feat(vm): validate cloud-init userdata by hardcoretime · Pull Request #1937 · deckhouse/virtualization

hardcoretime · 2026-01-29T23:22:38Z

Description

Cloud-init userdata in the virtual machine specification should not be empty or exceed 2048 KB.

Why do we need it, and what problem does it solve?

These changes are required to prevent the virtual machine from entering a pending status due to incorrect cloud-init userdata.

What is the expected result?

Webhook prevents virtual machine creation or update with incorrect cloud-init userdata and Provisioning Handler return an error if resource was created with invalidated data.

Checklist

The code is covered by unit tests.
e2e tests passed.
Documentation updated according to the changes.
Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: vm
type: feature
summary: "Cloud-init userdata is now validated during virtual machine creation and updates."

deckhouse-BOaTswain · 2026-01-29T23:54:37Z

Workflow has started.
Follow the progress here: Workflow Run

The target step completed with status: failure.

Signed-off-by: Roman Sysoev <roman.sysoev@flant.com>

Isteb4k · 2026-01-30T16:28:02Z

images/virtualization-artifact/pkg/controller/service/provisioning_service.go

+	return nil
+}
+
+func (p *ProvisioningService) validateSysprepSecret(_ *corev1.Secret) error {


Overengineering. Code that does nothing. Remove everything unnecessary

Keep It Simple

Isteb4k · 2026-01-30T16:33:17Z

images/virtualization-artifact/pkg/controller/service/provisioning_service.go

+}
+
+func (p *ProvisioningService) ValidateUserDataLen(userData string) error {
+	if userData == "" {


trim it before validation

Isteb4k · 2026-01-30T16:36:14Z

images/virtualization-artifact/pkg/controller/service/provisioning_service.go

+	validate := len(checkKeys) == 0
+	for _, key := range checkKeys {
+		if _, ok := secret.Data[key]; ok {
+			validate = true


The variable is named incorrectly, and you can actually get rid of it

Keep It Simple

Isteb4k · 2026-01-30T16:44:20Z

images/virtualization-artifact/pkg/controller/service/provisioning_service.go

+	err := p.reader.Get(ctx, key, secret)
+	if err != nil {
+		if k8serrors.IsNotFound(err) {
+			return SecretNotFoundError(key.String())


Overengineering. The error looks cool, but you’re not using its advantages. You’re just putting it into a condition afterward. Just return a simple fmt.Errorf

Keep It Simple

Isteb4k · 2026-01-30T16:47:08Z

images/virtualization-artifact/pkg/controller/vm/internal/validators/provisioning_validator.go

+	provisioningService *service.ProvisioningService
+}
+
+func NewProvisioningValidator(provisioningService *service.ProvisioningService) *ProvisioningValidator {


It looks like you can use CEL rules instead

Isteb4k · 2026-01-30T16:49:06Z

images/virtualization-artifact/pkg/controller/service/provisioning_service.go

+	reader client.Reader
+}
+
+func NewProvisioningService(reader client.Reader) *ProvisioningService {


Why is this here and not inside the vm directory?

Isteb4k · 2026-01-30T16:52:24Z

images/virtualization-artifact/pkg/controller/service/provisioning_service.go

+
+func (p *ProvisioningService) validateCloudInitSecret(secret *corev1.Secret) error {
+	if !p.hasOneOfKeys(secret, cloudInitCheckKeys...) {
+		return fmt.Errorf("the secret should have one of data fields %v: %w", cloudInitCheckKeys, ErrSecretIsNotValid)


"the specified provisioning secret %q must have at least one of the following fields: %v: %w"

Isteb4k · 2026-01-30T16:54:01Z

images/virtualization-artifact/pkg/controller/vm/internal/provisioning.go

 		builder.Status(metav1.ConditionFalse).
 			Reason(vmcondition.ReasonProvisioningNotReady).
 			Message(service.CapitalizeFirstLetter(err.Error()))
 		return nil


This is a bug. It’s not the user’s fault. Shouldn’t this be validated at the CRD level?

