From e01278e4d08dc9d8fc11ff9fd4056bd3a0eaa322 Mon Sep 17 00:00:00 2001 From: tejassinghbhati Date: Thu, 13 Aug 2026 18:11:59 +0530 Subject: [PATCH 1/2] fix: stop the chart suggesting an empty nodeSelector The chart's error message told users to set 'nodeSelector: {}' when a rule should match all nodes, but the validating webhook rejects an empty selector outright with "nodeSelector must not be empty". Following the chart's own guidance with the webhook on fails on create. With the webhook off, which is the default, nothing blocks it and the rule matches every node in the cluster instead. Reword the message so it stops recommending it and says what actually happens. The prefix the chart test matches on is unchanged. Signed-off-by: tejassinghbhati --- charts/nrr-controller/templates/nodereadinessrules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/nrr-controller/templates/nodereadinessrules.yaml b/charts/nrr-controller/templates/nodereadinessrules.yaml index 8e94acf6..5b10ab7e 100644 --- a/charts/nrr-controller/templates/nodereadinessrules.yaml +++ b/charts/nrr-controller/templates/nodereadinessrules.yaml @@ -2,7 +2,7 @@ {{- range $rule := .Values.nodeReadinessRules }} {{- $spec := omit $rule "name" }} {{- if or (not (hasKey $spec "nodeSelector")) (kindIs "invalid" $spec.nodeSelector) }} -{{- fail (printf "nodeReadinessRules[%s]: spec.nodeSelector is required and immutable. Set it explicitly; use 'nodeSelector: {}' only if the rule is intended to match ALL nodes." ($rule.name | default "?")) }} +{{- fail (printf "nodeReadinessRules[%s]: spec.nodeSelector is required and immutable. Set it explicitly. An empty selector matches every node in the cluster, and is rejected by the validating webhook when that is enabled." ($rule.name | default "?")) }} {{- end }} --- apiVersion: readiness.node.x-k8s.io/v1alpha1 From fe723bb737b0ebf928ce34c6e4c85b51a43ccf32 Mon Sep 17 00:00:00 2001 From: tejassinghbhati Date: Thu, 13 Aug 2026 22:26:39 +0530 Subject: [PATCH 2/2] cleanup: apply reviewer wording for the nodeSelector message Signed-off-by: tejassinghbhati --- charts/nrr-controller/templates/nodereadinessrules.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/nrr-controller/templates/nodereadinessrules.yaml b/charts/nrr-controller/templates/nodereadinessrules.yaml index 5b10ab7e..3427fd27 100644 --- a/charts/nrr-controller/templates/nodereadinessrules.yaml +++ b/charts/nrr-controller/templates/nodereadinessrules.yaml @@ -2,7 +2,7 @@ {{- range $rule := .Values.nodeReadinessRules }} {{- $spec := omit $rule "name" }} {{- if or (not (hasKey $spec "nodeSelector")) (kindIs "invalid" $spec.nodeSelector) }} -{{- fail (printf "nodeReadinessRules[%s]: spec.nodeSelector is required and immutable. Set it explicitly. An empty selector matches every node in the cluster, and is rejected by the validating webhook when that is enabled." ($rule.name | default "?")) }} +{{- fail (printf "nodeReadinessRules[%s]: spec.nodeSelector is required and immutable. An empty selector to match every node in the cluster is rejected by the validating webhook to avoid cluster wide misconfiguration risks." ($rule.name | default "?")) }} {{- end }} --- apiVersion: readiness.node.x-k8s.io/v1alpha1