Support per-step timeout field in Kptfile pipeline by SurbhiAgarwal1 · Pull Request #4814 · kptdev/kpt

SurbhiAgarwal1 · 2026-10-17T16:37:58Z

Description
This PR adds support for a per-function timeout field on pipeline mutator and validator steps in the Kptfile as requested in issue #4473.

Add Timeout field to Function type in api/kptfile/v1/types.go and applyconfigurations
Add validation in api/kptfile/v1/validation.go ensuring positive, valid duration syntax (e.g. 30s, 1m, 5m)
Propagate function step timeout to ContainerFn and ExecFn runtimes in pkg/fn/runtime/runner.go
Integrate precedence: pipeline-level --timeout flag overrides step-level timeout, and step-level timeout overrides the 5-minute default
Update Kptfile schema definitions (kptfile.yaml and kptfile.json)
Built on top of #4798 (feat/4473-timeout-flag)

Motivation
Currently, both ContainerFn and ExecFn can accept a timeout, but there was no mechanism to configure a timeout per individual function step in the Kptfile pipeline. Adding this allows fast functions to fail quickly and heavy functions to have dedicated time limits in GitOps and CI workflows without relying solely on global CLI flags.

Testing

Validation tests in api/kptfile/v1/validation_test.go for valid durations, invalid syntax, zero, and negative values
Runtime step timeout execution tests in pkg/fn/runtime/runner_test.go
Precedence tests in pkg/fn/runtime/runner_test.go verifying CLI pipeline timeout precedence and step timeout precedence
Render executor tests in pkg/lib/kptops/render_executor_test.go
All unit tests passing with zero compilation errors

Part of #4473

The container and exec function runtimes accept a timeout, but nothing set it, so every function ran with the default of 5 minutes. Add a --timeout flag to both commands and pass it to the runtimes. A function that times out is now reported with its stderr and a 'Timed out after' line, and kpt no longer waits past the timeout for a child process that keeps the output open. Part of kptdev#4473 Assisted-by: Claude:claude-opus-5-5 Assisted-by: Codex:gpt-6.1-sol Signed-off-by: Nikshay <nikshayyadav90@gmail.com>

Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Nikshay <nikshayyadav90@gmail.com>

Signed-off-by: Nikshay <nikshayyadav90@gmail.com> Assisted-by: Claude:claude-opus-5-5

Signed-off-by: Nikshay <nikshayyadav90@gmail.com>

netlify · 2026-10-17T16:38:04Z

✅ Deploy Preview for kptdocs ready!

Name	Link
🔨 Latest commit	`0d88a10`
🔍 Latest deploy log	https://app.netlify.com/projects/kptdocs/deploys/6ad63992b08ba52907ed8d42
😎 Deploy Preview	https://deploy-preview-4814--kptdocs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Nikshay1

pulled this locally and the new tests pass for me. left a few small notes inline. the empty ci: re-trigger live-apply workflow commit could probably go before merge too. thanks for taking the Kptfile part!

Nikshay1 · 2026-10-19T05:59:27Z

+	opts := runneroptions.RunnerOptions{}
+	opts.InitDefaults(runneroptions.GHCRImagePrefix)
+	opts.AllowExec = true
+	opts.Timeout = 10 * time.Second


this test shows the shorter limit wins, a 100ms step still times out under a 10s flag. the PR description says the flag overrides the step timeout though. I like shorter-wins better, so maybe only the description needs a small change?

Nikshay1 · 2026-10-19T05:59:27Z

+  When this flag is not set, there is no limit for the whole pipeline, and each
+  function is allowed to run for 5 minutes.


this line came from #4798 and isn't right anymore once a step sets its own timeout. maybe something like

Suggested change

When this flag is not set, there is no limit for the whole pipeline, and each

function is allowed to run for 5 minutes.

When this flag is not set, there is no limit for the whole pipeline, and each

function is allowed to run for 5 minutes, or for its `timeout` from the

Kptfile if it sets one.

the same sentence is also in the flag help in cmdrender.go and in internal/docs/generated/fndocs/docs.go.

Nikshay1 · 2026-10-19T05:59:27Z

+	require.Len(t, fnResults.Items, 1)
+	assert.Equal(t, timeoutExitCode, fnResults.Items[0].ExitCode)
+}
+


gofmt wants this trailing blank line gone.

Nikshay1 · 2026-10-19T05:59:27Z

+	b.Timeout = &value
+	return b
+}
+


same trailing blank line here, gofmt flags this file too.

Nikshay1 · 2026-10-19T05:59:27Z

+
+	// Timeout specifies the maximum execution time for this function step
+	// (e.g. "30s", "1m", "5m"). If omitted, the pipeline timeout or default
+	// function timeout (5m) is used.


small thing, this doesn't apply with --allow-alpha-wasm, since runner.go only passes it to ContainerFn and ExecFn. wasm functions don't get the 5m default on main either, so it's not new. the --timeout docs already say "container and exec based functions only", maybe the same note fits here?

