Set minimum TLS version in webhooks #1426

sozercan · 2021-07-07T22:28:16Z

Signed-off-by: Sertac Ozercan sozercan@gmail.com
What this PR does / why we need it:

Upgrades CR to v0.9.2
Introduces tls-min-version flag to set min TLS version (defaulting to 1.2)

Which issue(s) this PR fixes (optional, using fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when the PR gets merged):
Fixes #1424

Special notes for your reviewer:

sozercan · 2021-07-07T22:29:26Z

third_party/sigs.k8s.io/controller-runtime/pkg/dynamiccache/cache.go

+		if err != nil {
+			return nil, err
+		}
+		selectorsByGVK[gvk] = selector


@shomron I am getting error

cannot use selector (variable of type internal.Selector) as internal.Selector value in assignmentcompilerIncompatibleAssign

any ideas?

Yes, the types come from different packages (upstream cache and forked cache) - and can't just be assigned to each other. This resolves it:

selectorsByGVK[gvk] = internal.Selector{ Label: selector.Label, Field: selector.Field, }

I'll go through the PR to see if there's anything else.

Opened sozercan#73 with fixes to the rebase.

thanks @shomron!

maxsmythe

LGTM

ritazh · 2021-09-09T01:20:12Z

@shomron when you get a chance, can you please help take a look at these failures: https://github.com/open-policy-agent/gatekeeper/pull/1426/checks?check_run_id=3550979914

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

Signed-off-by: Oren Shomron <shomron@gmail.com>

Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

sozercan · 2021-09-14T17:01:12Z

Looks like #1538 updated the constraint framework vendor without go.mod change. I updated frameworks to 2924b2c86f76 for now so it doesn't keep generating diffs.

@willbeason

sozercan · 2021-09-14T17:57:38Z

https://github.com/open-policy-agent/gatekeeper/blob/master/pkg/controller/config/config_controller_test.go#L95 TestReconcile is failing but not sure why @shomron any thoughts?

sozercan · 2021-09-21T20:43:25Z

@maxsmythe still LGTY?

codecov-commenter · 2021-09-21T20:43:27Z

Codecov Report

Merging #1426 (7e89a28) into master (14de7cf) will increase coverage by 0.04%.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##           master    #1426      +/-   ##
==========================================
+ Coverage   52.77%   52.82%   +0.04%     
==========================================
  Files          89       89              
  Lines        7843     7849       +6     
==========================================
+ Hits         4139     4146       +7     
- Misses       3356     3357       +1     
+ Partials      348      346       -2

Flag	Coverage Δ
unittests	`52.82% <0.00%> (+0.04%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
pkg/metrics/client_metrics.go	`0.00% <0.00%> (ø)`
pkg/webhook/common.go	`66.00% <ø> (ø)`
pkg/webhook/mutation.go	`19.11% <0.00%> (-0.29%)`	⬇️
pkg/webhook/namespacelabel.go	`66.66% <0.00%> (-3.34%)`	⬇️
pkg/webhook/policy.go	`29.26% <0.00%> (-0.17%)`	⬇️
pkg/controller/mutators/core/controller_core.go	`55.44% <0.00%> (+1.55%)`	⬆️
pkg/watch/replay.go	`81.25% <0.00%> (+2.27%)`	⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a968ce3...7e89a28. Read the comment docs.

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

maxsmythe

One comment about metrics

WRT the informer, are we also upgrading our fork as part of this PR?

maxsmythe · 2021-09-22T02:50:26Z

pkg/metrics/client_metrics.go

@@ -31,4 +32,4 @@ func DisableRESTClientMetrics() {

 type noopLatency struct{}

-func (noopLatency) Observe(string, url.URL, time.Duration) {}
+func (noopLatency) Observe(context.Context, string, url.URL, time.Duration) {}


Why are we adding context here? Looking at the definition of clientmetrics.RequestLatency, it doesn't appear to expect a context.

Looks like this is part of k8s v1.21 changes:
https://github.com/kubernetes/client-go/blob/release-1.21/tools/metrics/metrics.go#L117
https://github.com/kubernetes-sigs/controller-runtime/blob/v0.9.2/pkg/metrics/client_go_adapter.go#L166

ah, might have been looking at an older version of the code. LGTM

ritazh · 2021-09-22T16:01:50Z

WRT the informer, are we also upgrading our fork as part of this PR?

