NVIDIA / nodewright / 36760215515

83%

Build Type

push

github

Committed by web-flow

Commit Message

fix(operator)!: reject a runtime-required taint key that cannot name the autoTaint marker (#703)

* fix(operator): keep the autoTaint marker a valid annotation key

HandleAutoTaint marks a node it tainted with
nodewright.nvidia.com/autoTaint_<taintKey>. Validate accepts any taint
key ParseTaints does, so a DNS-prefixed key such as
example.com/runtime-required produced a name with a second "/", and a
long key one past the 63-character limit. The apiserver rejected the
patch, taking the taint in it too; the node stayed "new", HandleAutoTaint
failed on every reconcile, and since it runs first and returns early,
no NodeWright made progress.

autoTaintAnnotationKey replaces the key's "/" with "." and truncates an
over-long name. Keys that already produced a valid name, including the
default, keep it, and nothing reads the taint key back out of the name.

Fixes #702

Signed-off-by: Alex Yuskauskas <ayuskauskas@nvidia.com>

* fix(operator): reject a runtime-required taint key that cannot name the autoTaint marker

Per review, keep the marker name and reject the config instead of
renaming it. The taint key is operator config, so Validate now checks
that nodewright.nvidia.com/autoTaint_<key> is a valid annotation key,
next to the existing ParseTaints check. A DNS-prefixed key or one longer
than 53 characters stops the operator at startup with a clear message,
rather than wedging every reconcile the first time a NodeWright enables
autoTaintNewNodes.

autoTaintAnnotationKey is back to the historical name and remains the
one place it is built. The options spec no longer leaves MaxInterval
invalid after its first check, which had made every later rejection
pass for the wrong reason.

RELEASE_NOTES: an upgrade note, since an existing prefixed key now fails
startup. The chart value comment and runtime-required.md state the
constraint.

Signed-off-by: Alex Yuskauskas <ayuskauskas@nvidia.com>

* docs: note the autoTaint marker follows a custom runtime-required taint k... (continued)

Coverage Stats

9 of 9 new or added lines in 2 files covered. (100.0%)

9 existing lines in 1 file now uncovered.

9371 of 11361 relevant lines covered (82.48%)

7.64 hits per line