SecretVolumeSource invalid defaultMode - needs to be sent as a string with a leading 0

[dajester2013]

The schema for io.fabric8.kubernetes.api.model.SecretVolumeSource specifies defaultMode as "integer"

kubernetes-client/kubernetes-model-generator/kubernetes-model-core/src/main/resources/schema/kube-schema.json

Line 7306 in ca0a124

"type": "integer",

However, the API requires defaultMode to be a string with a leading zero, as indicated by this error:

create Pod postgres-0 in StatefulSet postgres failed error: Pod "postgres-0" is invalid: [spec.volumes[2].secret.defaultMode: Invalid value: 640: must be a number between 0 and 0777 (octal), both inclusive, spec.containers[0].volumeMounts[3].name: Not found: "cert"]

This is the relevant excerpt from my statefulset yaml:

        - name: cert
          secret: 
            secretName: postgres-cert
            defaultMode: "0640" # I even tried quoting it here...

[manusa]

Did you try the octal losing the leading zero (many systems admit this)?

The model is generated from the go Types

[dajester2013]

Did you try the octal losing the leading zero (many systems admit this)?

The model is generated from the go Types

I'm not sure what to make of this suggestion - I know just enough to be dangerous when it comes to kubernetes...

https://gist.github.com/dajester2013/90b2302a6ad44378bb42eb71b9104035#file-postgres-statefulset-example-yaml-L32

This is a more complete version of the statefulset yaml (I can provide the full manifest if needed). If I upload this to the Kubernetes Dashboard, or apply with kubectl, it works.

However, this fails because of the leading zero being dropped in the "defaultMode":

k8sClient.load("path/to/statefulset.yaml").createOrDelete()

If there is some other way of specifying that value, I'd be glad to try.

[dajester2013]

Ok.. came across this:

Note that the JSON spec doesn't support octal notation, so use the value 256 for 0400 permissions. If you use YAML instead of JSON for the Pod, you can use octal notation to specify permissions in a more natural way.

After doing some step debugging, it does appear that this client is transforming the yaml to json. However, in that transformation, the octal is not being converted to decimal as required by the JSON API.

Changing 0640 to 416 gets me around the problem for now, but it's a bit of a gotcha...

[manusa]

Yes, this might bring some confusion.
We should probably document a warning somewhere or FAQ entry.