSituations":"Typo in the target registry host in the cluster spec assets config; including a URL scheme ('https://myregistry/repo') which is not part of a reference; copying a source URL verbatim into the target field when the target registry has a different repository path/port; empty target because the private-registry asset value was never set for highly secure clusters.","solutions":["Correct TargetImage in the kops cluster spec to a valid reference, e.g. 'myregistry.example.com/kops/kube-apiserver:v1.28.0'.","Remove any URL scheme (https://) and credentials from the target string; only host[:port]/repo[:tag][@digest] is allowed.","Verify no template placeholders remain unexpanded in the target value.","Sanity-check with `crane digest <target>` to confirm the reference parses and is reachable."],"exampleFix":"// before\nCopyImage{SourceImage: \"registry.k8s.io/kops/kube-apiserver:v1.28.0\", TargetImage: \"https://myregistry.example.com/kops/kube-apiserver\"}\n// after\nCopyImage{SourceImage: \"registry.k8s.io/kops/kube-apiserver:v1.28.0\", TargetImage: \"myregistry.example.com/kops/kube-apiserver:v1.28.0\"}","handlingStrategy":"validation","validationCode":"func validTargetRef(ref string) bool {\n\tif ref == \"\" || strings.Contains(ref, \"://\") {\n\t\treturn false\n\t}\n\t_, err := name.ParseReference(ref)\n\treturn err == nil\n}\n\nif !validTargetRef(target.TargetImage) {\n\treturn fmt.Errorf(\"invalid TargetImage reference: %q\", target.TargetImage)\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n\tvar bad *name.ErrBadName\n\tif errors.As(err, &bad) {\n\t\treturn fmt.Errorf(\"target image reference %q is not a valid OCI reference: %w\", targetImage, err)\n\t}\n\treturn err\n}","preventionTips":["Always include host[:port]/repository:tag — no URL scheme, no credentials in the string.","Mirror both source and target values together and validate the pair before running.","Ensure the private-registry asset values are set for highly secure clusters before attempting the copy.","Lint cluster spec assets in CI with a ParseReference check."],"tags":["container-image","input-validation","image-reference"],"backgroundTag":"invalid-image-reference","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}