What happened:
We observed that the Custom Resource Definition (CRD) does not sufficiently validate user-provided input for one or more label-related fields.
Specifically, the affected field accepts values that do not satisfy the expected label format because the CRD schema does not define an appropriate validation rule (e.g., a pattern constraint), and no admission validation logic rejects the invalid input (e.g., label: test-wec1, test-wec2). As a result, invalid label values can be successfully created and stored by the API server. These invalid values may later cause errors when the application or controller processes the affected fields, leading to reconciliation failures or unexpected runtime behavior.
Locations:
https://github.com/karmada-io/karmada/blob/18d5e4a39371d5618495357833df6336fd642b3a/charts/karmada-operator/templates/crd-operator.karmada.io_karmadas.yaml#L1231
volumeClaim.labels (It appears that validation is missing for all template label fields. If I counted correctly, there are 12 such locations in total.)
Current Behavior
The resource containing an invalid label value is accepted by the API server and successfully created.
What you expected to happen:
The invalid label value should be rejected during resource creation or update.
This validation can be enforced by:
defining an appropriate validation rule (e.g., a pattern constraint) in the CRD schema, or
implementing admission validation logic (such as a validating admission webhook or equivalent internal validation) to reject invalid values before the resource is persisted.
How to reproduce it (as minimally and precisely as possible):
- Install the CRD and the corresponding controller.
- Create a CR containing an invalid value for the label-related field.
- Apply the resource.
- Verify that the resource is successfully created.
Anything else we need to know?:
Environment:
- Karmada version: v1.19.0-alpha.0
- kubectl-karmada or karmadactl version (the result of
kubectl-karmada version or karmadactl version):
- Others:
What happened:
We observed that the Custom Resource Definition (CRD) does not sufficiently validate user-provided input for one or more label-related fields.
Specifically, the affected field accepts values that do not satisfy the expected label format because the CRD schema does not define an appropriate validation rule (e.g., a pattern constraint), and no admission validation logic rejects the invalid input (e.g., label: test-wec1, test-wec2). As a result, invalid label values can be successfully created and stored by the API server. These invalid values may later cause errors when the application or controller processes the affected fields, leading to reconciliation failures or unexpected runtime behavior.
Locations:
https://github.com/karmada-io/karmada/blob/18d5e4a39371d5618495357833df6336fd642b3a/charts/karmada-operator/templates/crd-operator.karmada.io_karmadas.yaml#L1231
volumeClaim.labels (It appears that validation is missing for all template label fields. If I counted correctly, there are 12 such locations in total.)
Current Behavior
The resource containing an invalid label value is accepted by the API server and successfully created.
What you expected to happen:
The invalid label value should be rejected during resource creation or update.
This validation can be enforced by:
defining an appropriate validation rule (e.g., a pattern constraint) in the CRD schema, or
implementing admission validation logic (such as a validating admission webhook or equivalent internal validation) to reject invalid values before the resource is persisted.
How to reproduce it (as minimally and precisely as possible):
Anything else we need to know?:
Environment:
kubectl-karmada versionorkarmadactl version):