zarf-dev / zarf

DevSecOps for Air Gap & Limited-Connection Systems. https://zarf.dev/
Apache License 2.0
1.39k stars 169 forks source link

Detect Invalid Helm Release Names Before Deployment #2776

Closed jamestexas closed 2 months ago

jamestexas commented 2 months ago

Is your feature request related to a problem? Please describe.

There is an inconsistency between what Zarf allows in Helm chart releaseName and what the Kubernetes API server accepts when creating resources. Specifically, Zarf allows release names that include periods (e.g., ollama-0.47.0), which conform to RFC 1123 Label Names. However, these names cause errors when Kubernetes attempts to create certain resources, despite being theoretically valid according to the naming conventions.

Describe the expected behavior

Steps to reproduce

  1. Create a zarf.yaml file with the following content:
kind: ZarfPackageConfig
metadata:
  name: ollama-api
  description: "A Zarf Package for deploying Ollama on Kubernetes."

components:
  - name: ollama-helm
    description: "Deploys Ollama API service"
    charts:
      - name: ollama
        url: https://otwld.github.io/ollama-helm
        releaseName: "ollama-0.47.0" # This causes issues with some Kubernetes resources
        version: 0.47.0
        namespace: ollama
  1. Run zarf lint
Lint Output ```shell ┌[17:00:03]─────> │ github.com/jamestexas/ollama-demo └> zarf dev lint . NOTE Saving log file to /var/folders/qh/9h3zdnss3sq ```
  1. Run zarf package create . --confirm
    Create Output
┌[17:00:12]─────>
│ github.com/jamestexas/ollama-demo
└> zarf package create . --confirm

 NOTE  Saving log file to
       /var/folders/qh/9h3zdnss3sq7c0688kzzw4l40000gn/T/zarf-2024-07-26-18-02-03-3751241269.log

 NOTE  Using build directory .

  📦 PACKAGE DEFINITION

kind: ZarfPackageConfig

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
metadata:  information about this package

  name: ollama-api
  description: A Zarf Package for deploying Ollama on Kubernetes.
  architecture: arm64

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
components:  components selected for this operation

- name: ollama-helm
  description: Deploys Ollama API service
  charts:
  - name: ollama
    version: 0.47.0
    url: https://otwld.github.io/ollama-helm
    namespace: ollama
    releaseName: ollama-0.47.0

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ✔  Create Zarf package confirmed

  📦 OLLAMA-HELM COMPONENT

  ✔  Processing helm chart ollama:0.47.0 from repo https://otwld.github.io/ollama-helm
  ✔  Creating SBOMs for 0 images and 0 components with files.
  ✔  Package saved to "zarf-package-ollama-api-arm64.tar.zst"

  1. Run zarf package deploy
Package Deploy Output ```shell Deploys Ollama API service ? Deploy the ollama-helm component? Yes ✔ Waiting for cluster connection ✔ Gathering additional cluster information (if available) 📦 OLLAMA-HELM COMPONENT ✔ Loading the Zarf State from the Kubernetes cluster ⠙ warning: Upgrade "ollama-0.47.0" failed: failed to create resource: Service "ollama-0.47.0" is invalid: metadata.name: Invalid value: "ollama-0.47.0": a DNS-1035 label must consist of lower case alphanumeric characters or '-', start with an alphabetic character, and end with an alphanumeric character (e.g. 'my-name', or 'abc-123', regex used for validation is '[a-z]([-a-z0-9]*[a-z0-9])?') WARNING Attempt (1/3) failed with: failed to create resource: Service "ollama-0.47.0" is invalid: metadata.name: Invalid value: "ollama-0.47.0": a DNS-1035 label must consist of lower case alphanumeric characters or '-', start with an alphabetic character, and end with an alphanumeric character (e.g. 'my-name', or 'abc-123', regex used for validation is '[a-z]([-a-z0-9]*[a-z0-9])?') WARNING Retrying in 5s ⠹ warning: Upgrade "ollama-0.47.0" failed: failed to create resource: Service "ollama-0.47.0" is invalid: metadata.name: Invalid value: "ollama-0.47.0": a DNS-1035 label must consist of lower case alphanumeric characters or '-', start with an alphabetic character, and end ⠸ warning: Upgrade "ollama-0.47.0" failed: failed to create resource: Service "ollama-0.47.0" is invalid: metadata.name: Invalid value: "ollama-0.47.0": a DNS-1035 label must consist of lower case alphanumeric characters or '-', start with an alphabetic character, and end ⠼ warning: Upgrade "ollama-0.47.0" failed: failed to create resource: Service "ollama-0.47.0" is invalid: metadata.name: Invalid value: "ollama-0.47.0": a DNS-1035 label must consist of lower case alphanumeric characters or '-', start with an alphabetic character, and end ⠴ warning: Upgrade "ollama-0.47.0" failed: failed to create resource: Service "ollama-0.47.0" is invalid: metadata.name: Invalid value: "ollama-0.47.0": a DNS-1035 label must consist of lower case alphanumeric characters or '-', start with an alphabetic character, and end with an alphanumeric character (e.g. 'my-name', or 'abc-123', regex used for validation is '[a-z]([-a-z0-9]*[a-z0-9])?') (1s)^C ```

