fix: truncate over-sized status condition message/reason (#10322)

(cherry picked from commit dc9c432)

Author: weicao

controllers/apps/cluster/cluster_status_conditions.go

@@ -77,8 +77,8 @@ func newFailedProvisioningStartedCondition(err error) metav1.Condition {
 	return metav1.Condition{
 		Type:    appsv1.ConditionTypeProvisioningStarted,
 		Status:  metav1.ConditionFalse,
-		Message: err.Error(),
-		Reason:  getConditionReasonWithError(ReasonPreCheckFailed, err),
+		Message: intctrlutil.TruncateConditionMessage(err.Error()),
+		Reason:  intctrlutil.TruncateConditionReason(getConditionReasonWithError(ReasonPreCheckFailed, err)),
 	}
 }
 
@@ -105,8 +105,8 @@ func newFailedApplyResourcesCondition(err error) metav1.Condition {
 	return metav1.Condition{
 		Type:    appsv1.ConditionTypeApplyResources,
 		Status:  metav1.ConditionFalse,
-		Message: err.Error(),
-		Reason:  getConditionReasonWithError(ReasonApplyResourcesFailed, err),
+		Message: intctrlutil.TruncateConditionMessage(err.Error()),
+		Reason:  intctrlutil.TruncateConditionReason(getConditionReasonWithError(ReasonApplyResourcesFailed, err)),
 	}
 }
 

controllers/apps/component/utils.go

@@ -75,8 +75,8 @@ func newFailedProvisioningStartedCondition(err error) metav1.Condition {
 	return metav1.Condition{
 		Type:    appsv1.ConditionTypeProvisioningStarted,
 		Status:  metav1.ConditionFalse,
-		Message: err.Error(),
-		Reason:  getConditionReasonWithError(reasonPreCheckFailed, err),
+		Message: intctrlutil.TruncateConditionMessage(err.Error()),
+		Reason:  intctrlutil.TruncateConditionReason(getConditionReasonWithError(reasonPreCheckFailed, err)),
 	}
 }
 

pkg/controllerutil/condition_truncate.go

@@ -0,0 +1,75 @@
+/*
+Copyright (C) 2022-2026 ApeCloud Co., Ltd
+
+This file is part of KubeBlocks project
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+package controllerutil
+
+import (
+	"unicode/utf8"
+)
+
+// metav1.Condition.message has a CRD maxLength of 32768 bytes. Leave a margin
+// so the truncation marker fits and writes still succeed when the unbounded
+// underlying error (for example, a kbagent action stderr dump that already
+// exceeds 32768 bytes by itself) would otherwise cause the API server to
+// reject the status patch with "Too long: may not be more than 32768 bytes".
+const maxConditionMessageBytes = 32000
+
+// metav1.Condition.reason has a CRD maxLength of 1024 bytes.
+const maxConditionReasonBytes = 1024
+
+// conditionMsgTruncationMarker is appended to a truncated message so readers
+// can tell the message was cut off rather than naturally short. The full
+// underlying error remains available in the controller log; this marker only
+// covers the on-cluster Condition surface.
+const conditionMsgTruncationMarker = "\n[...truncated; see controller log for full error]"
+
+// TruncateConditionMessage returns msg unchanged when it fits in the Condition
+// message budget, otherwise it returns a UTF-8 safe prefix followed by the
+// truncation marker. The result is guaranteed to be valid UTF-8 and no longer
+// than maxConditionMessageBytes bytes.
+func TruncateConditionMessage(msg string) string {
+	if len(msg) <= maxConditionMessageBytes {
+		return msg
+	}
+	limit := maxConditionMessageBytes - len(conditionMsgTruncationMarker)
+	truncated := msg[:limit]
+	// A naive byte-level cut can land in the middle of a multi-byte rune.
+	// Walk back one byte at a time until the remaining prefix parses as
+	// valid UTF-8 — this also handles the case where the final byte is a
+	// rune start but the rune itself is incomplete.
+	for !utf8.ValidString(truncated) && len(truncated) > 0 {
+		truncated = truncated[:len(truncated)-1]
+	}
+	return truncated + conditionMsgTruncationMarker
+}
+
+// TruncateConditionReason returns reason unchanged when it fits in the
+// Condition reason budget, otherwise a UTF-8 safe prefix cut to fit. No marker
+// is appended — reason is a short identifier consumed by automation, not a
+// human-readable message.
+func TruncateConditionReason(reason string) string {
+	if len(reason) <= maxConditionReasonBytes {
+		return reason
+	}
+	truncated := reason[:maxConditionReasonBytes]
+	for !utf8.ValidString(truncated) && len(truncated) > 0 {
+		truncated = truncated[:len(truncated)-1]
+	}
+	return truncated
+}

