Change:
Scenario: Expected results: pod would not be created as [0] is invalid Actual results: pod is created. Turns out we are not doing any validation of envFrom in container spec today.
There are no sig labels on this issue. Please by:<br(1) mentioning a sig: <br(2) specifying the label manually: <br<brNote: method (1) will trigger a notification to the team. You can find the team list .
I don't know that we can tighten without failing pods.
The validation code exists, but there was no wiring done from validateContainers.
Pods fail on kubelet already. So those pods were not doing much already. We had a BZ on this.
Fail how - fail to even start, or fail to get the input?

Discussion:
return allErrs } <ins> // ValidateEnv validates env vars </ins> func ValidateEnv(vars []api.EnvVar, fldPath *field.Path) field.ErrorList { allErrs := field.ErrorList{}

func validateConfigMapKeySelector(s *api.ConfigMapKeySelector, fldPath *field.Path) field.ErrorList { allErrs := field.ErrorList{} <del> if len(s.Name) == 0 { allErrs = append(allErrs, field.Required(fldPath.Child("name"), "")) </del> <ins> nameFn := ValidateNameFunc(ValidateSecretName) for _, msg := range nameFn(s.Name, false) { allErrs = append(allErrs, field.Invalid(fldPath.Child("name"), s.Name, msg)) </ins> } if len(s.Key) == 0 { allErrs = append(allErrs, field.Required(fldPath.Child("key"), ""))

func validateSecretKeySelector(s *api.SecretKeySelector, fldPath *field.Path) field.ErrorList { allErrs := field.ErrorList{} <del> if len(s.Name) == 0 { allErrs = append(allErrs, field.Required(fldPath.Child("name"), "")) </del> <ins> nameFn := ValidateNameFunc(ValidateSecretName) for _, msg := range nameFn(s.Name, false) { allErrs = append(allErrs, field.Invalid(fldPath.Child("name"), s.Name, msg)) </ins> } if len(s.Key) == 0 { allErrs = append(allErrs, field.Required(fldPath.Child("key"), ""))

allErrs = append(allErrs, validateProbe(ctr.ReadinessProbe, idxPath.Child("readinessProbe"))...) allErrs = append(allErrs, validateContainerPorts(ctr.Ports, idxPath.Child("ports"))...) allErrs = append(allErrs, ValidateEnv(ctr.Env, idxPath.Child("env"))...) <ins> allErrs = append(allErrs, ValidateEnvFrom(ctr.EnvFrom, idxPath.Child("envFrom"))...) </ins> allErrs = append(allErrs, ValidateVolumeMounts(ctr.VolumeMounts, volumes, idxPath.Child("volumeMounts"))...) allErrs = append(allErrs, validatePullPolicy(ctr.ImagePullPolicy, idxPath.Child("imagePullPolicy"))...) allErrs = append(allErrs, ValidateResourceRequirements(&ctr.Resources, idxPath.Child("resources"))...)

expectedError: `[0].valueFrom: Invalid value: "": may not have more than one field specified at a time`, }, { <ins> name: "valueFrom.secretKeyRef.name invalid", envs: []api.EnvVar{{ Name: "abc", ValueFrom: &api.EnvVarSource{ SecretKeyRef: &api.SecretKeySelector{ LocalObjectReference: api.LocalObjectReference{ Name: "$%^&*#", }, Key: "a-key", }, }, }}, }, { name: "valueFrom.configMapKeyRef.name invalid", envs: []api.EnvVar{{ Name: "abc", ValueFrom: &api.EnvVarSource{ ConfigMapKeyRef: &api.ConfigMapKeySelector{ LocalObjectReference: api.LocalObjectReference{ Name: "$%^&*#", }, Key: "some-key", }, }, }}, }, { </ins> name: "missing FieldPath on ObjectFieldSelector", envs: []api.EnvVar{{ Name: "abc",

}, expectedError: "field: Invalid value: "": may not have more than one field specified at a time", }, <ins> { name: "invalid secret ref name", envs: []api.EnvFromSource{ { SecretRef: &api.SecretEnvSource{ LocalObjectReference: api.LocalObjectReference{Name: "$%^&*#"}}, }, }, expectedError: "field[0].secretRef.name: Invalid value: "$%^&*#": " + dnsSubdomainLabelErrMsg, }, { name: "invalid config ref name", envs: []api.EnvFromSource{ { ConfigMapRef: &api.ConfigMapEnvSource{ LocalObjectReference: api.LocalObjectReference{Name: "$%^&*#"}}, }, }, expectedError: "field[0].configMapRef.name: Invalid value: "$%^&*#": " + dnsSubdomainLabelErrMsg, }, </ins> } for _, tc := range errorCases { if errs := ValidateEnvFrom(tc.envs, field.NewPath("field")); len(errs) == 0 {

ImagePullPolicy:          "IfNotPresent", TerminationMessagePolicy: "File", }, <ins> { Name:                     "env-from-source", Image:                    "image", ImagePullPolicy:          "IfNotPresent", TerminationMessagePolicy: "File", EnvFrom: []api.EnvFromSource{ { ConfigMapRef: &api.ConfigMapEnvSource{ LocalObjectReference: api.LocalObjectReference{ Name: "test", }, }, }, }, }, </ins> {Name: "abc-1234", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File", SecurityContext: fakeValidSecurityContext(true)}, } if errs := validateContainers(successCase, volumes, field.NewPath("field")); len(errs) != 0 {

TerminationMessagePolicy: "File", }, }, <ins> "Invalid env from": { { Name:                     "env-from-source", Image:                    "image", ImagePullPolicy:          "IfNotPresent", TerminationMessagePolicy: "File", EnvFrom: []api.EnvFromSource{ { ConfigMapRef: &api.ConfigMapEnvSource{ LocalObjectReference: api.LocalObjectReference{ Name: "$%^&*#", }, }, }, }, }, }, </ins> } for k, v := range errorCases { if errs := validateContainers(v, volumes, field.NewPath("field")); len(errs) == 0 {