Repository navigation
Commit c6444ab
committed
fix(kubernetes): validate kernelModules and schematicID before the shell
Review B1. The worker machine config is written through
`cat <<EOF | kubectl apply -f -` with an unquoted delimiter, which the
script needs so ${RELEASE} and friends expand and which therefore expands
everything else in the block. kernelModules[].name,
kernelModules[].parameters[] and schematicID are free-form strings from a
tenant-facing CR that land in it verbatim: a module name of `nvidia$(id)`
runs `id` inside the talos-reconcile pod, whose ServiceAccount can write
TalosConfigTemplates and read Talos secrets.
Guard all three at render time with regexMatch and fail, the convention
cluster.yaml already uses for the kubelet reservation strings in the same
block. cozyvalues-gen has no pattern vocabulary, so values.schema.json
cannot carry this.
Module names take ^[a-z0-9_-]+$ and parameters ^[A-Za-z0-9_.,:=+/-]+$,
validated only when the operator supplied the list — the automatic NVIDIA
set is valid by construction. schematicID takes ^[0-9a-f]{64}$, the whole
of an image-factory digest's syntax, and is validated on the EFFECTIVE
value, which also closes the pre-existing path through the cluster-wide
talos.schematicID.
Review B2. Document that kernelModules does not reach workers that
already exist: MachineDeployment.spec.template.spec.bootstrap.configRef
names a fixed TalosConfigTemplate, so rewriting the template leaves
spec.template untouched, CAPI starts no rollout, and a running Machine
keeps the config it booted with. The asymmetry with schematicID, which
rolls the group by changing its boot image, is now stated in both.
Refs: #3563
Assisted-By: Claude <[email protected]>
Signed-off-by: Mattia Eleuteri <[email protected]>1 parent b507cb5 commit c6444ab
18 files changed
Lines changed: 300 additions & 73 deletions
File tree
- api/apps/v1alpha1
- kubernetesnodes
- kubernetes
- packages
- apps
- kubernetes-nodes
- templates
- tests
- kubernetes
- templates
- talos
- tests
- system
- kubernetes-nodes-rd/cozyrds
- kubernetes-rd/cozyrds
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments