[main] Global settings

[joshmeranda]

Issue:

Problem

Not all validations performed by norman on rancher settings are done by steve.

Solution

Added additional validations for rancher settings crds.d

CheckList

• Test
• Docs

[andreas-kupries]

Hi @joshmeranda Today I ran into an issue with the webhook which this PR may be involved in.

On the rancher side I see rancher startup failing with

ACTUAL 2026/08/17 14:20:13 [FATAL] admission webhook "rancher.cattle.io.settings.management.cattle.io" denied the request: value: Invalid value: "": time: invalid duration "s"

In the webhook log the last entry seen is

time="2026-08-17T14:20:13+02:00" level=debug msg="admit result: CREATE management.cattle.io/v3, Kind=Setting auth-user-info-max-age-seconds user=system:admin allowed=false err="

I.e. creation of the auth-user-info-max-age-seconds setting is rejected by the webhook
And this PR adds the validation to the webhook.

With extended logging in my local webhook I see

HOOK ACTUAL time="2026-08-17T14:20:13+02:00" level=warning msg="ZZZZZZ setting admit new @ ((&{TypeMeta:{Kind:Setting APIVersion:management.cattle.io/v3} ObjectMeta:{Name:auth-user-info-max-age-seconds GenerateName: Namespace: SelfLink: UID:aa5a53d0-b172-4fb9-99ae-f87280a9f3d3 ResourceVersion: Generation:1 CreationTimestamp:2026-08-17 14:20:13 +0200 CEST DeletionTimestamp: DeletionGracePeriodSeconds: Labels:map[] Annotations:map[] OwnerReferences:[] Finalizers:[] ManagedFields:[{Manager:rancher_debug Operation:Update APIVersion:management.cattle.io/v3 Time:2026-08-17 14:20:13 +0200 CEST FieldsType:FieldsV1 FieldsV1:{"f:customized":{},"f:default":{},"f:source":{},"f:value":{}} Subresource:}]} Value: Default:3600 Customized:false Source:}))"

Emphasis on the Value and Default fields here is mine.

I.e. the webhook is given a setting with a Default, but not a Value. This matches the error message reported by r/r: invalid duration "s", i.e. the empty value is extended with the unit s, then parsed, which fails.

The definition of the setting, i.e.

AuthUserInfoMaxAgeSeconds = NewSetting("auth-user-info-max-age-seconds", "3600") // 1 hour

in r/r seems to have its last change done 4 years ago. I.e. unlikely to have caused this.

My setup used r/r commit 1952e0e987242f0f2ca73799df7f1af9729ded72 (main at the time I am writing this)
and r/w commit 006f35e, which, while it has changes, are outside of settings, and not reached/triggered during startup either.

[joshmeranda]

@andreas-kupries I wasn't able to reproduce but I see the where the issue lies. I think validation error slips through the cracks because the setting is being created before webhook up.

[andreas-kupries]

I am using a local webhook for work of my own, and the created setting definitely reaches the setting validator in the webhook, where it is then rejected. Per my logs.

[joshmeranda]

Fair enough, I have a fix... just fighting with github outages to get the fix up\

[joshmeranda]

#1785
#1786