Bug 1737057 - Subscription CRD does not validate `config` block
Summary: Subscription CRD does not validate `config` block
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: OLM
Version: 4.2.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: 4.2.0
Assignee: Evan Cordell
QA Contact: Jian Zhang
URL:
Whiteboard:
Depends On:
Blocks: 1732613
TreeView+ depends on / blocked
 
Reported: 2019-08-02 13:28 UTC by Evan Cordell
Modified: 2019-10-16 06:34 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-10-16 06:34:33 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github operator-framework operator-lifecycle-manager pull 978 0 None closed Bug 1737057: Sub CRD does not validate config 2020-04-02 13:10:14 UTC
Red Hat Product Errata RHBA-2019:2922 0 None None None 2019-10-16 06:34:42 UTC

Description Evan Cordell 2019-08-02 13:28:04 UTC
Description of problem:

Subscription doesn't validate the new config block.

How reproducible:
Always

Steps to Reproduce:

1. Subscribe to etcd from community-operators
2. Add a bad config block into a subscription.
mac:~ jianzhang$ oc get sub -n default etcd -o yaml
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
...
spec:
  channel: singlenamespace-alpha
  config:
  - env:
    - name: PROXY_HTTP
      value: test
  installPlanApproval: Automatic
  name: etcd
  source: community-operators
  sourceNamespace: openshift-marketplace
  startingCSV: etcdoperator.v0.9.4



Actual results:

E0729 06:29:30.655645       1 reflector.go:126] pkg/lib/queueinformer/queueinformer_operator.go:152: Failed to list *v1alpha1.Subscription: v1alpha1.SubscriptionList.Items: []v1alpha1.Subscription: v1alpha1.Subscription.Spec: v1alpha1.SubscriptionSpec.Config: readObjectStart: expect { or n, but found [, error found in #10 byte of ...|"config":[{"env":[{"|..., bigger context ...|pec":{"channel":"singlenamespace-alpha","config":[{"env":[{"name":"PROXY_HTTP","value":"test"}]}],"i|...


Expected results:

Error saying that the format of the object is incorrect.

Additional info:

Comment 1 Jian Zhang 2019-08-05 02:37:41 UTC
Hi, Evan

I'm confused, this issue related to the CRD?

Comment 2 Evan Cordell 2019-08-05 13:16:48 UTC
Yes,

The CRD lacks the proper schema, which means that invalid data can make it to the operator.

Comment 4 Jian Zhang 2019-08-27 09:48:03 UTC
The latest payload is 4.2.0-0.nightly-2019-08-26-235330, but the OLM version is 414ead11612825cabf3fb44323b7018af04ada14 which this fixed PR hasn't been merged in.
mac:~ jianzhang$ oc exec catalog-operator-6b55979bdc-d9d2q -- olm --version
OLM version: 0.11.0
git commit: 414ead11612825cabf3fb44323b7018af04ada14

Change status to MODIFIED first.

Comment 6 Jian Zhang 2019-08-28 07:25:55 UTC
OLM version:
mac:~ jianzhang$ oc exec catalog-operator-5b7798599-jpkzb -- olm --version
OLM version: 0.11.0
git commit: 21160c27bcc7ecb34a7babf33d010c557e0f075f

Cluster version is 4.2.0-0.nightly-2019-08-28-004049

1, Create an OperatorGroup resource in the default project.
mac:~ jianzhang$ cat og.yaml 
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: test-og
  namespace: default
spec:
  targetNamespaces:
  - default
mac:~ jianzhang$ oc create -f og.yaml 
operatorgroup.operators.coreos.com/test-og created

2, Try to create the subscription with the config field, get the errors below.

mac:~ jianzhang$ oc create -f sub-etcd-42-config.yaml 
The Subscription "etcd-config-test" is invalid: []: Invalid value: map[string]interface {}{"apiVersion":"operators.coreos.com/v1alpha1", "kind":"Subscription", "metadata":map[string]interface {}{"creationTimestamp":"2019-08-28T06:53:52Z", "generation":1, "name":"etcd-config-test", "namespace":"default", "uid":"98a322d9-c960-11e9-9c68-0210964a06ba"}, "spec":map[string]interface {}{"channel":"singlenamespace-alpha", "config":[]interface {}{map[string]interface {}{"env":[]interface {}{map[string]interface {}{"name":"PROXY_HTTP", "value":"test"}}}}, "installPlanApproval":"Automatic", "name":"etcd", "source":"community-operators", "sourceNamespace":"openshift-marketplace", "startingCSV":"etcdoperator.v0.9.4"}}: validation failure list:
spec.config in body must be of type object: "array"

mac:~ jianzhang$ oc get sub
No resources found.

