giantswarm / kyverno-policy-operator

Apache License 2.0
0 stars 0 forks source link

Truncate name size when the name is too long #122

Closed fhielpos closed 3 months ago

fhielpos commented 3 months ago

Description

This PR addresses an issue where if the name of a Deployment was too long, Kubernetes would truncate it in order to be able to add Pod identifiers to it.

fhielpos commented 3 months ago

I created a PolicyException with a super long name:

spec:
  policies:
  - disallow-capabilities-strict
  - disallow-privilege-escalation
  - require-run-as-nonroot
  - restrict-seccomp-strict
  targets:
  - kind: Deployment
    names:
    - this-is-a-really-long-deployment-name-that-i-hope-is-longer-than-63-chars
    namespaces:
    - test

The output of the Kyverno PolicyException is as expected:

    match:
      any:
      - resources:
          kinds:
          - Deployment
          - ReplicaSet
          - Pod
          names:
          - this-is-a-really-long-deployment-name-that-i-hope-is-longe*
          namespaces:
          - test

Incredibly enough, Kubernetes let me create the deployment as is:

Warning: metadata.name: this is used in Pod names and hostnames, which can result in surprising behavior; a DNS label is recommended: [must be no more than 63 characters]
deployment.apps/this-is-a-really-long-deployment-name-that-i-hope-is-longer-than-63-chars created

And the Pods followed the 59 char limit:

NAME                                                              READY   STATUS    RESTARTS   AGE
this-is-a-really-long-deployment-name-that-i-hope-is-longexw8j6   1/1     Running   0          3m57s
                                                         ^
                                                         | - 59 chars
fhielpos commented 3 months ago

Will merge this one for now. It works as expected, probably could be improved in the future and split Deployment and Pods, but this at least will fix the issues we are seeing now.