Topology should validate failureDomain before creating MachineDeployments

[fabriziopandini]

User Story

As a user, I would like to have validation on failureDomain value selected for my MachineDeployments

Detailed Description

This is a follow up of #5850 (comment)

#5850 introduced the possibility to spread MachineDeployments across failureDomains, however, on creation it is not possible to validate the selected failureDomain matches one of the available failureDomains, given that they are derived from the InfrastructureCluster after Cluster creation.

So this issue is about discussing options to ensure that a MachineDeployment gets created only if the corresponding failureDomain exists.

Option 1. We should wait to create a MachineDeployment until available failureDomains are reported on the Cluster.Status, providing evidence of this in the TopologyReconciled conditions. If the required failureDomain does not match any available failureDomains, this is a reconcile error.

Option 2. If the available failureDomains are reported on the Cluster.Status, we should validate failureDomain for new MachineDeployments/edited MachineDeployments upfront.

Option 1 and 2 are not exclusive

/kind feature
/area topology
/milestone v1.1

[sbueringer]

I think if the failureDomain is set in MachineDeploymentTopology we should only create a MD when we can validate if the failureDomain is valid (i.e. if it's one of the failureDomains in the Cluster).

Otherwise the machines might get created first in the wrong failure domain and then re-created once the Cluster contains the list of failureDomains.

Potentially related question: The failureDomain is and should be mutable, right?

[vincepri]

The failureDomain is and should be mutable, right?

Yes, users can decide to move all machines in a MD to a different AZ and trigger a rollout

I think if the failureDomain is set in MachineDeploymentTopology we should only create a MD when we can validate if the failureDomain is valid (i.e. if it's one of the failureDomains in the Cluster).

+1

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[fabriziopandini]

/lifecycle frozen

[fabriziopandini]

/triage accepted

[fabriziopandini]

moving out of the milestone because not staffed yet, but nice to have the soon as possible
/help

[k8s-ci-robot]

@fabriziopandini:
This request has been marked as needing help from a contributor.

Guidelines

Please ensure that the issue body includes answers to the following questions:

• Why are we solving this issue?
• To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points?
• Does this issue have zero to low barrier of entry?
• How can the assignee reach out to you for help?

For more details on the requirements of such an issue, please see here and ensure that they are met.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help command.

In response to this:

moving out of the milestone because not staffed yet, but nice to have the soon as possible
/help

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[fabriziopandini]

/priority important-longterm