Bug 1776914 - [sriov] sriov webhook should validate the resourcename in SriovNetworkNodePolicy
Summary: [sriov] sriov webhook should validate the resourcename in SriovNetworkNodePolicy
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 4.3.0
Hardware: All
OS: All
medium
medium
Target Milestone: ---
: 4.3.0
Assignee: Peng Liu
QA Contact: zhaozhanqi
URL:
Whiteboard:
Depends On: 1774419
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-11-26 15:02 UTC by Peng Liu
Modified: 2020-01-23 11:14 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1774419
Environment:
Last Closed: 2020-01-23 11:14:35 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift sriov-network-operator pull 134 0 'None' closed [release-4.3] Bug 1776914: Webhook Add validation for resourceName 2020-07-04 00:43:16 UTC
Red Hat Product Errata RHBA-2020:0062 0 None None None 2020-01-23 11:14:46 UTC

Description Peng Liu 2019-11-26 15:02:00 UTC
+++ This bug was initially created as a clone of Bug #1774419 +++

Description of problem:
When creating cr SriovNetworkNodePolicy with "resourceName: intel-rhel".  the device-plugin pod creashed with error: 

oc logs sriov-device-plugin-klb2t
I1120 09:36:40.274970      20 manager.go:70] Using Kubelet Plugin Registry Mode
I1120 09:36:40.275183      20 main.go:44] resource manager reading configs
I1120 09:36:40.275746      20 manager.go:98] ResourceList: [{ResourceName:intelnetdevice-rhel IsRdma:false Selectors:{Vendors:[8086] Devices:[] Drivers:[iavf mlx5_core i40evf ixgbevf] PfNames:[p1p1] LinkTypes:[]}}]
E1120 09:36:40.275876      20 manager.go:161] resource name "intelnetdevice-rhel" contains invalid characters
F1120 09:36:40.275901      20 main.go:57] Exiting.. one or more invalid configuration(s) given

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Assume the sriov operator is installed
2. Create one CR with:
apiVersion: sriovnetwork.openshift.io/v1
kind: SriovNetworkNodePolicy
metadata:
  name: intel-netdevice-rhel
  namespace: openshift-sriov-network-operator
spec:
  deviceType: netdevice
  mtu: 1500
  nicSelector:
    pfNames:
      - p1p1
    rootDevices:
      - '0000:3b:00.0'
    vendor: '8086'
  nodeSelector:
    feature.node.kubernetes.io/sriov-capable-rhel: 'true'
  numVfs: 5
  priority: 99
  resourceName: intel-rhel
3. oc get pod
4. 

Actual results:

oc logs sriov-device-plugin-klb2t
I1120 09:36:40.274970      20 manager.go:70] Using Kubelet Plugin Registry Mode
I1120 09:36:40.275183      20 main.go:44] resource manager reading configs
I1120 09:36:40.275746      20 manager.go:98] ResourceList: [{ResourceName:intelnetdevice-rhel IsRdma:false Selectors:{Vendors:[8086] Devices:[] Drivers:[iavf mlx5_core i40evf ixgbevf] PfNames:[p1p1] LinkTypes:[]}}]
E1120 09:36:40.275876      20 manager.go:161] resource name "intelnetdevice-rhel" contains invalid characters
F1120 09:36:40.275901      20 main.go:57] Exiting.. one or more invalid configuration(s) given

Expected results:

Webhook should add validation for resourceName.

Additional info:

--- Additional comment from Peng Liu on 2019-11-25 09:32:59 UTC ---

The sriov-network-device-plugin only allows the resourceNames which follow '^[a-zA-Z0-9-]+$'. I guess the intention is to follow rfc952. However, in rfc952, '-' is a valid character. The sriov-network-device-plugin code may also need to be fixed.

Comment 2 zhaozhanqi 2019-12-05 08:05:48 UTC
Verified this bug on quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:6f3948b904f24b7f0d0b3b4ed82f56000e0d975c84b572c3c49379004920576a

Error from server (resource name "intel-rhel" contains invalid characters): error when creating "sriovcr.yaml": admission webhook "operator-webhook.sriovnetwork.openshift.io" denied the request: resource name "intel-rhel" contains invalid characters

Comment 4 errata-xmlrpc 2020-01-23 11:14:35 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0062


Note You need to log in before you can comment on or make changes to this bug.