-
Notifications
You must be signed in to change notification settings - Fork 71
add iam auth policy conflict handling #456
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
| if err != nil { | ||
| if services.IsNotFoundError(err) { | ||
| c.log.Infof("reconcile error, retry in 30sec: %s", err) | ||
| if !isDelete && services.IsNotFoundError(err) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What this condition used for !isDelete?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for pointing, logic is wrong in the code. Intention was:
If it's policy delete request and SN or Svc not found, dont throw error, just remove finalizer and we done.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
updated condition
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we should start doing unit tests in controllers :D
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why I think old code is correct... !isDelete && services.IsNotFoundError(err)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
if it's policy delete and svc not found ignore, otherwise throw
(isDelete && notFound) -> ignore
!(isDelete && notFound) -> throw
| err = c.handleConflicts(ctx, k8sPolicy) | ||
| if err != nil { | ||
| c.log.Error(err) | ||
| return ctrl.Result{RequeueAfter: 30 * time.Second}, nil |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
for the Conflicted policy, should it just be "reconciled" with PolicyReasonConflicted status, instead of keep looping? (i.e., only the first IAMAuthPolicy takes effect and the controller just ignore other Conflicted ones )
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
with loop it should converge by itself when conflict is resolved, for example if I start controller with 2 policies, both will be in conflict state. When I remove one of them another one will succeed in ~30 sec
9c8f785 to
d666982
Compare
Pull Request Test Coverage Report for Build 6672227526
💛 - Coveralls |
Note:
add IAM auth policy conflicts handling
Tested manually by creating multiple policies for same target ref.
Log example:
Policy Status updated: