Kubernetes publisher: WithPersistentVolume name-match propagates invalid mount source name (containing dots) into StatefulSet podSpec volumes[].name

[mitchdenny]

Discovered while testing E2E PV durability for #16929 (issue #16999).

Symptom

When binding a Postgres resource to a first-class KubernetesPersistentVolumeResource using the name-match overload, the publisher generates an invalid StatefulSet:

StatefulSet.apps "pg-statefulset" is invalid:
  spec.template.spec.volumes[0].name: Invalid value:
    "k8sdeploypvtest.apphost-d10c8f5ce6-pg-data": must not contain dots
  spec.template.spec.containers[0].volumeMounts[0].name: Not found:
    "k8sdeploypvtest.apphost-d10c8f5ce6-pg-data"

Repro

var pgData = k8s.AddPersistentVolume("pg-data")
    .WithStorageClass("standard")
    .WithCapacity("1Gi")
    .WithAccessMode(PersistentVolumeAccessMode.ReadWriteOnce);

// No-arg WithDataVolume auto-generates a unique mount source name of the
// form "{AppHost}.{hash}-{name}" — e.g. "k8sdeploypvtest.apphost-d10c8f5ce6-pg-data"
var postgres = builder.AddPostgres("pg")
    .WithDataVolume()
    .WithPersistentVolume(pgData);

Root cause

KubernetesPersistentVolumeExtensions.WithPersistentVolume(IResourceBuilder<KubernetesPersistentVolumeResource>) matches the workload's existing ContainerMountAnnotation by source name and reuses that source name as the K8s volumes[].name ref in the podSpec. K8s requires that name to be a DNS_LABEL (lowercase, alphanumeric + dashes, no dots), but the auto-generated mount source can contain dots.

The PVC itself is named correctly (pg-data, the PV resource name) — only the podSpec ref is broken.

Workaround

Pass an explicit name to WithDataVolume("pg-data") so it matches the PV name directly. Used by the new E2E test (KubernetesDeployWithPersistentVolumeTests) to unblock CI.

Suggested fix

Normalize the mount source name to a DNS_LABEL when materializing the podSpec volume entry. The reference table built in KubernetesPublishingContext already has the binding-by-name, so we just need to apply something like HelmExtensions.ToKubernetesResourceName (or equivalent) at the podSpec-emit site.

cc @mitchdenny

[joperezr]

🤖 Aspire triage pass — 2026-05-16 08:08 UTC

Area: area-deployment
Kind: bug
Repro: yes-minimal — see the ## Repro block in the issue body
Affected version(s): not stated explicitly; K8s publisher path (KubernetesPersistentVolumeExtensions.WithPersistentVolume + auto-named WithDataVolume)
Severity: S3 — broken K8s podSpec emission with a documented in-issue workaround (pass explicit name to WithDataVolume("pg-data"))

Urgency: 🟡 vNext — recommend milestone 13.4
Reason: clean root-cause analysis with workaround; not a confirmed regression vs 13.2 (Kubernetes publisher PV binding is new code from the recent first-class PV work referenced by #16929/#16999). Worth fixing in next minor, not servicing.

Suggested owner(s): @eerhardt (score 9), backup @davidfowl (score 4)
Evidence:

• eerhardt closed (as assignee) aspire destroy --non-interactive requires --yes and exits 0 on failure #16623, PublishAsHostedAgent hangs resolving referenced ACA app endpoint during aspire deploy #16608, Valid App Service Environment Resource Name Leads to Invalid Bicep Identifier for Application Insights: bicepIdentifier should only contain letters, numbers, and underscores #16521, aspire deploy - Permission denied in Azure Pipelines #14523, [13.0.0] Aspire provision-sql-roles deployment fails when run by user/service principal #12986 in area-deployment within the last 180d
• davidfowl closed (as assignee) aspire deploy fails when using Podman without Docker Compose #13315, ParameterProcessor does not handle Parameters with different configuration section #13154 in area-deployment; CODEOWNERS lists @davidfowl on src/Aspire.Hosting
• Issue author @mitchdenny is the dominant Kubernetes publisher contributor (Enable Gateway API and AGC in AddAzureKubernetesEnvironment #16990, Add first-class Kubernetes Ingress and Gateway API resources #16487, Add Azure Kubernetes Service (AKS) hosting support #16088, Kubernetes publisher: cross-resource secret references generate broken Helm value paths #14370 — the analogous "Kubernetes publisher: cross-resource secret references" bug) but is excluded as the reporter; he is the natural domain reviewer
• CODEOWNERS does not list a dedicated owner for the Kubernetes publisher path; falling back to area-deployment closure leads

Confidence: high
Needs human?: no

Dry-run mode — no labels or milestone applied. Reply /triage apply to promote, or edit and reapply.