pkg/controllerutil/condition_truncate_test.go

@@ -0,0 +1,162 @@
+/*
+Copyright (C) 2022-2026 ApeCloud Co., Ltd
+
+This file is part of KubeBlocks project
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+package controllerutil
+
+import (
+	"strings"
+	"testing"
+	"unicode/utf8"
+)
+
+// threeByteRune is the codepoint U+4E2D encoded as the bytes 0xE4 0xB8 0xAD.
+// It is used to exercise the UTF-8 boundary walk-back without putting
+// non-ASCII bytes into the source file (the Go compiler converts the
+// universal-character-name escape into the same 3-byte UTF-8 sequence).
+const threeByteRune = "\u4e2d"
+
+func TestTruncateConditionMessage_EmptyAndSmall(t *testing.T) {
+	for name, in := range map[string]string{
+		"empty":      "",
+		"short":      "boom",
+		"at_limit":   strings.Repeat("a", maxConditionMessageBytes),
+		"just_below": strings.Repeat("a", maxConditionMessageBytes-1),
+	} {
+		t.Run(name, func(t *testing.T) {
+			got := TruncateConditionMessage(in)
+			if got != in {
+				t.Fatalf("expected unchanged message, got len=%d (in len=%d)", len(got), len(in))
+			}
+		})
+	}
+}
+
+func TestTruncateConditionMessage_LargeASCII(t *testing.T) {
+	in := strings.Repeat("x", maxConditionMessageBytes*2)
+	got := TruncateConditionMessage(in)
+	if len(got) > maxConditionMessageBytes {
+		t.Fatalf("expected len <= %d, got %d", maxConditionMessageBytes, len(got))
+	}
+	if !strings.HasSuffix(got, conditionMsgTruncationMarker) {
+		t.Fatalf("expected trailing truncation marker, got %q", got[len(got)-100:])
+	}
+	if !utf8.ValidString(got) {
+		t.Fatalf("expected valid UTF-8 result")
+	}
+}
+
+func TestTruncateConditionMessage_UTF8RuneBoundaryAfterFirstByte(t *testing.T) {
+	// threeByteRune is 3 bytes. Build a payload whose naive byte-cut at
+	// maxConditionMessageBytes - len(marker) lands one byte past the
+	// rune start, leaving the first byte alone at the tail (rune start
+	// but incomplete). The implementation must walk back to a valid
+	// UTF-8 boundary.
+	limit := maxConditionMessageBytes - len(conditionMsgTruncationMarker)
+	// Prefix of (limit-1) ASCII bytes, then threeByteRune. The byte at
+	// index (limit-1) is the first byte of the multi-byte rune.
+	in := strings.Repeat("a", limit-1) + threeByteRune + strings.Repeat("a", maxConditionMessageBytes)
+
+	got := TruncateConditionMessage(in)
+	if !utf8.ValidString(got) {
+		t.Fatalf("result is not valid UTF-8: %q", got[len(got)-10:])
+	}
+	if len(got) > maxConditionMessageBytes {
+		t.Fatalf("expected len <= %d, got %d", maxConditionMessageBytes, len(got))
+	}
+	if !strings.HasSuffix(got, conditionMsgTruncationMarker) {
+		t.Fatalf("expected marker suffix")
+	}
+}
+
+func TestTruncateConditionMessage_UTF8RuneBoundaryAfterSecondByte(t *testing.T) {
+	// Variant: naive cut lands after the second byte of threeByteRune
