Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Safely consume TLSSecurityProfile from APIServer CR #2149

Merged
merged 1 commit into from
Nov 24, 2022
Merged

Safely consume TLSSecurityProfile from APIServer CR #2149

merged 1 commit into from
Nov 24, 2022

Conversation

tiraboschi
Copy link
Member

@tiraboschi tiraboschi commented Nov 21, 2022 •
edited

APIServer CR is validating TLSSecurityProfile
less strictly than CNAO.
HCO in general delegates the validation
to the operators that is managing,
but this is not true for values directly
read from the APIServer CR
that are not passing into our validating
webhook.
So if the cluster admin requires
a custom configuration for TLSSecurityProfile
on the APIServer CR all the components
but CNAO will accept it while CNAO
will refuse it continuously.
Let's prevent this sanitizing the input.
this is not validated

Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=2137896

TODO: add unit tests

Signed-off-by: Simone Tiraboschi stirabos@redhat.com

Reviewer Checklist

Reviewers are supposed to review the PR for every aspect below one by one. To check an item means the PR is either "OK" or "Not Applicable" in terms of that item. All items are supposed to be checked before merging a PR.

  • PR Message
  • Commit Messages
  • How to test
  • Unit Tests
  • Functional Tests
  • User Documentation
  • Developer Documentation
  • Upgrade Scenario
  • Uninstallation Scenario
  • Backward Compatibility
  • Troubleshooting Friendly

Release note:

Safely consume TLSSecurityProfile from APIServer CR

@tiraboschi tiraboschi added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 21, 2022
@kubevirt-bot kubevirt-bot added dco-signoff: yes Indicates the PR's author has DCO signed all their commits. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. size/M and removed do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels Nov 21, 2022
@coveralls
Copy link
Collaborator

coveralls commented Nov 21, 2022 •
edited

Pull Request Test Coverage Report for Build 3525527586

  • 49 of 54 (90.74%) changed or added relevant lines in 1 file are covered.
  • 1 unchanged line in 1 file lost coverage.
  • Overall coverage increased (+0.02%) to 85.456%
Changes Missing Coverage Covered Lines Changed/Added Lines %
pkg/util/cluster.go 49 54 90.74%
Files with Coverage Reduction New Missed Lines %
controllers/operands/operandHandler.go 1 84.34%
Totals Coverage Status
Change from base Build 3495979789: 0.02%
Covered Lines: 4671
Relevant Lines: 5466
💛 - Coveralls

@tiraboschi
Safely consume TLSSecurityProfile from APIServer CR
46834de 
APIServer CR is validating TLSSecurityProfile
less strictly than CNAO.
HCO in general delegates the validation
to the operators that is managing,
but this is not true for values directly
read from the APIServer CR
that are not passing into our validating
webhook.
So if the cluster admin requires
a custom configuration for TLSSecurityProfile
on the APIServer CR all the components
but CNAO will accept it while CNAO
will refuse it continuously.
Let's prevent this sanitizing the input.
this is not validated

Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=2137896

Signed-off-by: Simone Tiraboschi <stirabos@redhat.com>
@sonarcloud
Copy link

sonarcloud bot commented Nov 22, 2022

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
0.0% 0.0% Duplication

@hco-bot
Copy link
Collaborator

hco-bot commented Nov 22, 2022

hco-e2e-image-index-aws lane succeeded.
/override ci/prow/hco-e2e-image-index-gcp

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-image-index-gcp

In response to this:

hco-e2e-image-index-aws lane succeeded.
/override ci/prow/hco-e2e-image-index-gcp

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hco-bot
Copy link
Collaborator

hco-bot commented Nov 22, 2022

hco-e2e-upgrade-index-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-index-sno-azure
hco-e2e-upgrade-prev-index-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-index-sno-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-upgrade-index-sno-azure, ci/prow/hco-e2e-upgrade-prev-index-sno-azure

