Skip to content

pod-files rule checks 1 pod per owner reference group#43

Merged
dimityrmirchev merged 4 commits intogardener:mainfrom
AleksandarSavchev:check-1-pod-by-ref
Oct 9, 2023
Merged

pod-files rule checks 1 pod per owner reference group#43
dimityrmirchev merged 4 commits intogardener:mainfrom
AleksandarSavchev:check-1-pod-by-ref

Conversation

@AleksandarSavchev
Copy link
Copy Markdown
Member

@AleksandarSavchev AleksandarSavchev commented Oct 5, 2023

What this PR does / why we need it:

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Release note:

DISA Kubernetes STIGS `pod-files` rule now checks only 1 pod per owner reference group.

@AleksandarSavchev AleksandarSavchev requested a review from a team as a code owner October 5, 2023 14:08
@gardener-robot gardener-robot added needs/review size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Oct 5, 2023
Copy link
Copy Markdown
Member

@dimityrmirchev dimityrmirchev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I left some initial minor comments

Comment on lines +322 to +323
// GroupMinimalPodsByNodes groups pods by their nodes. Includes only one pod per reference group while trying
// to return a minimal number of groups.
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// GroupMinimalPodsByNodes groups pods by their nodes. Includes only one pod per reference group while trying
// to return a minimal number of groups.
// SelectPodOfReferenceGroup returns a single pod per owner reference group
// as well as groups the returned pods by the nodes they are scheduled on.
// Pods that do not have an owner reference will always be selected.
// It tries to pick the pods in a way that fewer nodes will be selected.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can also move this to internal/utils

groupedPodsByNodes := map[string][]corev1.Pod{}
groupedPodsByReferences := map[string][]corev1.Pod{}
for _, pod := range pods {
podTarget := target.With("name", pod.Name, "namespace", pod.Namespace, "kind", "pod")
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This can be moved closer to its usage

})

for _, key := range keys {
pods := groupedPodsByReferences[key]
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
pods := groupedPodsByReferences[key]
// we start from the smaller ref group because of fewer options to chose nodes from
pods := groupedPodsByReferences[key]

return ok
})

if podOnUsedNodeIdx < 0 {
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
if podOnUsedNodeIdx < 0 {
// if none of the pods match already selected node
// selected the node and add a single pod of the reference group for checking
if podOnUsedNodeIdx < 0 {

continue
}

pod := pods[podOnUsedNodeIdx]
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
pod := pods[podOnUsedNodeIdx]
// if there is a pod of the reference group which is scheduled on a selected node
// then add this pod to the "to-be-checked" pods
pod := pods[podOnUsedNodeIdx]

@dimityrmirchev dimityrmirchev changed the title pod-files rule checks 1 pod per reference group pod-files rule checks 1 pod per owner reference group Oct 9, 2023
Copy link
Copy Markdown
Member

@dimityrmirchev dimityrmirchev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@dimityrmirchev dimityrmirchev merged commit 4878707 into gardener:main Oct 9, 2023
@ghost ghost added the reviewed/ok-to-test label Oct 9, 2023
@AleksandarSavchev AleksandarSavchev deleted the check-1-pod-by-ref branch February 7, 2024 07:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size/XL Denotes a PR that changes 500-999 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants