az aks create|nodepool add --labels - labels ignored if prefix contains '.'

[mathieu-benoit]

Describe the bug
az aks create|nodepool add --labels, labels are ignored if their prefix contains '.'.

To Reproduce

• az aks create --labels test.test/test=test
• or az aks nodepool add --labels test.test/test=test

Expected behavior
As described here https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set, prefix in labels could contain '.'. And I don't think this associated regex takes this into account: https://github.com/Azure/azure-cli/blob/dev/src/azure-cli/azure/cli/command_modules/acs/_validators.py#L291

Environment summary
Azure CLI 2.5.0 (aks-preview extension not installed)

Additional context
FYI, in my case, I would like to set this label to my User nodepool: kubernetes.azure.com/mode=user since it's not added for me.

[mathieu-benoit]

JFYI @jluk and @xizhamsft

[ghost]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @Azure/aks-pm.

[yonzhan]

aks

[djsly]

it seems that the logic for the node labels follows the more strict DNS-1123 standard.

While this is a valid standard for some names of resources in Kubernetes, the labels doesn't follow this standard

https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set

Labels are key/value pairs. Valid label keys have two segments: an optional prefix and name, separated by a slash (/). The name segment is required and must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), underscores (_), dots (.), and alphanumerics between. The prefix is optional. If specified, the prefix must be a DNS subdomain: a series of DNS labels separated by dots (.), not longer than 253 characters in total, followed by a slash (/).

[djsly]

https://github.com/kubernetes/kubernetes/blob/fdb2cb4c8832da1499069bda918c014762d8ac05/staging/src/k8s.io/apimachinery/pkg/util/validation/validation.go#L201-L212

is what Kubernetes uses to validate the DNS Prefixes

definition of a subdomain in DNS (RFC 1123)

[lilyjma]

@Azure/aks-pm please take a look!

[palma21]

Thanks folks anyone adventures a PR to fix it?

Otherwise adding @wenwu449 to add to the backlog

[seanmck]

Looks like an RP issue as problem repros in direct REST API calls as well. Also, it seems like it's the 2nd dot which is problematic.

[mathieu-benoit]

FYI @seanmck: I'm not able to reproduce the issue with Terraform: https://github.com/mathieu-benoit/myakscluster/blob/master/tf/aks.tf#L121

[github-actions]

Action required from @Azure/aks-pm

[ghost]

Action required from @Azure/aks-pm

[ghost]

Action required from @Azure/aks-pm

[gtxistxgao]

@mathieu-benoit

Tried to reproduce in az cli version 2.10. aks-preview extension not installed. Both az aks nodepool add --labels and az aks create --node-labels work well.

~$ az aks nodepool add --resource-group xxx --cluster-name xxxdemo --name nodepool3 --labels a.b/c=d -c 1
~$ k get node --show-labels | grep a.b/c=d
aks-nodepool3-xxx-vmss000000 Ready agent 6m25s v1.16.10 a.b/c=d,agentpool=nodepool3,beta.kubernetes.io/arch=amd64,beta.kubernetes.io/instance-type=Standard_DS2_v2,beta.kubernetes.io/os=linux,failure-domain.beta.kubernetes.io/region=westus2,failure-domain.beta.kubernetes.io/zone=0,kubernetes.azure.com/cluster=MC_xxx_xxxdemo_westus2,kubernetes.azure.com/node-image-version=AKSUbuntu-1604-2020.06.30,kubernetes.azure.com/role=agent,kubernetes.io/arch=amd64,kubernetes.io/hostname=aks-nodepool3-xxx-vmss000000,kubernetes.io/os=linux,kubernetes.io/role=agent,node-role.kubernetes.io/agent=,storageprofile=managed,storagetier=Premium_LRS

~$ az aks create --resource-group xxx --name xxxdemo2 --nodepool-labels a.b/c=d -c 1
~$ k get node --show-labels
NAME STATUS ROLES AGE VERSION LABELS
aks-nodepool1-xxx-vmss000000 Ready 3s v1.16.10 a.b/c=d,agentpool=nodepool1,beta.kubernetes.io/arch=amd64,beta.kubernetes.io/instance-type=Standard_DS2_v2,beta.kubernetes.io/os=linux,failure-domain.beta.kubernetes.io/region=westus2,failure-domain.beta.kubernetes.io/zone=0,kubernetes.azure.com/cluster=MC_xxx_xxxdemo2_westus2,kubernetes.azure.com/mode=system,kubernetes.azure.com/node-image-version=AKSUbuntu-1604-2020.06.30,kubernetes.azure.com/role=agent,kubernetes.io/arch=amd64,kubernetes.io/hostname=aks-nodepool1-xxx-vmss000000,kubernetes.io/os=linux,storageprofile=managed,storagetier=Premium_LRS

[ghost]

This issue has been automatically marked as stale because it has not had any activity for 60 days. It will be closed if no further activity occurs within 15 days of this comment.

[ghost]

This issue will now be closed because it hasn't had any activity for 15 days after stale. mathieu-benoit feel free to comment again on the next 7 days to reopen or open a new issue after that time if you still have a question/issue or suggestion.