search

external-secrets / external-secrets

External Secrets Operator reads information from a third-party service like AWS Secrets Manager and automatically injects the values as Kubernetes Secrets.
https://external-secrets.io/main
Apache License 2.0
4.51k stars 852 forks source link

Helm chart can generate resource names longer than the 63 character DNS limit #1997

Open isker opened 1 year ago

isker commented 1 year ago

Kubernetes requires certain names (at least metadata.name and label names/values) to be <64 characters long, to comply with DNS limits. The helm chart can generate names longer than this, in spite of attempting not to.

The default value of external-secrets.fullname is properly truncated: https://github.com/external-secrets/external-secrets/blob/fe3c78d2af1202331df6bfbc7237f5f310dd5c21/deploy/charts/external-secrets/templates/_helpers.tpl#L8-L24

But it is then appended to in length-sensitive contexts without further truncation: https://github.com/external-secrets/external-secrets/blob/fe3c78d2af1202331df6bfbc7237f5f310dd5c21/deploy/charts/external-secrets/templates/webhook-deployment.yaml#L5

This bit me when installing the helm chart with AWS CDK, which is notorious for generating long resource names. I ended up with failures like this:

Error: Service "itlabcirunnerstackclusterchartexternalsecrets449a9ff5-external-webhook" is invalid: metadata.name: Invalid value: "itlabcirunnerstackclusterchartexternalsecrets449a9ff5-external-webhook": must be no more than 63 characters'

This is easily fixed by parameterizing the helm chart installation with a shorter non-default full name, but it might be worth making the defaults work in all cases.

github-actions[bot] commented 1 year ago

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 30 days.

isker commented 1 year ago

As far as I can tell this issue has not been addressed.