Skip to content

⚠️ update name validation patterns to match Kubernetes as close as possible #1175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 4, 2024
Merged

⚠️ update name validation patterns to match Kubernetes as close as possible #1175

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
61417d9
update name validation patterns to match Kubernetes as closely as pos…
everettraven Sep 4, 2024
b9797ec
remove duplicate channel name admission test
everettraven Sep 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 25 additions & 17 deletions api/v1alpha1/clusterextension_types.go
View file
Open in desktop
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do the before or after changes from this PR align to the validations that happen in opm validate? We need to make sure that package and channel names are fully specified and validated the exact same way in both places.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As far as I can tell, the validation for the package name does match. There does not appear to be any validation on channel names in opm validate.

IMO we should merge the validation changes here and then add the validation of the channel name to opm validate.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we need to check known catalogs against these proposed validations before we merge so that we have more information to make a decision. We may ultimately decide to implement these validations despite breaking existing content, but we should know before we act.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gist that verified this validation works for all channel names in all known catalogs (except for one in the redhat certified operators index that looks like an unintentional channel name): https://gist.github.com/everettraven/4691c8cc6181f28b129f46cceeb602b5

Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ type ClusterExtensionSpec struct {
// applied to other Namespaces. This Namespace is expected to exist.
//
// installNamespace is required, immutable, and follows the DNS label standard
// as defined in RFC 1123. This means that valid values:
// as defined in [RFC 1123]. This means that valid values:
// - Contain no more than 63 characters
// - Contain only lowercase alphanumeric characters or '-'
// - Start with an alphanumeric character
Expand All @@ -85,6 +85,8 @@ type ClusterExtensionSpec struct {
// - thisisareallylongnamespacenamethatisgreaterthanthemaximumlength
// - some.namespace
//
// [RFC 1123]: https://tools.ietf.org/html/rfc1123
//
//+kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
//+kubebuilder:validation:MaxLength:=63
//+kubebuilder:validation:XValidation:rule="self == oldSelf",message="installNamespace is immutable"
Expand Down Expand Up @@ -140,11 +142,10 @@ type CatalogSource struct {
// packageName is a reference to the name of the package to be installed
// and is used to filter the content from catalogs.
//
// This field is required, immutable and follows the DNS label standard as defined in RFC
// 1123, with a deviation in the maximum length being no more than 48
// characters. This means that valid values:
// - Contain no more than 48 characters
// - Contain only lowercase alphanumeric characters or '-'
// This field is required, immutable and follows the DNS subdomain name
// standard as defined in [RFC 1123]. This means that valid entries:
// - Contain no more than 253 characters
// - Contain only lowercase alphanumeric characters, '-', or '.'
// - Start with an alphanumeric character
// - End with an alphanumeric character
//
Expand All @@ -160,8 +161,10 @@ type CatalogSource struct {
// - thisisareallylongpackagenamethatisgreaterthanthemaximumlength
// - some.package
//
//+kubebuilder:validation:MaxLength:=48
//+kubebuilder:validation:Pattern:=^[a-z0-9]+(-[a-z0-9]+)*$
// [RFC 1123]: https://tools.ietf.org/html/rfc1123
//
//+kubebuilder:validation:MaxLength:=253
//+kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
//+kubebuilder:validation:XValidation:rule="self == oldSelf",message="packageName is immutable"
PackageName string `json:"packageName"`

Expand Down Expand Up @@ -259,10 +262,9 @@ type CatalogSource struct {
//
// When unspecified, upgrade edges across all channels will be used to identify valid automatic upgrade paths.
//
// This field follows the DNS subdomain name standard as defined in RFC
// 1123, with a deviation in the maximum length being no more than 48
// characters. This means that valid values:
// - Contain no more than 48 characters
// This field follows the DNS subdomain name standard as defined in [RFC
// 1123]. This means that valid entries:
// - Contain no more than 253 characters
// - Contain only lowercase alphanumeric characters, '-', or '.'
// - Start with an alphanumeric character
// - End with an alphanumeric character
Expand All @@ -281,9 +283,13 @@ type CatalogSource struct {
// - -some-channel
// - some-channel-
// - thisisareallylongchannelnamethatisgreaterthanthemaximumlength
// - original_40
// - --default-channel
//
// [RFC 1123]: https://tools.ietf.org/html/rfc1123
//
//+kubebuilder:validation:MaxLength:=48
//+kubebuilder:validation:Pattern:=^[a-z0-9]+([\.-][a-z0-9]+)*$
//+kubebuilder:validation:MaxLength:=253
//+kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
//+optional
Channel string `json:"channel,omitempty"`

