Why can I decode a protobuf namespace but not a configmap?

5/31/2021

I'm trying to see how far I can get with decoding protobuf as stored in etcd by Kubernetes. I'm running in a weird problem where I can decode most of the protobuf, except for configmaps:

This gives me valid output:

etcdctl get /registry/namespaces/default -w protobuf | protoc --decode_raw

But this gives me an error:

etcdctl get /registry/configmaps/kube-system/coredns -w protobuf | protoc --decode_raw
Failed to parse input.

If I do not pipe the output through protoc, it looks like protobuf (lots of readable strings with control characters in between). What am I doing wrong? What's different with regards to a ConfigMap as opposed to other resources? Is there a way to make it work?

-- Tim Stoop
kubernetes
protocol-buffers

1 Answer

6/1/2021

First, you should to know:

Protobufs are raw binary data, and they can contain NULL bytes.

As you mentioned you have control characters:

If I do not pipe the output through protoc, it looks like protobuf (lots of readable strings with control characters in between).

I can't guess what the signs are. However, it is possible that a NULL byte might have ended up somewhere. In this situation you will get an error Failed to parse input.

If you have only control characters try to store output from etcdctl get /registry/configmaps/kube-system/coredns -w protobuf in the variable and the use printf command, like this:

result=`etcdctl get /registry/configmaps/kube-system/coredns -w protobuf`
printf $result | protoc --decode_raw

This could works if you have only control characters. But that proto still could failed to parse with --decode_raw, if you have a NULL byte in the middle of the proto.

Additionally coderanger well mentioned

Just to say it, this is just for fun, right? Like you know that you should never do this in a real cluster? :D

You can also read more about similar problems here, here and here.

-- Mikołaj Głodziak
Source: StackOverflow