Repository navigation
Conversation
`podTemplates[].spec` carried a `# TODO specify PodSpec` and
`x-kubernetes-preserve-unknown-fields: true`, so anything under it was
accepted unvalidated: a misspelled `resorces:` or a stray field silently
did nothing until the StatefulSet came out wrong.
The schema is generated from `corev1.PodSpec` of k8s.io/api v0.30.14 --
the version this operator builds against -- with controller-gen, so
Quantity and IntOrString get proper `x-kubernetes-int-or-string` instead
of hand-written approximations.
Descriptions are stripped (`crd:maxDescLen=0`). With them the CRD grows
past the 256 KiB `kubectl.kubernetes.io/last-applied-configuration`
annotation limit and a plain `kubectl apply -f` -- the install path in
the README -- fails with `metadata.annotations: Too long`. Without them
the ClickHouseInstallation CRD goes from ~130 to ~187 KiB and
client-side apply keeps working; only `kubectl explain` output for those
fields is lost.
Verified against a kwok v1.36.1 apiserver:
- `kubectl apply -f deploy/operator/clickhouse-operator-install-bundle.yaml` succeeds
- a CHI using securityContext, initContainers, tolerations and
topologySpreadConstraints is accepted
- `podTemplates[0].spec.containers[0].resorces` is rejected with
`unknown field` for both CHI and CHIT
ClickHouseKeeperInstallation carries the same TODO and is left for a
separate change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Alexey Belaytzev <github@accounts.ti1orn.com>
belaytzev
force-pushed
the
feat/specify-podspec-in-podtemplates
branch
from
October 31, 2026 19:46
bc4f092 to
f4fdd51
Compare
Author
|
Retargeted from Rebased as a single commit on With the new CI hasn't run on this PR yet. It probably needs approval for fork workflows. |
…n PodSpec With the full PodSpec schema the CHI and CHIT CRDs grow to ~334 KB and no longer fit one ConfigMap (262144 bytes), so the Helm chart's CRD hook cannot ship them: dev/test_helm_chart.sh fails on "every CRD fits one ConfigMap". affinity, volumes and ephemeralContainers take ~112 KB of the schema. They now carry x-kubernetes-preserve-unknown-fields, as the whole spec did before. ephemeralContainers cannot be set at pod creation anyway. containers, initContainers, securityContext, tolerations and the rest stay validated. Both CRDs drop to ~222 KB. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Alexey Belaytzev <github@accounts.ti1orn.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
spec.templates.podTemplates[].specis declared as a baretype: objectwithx-kubernetes-preserve-unknown-fields: trueand carries a# TODO specify PodSpec.Everything under it is therefore accepted without validation — a misspelled
resorces:or a stray field is silently ignored, and the mistake only surfaceslater as a StatefulSet that does not look like what was written.
This closes that TODO for
ClickHouseInstallation/ClickHouseInstallationTemplate.How the schema was produced
Generated with
controller-genfromcorev1.PodSpecof k8s.io/api v0.30.14 —the version this operator builds against — rather than written by hand. That matters
for the awkward types:
QuantityandIntOrStringcome out as properx-kubernetes-int-or-stringnodes (45 of them), and there are no$ref/oneOfconstructs that a structural schema would reject.
Only
deploy/builder/templates-install-bundle/...-crd-01-chi-chit.yamlwas edited byhand. In every generated file the same block replaces the
# TODO specify PodSpecnode of the CHI and CHIT CRDs; nothing else in those files changed.
Why descriptions are stripped
The schema is generated with
crd:maxDescLen=0. This is not cosmetic:kubectl apply -f(client-side)With descriptions the CRD grows past the 256 KiB limit of the
kubectl.kubernetes.io/last-applied-configurationannotation, and a plainkubectl apply -f deploy/operator/clickhouse-operator-install-bundle.yaml— theinstall path documented in the README — fails with:
Only
--server-sidewould work. Stripping descriptions keeps the documented installpath intact; the cost is that
kubectl explainno longer prints help text for thePodSpec fields. Happy to switch to the full version if you would rather have the
descriptions and require server-side apply.
Fields left schemaless
Even without descriptions, the full PodSpec pushed the CHI and CHIT CRDs to ~334 KB.
That is over the 262144-byte ConfigMap limit, so the Helm chart's CRD hook can't ship
them, and
dev/test_helm_chart.shfails on "every CRD fits one ConfigMap".affinity,volumesandephemeralContainers(~112 KB together) keepx-kubernetes-preserve-unknown-fields: true, same as the wholespecbefore this PR.ephemeralContainerscan't be set at pod creation anyway. Everything else is stillvalidated:
containers,initContainers,securityContext,tolerations,topologySpreadConstraintsand so on. Both CRDs are now ~222 KB.Verification
Against a kwok
v1.36.1apiserver, using the regenerated bundle:kubectl apply -f deploy/operator/clickhouse-operator-install-bundle.yaml— applies cleanly, client-sidesecurityContext,initContainers,tolerationsandtopologySpreadConstraints— acceptedpodTemplates[0].spec.containers[0].resorces— rejected:Scope
ClickHouseKeeperInstallationcarries the same TODO; left out deliberately to keepthis reviewable. Happy to follow up with it.
Context
This started as datreeio/CRDs-catalog#737, where the schema was patched in the
catalog instead. @eyarz rightly pointed out that the catalog should mirror the vendor
CR and the fix belongs here.