Expand Down Expand Up @@ -329,8 +335,8 @@ type ServiceAccountReference struct {
//
// This ServiceAccount is expected to exist in the installNamespace.
//
// This field follows the DNS subdomain name standard as defined in RFC
// 1123. This means that valid values:
// This field follows the DNS subdomain name standard as defined in [RFC
// 1123]. This means that valid values:
// - Contain no more than 253 characters
// - Contain only lowercase alphanumeric characters, '-', or '.'
// - Start with an alphanumeric character
Expand All @@ -347,8 +353,10 @@ type ServiceAccountReference struct {
// - -some-serviceaccount
// - some-serviceaccount-
//
// [RFC 1123]: https://tools.ietf.org/html/rfc1123
//
//+kubebuilder:validation:MaxLength:=253
//+kubebuilder:validation:Pattern:=^[a-z0-9]+([.|-][a-z0-9]+)*$
//+kubebuilder:validation:Pattern:=^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
//+kubebuilder:validation:XValidation:rule="self == oldSelf",message="name is immutable"
Name string `json:"name"`
}
Expand Down
42 changes: 25 additions & 17 deletions config/base/crd/bases/olm.operatorframework.io_clusterextensions.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ spec:
applied to other Namespaces. This Namespace is expected to exist.

installNamespace is required, immutable, and follows the DNS label standard
as defined in RFC 1123. This means that valid values:
as defined in [RFC 1123]. This means that valid values:
- Contain no more than 63 characters
- Contain only lowercase alphanumeric characters or '-'
- Start with an alphanumeric character
Expand All @@ -64,6 +64,8 @@ spec:
- some-namespace-
- thisisareallylongnamespacenamethatisgreaterthanthemaximumlength
- some.namespace

[RFC 1123]: https://tools.ietf.org/html/rfc1123
maxLength: 63
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
type: string
Expand Down Expand Up @@ -133,8 +135,8 @@ spec:

This ServiceAccount is expected to exist in the installNamespace.

This field follows the DNS subdomain name standard as defined in RFC
1123. This means that valid values:
This field follows the DNS subdomain name standard as defined in [RFC
1123]. This means that valid values:
- Contain no more than 253 characters
- Contain only lowercase alphanumeric characters, '-', or '.'
- Start with an alphanumeric character
Expand All @@ -150,8 +152,10 @@ spec:
Some examples of invalid values are:
- -some-serviceaccount
- some-serviceaccount-

[RFC 1123]: https://tools.ietf.org/html/rfc1123
maxLength: 253
pattern: ^[a-z0-9]+([.|-][a-z0-9]+)*$
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
x-kubernetes-validations:
- message: name is immutable
Expand Down Expand Up @@ -196,10 +200,9 @@ spec:

When unspecified, upgrade edges across all channels will be used to identify valid automatic upgrade paths.

This field follows the DNS subdomain name standard as defined in RFC
1123, with a deviation in the maximum length being no more than 48
characters. This means that valid values:
- Contain no more than 48 characters
This field follows the DNS subdomain name standard as defined in [RFC
1123]. This means that valid entries:
- Contain no more than 253 characters
- Contain only lowercase alphanumeric characters, '-', or '.'
- Start with an alphanumeric character
- End with an alphanumeric character
Expand All @@ -218,19 +221,22 @@ spec:
- -some-channel
- some-channel-
- thisisareallylongchannelnamethatisgreaterthanthemaximumlength
maxLength: 48
pattern: ^[a-z0-9]+([\.-][a-z0-9]+)*$
- original_40
- --default-channel

[RFC 1123]: https://tools.ietf.org/html/rfc1123
maxLength: 253
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
packageName:
description: |-
packageName is a reference to the name of the package to be installed
and is used to filter the content from catalogs.

