Admission webhook "validation.istio.io" does not allow underscore in FQDN, what's the workaround?

[edwardccg]

We have legacy SQL server which has underscore (_) in the FQDN, this is causing the Admission webhook "validation.istio.io" complaining about the configuration. I have tried to remove the underscore to test and its happy without underscore, so I believe the problem is on the underscore in FQDN in the ServiceEntry.

Is there anyway to bypass the validation and have istio accepting the FQDN for the ServiceEntry?

Istio version

client version: 1.20.3
control plane version: 1.20.3
data plane version: 1.20.3 (7 proxies)

Error

ServiceEntry/sample/sqlserver-db dry-run failed: admission webhook "validation.istio.io" denied the request: configuration is invalid: domain name "glb_d000.mydomain.net" invalid (label "glb_d000" invalid)

Yaml

---
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: sqlserver-db
  namespace: sample
spec:
  hosts:
    - "glb_d000.mydomain.net"
  addresses:
    - 10.0.0.0
  location: MESH_EXTERNAL
  exportTo:
    - "."
  ports:
    - name: tcp
      number: 23603
      protocol: TCP

Related code

validateFQDN

istio/pkg/config/validation/validation.go

Lines 265 to 270 in 2f54c6a

	func ValidateFQDN(fqdn string) error {
	if err := checkDNS1123Preconditions(fqdn); err != nil {
	return err
	}
	return validateDNS1123Labels(fqdn)
	}

validateDNS1123Labels

istio/pkg/config/validation/validation.go

Lines 298 to 314 in 2f54c6a

	func validateDNS1123Labels(domain string) error {
	parts := strings.Split(domain, ".")
	topLevelDomain := parts[len(parts)-1]
	if _, err := strconv.Atoi(topLevelDomain); err == nil {
	return fmt.Errorf("domain name %q invalid (top level domain %q cannot be all-numeric)", domain, topLevelDomain)
	}
	for i, label := range parts {
	// Allow the last part to be empty, for unambiguous names like `istio.io.`
	if i == len(parts)-1 && label == "" {
	return nil
	}
	if !labels.IsDNS1123Label(label) {
	return fmt.Errorf("domain name %q invalid (label %q invalid)", domain, label)
	}
	}
	return nil
	}

IsDNS1123Label

istio/pkg/config/labels/instance.go

Lines 111 to 113 in 2f54c6a

	func IsDNS1123Label(value string) bool {
	return len(value) <= DNS1123LabelMaxLength && dns1123LabelRegexp.MatchString(value)
	}

dns1123LabelFmt does not contain _ here

istio/pkg/config/labels/instance.go

Lines 28 to 49 in 2f54c6a

	const (
	DNS1123LabelMaxLength = 63 // Public for testing only.
	dns1123LabelFmt = "[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?"
	// a wild-card prefix is an '*', a normal DNS1123 label with a leading '*' or '*-', or a normal DNS1123 label
	wildcardPrefix = `(\*|(\*|\*-)?` + dns1123LabelFmt + `)`
	// Using kubernetes requirement, a valid key must be a non-empty string consist
	// of alphanumeric characters, '-', '_' or '.', and must start and end with an
	// alphanumeric character (e.g. 'MyValue', or 'my_value', or '12345'
	qualifiedNameFmt = "(?:[A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]"
	// In Kubernetes, label names can start with a DNS name followed by a '/':
	dnsNamePrefixFmt = dns1123LabelFmt + `(?:\.` + dns1123LabelFmt + `)*/`
	dnsNamePrefixMaxLength = 253
	)
	var (
	tagRegexp = regexp.MustCompile("^(" + dnsNamePrefixFmt + ")?(" + qualifiedNameFmt + ")$") // label value can be an empty string
	labelValueRegexp = regexp.MustCompile("^" + "(" + qualifiedNameFmt + ")?" + "$")
	dns1123LabelRegexp = regexp.MustCompile("^" + dns1123LabelFmt + "$")
	wildcardPrefixRegexp = regexp.MustCompile("^" + wildcardPrefix + "$")
	)

[edwardccg]

Our current work around is to create Internal DNS CNAME/ALIAS record for glbd000.mydomain.net to glb_d000.mydomain.net

[edwardccg]

After tested, this is working, our DNS team create ALIAS record instead of CNAME. I will mark this as answer