PR 1040 review

Both of main's outcomes matter here. In all 8 script and format cases I ran, what main sends intact is what fails to parse as YAML, because getUserData falls into its catch and returns the text as typed. So this PR blocks exactly the non-YAML content that works today, and lets through the scripts main already changes (FYI 1).

PR: the running VM ttt holding a script, Save clicked with nothing changed. Blocked, no request sent. (Form cropped to the banner and the editor.)

PR: a Windows VM with Cloudbase-Init #ps1_sysnative user data. Blocked. (Form cropped.)

Suggested inline comment, on line 432

Attach the two screenshots above to this comment. Docs: cloud-init user-data formats, Cloudbase-Init userdata. KubeVirt's startup scripts page also shows a #!/bin/bash script as cloudInitNoCloud user data.

The issue says "input arbitrary words". The check only catches words that break the surrounding structure, like the issue video, where they follow the default template's mapping. Network Data starts empty, so words there are a valid YAML string and go through as typed.

Suggested inline comment, on line 440

Suggested inline comment, on line 251 of the template page

validateCloudInit() {
  const isMapping = (text) => {
    try {
      const doc = jsyaml.load(text);

      return doc === undefined || doc === null || (typeof doc === 'object' && !Array.isArray(doc));
    } catch (e) {
      return false;
    }
  };

  if (/^\s*#cloud-config(\s|$)/.test(this.userScript || '') && !isMapping(this.userScript)) {
    this.errors.push(this.t('harvester.virtualMachine.cloudConfig.user.invalidYaml'));
  }

  if (this.networkScript && !isMapping(this.networkScript)) {
    this.errors.push(this.t('harvester.virtualMachine.cloudConfig.network.invalidYaml'));
  }
},

This goes in the main comment because it has no line to anchor to. It matters because QA works from these steps.

• "Skipped for Windows VMs" and the whole Windows section are out of date since 535a606.
• Step 3's snippet parses to {"password":"test - invalid indentation"}, so it saves. The author's screenshot used a different input, the default template plus words, and that does block.

When a script happens to parse as YAML, for example one with no comment between its commands, the form adds #cloud-config and can fold its lines. Cloud-init then won't run it as a script. Example sent by main, the PR and the fix alike:

#cloud-config
#!/bin/bash
# install nginx
apt-get update systemctl enable --now nginx

Not this PR's bug, and the fix leaves it alone. It's worth its own issue, and I can file one if you want.

With bad user data, Edit as YAML then Create sends the VM on all three builds. The other form validators don't run there either, so I wouldn't ask for it in this PR. The YAML only shows a secretRef, and no secret write showed up in my stubbed run. I didn't work out whether that's the stub or the app.

From reading the code, that page and the "create new" modal save the text without parsing it. Bad text can still become a template, and it only blocks later at VM save. The issue is about VMs, so this is out of scope.

• The branch is 37 commits behind main. It merges cleanly, but its base has shell 3.0.12-rc.7 with CodeMirror 5, and main has 3.0.14 with CodeMirror 6. CI last ran on Aug 5, so a rebase would refresh it.
• Duplicate keys: runcmd twice is blocked on the PR and the fix, while cloud-init's PyYAML accepts it and the last one wins. It's probably a mistake anyway, so I'd leave it.
• Text with no header isn't checked with the fix, because it could be anything. The form then adds #cloud-config if it parses, as main does.
• For the designer: the banner doesn't say which line is wrong.