Skip to content

SPLAT-2603: Updated AWS dedicated host id validation pattern #1451

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Jan 12, 2026
+119 −10
Merged

SPLAT-2603: Updated AWS dedicated host id validation pattern #1451

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions pkg/webhooks/machine_webhook.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ var (
// AWS Variables / Defaults

// awsDedicatedHostNamePattern is used to validate the id of a dedicated host
awsDedicatedHostNamePattern = regexp.MustCompile(`^h-[0-9a-f]{17}$`)
awsDedicatedHostNamePattern = regexp.MustCompile(`^h-([0-9a-f]{8}|[0-9a-f]{17})$`)

// Azure Defaults
defaultAzureVnet = func(clusterID string) string {
Expand Down Expand Up @@ -950,7 +950,7 @@ func processAWSPlacementTenancy(placement machinev1beta1.Placement) field.ErrorL
case machinev1beta1.HostAffinityAnyAvailable:
// DedicatedHost is optional. If it is set, make sure it follows conventions
if placement.Host.DedicatedHost != nil && !awsDedicatedHostNamePattern.MatchString(placement.Host.DedicatedHost.ID) {
errs = append(errs, field.Invalid(field.NewPath("spec.placement.host.dedicatedHost.id"), placement.Host.DedicatedHost.ID, "id must start with 'h-' followed by 17 lowercase hexadecimal characters (0-9 and a-f)"))
errs = append(errs, field.Invalid(field.NewPath("spec.placement.host.dedicatedHost.id"), placement.Host.DedicatedHost.ID, "id must start with 'h-' followed by 8 or 17 lowercase hexadecimal characters (0-9 and a-f)"))
}
case machinev1beta1.HostAffinityDedicatedHost:
// We need to make sure DedicatedHost is set with an ID
Expand All @@ -959,9 +959,9 @@ func processAWSPlacementTenancy(placement machinev1beta1.Placement) field.ErrorL
} else {
// If not set, return required error. If it does not match pattern, return pattern failure message.
if placement.Host.DedicatedHost.ID == "" {
errs = append(errs, field.Required(field.NewPath("spec.placement.host.dedicatedHost.id"), "id is required and must start with 'h-' followed by 17 lowercase hexadecimal characters (0-9 and a-f)"))
errs = append(errs, field.Required(field.NewPath("spec.placement.host.dedicatedHost.id"), "id is required and must start with 'h-' followed by 8 or 17 lowercase hexadecimal characters (0-9 and a-f)"))
} else if !awsDedicatedHostNamePattern.MatchString(placement.Host.DedicatedHost.ID) {
errs = append(errs, field.Invalid(field.NewPath("spec.placement.host.dedicatedHost.id"), placement.Host.DedicatedHost.ID, "id must start with 'h-' followed by 17 lowercase hexadecimal characters (0-9 and a-f)"))
errs = append(errs, field.Invalid(field.NewPath("spec.placement.host.dedicatedHost.id"), placement.Host.DedicatedHost.ID, "id must start with 'h-' followed by 8 or 17 lowercase hexadecimal characters (0-9 and a-f)"))
}
}
default:
Expand Down
121 changes: 115 additions & 6 deletions pkg/webhooks/machine_webhook_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -376,7 +376,7 @@ func TestMachineCreation(t *testing.T) {
},
},
},
expectedError: "admission webhook \"validation.machine.machine.openshift.io\" denied the request: spec.placement.host.dedicatedHost.id: Required value: id is required and must start with 'h-' followed by 17 lowercase hexadecimal characters (0-9 and a-f)",
expectedError: "admission webhook \"validation.machine.machine.openshift.io\" denied the request: spec.placement.host.dedicatedHost.id: Required value: id is required and must start with 'h-' followed by 8 or 17 lowercase hexadecimal characters (0-9 and a-f)",
},
{
name: "configure host placement with AnyAvailable affinity and empty ID",
Expand All @@ -399,7 +399,7 @@ func TestMachineCreation(t *testing.T) {
},
},
},