This field is required, immutable and follows the DNS label standard as defined in RFC
1123, with a deviation in the maximum length being no more than 48
characters. This means that valid values:
- Contain no more than 48 characters
- Contain only lowercase alphanumeric characters or '-'
This field is required, immutable and follows the DNS subdomain name
standard as defined in [RFC 1123]. This means that valid entries:
- Contain no more than 253 characters
- Contain only lowercase alphanumeric characters, '-', or '.'
- Start with an alphanumeric character
- End with an alphanumeric character

Expand All @@ -245,8 +251,10 @@ spec:
- some-package-
- thisisareallylongpackagenamethatisgreaterthanthemaximumlength
- some.package
maxLength: 48
pattern: ^[a-z0-9]+(-[a-z0-9]+)*$

[RFC 1123]: https://tools.ietf.org/html/rfc1123
maxLength: 253
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
type: string
x-kubernetes-validations:
- message: packageName is immutable
Expand Down
16 changes: 12 additions & 4 deletions internal/controllers/clusterextension_admission_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ func TestClusterExtensionSourceConfig(t *testing.T) {
}

func TestClusterExtensionAdmissionPackageName(t *testing.T) {
tooLongError := "spec.source.catalog.packageName: Too long: may not be longer than 48"
tooLongError := "spec.source.catalog.packageName: Too long: may not be longer than 253"
regexMismatchError := "spec.source.catalog.packageName in body should match"

testCases := []struct {
Expand All @@ -81,7 +81,7 @@ func TestClusterExtensionAdmissionPackageName(t *testing.T) {
errMsg string
}{
{"no package name", "", regexMismatchError},
{"long package name", "this-is-a-really-long-package-name-that-is-greater-than-48-characters", tooLongError},
{"long package name", strings.Repeat("x", 254), tooLongError},
{"leading digits with hypens", "0my-1package-9name", ""},
{"trailing digits with hypens", "my0-package1-name9", ""},
{"digits with hypens", "012-345-678-9", ""},
Expand All @@ -94,6 +94,10 @@ func TestClusterExtensionAdmissionPackageName(t *testing.T) {
{"single hypen", "-", regexMismatchError},
{"uppercase letters", "ABC-DEF-GHI-JKL", regexMismatchError},
{"special characters", "my-$pecial-package-name", regexMismatchError},
{"dot separated", "some.package", ""},
{"underscore separated", "some_package", regexMismatchError},
{"starts with dot", ".some.package", regexMismatchError},
{"multiple sequential separators", "a.-b", regexMismatchError},
}

t.Parallel()
Expand Down Expand Up @@ -123,6 +127,7 @@ func TestClusterExtensionAdmissionPackageName(t *testing.T) {
})
}
}

func TestClusterExtensionAdmissionVersion(t *testing.T) {
tooLongError := "spec.source.catalog.version: Too long: may not be longer than 64"
regexMismatchError := "spec.source.catalog.version in body should match"
Expand Down Expand Up @@ -222,7 +227,7 @@ func TestClusterExtensionAdmissionVersion(t *testing.T) {
}

func TestClusterExtensionAdmissionChannel(t *testing.T) {
tooLongError := "spec.source.catalog.channel: Too long: may not be longer than 48"
tooLongError := "spec.source.catalog.channel: Too long: may not be longer than 253"
regexMismatchError := "spec.source.catalog.channel in body should match"

testCases := []struct {
Expand All @@ -234,7 +239,7 @@ func TestClusterExtensionAdmissionChannel(t *testing.T) {
{"hypen-separated", "hyphenated-name", ""},
{"dot-separated", "dotted.name", ""},
{"includes version", "channel-has-version-1.0.1", ""},
{"long channel name", "longname01234567890123456789012345678901234567890", tooLongError},
{"long channel name", strings.Repeat("x", 254), tooLongError},
{"spaces", "spaces spaces", regexMismatchError},
{"capitalized", "Capitalized", regexMismatchError},
{"camel case", "camelCase", regexMismatchError},
Expand All @@ -243,6 +248,8 @@ func TestClusterExtensionAdmissionChannel(t *testing.T) {
{"ends with hyphen", "end-with-hyphen-", regexMismatchError},
{"starts with period", ".start-with-period", regexMismatchError},
{"ends with period", "end-with-period.", regexMismatchError},
{"contains underscore", "some_thing", regexMismatchError},
{"multiple sequential separators", "a.-b", regexMismatchError},
}

t.Parallel()
Expand Down Expand Up @@ -350,6 +357,7 @@ func TestClusterExtensionAdmissionServiceAccount(t *testing.T) {
{"ends with hyphen", "end-with-hyphen-", regexMismatchError},
{"starts with period", ".start-with-period", regexMismatchError},
{"ends with period", "end-with-period.", regexMismatchError},
{"multiple sequential separators", "a.-b", regexMismatchError},
}

t.Parallel()
Expand Down