In response to this:

hco-e2e-upgrade-index-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-index-sno-azure
hco-e2e-upgrade-prev-index-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-index-sno-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hco-bot
Copy link
Collaborator

hco-bot commented Nov 22, 2022

hco-e2e-upgrade-prev-index-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-index-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-upgrade-prev-index-azure

In response to this:

hco-e2e-upgrade-prev-index-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-index-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hco-bot
Copy link
Collaborator

hco-bot commented Nov 22, 2022

hco-e2e-upgrade-index-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-index-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-upgrade-index-azure

In response to this:

hco-e2e-upgrade-index-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-index-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hco-bot
Copy link
Collaborator

hco-bot commented Nov 22, 2022

hco-e2e-image-index-aws lane succeeded.
/override ci/prow/hco-e2e-image-index-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-image-index-azure

In response to this:

hco-e2e-image-index-aws lane succeeded.
/override ci/prow/hco-e2e-image-index-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tiraboschi
Copy link
Member Author

/retest

@hco-bot
Copy link
Collaborator

hco-bot commented Nov 22, 2022

hco-e2e-kv-smoke-gcp lane succeeded.
/override ci/prow/hco-e2e-kv-smoke-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-kv-smoke-azure

In response to this:

hco-e2e-kv-smoke-gcp lane succeeded.
/override ci/prow/hco-e2e-kv-smoke-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci
Copy link

openshift-ci bot commented Nov 22, 2022

@tiraboschi: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/hco-e2e-image-index-gcp 46834de link true /test hco-e2e-image-index-gcp
ci/prow/hco-e2e-upgrade-prev-index-sno-azure 46834de link false /test hco-e2e-upgrade-prev-index-sno-azure
ci/prow/hco-e2e-upgrade-index-sno-azure 46834de link false /test hco-e2e-upgrade-index-sno-azure
ci/prow/hco-e2e-upgrade-prev-index-azure 46834de link true /test hco-e2e-upgrade-prev-index-azure
ci/prow/hco-e2e-upgrade-index-azure 46834de link true /test hco-e2e-upgrade-index-azure
ci/prow/hco-e2e-image-index-azure 46834de link true /test hco-e2e-image-index-azure
ci/prow/hco-e2e-kv-smoke-azure 46834de link true /test hco-e2e-kv-smoke-azure
ci/prow/hco-e2e-image-index-sno-azure 46834de link false /test hco-e2e-image-index-sno-azure

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hco-bot
Copy link
Collaborator

hco-bot commented Nov 22, 2022

hco-e2e-image-index-sno-aws lane succeeded.
/override ci/prow/hco-e2e-image-index-sno-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-image-index-sno-azure

In response to this:

hco-e2e-image-index-sno-aws lane succeeded.
/override ci/prow/hco-e2e-image-index-sno-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@kubevirt-bot kubevirt-bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Nov 23, 2022
orenc1
orenc1 approved these changes Nov 24, 2022
View reviewed changes
Copy link
Collaborator

@orenc1 orenc1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@kubevirt-bot kubevirt-bot added the lgtm Indicates that a PR is ready to be merged. label Nov 24, 2022
@kubevirt-bot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: orenc1

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubevirt-bot kubevirt-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 24, 2022
@kubevirt-bot kubevirt-bot merged commit b12e6dd into kubevirt:main Nov 24, 2022
@tiraboschi
Copy link
Member Author

/cherry-pick release-1.8

@tiraboschi tiraboschi deleted the tls_valid branch November 24, 2022 08:26
@kubevirt-bot kubevirt-bot mentioned this pull request Nov 24, 2022
Merged
@kubevirt-bot
Copy link
Contributor

@tiraboschi: new pull request created: #2158

In response to this:

/cherry-pick release-1.8

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@orenc1 orenc1 orenc1 approved these changes

@machadovilaca machadovilaca Awaiting requested review from machadovilaca

@nunnatsa nunnatsa Awaiting requested review from nunnatsa

Assignees

@orenc1 orenc1

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. lgtm Indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@tiraboschi @coveralls @hco-bot @kubevirt-bot @orenc1