+	// (the second byte is a continuation byte, not a rune start, but
+	// walking back to the prior byte still leaves an incomplete rune -
+	// the loop must continue until the result parses as valid UTF-8).
+	limit := maxConditionMessageBytes - len(conditionMsgTruncationMarker)
+	in := strings.Repeat("a", limit-2) + threeByteRune + strings.Repeat("a", maxConditionMessageBytes)
+
+	got := TruncateConditionMessage(in)
+	if !utf8.ValidString(got) {
+		t.Fatalf("result is not valid UTF-8")
+	}
+	if len(got) > maxConditionMessageBytes {
+		t.Fatalf("expected len <= %d, got %d", maxConditionMessageBytes, len(got))
+	}
+	if !strings.HasSuffix(got, conditionMsgTruncationMarker) {
+		t.Fatalf("expected marker suffix")
+	}
+}
+
+func TestTruncateConditionMessage_RealWorldErrorShape(t *testing.T) {
+	// Approximates the C03 scenario: a single kbagent action error that
+	// already exceeds 32 KiB on its own. Verify it fits the post-fix
+	// budget and stays valid UTF-8.
+	payload := "action: udf-shardingShardRemove, executed on pod: rds-x, error: exit code: 1, stderr: "
+	payload += strings.Repeat("rds-cluster-shard-pod-fqdn-line ", 2000) // ~64 KiB
+	got := TruncateConditionMessage(payload)
+	if len(got) > maxConditionMessageBytes {
+		t.Fatalf("expected len <= %d, got %d", maxConditionMessageBytes, len(got))
+	}
+	if !utf8.ValidString(got) {
+		t.Fatalf("expected valid UTF-8 result")
+	}
+	if !strings.HasSuffix(got, conditionMsgTruncationMarker) {
+		t.Fatalf("expected truncation marker")
+	}
+}
+
+func TestTruncateConditionReason_EmptyAndSmall(t *testing.T) {
+	for name, in := range map[string]string{
+		"empty":    "",
+		"short":    "ApplyResourcesFailed",
+		"at_limit": strings.Repeat("a", maxConditionReasonBytes),
+	} {
+		t.Run(name, func(t *testing.T) {
+			got := TruncateConditionReason(in)
+			if got != in {
+				t.Fatalf("expected unchanged reason, got len=%d", len(got))
+			}
+		})
+	}
+}
+
+func TestTruncateConditionReason_LargeASCII(t *testing.T) {
+	in := strings.Repeat("R", maxConditionReasonBytes*3)
+	got := TruncateConditionReason(in)
+	if len(got) > maxConditionReasonBytes {
+		t.Fatalf("expected len <= %d, got %d", maxConditionReasonBytes, len(got))
+	}
+	if !utf8.ValidString(got) {
+		t.Fatalf("expected valid UTF-8 result")
+	}
+}
+
+func TestTruncateConditionReason_UTF8RuneBoundary(t *testing.T) {
+	// Naive cut lands inside a 3-byte rune. The walk-back must stop on
+	// a valid UTF-8 prefix.
+	in := strings.Repeat("R", maxConditionReasonBytes-1) + threeByteRune + strings.Repeat("R", maxConditionReasonBytes)
+	got := TruncateConditionReason(in)
+	if !utf8.ValidString(got) {
+		t.Fatalf("result not valid UTF-8")
+	}
+	if len(got) > maxConditionReasonBytes {
+		t.Fatalf("expected len <= %d, got %d", maxConditionReasonBytes, len(got))
+	}
+}