Skip to content

🐛 Fix validation of worker topology names in Cluster resource #12069

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 8 commits into
base: main
Choose a base branch
from

Conversation

dlipovetsky
Copy link
Contributor

What this PR does / why we need it:
The worker topology name is used to generate the name of a Kubernetes resource (MachineDelpoyment or MachinePool), and must therefore be a valid Kubernetes resource name. The existing validation does not ensure this.

The first commit adds tests; without a fix, they fail, as expected.
The second commit fixes the validation.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #12068

/area clusterclass

…etes resource name

The worker topology name is used to generate the name of a Kubernetes
resource (MachineDelpoyment or MachinePool), and must therefore be a
valid Kubernetes resource name.
@k8s-ci-robot
Copy link
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@k8s-ci-robot k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. area/clusterclass Issues or PRs related to clusterclass cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Apr 7, 2025
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign vincepri for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Apr 7, 2025
@dlipovetsky
Copy link
Contributor Author

When I authored the fix, I noticed a disagreement between the validation and the API types. I will keep this as a draft PR until we resolve the disagreement.

The API types say that a worker topology Name may be up to 255 characters:-

However, both MachineDeployment and MachinePool validation limits the name to 63 characters, because it checks that the name is a valid label value:

My draft PR replaces this value check with a stricter one, but the length is not changed.

As an aside, I noticed that our validation imposes this 63 character limit on the Cluster and MachineDeployment names:

@sbueringer
Copy link
Member

@dlipovetsky

When I authored the fix, I noticed a disagreement between the validation and the API types. I will keep this as a draft PR until we resolve the disagreement.

When I introduced MaxLength on the field I missed that we already had that validation in the webhook. So I assumed that we have to keep supporting longer strings.

The MD webhook was not a factor there because we limit the name actually used for the MD here:

name, err := topologynames.MachineDeploymentNameGenerator(nameTemplate, s.Current.Cluster.Name, machineDeploymentTopology.Name).GenerateName()

As we already had that validation in the webhook. Let's reduce the MaxLengths accordingly

@dlipovetsky dlipovetsky marked this pull request as ready for review April 8, 2025 16:36
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 8, 2025
…bernetes resource names

Use IsDNS1123Subdomain
…bernetes resource names

Check that Name is both a valid Kubernetes resource name, and a valid label value
… Kubernetes resource name

Add tests for maximum length and invalid characters in a label value
@k8s-ci-robot k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Apr 9, 2025
… Kubernetes resource name

Test for max length should fail due to max length, not due to uppercase characters
…bernetes resource names

Explain why we use IsValidLabelValue check
… Kubernetes resource name

Add tests to check package
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/clusterclass Issues or PRs related to clusterclass cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Cluster validation allows invalid worker topology names
4 participants