Found while fixing #21. Same root cause, worse blast radius: this one needs no opt-in flag, it breaks a default install.
Problem
authup.adminConsole.fullname is trunc 52 of the base plus -admin-console, i.e. up to 66 characters, and that name is used for the admin-console Service.
A Service's metadata.name must be a DNS-1035 label, capped at 63 characters. So any release whose authup.fullname reaches 50 characters or more produces a Service the API server rejects, and the install fails outright.
Reproduce:
helm template $(python3 -c "print('n'*53)") charts/authup | python3 -c "
import sys, yaml
for d in yaml.safe_load_all(sys.stdin):
if d and d['kind'] in ('Service','Job') and len(d['metadata']['name']) > 63:
print(len(d['metadata']['name']), d['kind'], d['metadata']['name'])
"
# -> 66 Service <release>-admin-consoleScope
That render is the full audit, and the admin-console Service is the only name over the limit once #21 capped the migration Job. Everything else fits:
| Suffix |
Base trunc |
Total |
Ceiling that applies |
-admin-console (14) |
52 |
66 |
63 (Service) ❌ |
-postgresql (11) |
52 |
63 |
63 (Service) ✅ exactly at it |
-server (7) |
52 |
59 |
63 (Service) ✅ |
-valkey (7) |
52 |
59 |
63 (Service) ✅ |
-mysql (6) |
52 |
58 |
63 (Service) ✅ |
-admin-console-env reaches 70, but that is a ConfigMap, where 253 applies.
Suggested fix
One number: trunc the base to 49 in authup.adminConsole.fullname, so 49 + 14 = 63. That keeps architecture rule 9's property (the component suffix always survives, names stay distinct) while respecting the real ceiling.
Renaming is safe: every release name in the affected range is currently un-installable, so no working deployment has a name that would move.
A more general variant is to derive the base trunc from the suffix length per component, so the next component suffix cannot reintroduce this. -postgresql sitting exactly on 63 today suggests it is worth doing properly rather than adjusting one constant.
Related
Rule 9 in .agents/architecture.md was amended in #20 to say it keeps names distinct, not short, and that 63 rather than 253 is the ceiling wherever a name becomes a label value or a DNS-1035 label. This is the remaining instance of that.
Found while fixing #21. Same root cause, worse blast radius: this one needs no opt-in flag, it breaks a default install.
Problem
authup.adminConsole.fullnameistrunc 52of the base plus-admin-console, i.e. up to 66 characters, and that name is used for the admin-console Service.A Service's
metadata.namemust be a DNS-1035 label, capped at 63 characters. So any release whoseauthup.fullnamereaches 50 characters or more produces a Service the API server rejects, and the install fails outright.Reproduce:
Scope
That render is the full audit, and the admin-console Service is the only name over the limit once #21 capped the migration Job. Everything else fits:
-admin-console(14)-postgresql(11)-server(7)-valkey(7)-mysql(6)-admin-console-envreaches 70, but that is a ConfigMap, where 253 applies.Suggested fix
One number: trunc the base to
49inauthup.adminConsole.fullname, so49 + 14 = 63. That keeps architecture rule 9's property (the component suffix always survives, names stay distinct) while respecting the real ceiling.Renaming is safe: every release name in the affected range is currently un-installable, so no working deployment has a name that would move.
A more general variant is to derive the base trunc from the suffix length per component, so the next component suffix cannot reintroduce this.
-postgresqlsitting exactly on 63 today suggests it is worth doing properly rather than adjusting one constant.Related
Rule 9 in
.agents/architecture.mdwas amended in #20 to say it keeps names distinct, not short, and that 63 rather than 253 is the ceiling wherever a name becomes a label value or a DNS-1035 label. This is the remaining instance of that.