Graylog2 / Graylog2/graylog-helm

[B-03] Helm name helpers truncate base before appending suffixes, creating DNS-invalid names exceeding 63 characters

Open
#119 0 comments 0 reactions 1 assignee Claimed by @alix-graylog View on GitHub
blocker bug
Dominant language
Go Template
Stars
12
Forks
3
Avg merge
2d 4h
Merged PRs (30d)
13

Description

## Summary
Name helper functions in `_helpers.tpl` truncate resource names to 63 characters before appending suffixes (e.g., `-sa`, `-init-cm`). This causes derived resource names to exceed
the 63-character Kubernetes DNS label limit. A 53-character release name can produce Service and ConfigMap names of 77–88 characters.

### Details
The issue occurs across multiple helper functions that append suffixes to `graylog.fullname`:

- `graylog.cm.init.name` (line 60): `include "graylog.fullname" . | printf "%s-init-cm"`
- `graylog.serviceAccountName` (line 69): `include "graylog.fullname" . | printf "%s-sa"`
- `graylog.mongodb.serviceAccountName` (line 80): `include "graylog.fullname" . | printf "%s-mongo-sa"`

The `graylog.fullname` helper (lines 13-24) truncates to 63 characters on lines 15, 19, and 21. When suffixes are appended afterward, the final resource name exceeds 63
characters, violating the Kubernetes DNS naming spec.

**Example:** Release name `my-very-long-release-name-that-is-fifty-three-chars-long` (53 chars):
- Truncated fullname: 63 chars (already at limit)
- After appending `-init-cm`: 71 chars (exceeds DNS label limit)
- After appending `-mongo-sa`: 72 chars (exceeds DNS label limit)

**Reference:** B-03 (Production Readiness Review)

### Impact
Resource creation fails with DNS label validation errors when long release names are used, preventing deployments on clusters with strict validation. This is particularly
problematic in CI/CD environments where release names may be auto-generated with timestamps or environment identifiers.

## How to Reproduce?

### Environment
- Helm chart version: v4.2.0 or later
- Kubernetes version: any (this is a naming constraint issue)

### Pre-flight checks
- [x] `helm lint ./graylog` passes
- [x] Checked existing issues for duplicates

### Steps to reproduce the issue:

1. Use a long release name (at or near 53 characters):
```bash
helm template my-very-long-release-name-that-is-fifty-three-characters-long ./graylog

2. Inspect the generated ServiceAccount and ConfigMap names in the output:
helm template my-very-long-release-name-that-is-fifty-three-characters-long ./graylog | grep -E "name:|kind:" | head -30
3. Count characters in derived names like graylog-init-cm and graylog-mongo-sa.

Expected behavior
All generated resource names should be 63 characters or fewer to comply with the Kubernetes DNS naming specification.

Actual behavior
ConfigMap names, ServiceAccount names, and other derived resources exceed 63 characters, violating DNS label constraints and potentially causing validation failures during helm
install or helm upgrade.

Notes for maintainers

The fix requires refactoring the naming helpers to truncate the complete derived name after all suffixes are appended, rather than truncating the base fullname before appending.

Current pattern (wrong):
{{- include "graylog.fullname" . | trunc 63 | printf "%s-init-cm" }}

Corrected pattern:
{{- include "graylog.fullname" . | printf "%s-init-cm" | trunc 63 | trimSuffix "-" }}

This ensures that:
1. The base fullname is calculated
2. The suffix is appended
3. The complete name is truncated to 63 characters
4. Trailing hyphens are removed if truncation occurred mid-suffix

Apply this fix consistently across all helpers that append suffixes (lines 60, 69, 80, and any others in service/ingress/pdb/pvc templates).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.