Yes, @shomron's commit d390a0a updates the fork from 0.8.2 to 0.9.2

maxsmythe

LGTM

sozercan commented Jul 7, 2021

View reviewed changes

sozercan force-pushed the tls-min-version branch from 99fea11 to a58f7b3 Compare July 7, 2021 22:32

sozercan requested a review from shomron July 21, 2021 16:11

ritazh marked this pull request as ready for review September 7, 2021 19:06

maxsmythe approved these changes Sep 8, 2021

View reviewed changes

ritazh force-pushed the tls-min-version branch from 21c266c to 7d3dfa7 Compare September 9, 2021 00:45

sozercan and others added 6 commits September 10, 2021 12:09

TLS min version

6e2f0aa

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

update CR

6f269a9

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

objectutil -> internal

366de2e

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

fix selector

519bcc0

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

Fixes for controller-runtime rebase 0.8.2->0.9.2 (#73)

d390a0a

Signed-off-by: Oren Shomron <shomron@gmail.com>

update client_metrics

8d4b631

Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>

ritazh force-pushed the tls-min-version branch from 7d3dfa7 to 8d4b631 Compare September 10, 2021 19:10

sozercan and others added 5 commits September 13, 2021 14:24

Merge branch 'master' into tls-min-version

abc0057

Merge branch 'master' into tls-min-version

b7000f2

Merge branch 'master' into tls-min-version

3523fde

update frameworks to 2924b2c86f76

db56b9d

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

Merge branch 'master' into tls-min-version

adc31bb

shomron mentioned this pull request Sep 20, 2021

Scope pkg/readiness/Test_CollectDeleted to a controlled namespace #1567

Merged

sozercan and others added 2 commits September 21, 2021 09:30

Merge branch 'master' into tls-min-version

df6bff8

Merge branch 'master' into tls-min-version

825a8f8

sozercan force-pushed the tls-min-version branch from 7e89a28 to 178b70e Compare September 21, 2021 20:49

remove finalizer

234c33b

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

sozercan force-pushed the tls-min-version branch from 178b70e to 234c33b Compare September 21, 2021 20:50

maxsmythe reviewed Sep 22, 2021

View reviewed changes

Merge branch 'master' into tls-min-version

dc2b3f8

maxsmythe approved these changes Sep 23, 2021

View reviewed changes

sozercan merged commit 921869d into open-policy-agent:master Sep 23, 2021

sozercan deleted the tls-min-version branch September 23, 2021 15:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Set minimum TLS version in webhooks #1426

Set minimum TLS version in webhooks #1426

sozercan commented Jul 7, 2021

sozercan Jul 7, 2021

shomron Aug 4, 2021

shomron Aug 4, 2021

sozercan Aug 4, 2021

maxsmythe left a comment

ritazh commented Sep 9, 2021

sozercan commented Sep 14, 2021 •

edited

Loading

sozercan commented Sep 14, 2021 •

edited

Loading

sozercan commented Sep 21, 2021

codecov-commenter commented Sep 21, 2021

maxsmythe left a comment

maxsmythe Sep 22, 2021

sozercan Sep 22, 2021 •

edited

Loading

maxsmythe Sep 23, 2021

ritazh commented Sep 22, 2021

maxsmythe left a comment

Set minimum TLS version in webhooks #1426

Set minimum TLS version in webhooks #1426

Conversation

sozercan commented Jul 7, 2021

sozercan Jul 7, 2021

Choose a reason for hiding this comment

shomron Aug 4, 2021

Choose a reason for hiding this comment

shomron Aug 4, 2021

Choose a reason for hiding this comment

sozercan Aug 4, 2021

Choose a reason for hiding this comment

maxsmythe left a comment

Choose a reason for hiding this comment

ritazh commented Sep 9, 2021

sozercan commented Sep 14, 2021 • edited Loading

sozercan commented Sep 14, 2021 • edited Loading

sozercan commented Sep 21, 2021

codecov-commenter commented Sep 21, 2021

Codecov Report

maxsmythe left a comment

Choose a reason for hiding this comment

maxsmythe Sep 22, 2021

Choose a reason for hiding this comment

sozercan Sep 22, 2021 • edited Loading

Choose a reason for hiding this comment

maxsmythe Sep 23, 2021

Choose a reason for hiding this comment

ritazh commented Sep 22, 2021

maxsmythe left a comment

Choose a reason for hiding this comment

sozercan commented Sep 14, 2021 •

edited

Loading

sozercan commented Sep 14, 2021 •

edited

Loading

sozercan Sep 22, 2021 •

edited

Loading