Azure / AKS

Azure Kubernetes Service
1.92k stars 284 forks source link

[Feature] Auto detect invisible/zero-width character and reject the input #4235

Closed JoeyC-Dev closed 3 weeks ago

JoeyC-Dev commented 3 weeks ago

Is your feature request related to a problem? Please describe. Sometimes, customers will accidentally put a invisible/zero-width character in the yaml like below:

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: azure-kvname-wi 
spec:
  provider: azure
  parameters:
    usePodIdentity: "false"
    clientID: 00000000-0000-0000-0000-000000000000​
    keyvaultName: ${KEYVAULT_NAME}
    cloudName: ""
    objects:  |
      array:
        - |
          objectName: secret1 
          objectType: secret 
          objectVersion: ""      
    tenantId: "${IDENTITY_TENANT}" 

image

You actually can apply the yaml like above into AKS and cause the problem that is very hard to discover. The last time I encountered this problem, it took three days to find out as the configuration itself is totally okay (except this zero-width character).

Describe the solution you'd like Will reject the input and prompt related info if find out any content includes zero-width or invisible character.

Describe alternatives you've considered None

Additional context This is the third time I faced this problem with customer so I believe this is something needed. It is just harsh for anyone to find out the root cause like this.

PixelRobots commented 3 weeks ago

It may be better to put this request on the secret store provider Git repo as they might be able to add validation in. https://github.com/Azure/secrets-store-csi-driver-provider-azure

JoeyC-Dev commented 3 weeks ago

@PixelRobots Thank you for your suggestion. I will submit a feature request tomorrow and close this one after then.