Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Most RKE1 Cluster YAML keys are not validated before cluster creation #5676

Closed
Tracked by #5983
rosskirkpat opened this issue Apr 21, 2022 · 3 comments
Closed
Tracked by #5983

Comments

@rosskirkpat
Copy link

Setup

  • Rancher version: v2.6.5-rc1
  • Browser type & version: Firefox 98.0.2 on MacOS 12.2.1

Describe the bug

Most RKE1 cluster yaml keys are not validated prior to cluster creation. Any keys that are are camel cased or begin with an uppercase letter are not flagged as invalid and the values for those keys will be lost once the cluster is created.

To Reproduce
Create an RKE1 cluster by editing via YAML and using uppercase keys

Result
Any keys that are uppercase are replaced with their default values and lose the configured value.

Expected Result
The UI should validate all cluster yaml keys and block cluster creation if any configured keys are invalid, same as it does for name and rancher_kubernetes_engine_config.

Additional context
It currently appears to only validate the name and rancher_kubernetes_engine_config keys

Here are the three cluster yamls from each stage shown in the screenshots

Screenshots

Screen Shot 2022-04-21 at 5 25 12 PM

Screen Shot 2022-04-21 at 5 26 44 PM

Screen Shot 2022-04-21 at 5 27 11 PM

Screen Shot 2022-04-21 at 5 28 07 PM

@rosskirkpat
Copy link
Author

This issue was discovered while investigating a docs issue with secret_encryption_config in RKE1 clusters.

Following the docs here, I specified the following in kube_api:

Before:
Screen Shot 2022-04-21 at 5 25 49 PM

    kube_api:
      always_pull_images: false
      pod_security_policy: false
      secrets_encryption_config:
        enabled: true
        custom_config:
          api_version: apiserver.config.k8s.io/v1
          kind: EncryptionConfiguration
          Resources:
          - Providers:
            - AESCBC:
                Keys:
                  - Name: key1
                    Secret: b6E0EuBMGOV86UVC76SzUqRAxECZOdK7+tWSzaIP4dk=
              Resources:
                - secrets
            - identity: {}
        service_node_port_range: 30000-32767

This configuration passed validation but ended up as

    kube-api:
      always_pull_images: false
      pod_security_policy: false
      secrets_encryption_config:
        custom_config:
          api_version: apiserver.config.k8s.io/v1
          kind: EncryptionConfiguration
        enabled: true
      service_node_port_range: 30000-32767

After:

Screen Shot 2022-04-21 at 5 53 28 PM

@slickwarren slickwarren self-assigned this Apr 21, 2022
@slickwarren slickwarren added this to the v2.6.5 milestone Apr 21, 2022
@slickwarren slickwarren added the team/area2 Hostbusters label Apr 21, 2022
@gaktive gaktive modified the milestones: v2.6.5, v2.6.6 Apr 25, 2022
@nwmac nwmac added ember Ember UI Issue size/3 Size Estimate 3 labels May 6, 2022
@gaktive gaktive modified the milestones: v2.6.6, v2.6.x May 25, 2022
@gaktive gaktive added kind/bug and removed bug labels Jun 2, 2022
@catherineluse
Copy link
Contributor

catherineluse commented Nov 5, 2022

It should be a higher priority to fix the docs issue (the incorrectly capitalized keys https://rancher.com/docs/rke/latest/en/config-options/secrets-encryption/#example-using-custom-encryption-configuration-with-user-provided-32-byte-random-key) than it is to add this validation here. Normally we only validate the forms, whereas in YAML, we expect the user to be following docs. So if there's a problem with the docs, that should be fixed first.

I have opened a docs ticket here: https://github.com/rancher/docs/issues/4346

@gaktive
Copy link
Member

gaktive commented Oct 17, 2024

Closing since docs were updated and validation not possible in code.

@gaktive gaktive closed this as completed Oct 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

5 participants