From 63e8348e9cf371b92a84fef29583cfdd750ae58c Mon Sep 17 00:00:00 2001
From: Joe Searcy <joe@twr.io>
Date: Tue, 25 Jul 2023 16:52:20 -0400
Subject: [PATCH] Add validation for reserved label

Signed-off-by: Joe Searcy <joe@twr.io>
---
 pkg/imgpkg/cmd/push.go | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/pkg/imgpkg/cmd/push.go b/pkg/imgpkg/cmd/push.go
index 12bb6538e..ac7798125 100644
--- a/pkg/imgpkg/cmd/push.go
+++ b/pkg/imgpkg/cmd/push.go
@@ -58,6 +58,11 @@ func (po *PushOptions) Run() error {
 		return err
 	}
 
+	err = po.validateFlags()
+	if err != nil {
+		return err
+	}
+
 	var imageURL string
 
 	isBundle := po.BundleFlags.Bundle != ""
@@ -145,3 +150,17 @@ func (po *PushOptions) pushImage(registry registry.Registry) (string, error) {
 	logger := util.NewUILevelLogger(util.LogWarn, util.NewLogger(po.ui))
 	return plainimage.NewContents(po.FileFlags.Files, po.FileFlags.ExcludedFilePaths, po.FileFlags.PreservePermissions).Push(uploadRef, po.Labels, registry, logger)
 }
+
+// validateFlags checks if the provided flags are valid
+func (po *PushOptions) validateFlags() error {
+
+	// Verify the user did NOT specify a reserved OCI label
+	_, present := po.Labels[bundle.BundleConfigLabel]
+
+	if present {
+		return fmt.Errorf("label '%s' is reserved and cannot be overriden. Please use a different key", bundle.BundleConfigLabel)
+	}
+
+	return nil
+
+}