From a5e361c3dcb46fc00f2bf1683c74d2de15fe1d21 Mon Sep 17 00:00:00 2001
From: Arsolitt <arsolitt@gmail.com>
Date: Wed, 22 Apr 2026 17:20:13 +0300
Subject: [PATCH] fix(kubernetes): add zero-value validation for kubelet
 reservation fields

User-supplied memory and CPU reservation values that parse to zero or
negative are now rejected with a clear error message. The format regex
alone cannot catch semantic invalidity like "0Mi" or "0m".

Signed-off-by: Arsolitt <arsolitt@gmail.com>
---
 .../apps/kubernetes/templates/cluster.yaml    | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml
index 5ca249762..5952ccb85 100644
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -240,6 +240,29 @@ metadata:
 {{-     fail (printf "nodeGroup %s: invalid %s value %q — must be %s" $groupName .key (.value | toString) .hint) }}
 {{-   end }}
 {{- end }}
+{{/* Validate that user-supplied reservation values are positive (non-zero) */}}
+{{- range $_, $entry := list (dict "key" "systemReservedMemory" "value" $kubeletOverride.systemReservedMemory) (dict "key" "kubeReservedMemory" "value" $kubeletOverride.kubeReservedMemory) }}
+{{-   if $entry.value }}
+{{-     $bytes := include "cozy-lib.resources.toFloat" ($entry.value | toString) | float64 }}
+{{-     if le $bytes 0.0 }}
+{{-       fail (printf "nodeGroup %s: %s must be a positive value, got %s" $groupName $entry.key ($entry.value | toString)) }}
+{{-     end }}
+{{-   end }}
+{{- end }}
+{{- range $_, $entry := list (dict "key" "systemReservedCpu" "value" $kubeletOverride.systemReservedCpu) (dict "key" "kubeReservedCpu" "value" $kubeletOverride.kubeReservedCpu) }}
+{{-   if $entry.value }}
+{{-     $cpuStr := $entry.value | toString }}
+{{-     $cpuVal := 0.0 }}
+{{-     if hasSuffix "m" $cpuStr }}
+{{-       $cpuVal = trimSuffix "m" $cpuStr | float64 }}
+{{-     else }}
+{{-       $cpuVal = $cpuStr | float64 }}
+{{-     end }}
+{{-     if le $cpuVal 0.0 }}
+{{-       fail (printf "nodeGroup %s: %s must be a positive value, got %s" $groupName $entry.key $cpuStr) }}
+{{-     end }}
+{{-   end }}
+{{- end }}
 {{/* Validate absolute eviction threshold formats before converting */}}
 {{- if not (hasSuffix "%" $evictionHardMemory) }}
 {{-   if not (regexMatch `^[0-9]+(\.[0-9]+)?([eE][+-]?[0-9]+)?(Ki|Mi|Gi|Ti|Pi|Ei|k|M|G|T|P|E)?$` $evictionHardMemory) }}