error: username or group is not a DNS-1123 hostname

[brosner]

I am seeing this error by largely following the documentation. Groups in example.yaml and from the Kubernetes docs typically have a colon in them. For example system:masters. However, this is failing authentication because they don't conform. I am not sure whether I should be changing the group name or if this constraint is either in the wrong place or should be removed altogether?

[christopherhein]

@nckturner @mattmoyer I was digging into the username fields in https://github.com/kubernetes/kubernetes and it doesn't look like they have any validation on the field. Do you know of anything different?

[jutley]

I just ran into this issue. I do not see anything in Kubernetes that says that usernames have the restrictions that this project imposes.

The closest thing I could find is the restrictions on resource names, and labels.

Furthermore, our current setup uses users with "Firstname Lastname" as their username, which doesn't match DNS-1123. In the official documentation, the sample username is an email address (which we would like to move to), which also does not match DNS-1123.

I think this bit of validation needs to be removed. From what I can tell, I think we just need to edit this code as follows:

template = strings.Replace(template, "{{SessionName}}", identity.SessionName, -1)

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[richardmarshall]

I ran into this as well. Given that k8s doesn't place a dns-1123 restriction on usernames or groups I definitely think this check as well as the replacement of @s should be removed.

Additionally the current regex used to check if a user/group name is conforming contains an error.

"[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*"

The expression isn't end/beginning of line anchored so it will match any string that contains a sub-string that is a valid dns-1123 name.

/reopen
/remove-lifecycle rotten

[k8s-ci-robot]

@richardmarshall: You can't reopen an issue/PR unless you authored it or you are a collaborator.

In response to this:

I ran into this as well. Given that k8s doesn't place a dns-1123 restriction on usernames or groups I definitely think this check as well as the replacement of @s should be removed.

Additionally the current regex used to check if a user/group name is conforming contains an error.

"[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*"

The expression isn't end/beginning of line anchored so it will match any string that contains a sub-string that is a valid dns-1123 name.

/reopen
/remove-lifecycle rotten

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.