-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
None
-
None
-
False
-
-
False
-
-
Issue Summary
When CREATE_ONLY_MODE is set to an invalid value (e.g., "random-123", "yes", "1"), it incorrectly changes the state to disabled (FALSE). Invalid values should NOT change the current state - only valid values "TRUE" or "FALSE" (case-insensitive) should be allowed to change the state.
Current Behavior (Bug)
| Current State | New Value | Capitalized | Result | Issue |
| TRUE (enabled) | "random-123" | "RANDOM-123" | FALSE (disabled) | ❌ State changed by invalid value |
| TRUE (enabled) | "yes" | "YES" | FALSE (disabled) | ❌ State changed by invalid value |
| FALSE (disabled) | "xyz" | "XYZ" | FALSE (disabled) | ✅ OK (but silent, no warning) |
Expected Behavior
| Current State | New Value | Capitalized | Valid? | Expected Result |
| TRUE (enabled) | "true" | "TRUE" | ✅ Yes | TRUE (state changed) |
| TRUE (enabled) | "false" | "FALSE" | ✅ Yes | FALSE (state changed) |
| TRUE (enabled) | "random-123" | "RANDOM-123" | ❌ No | TRUE (state UNCHANGED + warning) |
| TRUE (enabled) | "yes" | "YES" | ❌ No | TRUE (state UNCHANGED + warning) |
| FALSE (disabled) | "true" | "TRUE" | ✅ Yes | TRUE (state changed) |
| FALSE (disabled) | "xyz" | "XYZ" | ❌ No | FALSE (state UNCHANGED + warning) |
Problem
- Invalid values silently change the state to FALSE
- If create-only mode is TRUE and user sets invalid value, it becomes FALSE unexpectedly
- No warning is logged for invalid values
- User loses their enabled state due to a typo or invalid input
Steps to Reproduce
# Step 1: Enable create-only mode oc patch subscription zero-trust-workload-identity-manager-v1-0-0-sub \ -n zero-trust-workload-identity-manager \ --type='merge' -p '\{"spec":{"config":{"env":[{"name":"CREATE_ONLY_MODE","value":"true"}]}}}' # Step 2: Verify CreateOnlyMode is TRUE oc get zerotrustworkloadidentitymanagers cluster -o jsonpath='\{.status.conditions[?(@.type=="CreateOnlyMode")].status}' # Output: True # Step 3: Set invalid value oc patch subscription zero-trust-workload-identity-manager-v1-0-0-sub \ -n zero-trust-workload-identity-manager \ --type='merge' -p '\{"spec":{"config":{"env":[{"name":"CREATE_ONLY_MODE","value":"random-123"}]}}}' # Step 4: Check status - BUG: it becomes FALSE! oc get zerotrustworkloadidentitymanagers cluster -o jsonpath='\{.status.conditions[?(@.type=="CreateOnlyMode")].status}' # Output: False ← BUG! Should remain True
Root Cause
Current code in pkg/controller/utils/utils.go:
func IsInCreateOnlyMode() bool { createOnlyEnvValue := os.Getenv(createOnlyEnvName) return createOnlyEnvValue == "true" // Returns false for ANY non-"true" value }
Suggested Fix
func IsInCreateOnlyMode() bool { value := os.Getenv(CreateOnlyEnvName) if value == "" { return getCurrentState() // Return current state if empty } // Capitalize the input capitalizedValue := strings.ToUpper(strings.TrimSpace(value)) switch capitalizedValue { case "TRUE": // Valid TRUE - change state to enabled setCurrentState(true) return true case "FALSE": // Valid FALSE - change state to disabled setCurrentState(false) return false default: // Invalid value - DO NOT change state, log warning log.Info("Invalid CREATE_ONLY_MODE value: state unchanged", "inputValue", value, "capitalizedValue", capitalizedValue, "currentState", getCurrentState(), "validValues", "true, false (case-insensitive)") return getCurrentState() // Return current state unchanged } }
Acceptance Criteria
- [ ] Only "true"/"TRUE"/"True" changes state to ENABLED
- [ ] Only "false"/"FALSE"/"False" changes state to DISABLED
- [ ] Invalid values DO NOT change current state
- [ ] Invalid values log a WARNING message with details
- [ ] Empty value keeps current state (default: disabled)
- [ ] Unit tests added for state preservation scenarios
- [ ] Tested transition: TRUE → invalid → should remain TRUE
Impact
High - Users can accidentally disable create-only mode by setting an invalid value (typo), causing the operator to start reconciling and overwriting their manual changes.
- account is impacted by
-
SPIRE-368 [e2e][automation] create only mode validation along with premerge testing of {https://github.com/openshift/zero-trust-workload-identity-manager/pull/89}
-
- To Do
-