expectedError: "admission webhook \"validation.machine.machine.openshift.io\" denied the request: spec.placement.host.dedicatedHost.id: Required value: id is required and must start with 'h-' followed by 17 lowercase hexadecimal characters (0-9 and a-f)",
expectedError: "admission webhook \"validation.machine.machine.openshift.io\" denied the request: spec.placement.host.dedicatedHost.id: Required value: id is required and must start with 'h-' followed by 8 or 17 lowercase hexadecimal characters (0-9 and a-f)",
},
{
name: "configure host placement with AnyAvailable affinity and invalid ID",
Expand All @@ -422,7 +422,7 @@ func TestMachineCreation(t *testing.T) {
},
},
},
expectedError: "admission webhook \"validation.machine.machine.openshift.io\" denied the request: spec.placement.host.dedicatedHost.id: Invalid value: \"invalid\": id must start with 'h-' followed by 17 lowercase hexadecimal characters (0-9 and a-f)",
expectedError: "admission webhook \"validation.machine.machine.openshift.io\" denied the request: spec.placement.host.dedicatedHost.id: Invalid value: \"invalid\": id must start with 'h-' followed by 8 or 17 lowercase hexadecimal characters (0-9 and a-f)",
},
{
name: "configure host placement with invalid affinity",
Expand Down Expand Up @@ -467,6 +467,52 @@ func TestMachineCreation(t *testing.T) {
},
expectedError: "",
},
{
name: "configure host placement with DedicatedHost affinity and valid 8-character ID",
platformType: osconfigv1.AWSPlatformType,
clusterID: "aws-cluster",
providerSpecValue: &kruntime.RawExtension{
Object: &machinev1beta1.AWSMachineProviderConfig{
AMI: machinev1beta1.AWSResourceReference{
ID: ptr.To[string]("ami"),
},
InstanceType: "test",
Placement: machinev1beta1.Placement{
Tenancy: machinev1beta1.HostTenancy,
Host: &machinev1beta1.HostPlacement{
Affinity: ptr.To(machinev1beta1.HostAffinityDedicatedHost),
DedicatedHost: &machinev1beta1.DedicatedHost{
ID: "h-12345678",
},
},
},
},
},
expectedError: "",
},
{
name: "configure host placement with AnyAvailable affinity and valid 8-character ID",
platformType: osconfigv1.AWSPlatformType,
clusterID: "aws-cluster",
providerSpecValue: &kruntime.RawExtension{
Object: &machinev1beta1.AWSMachineProviderConfig{
AMI: machinev1beta1.AWSResourceReference{
ID: ptr.To[string]("ami"),
},
InstanceType: "test",
Placement: machinev1beta1.Placement{
Tenancy: machinev1beta1.HostTenancy,
Host: &machinev1beta1.HostPlacement{
Affinity: ptr.To(machinev1beta1.HostAffinityAnyAvailable),
DedicatedHost: &machinev1beta1.DedicatedHost{
ID: "h-12345678",
},
},
},
},
},
expectedError: "",
},
{
name: "configure host placement with DedicatedHost affinity and empty ID",
platformType: osconfigv1.AWSPlatformType,
Expand All @@ -486,7 +532,7 @@ func TestMachineCreation(t *testing.T) {
},
},
},
expectedError: "admission webhook \"validation.machine.machine.openshift.io\" denied the request: spec.placement.host.dedicatedHost.id: Required value: id is required and must start with 'h-' followed by 17 lowercase hexadecimal characters (0-9 and a-f)",
expectedError: "admission webhook \"validation.machine.machine.openshift.io\" denied the request: spec.placement.host.dedicatedHost.id: Required value: id is required and must start with 'h-' followed by 8 or 17 lowercase hexadecimal characters (0-9 and a-f)",
},
{
name: "configure host placement with DedicatedHost affinity and ID not set",
Expand All @@ -505,7 +551,7 @@ func TestMachineCreation(t *testing.T) {
},
},
},
expectedError: "admission webhook \"validation.machine.machine.openshift.io\" denied the request: spec.placement.host.dedicatedHost.id: Required value: id is required and must start with 'h-' followed by 17 lowercase hexadecimal characters (0-9 and a-f)",
