Automated cherry pick of #17973

pkg/api/validation/validation.go

@@ -1115,6 +1115,12 @@ func ValidatePodSpec(spec *api.PodSpec) errs.ValidationErrorList {
 		}
 	}
 
+	if len(spec.NodeName) > 0 {
+		if ok, msg := ValidateNodeName(spec.NodeName, false); !ok {
+			allErrs = append(allErrs, errs.NewFieldInvalid("nodeName", spec.NodeName, msg))
+		}
+	}
+
 	if spec.ActiveDeadlineSeconds != nil {
 		if *spec.ActiveDeadlineSeconds <= 0 {
 			allErrs = append(allErrs, errs.NewFieldInvalid("activeDeadlineSeconds", spec.ActiveDeadlineSeconds, "activeDeadlineSeconds must be a positive integer greater than 0"))

pkg/api/validation/validation_test.go

@@ -1341,6 +1341,13 @@ func TestValidatePodSpec(t *testing.T) {
 			DNSPolicy:             api.DNSClusterFirst,
 			ActiveDeadlineSeconds: &activeDeadlineSeconds,
 		},
+		"bad nodeName": {
+			NodeName:      "node name",
+			Volumes:       []api.Volume{{Name: "vol", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}}},
+			Containers:    []api.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent"}},
+			RestartPolicy: api.RestartPolicyAlways,
+			DNSPolicy:     api.DNSClusterFirst,
+		},
 	}
 	for k, v := range failureCases {
 		if errs := ValidatePodSpec(&v); len(errs) == 0 {

pkg/client/unversioned/kubelet.go

@@ -18,7 +18,10 @@ package unversioned
 
 import (
 	"errors"
+	"fmt"
 	"net/http"
+
+	"k8s.io/kubernetes/pkg/api/validation"
 )
 
 // KubeletClient is an interface for all kubelet functionality
@@ -75,6 +78,9 @@ func NewKubeletClient(config *KubeletConfig) (KubeletClient, error) {
 }
 
 func (c *HTTPKubeletClient) GetConnectionInfo(host string) (string, uint, http.RoundTripper, error) {
+	if ok, msg := validation.ValidateNodeName(host, false); !ok {
+		return "", 0, nil, fmt.Errorf("invalid node name: %s", msg)
+	}
 	scheme := "http"
 	if c.Config.EnableHttps {
 		scheme = "https"

pkg/client/unversioned/kubelet_test.go

@@ -82,6 +82,7 @@ func TestNewKubeletClientTLSInvalid(t *testing.T) {
 
 func TestNewKubeletClientTLSValid(t *testing.T) {
 	config := &KubeletConfig{
+		Port:        1234,
 		EnableHttps: true,
 		TLSClientConfig: TLSClientConfig{
 			CertFile: "../testdata/mycertvalid.cer",
@@ -99,4 +100,27 @@ func TestNewKubeletClientTLSValid(t *testing.T) {
 	if client == nil {
 		t.Error("client should not be nil")
 	}
+
+	{
+		scheme, port, transport, err := client.GetConnectionInfo("foo")
+		if err != nil {
+			t.Errorf("Error getting info: %v", err)
+		}
+		if scheme != "https" {
+			t.Errorf("Expected https, got %s", scheme)
+		}
+		if port != 1234 {
+			t.Errorf("Expected 1234, got %d", port)
+		}
+		if transport == nil {
+			t.Errorf("Expected transport, got nil")
+		}
+	}
+
+	{
+		_, _, _, err := client.GetConnectionInfo("foo bar")
+		if err == nil {
+			t.Errorf("Expected error getting connection info for invalid node name, got none")
+		}
+	}
 }