mac:~ jianzhang$ cat sub-etcd-42-config.yaml 
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: etcd-config-test
  namespace: default
spec:
  config:
  - env:
    - name: PROXY_HTTP
      value: test
  channel: singlenamespace-alpha
  installPlanApproval: Automatic
  name: etcd
  source: community-operators
  sourceNamespace: openshift-marketplace
  startingCSV: etcdoperator.v0.9.4


3, Create a subscription without the `config` field.
mac:~ jianzhang$ cat sub-etcd-42.yaml 
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: etcd-config-test
  namespace: default
spec:
  channel: singlenamespace-alpha
  installPlanApproval: Automatic
  name: etcd
  source: community-operators
  sourceNamespace: openshift-marketplace
  startingCSV: etcdoperator.v0.9.4

mac:~ jianzhang$ oc create -f sub-etcd-42.yaml 
subscription.operators.coreos.com/etcd-config-test created

mac:~ jianzhang$ oc get sub
NAME               PACKAGE   SOURCE                CHANNEL
etcd-config-test   etcd      community-operators   singlenamespace-alpha
mac:~ jianzhang$ oc get csv
NAME                  DISPLAY   VERSION   REPLACES              PHASE
etcdoperator.v0.9.4   etcd      0.9.4     etcdoperator.v0.9.2   Succeeded
mac:~ jianzhang$ oc get pods
NAME                             READY   STATUS    RESTARTS   AGE
etcd-operator-7dcf8b48c9-7vkfb   3/3     Running   0          72s

LGTM, verify it first.

One more question, I followed this https://github.com/operator-framework/operator-lifecycle-manager/blob/master/Documentation/contributors/design-proposals/operator-config.md#subscription-spec-changes to set the "config" field, but still get the above error.
So, what's the correct format for the `config` field? The JSON format of the above YAML as below, I guess this `config` field is an array.
Correct me if I'm wrong.

format 1:
{ apiVersion: 'operators.coreos.com/v1alpha1',
  kind: 'Subscription',
  metadata: { name: 'etcd-config-test', namespace: 'default' },
  spec: 
   { config: [ { env: [ { name: 'PROXY_HTTP', value: 'test' } ] } ],
     channel: 'singlenamespace-alpha',
     installPlanApproval: 'Automatic',
     name: 'etcd',
     source: 'community-operators',
     sourceNamespace: 'openshift-marketplace',
     startingCSV: 'etcdoperator.v0.9.4' } }

format 2:
{ apiVersion: 'operators.coreos.com/v1alpha1',
  kind: 'Subscription',
  metadata: { name: 'etcd-config-test', namespace: 'default' },
  spec: 
   { config: [ { env: null, test: [ { name: 'PROXY_HTTP', value: 'test' } ] } ],
     channel: 'singlenamespace-alpha',
     installPlanApproval: 'Automatic',
     name: 'etcd',
     source: 'community-operators',
     sourceNamespace: 'openshift-marketplace',
     startingCSV: 'etcdoperator.v0.9.4' } }

Both failed.

Comment 7 Abu Kashem 2019-09-02 14:41:20 UTC
- 'config' is not an array.
- 'env' is an array of object with 'name' and 'value'
 
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: etcd
namespace: local
spec:
  channel: singlenamespace-alpha
  name: etcd
  source: operatorhubio-catalog
  sourceNamespace: local
  config:
    env:
    - name: MY_ENV1
      value: "my_env1_value"
    - name: MY_ENV2
      value: "my_env2_value"
    - name: NO_PROXY
      value: "foo,bar"

Comment 8 errata-xmlrpc 2019-10-16 06:34:33 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2922


Note You need to log in before you can comment on or make changes to this bug.