Add support for specifying a timeout field on individual mutator and validator pipeline steps in the Kptfile (e.g. timeout: 30s). - Add Timeout field to Function type in api/kptfile/v1/types.go and generated applyconfigurations. - Validate that the timeout field contains a valid, positive duration. - Parse step timeout and pass to ContainerFn and ExecFn runtimes. - Maintain precedence: the shorter limit wins (pipeline-level --timeout flag limits the whole run, step-level timeout limits the individual function, and step-level timeout overrides the default 5-minute timeout). - Update Kptfile schema definitions (JSON and YAML). - Add unit tests for validation, step execution timeout, and precedence. Part of kptdev#4473 Signed-off-by: SurbhiAgarwal <agarwalsurbhi1807@gmail.com>

sonarqubecloud · 2026-10-19T16:15:22Z

Quality Gate failed

Failed conditions
B Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

mozesl-nokia · 2026-10-20T11:49:54Z

+	// (e.g. "30s", "1m", "5m"). If omitted, the pipeline timeout or default
+	// function timeout (5m) is used. Applicable to container and exec based
+	// functions only.
+	Timeout string `yaml:"timeout,omitempty" json:"timeout,omitempty"`


I would propose using metav1.Duration for this as it already has proper unmarshalling, but that would require pulling in apimachinery...

Do we want to maybe have a copy of that metav1.Duration type somewhere so we can use it here (and elsewhere later) @kptdev/maintainers?

mozesl-nokia · 2026-10-20T11:51:59Z

+--timeout:
+  Maximum time the function is allowed to run, e.g. `30s` or `10m`.
+  If the function has not finished by then, the command fails. Default: `5m`.
+  Note that this is applicable to container and exec based functions only.


We only have container and exec functions

mozesl-nokia · 2026-10-20T11:52:04Z

+  When this flag is not set, there is no limit for the whole pipeline, and each
+  function is allowed to run for 5 minutes, or for its `timeout` from the
+  Kptfile if it sets one.
+  Note that this is applicable to container and exec based functions only.


We only have container and exec functions

mozesl-nokia · 2026-10-20T11:52:41Z

+	// function timeout (5m) is used. Applicable to container and exec based
+	// functions only.


We only have container and exec functions

mozesl-nokia · 2026-10-20T11:56:52Z

+
+// RunContext is like Run, but the function is also killed when the time
+// limit of ctx has passed.
+func (f *ExecFn) RunContext(ctx context.Context, r io.Reader, w io.Writer) error {


TODO: We should add this to the FunctionRunner interface, more likely a FunctionRunnerV2 to not break BC

mozesl-nokia · 2026-10-20T12:01:00Z

+	"fmt"
+	"time"
+
+	"github.com/kptdev/kpt/pkg/printer"


We shouldn't import printer here... and moving these errors to the api module is in the works, maybe put this there already?

Nikshay1 added 5 commits October 11, 2026 22:10

Add a container timeout test and fix the ExecFn.Timeout comment

8550705

Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Nikshay <nikshayyadav90@gmail.com>

Make --timeout limit the whole render pipeline

4894ab2

Signed-off-by: Nikshay <nikshayyadav90@gmail.com> Assisted-by: Claude:claude-opus-5-5

Pass the run context to ExecFn as a parameter

4e1534c

Signed-off-by: Nikshay <nikshayyadav90@gmail.com> Assisted-by: Claude:claude-opus-5-5

Say which timeout was exceeded in timeout errors

ba5dc16

Signed-off-by: Nikshay <nikshayyadav90@gmail.com>

SurbhiAgarwal1 requested review from a team and a balanced review from Copilot October 17, 2026 16:37

SurbhiAgarwal1 requested review from efiacor, kispaljr, liamfallon and mozesl-nokia as code owners October 17, 2026 16:38

Copilot AI reviewed Oct 17, 2026

Nikshay1 reviewed Oct 19, 2026

View reviewed changes

SurbhiAgarwal1 force-pushed the feat/4473-kptfile-step-timeout branch from 8b858f1 to 0d88a10 Compare October 19, 2026 15:38

mozesl-nokia reviewed Oct 20, 2026

View reviewed changes

		When this flag is not set, there is no limit for the whole pipeline, and each
		function is allowed to run for 5 minutes.

		// function timeout (5m) is used. Applicable to container and exec based
		// functions only.

Conversation

SurbhiAgarwal1 commented Oct 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Oct 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kptdocs ready!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Nikshay1 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Oct 19, 2026

Quality Gate failed

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

SurbhiAgarwal1 commented Oct 17, 2026 •

edited

Loading

netlify Bot commented Oct 17, 2026 •

edited

Loading

Nikshay1 left a comment •

edited

Loading