Actual behavior

Zarf successfully lints the configuration and creates the package without any warnings. However, during deployment, Kubernetes fails to create certain resources (like Services) due to the period in the release name, despite this name conforming to RFC 1123 Label Names.

Expected behavior

Zarf should either:

  1. Warn users during the lint and package creation processes that certain release names, while valid according to RFC 1123, may cause issues with some Kubernetes resources, or
  2. Automatically adjust release names during deployment to ensure compatibility with all Kubernetes resources, while maintaining uniqueness and traceability to the original release name.

Additional context

This issue highlights a discrepancy between the Kubernetes naming conventions documentation and the actual behavior of the Kubernetes API server for certain resources. While the release name "ollama-0.47.0" conforms to RFC 1123 Label Names, it causes issues with resources that may have more stringent naming requirements.

Addressing this inconsistency in Zarf would greatly improve the user experience by preventing unexpected deployment failures and aligning Zarf's behavior more closely with the actual constraints of Kubernetes resource creation.

Environment

└> sw_vers
ProductName:        macOS
ProductVersion:     14.5
BuildVersion:       23F79
└> zarf tools kubectl version
Client Version: v1.30.0
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.29.6+k3s2

Describe alternatives you've considered

  1. User-side workaround: Users could manually adjust their release names to avoid periods and other potentially problematic characters. However, this puts the burden on the user and doesn't address the underlying inconsistency.

  2. Helm chart modification: Zarf could potentially modify the Helm charts to use a sanitized release name internally, while still allowing users to specify their preferred release name. This would require careful handling to ensure that all references to the release name within the chart are updated consistently.

  3. Stricter validation: Zarf could implement stricter validation rules that align with the most restrictive Kubernetes resource naming requirements. While this would prevent deployment failures, it might be overly restrictive for some use cases.

Additional context

jamestexas commented 2 months ago

I did some further investigation and found that the issue is due to the DNS-1035 label standards, which are a requirement for naming in Kubernetes and consequently enforced by Helm. When attempting to install the Helm chart with a name containing dots, I encountered the following error:


┌[08:57:41]─────>
│ github.com/jamestexas/ollama-helm
└> helm install ollama-0.47.0 ollama-0.47.0.tgz --namespace ollama --create-namespace

W0729 09:57:44.914889   16262 warnings.go:70] metadata.name: this is used in Pod names and hostnames, which can result in surprising behavior; a DNS label is recommended: [must not contain dots]
Error: INSTALLATION FAILED: 1 error occurred:
    * Service "ollama-0.47.0" is invalid: metadata.name: Invalid value: "ollama-0.47.0": a DNS-1035 label must consist of lower case alphanumeric characters or '-', start with an alphabetic character, and end with an alphanumeric character (e.g. 'my-name',  or 'abc-123', regex used for validation is '[a-z]([-a-z0-9]*[a-z0-9])?')