expectedError: "admission webhook \"validation.machine.machine.openshift.io\" denied the request: spec.placement.host.dedicatedHost.id: Required value: id is required and must start with 'h-' followed by 8 or 17 lowercase hexadecimal characters (0-9 and a-f)",
},
{
name: "configure host placement with DedicatedHost affinity and invalid ID",
Expand All @@ -526,7 +572,70 @@ func TestMachineCreation(t *testing.T) {
},
},
},
expectedError: "admission webhook \"validation.machine.machine.openshift.io\" denied the request: spec.placement.host.dedicatedHost.id: Invalid value: \"invalid\": id must start with 'h-' followed by 17 lowercase hexadecimal characters (0-9 and a-f)",
expectedError: "admission webhook \"validation.machine.machine.openshift.io\" denied the request: spec.placement.host.dedicatedHost.id: Invalid value: \"invalid\": id must start with 'h-' followed by 8 or 17 lowercase hexadecimal characters (0-9 and a-f)",
},
{
name: "configure host placement with DedicatedHost affinity and 9-character ID (invalid length)",
platformType: osconfigv1.AWSPlatformType,
clusterID: "aws-cluster",
providerSpecValue: &kruntime.RawExtension{
Object: &machinev1beta1.AWSMachineProviderConfig{
AMI: machinev1beta1.AWSResourceReference{ID: ptr.To[string]("ami")},
InstanceType: "test",
Placement: machinev1beta1.Placement{
Tenancy: machinev1beta1.HostTenancy,
Host: &machinev1beta1.HostPlacement{
Affinity: ptr.To(machinev1beta1.HostAffinityDedicatedHost),
DedicatedHost: &machinev1beta1.DedicatedHost{
ID: "h-123456789",
},
},
},
},
},
expectedError: "admission webhook \"validation.machine.machine.openshift.io\" denied the request: spec.placement.host.dedicatedHost.id: Invalid value: \"h-123456789\": id must start with 'h-' followed by 8 or 17 lowercase hexadecimal characters (0-9 and a-f)",
},
{
name: "configure host placement with DedicatedHost affinity and 16-character ID (invalid length)",
platformType: osconfigv1.AWSPlatformType,
clusterID: "aws-cluster",
providerSpecValue: &kruntime.RawExtension{
Object: &machinev1beta1.AWSMachineProviderConfig{
AMI: machinev1beta1.AWSResourceReference{ID: ptr.To[string]("ami")},
InstanceType: "test",
Placement: machinev1beta1.Placement{
Tenancy: machinev1beta1.HostTenancy,
Host: &machinev1beta1.HostPlacement{
Affinity: ptr.To(machinev1beta1.HostAffinityDedicatedHost),
DedicatedHost: &machinev1beta1.DedicatedHost{
ID: "h-1234567890abcdef",
},
},
},
},
},
expectedError: "admission webhook \"validation.machine.machine.openshift.io\" denied the request: spec.placement.host.dedicatedHost.id: Invalid value: \"h-1234567890abcdef\": id must start with 'h-' followed by 8 or 17 lowercase hexadecimal characters (0-9 and a-f)",
},
{
name: "configure host placement with DedicatedHost affinity and 8-character ID with uppercase (invalid)",
platformType: osconfigv1.AWSPlatformType,
clusterID: "aws-cluster",
providerSpecValue: &kruntime.RawExtension{
Object: &machinev1beta1.AWSMachineProviderConfig{
AMI: machinev1beta1.AWSResourceReference{ID: ptr.To[string]("ami")},
InstanceType: "test",
Placement: machinev1beta1.Placement{
Tenancy: machinev1beta1.HostTenancy,
Host: &machinev1beta1.HostPlacement{
Affinity: ptr.To(machinev1beta1.HostAffinityDedicatedHost),
DedicatedHost: &machinev1beta1.DedicatedHost{
ID: "h-1234ABCD",
},
},
},
},
},
expectedError: "admission webhook \"validation.machine.machine.openshift.io\" denied the request: spec.placement.host.dedicatedHost.id: Invalid value: \"h-1234ABCD\": id must start with 'h-' followed by 8 or 17 lowercase hexadecimal characters (0-9 and a-f)",
},
{
name: "configure dedicated tenancy with host placement",
Expand Down