CNTRLPLANE-2781: Document valid character sets and add validation for Azure Marketplace image fields #8223
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -131,7 +131,12 @@ type AzureVMImage struct { | |
| Type AzureVMImageType `json:"type"` | ||
|
|
||
| // imageID is the Azure resource ID of a VHD image to use to boot the Azure VMs from. | ||
| // The expected format is an Azure resource ID string. This can be a managed image or an | ||
| // Azure Compute Gallery image version, for example: | ||
| // /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/images/{imageName} | ||
| // /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/galleries/{galleryName}/images/{imageDefinitionName}/versions/{imageVersionName} | ||
| // See https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules for | ||
| // Azure resource naming rules and restrictions. | ||
| // | ||
| // +optional | ||
| // +unionMember | ||
|
|
@@ -166,9 +171,11 @@ type AzureMarketplaceImage struct { | |
| ImageGeneration *AzureVMImageGeneration `json:"imageGeneration,omitempty"` | ||
|
|
||
| // publisher is the name of the organization that created the image. | ||
| // For example, "azureopenshift", "canonical", or "redhat". | ||
| // It must be between 3 and 50 characters in length, and consist of only lowercase letters, numbers, hyphens (-), and underscores (_). | ||
| // It must start with a lowercase letter or a number. | ||
| // See https://learn.microsoft.com/en-us/azure/virtual-machines/linux/cli-ps-findimage for more | ||
| // information on Azure Marketplace image publishers. | ||
| // | ||
| // +kubebuilder:validation:Pattern=`^[a-z0-9][a-z0-9-_]{2,49}$` | ||
| // +kubebuilder:validation:MinLength=3 | ||
|
|
@@ -177,17 +184,25 @@ type AzureMarketplaceImage struct { | |
| Publisher string `json:"publisher,omitempty"` | ||
|
|
||
| // offer specifies the name of a group of related images created by the publisher. | ||
| // For example, "RHEL", "WindowsServer", or "0001-com-ubuntu-server-jammy". | ||
| // The value must consist of only alphanumeric characters (a-z, A-Z, 0-9), | ||
| // hyphens (-), underscores (_), and periods (.). | ||
| // It must start with an alphanumeric character. | ||
|
Comment on lines
+188
to
+190
Contributor
There was a problem hiding this comment. Would something like
Contributor
Author
There was a problem hiding this comment. Yes, Real-world Azure offer names vary widely in format (e.g., If you'd like stricter rules (e.g., no consecutive special chars, must end with alphanumeric), happy to adjust — just flagging the trade-off with potential false negatives. AI-assisted response via Claude Code |
||
| // See https://learn.microsoft.com/en-us/azure/virtual-machines/linux/cli-ps-findimage for more | ||
|
Member
There was a problem hiding this comment. is there a canonical source to API rather than CLI?
Contributor
Author
There was a problem hiding this comment. The closest canonical API source is the Azure Compute REST API reference for Virtual Machine Images: With specific operations for each field:
However, the REST API docs don't document the character set constraints explicitly — those come from the Partner Center docs for publishers creating offers (e.g., https://learn.microsoft.com/en-us/partner-center/marketplace-offers/azure-vm-offer-setup). The CLI page currently linked is arguably the most user-friendly consumer-facing reference for finding valid values. Happy to update the links to the REST API reference or the Partner Center docs — let me know which you'd prefer. AI-assisted response via Claude Code |
||
| // information on Azure Marketplace image offers. | ||
| // | ||
| // +kubebuilder:validation:Pattern=`^[a-zA-Z0-9][a-zA-Z0-9._-]*$` | ||
|
Member
There was a problem hiding this comment. please use // +kubebuilder:validation:XValidation:rule="self.matches and add an envtest to validate this
Contributor
Author
There was a problem hiding this comment. Done. Replaced Added three envtest cases to
Regenerated CRDs and vendor. AI-assisted response via Claude Code |
||
| // +kubebuilder:validation:MinLength=1 | ||
| // +kubebuilder:validation:MaxLength=255 | ||
| // +optional | ||
| Offer string `json:"offer,omitempty"` | ||
|
|
||
| // sku specifies an instance of an offer, such as a major release of a distribution. | ||
| // For example, 22_04-lts-gen2, 8-lvm-gen2. | ||
| // The value must be between 1 and 255 characters in length, and consist of only lowercase | ||
| // letters, numbers, hyphens (-), and underscores (_). | ||
|
Comment on lines
+202
to
+203
Contributor
There was a problem hiding this comment. Would something like
Contributor
Author
There was a problem hiding this comment. Yes, Real-world SKU values like Let me know if you'd like that tightened, or if the current permissive approach is acceptable given that Azure's API provides the ultimate validation. AI-assisted response via Claude Code
Contributor
Author
There was a problem hiding this comment. Yes, In practice, real Azure SKUs (e.g. AI-assisted response via Claude Code |
||
| // See https://learn.microsoft.com/en-us/azure/virtual-machines/linux/cli-ps-findimage for more | ||
| // information on Azure Marketplace image SKUs. | ||
| // | ||
| // +kubebuilder:validation:Pattern=`^[a-z0-9-_]+$` | ||
| // +kubebuilder:validation:MinLength=1 | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Would something like
publisher10------__-----actually be valid?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes,
publisher10------__-----would pass this regex. The validation here is intentionally scoped to character set and length — it ensures only the documented characters (lowercase alphanumeric, hyphens, underscores) are used and the value starts with a letter or digit, but it doesn't enforce restrictions on consecutive special characters or trailing patterns.The rationale is that Azure's Compute API will reject any publisher name that doesn't match an actual registered publisher at deployment time, so the CRD validation acts as a first-pass format check rather than a semantic one. Tightening the regex (e.g., disallowing consecutive hyphens/underscores) risks rejecting valid Azure publisher names we haven't encountered, since Azure's exact naming rules aren't fully documented.
That said, if you'd prefer stricter validation here (e.g., requiring special chars to be non-consecutive or non-trailing), happy to tighten it — just want to be cautious about false negatives.
AI-assisted response via Claude Code