The Ansible "markUnsafe" option should mark more things as unsafe

[agaffney]

Bug Report

What did you do?

I added markUnsafe: true to watches.yaml and created a k8s resource containing strings that look like Jinja templates. I tried to access the _<group>_<kind> var to retrieve a field under status that I had previously written.

What did you expect to see?

I should be able to access data normally in the operator-provided _<group>_<kind> var when it contains Jinja-like data and have markUnsafe: true set.

What did you see instead? Under which circumstances?

Ansible blows up with a template error when it encounters the Jinja-like data contained in the k8s resource.

Environment

Operator type:

Kubernetes cluster type:

EKS

$ operator-sdk version

v1.7.2

Possible Solution

Make markUnsafe: true also apply to the _<group>_<kind> magic variable (and perhaps any other magic variables).

Additional context

I was able to work around this by using the k8s_info module to query the resource rather than using the operator-provided _<group>_<kind> var. Values returned from module invocations are treated as unsafe by default by Ansible.

[jlhuilier-1a]

Encountered also this issue with fields inside annotations. So I would also mark as unsafe all the CR fields, and not only the spec.

PS: The markUnsafe parameter doesn't seem to be documented today.

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[agaffney]

/remove-lifecycle stale

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[fabianvf]

/lifecycle frozen

[kfox1111]

I think we hit this same issue.