Isteb4k · 2026-01-30T16:55:52Z

images/virtualization-artifact/pkg/controller/vm/internal/provisioning.go

+	case errors.Is(err, service.ErrSecretIsNotValid):
 		builder.Status(metav1.ConditionFalse).
 			Reason(vmcondition.ReasonProvisioningNotReady).
 			Message(fmt.Sprintf("Invalid secret %q: %s", secretKey.String(), err.Error()))


It should already be clear from err.Error() that the secret failed validation. No need to duplicate this "Invalid secret"

Isteb4k · 2026-01-30T16:56:17Z

images/virtualization-artifact/pkg/controller/vm/internal/provisioning.go

-		} else {
+		err := h.provisioningService.ValidateUserDataLen(p.UserData)
+		if err != nil {
+			errMsg := fmt.Errorf("failed to validate userdata length: %w", err)


err = fmt.Errorf("failed to validate userdata length: %w", err)

No need to create one more variable

github-actions bot assigned hardcoretime Jan 29, 2026

hardcoretime added this to the v1.5.0 milestone Jan 29, 2026

hardcoretime changed the title ~~feat(vm): validate cloud init userdata~~ feat(vm): validate cloud-init userdata Jan 29, 2026

hardcoretime force-pushed the feat/vm/validate-cloud-init-userdata branch from d5074c3 to 150f8a7 Compare January 29, 2026 23:41

hardcoretime added the e2e/run Run e2e test on cluster of PR author label Jan 29, 2026

deckhouse-BOaTswain removed the e2e/run Run e2e test on cluster of PR author label Jan 30, 2026

hardcoretime force-pushed the feat/vm/validate-cloud-init-userdata branch from 150f8a7 to 4c1d8d4 Compare January 30, 2026 11:49

feat(vm): validate cloud init userdata

9b93aa5

Signed-off-by: Roman Sysoev <roman.sysoev@flant.com>

hardcoretime force-pushed the feat/vm/validate-cloud-init-userdata branch 2 times, most recently from d831e4b to 298e709 Compare January 30, 2026 14:36

test(vm): add userdata validation unit test

c907d80

Signed-off-by: Roman Sysoev <roman.sysoev@flant.com>

hardcoretime force-pushed the feat/vm/validate-cloud-init-userdata branch from 298e709 to c907d80 Compare January 30, 2026 15:01

hardcoretime added validation/skip/no_cyrillic Skip no_cyrillic validation validation/skip/doc_changes Skip doc changes validation and removed validation/skip/no_cyrillic Skip no_cyrillic validation labels Jan 30, 2026

hardcoretime marked this pull request as ready for review January 30, 2026 16:00

hardcoretime requested review from Isteb4k, fl64, goganat, yaroslavborbat and z9r5 as code owners January 30, 2026 16:00

Isteb4k requested changes Jan 30, 2026

View reviewed changes

z9r5 approved these changes Jan 31, 2026

View reviewed changes

hardcoretime marked this pull request as draft February 6, 2026 07:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(vm): validate cloud-init userdata#1937

feat(vm): validate cloud-init userdata#1937
hardcoretime wants to merge 2 commits intomainfrom
feat/vm/validate-cloud-init-userdata

hardcoretime commented Jan 29, 2026 •

edited

Loading

Uh oh!

deckhouse-BOaTswain commented Jan 29, 2026 •

edited

Loading

Uh oh!

Isteb4k Jan 30, 2026 •

edited

Loading

Uh oh!

Isteb4k Jan 30, 2026

Uh oh!

Isteb4k Jan 30, 2026 •

edited

Loading

Uh oh!

Isteb4k Jan 30, 2026

Uh oh!

Isteb4k Jan 30, 2026

Uh oh!

Isteb4k Jan 30, 2026

Uh oh!

Isteb4k Jan 30, 2026

Uh oh!

Isteb4k Jan 30, 2026

Uh oh!

Isteb4k Jan 30, 2026

Uh oh!

Isteb4k Jan 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

hardcoretime commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Why do we need it, and what problem does it solve?

What is the expected result?

Checklist

Changelog entries

Uh oh!

deckhouse-BOaTswain commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Isteb4k Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Isteb4k Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

hardcoretime commented Jan 29, 2026 •

edited

Loading

deckhouse-BOaTswain commented Jan 29, 2026 •

edited

Loading

Isteb4k Jan 30, 2026 •

edited

Loading

Isteb4k Jan 30, 2026 •

edited

Loading