AlinsRan commented on PR #2894:
URL:
https://github.com/apache/apisix-ingress-controller/pull/2894#issuecomment-6333715346
Please add non-negative timeout validation for ApisixRoute. `buildTimeout`
currently uses `cmp.Or`, which only replaces zero: `-500ms` previously became
the 60-second fallback after integer truncation, but this change sends `-0.5`
to ADC. APISIX rejects non-positive timeout values. ApisixUpstream already
checks for negative durations in its translator; ApisixRoute does not.
CEL can reject these inputs at CRD admission. I verified the following
field-level marker on `UpstreamTimeout.Connect`, `Read`, and `Send`:
```go
// +kubebuilder:validation:XValidation:rule="duration(self) >=
duration('0s')",message="timeout must not be negative"
```
Using `>=` preserves the existing behavior where zero selects the default
timeout. The shared type propagates the rule into the ApisixRoute and
ApisixUpstream CRDs, including the upstream port-level settings.
Validation against PR head `c37d5ac064cd644f488dfdf6654c6cad7bc07e29`:
- Regenerated the CRDs with the repository's controller-gen v0.17.2.
- The generated CRDs passed Kubernetes `ValidateCustomResourceDefinition`
validation.
- OpenAPI and CEL validation tests passed for all three timeout fields on
ApisixRoute and ApisixUpstream: `-500ms` and `-1s` are rejected; `0s`, `0`,
`1ms`, `500ms`, `1.5s`, and `1m30s` are accepted; malformed and empty strings
are rejected; omitted fields are accepted.
- Example error: `spec.http[0].timeout.connect: Invalid value: "-500ms":
timeout must not be negative`.
These tests used the Kubernetes validation libraries from the project
dependencies, not a live API server. Please commit the regenerated CRDs and
regression tests with the rule. A translator-side negative-value check would
also cover existing objects and installations whose CRDs have not yet been
upgraded.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
