statefulset don't have podSpec validation

[Lion-Wei]

What happened:

Currently statefulset don't have podSpec validation, which might result in we can create statefulset with invalid podSpec, but this statefulset can't create any pod.

# k create -f sts.yaml
statefulset.apps/sts-test created

# k describe  sts sts-test
Events:
  Type     Reason        Age                From                    Message
  ----     ------        ----               ----                    -------
  Warning  FailedCreate  5s (x13 over 25s)  statefulset-controller  create Pod sts-test-0 in StatefulSet sts-test failed error: Pod "sts-test-0" is invalid: spec.containers[0].name: Invalid value: "container-0asaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa": must be no more than 63 characters

What you expected to happen:

Statefulset validation should cover PodTemplateSpec validation.

How to reproduce it (as minimally and precisely as possible):

Create a statefulset with invalid podSpec, like container name more then 63 characters. For example:

apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app: sts-test
  name: sts-test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sts-test
  serviceName: headless-service
  template:
    metadata:
      labels:
        app: sts-test
    spec:
      containers:
      - image: nginx:latest
        imagePullPolicy: IfNotPresent
        name: container-0asaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      restartPolicy: Always
      schedulerName: default-scheduler
      terminationGracePeriodSeconds: 30

Anything else we need to know?:

I can see ValidatePodTemplateSpec function in ValidatePodTemplateSpecForStatefulSet be commented, which said check volumes will fail for statefulset, I don't know this background, do we have any schedule to fix this TODO?

kubernetes/pkg/apis/apps/validation/validation.go

Lines 47 to 62 in a51d574

	func ValidatePodTemplateSpecForStatefulSet(template *api.PodTemplateSpec, selector labels.Selector, fldPath *field.Path) field.ErrorList {
	allErrs := field.ErrorList{}
	if template == nil {
	allErrs = append(allErrs, field.Required(fldPath, ""))
	} else {
	if !selector.Empty() {
	// Verify that the StatefulSet selector matches the labels in template.
	labels := labels.Set(template.Labels)
	if !selector.Matches(labels) {
	allErrs = append(allErrs, field.Invalid(fldPath.Child("metadata", "labels"), template.Labels, "`selector` does not match template `labels`"))
	}
	}
	// TODO: Add validation for PodSpec, currently this will check volumes, which we know will
	// fail. We should really check that the union of the given volumes and volumeClaims match
	// volume mounts in the containers.
	// allErrs = append(allErrs, apivalidation.ValidatePodTemplateSpec(template, fldPath)...)

Environment:

• Kubernetes version (use kubectl version): master

[Lion-Wei]

@kubernetes/sig-apps-bugs

[liggitt]

see #64841 for issues with tightening validation

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.