add a verify equivilant to prometheus visibility rules #100552
Conversation
k8s-ci-robot
added
release-note-none
k8s-ci-robot
added
the
approved
BenTheElder
requested review from
dims and
spiffxp
and removed request for
fejta
|
cc @serathius xref: #99561 (comment) #99876 (comment) |
| ./test/e2e_node | ||
| ./test/integration/apiserver/flowcontrol | ||
| ./test/integration/metrics | ||
| ) |
There was a problem hiding this comment.
This is the current list of importers.
It also matches the previous visibility rule, though is more specific for component-base/metrics.
kubernetes/build/visible_to/BUILD
Lines 431 to 444 in a1f2787
|
/retest |
|
/retest |
|
@BenTheElder -- do you want this PR to be in the milestone? asking since the issue is in milestone. :) |
|
Yes, let me fix that. We want to prevent regressions here after dropping bazel, the test is very cheap, and the changes are contained to |
| done < <(grep \ | ||
| --exclude-dir={_output,vendor} \ | ||
| --include='*.go' \ | ||
| -R . \ |
There was a problem hiding this comment.
replace . with $KUBE_ROOT just to be sure?
There was a problem hiding this comment.
Good catch, thanks. Will do 👍
There was a problem hiding this comment.
actually, I cd'ed within this subshell instead. because then we don't need to do more path mangling to get package paths instead of absolute paths.
hack/verify-prometheus-imports.sh
Outdated
| if ! kube::util::array_contains "$pkg" "${packages_probably_importing_prometheus[@]}"; then | ||
| packages_probably_importing_prometheus+=("$pkg") | ||
| fi | ||
| done < <(grep \ |
There was a problem hiding this comment.
do all these options work well whether GNU grep or BSD grep is used?
There was a problem hiding this comment.
yes. this doesn't use any GNU extensions, I tested this on mac first (2.5.1-FreeBSD) and then ~debian (GNU grep 3.6)
BenTheElder
force-pushed
the
prometheus-visibility
branch
2 times, most recently
from
83b769c
to
d4c4ed3
Compare
|
/assign |
| -R . \ | ||
| -l \ | ||
| -Ee '"github.com/prometheus/.*"' \ | ||
| | LC_ALL=C sort -u) |
There was a problem hiding this comment.
I think you could xargs dirname and uniq to avoid the array logic above but not a blocker
There was a problem hiding this comment.
dirname only accepts a single argument on darwin, so it's not really going to help, we still need to do it serially.
I think we're going to switch to filepaths anyhow though, after discussing what is desired with @logicalhan elsewhere.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: BenTheElder, spiffxp The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
BenTheElder
force-pushed
the
prometheus-visibility
branch
from
d4c4ed3
to
7ede8a2
Compare
k8s-ci-robot
added
the
lgtm
|
Changes:
|
What type of PR is this?
/kind bug
(we should have been enforcing this, the previous solution was lost in #99561)
What this PR does / why we need it:
Efficiently ensures that prometheus imports remain restricted per #89267 following the removal of bazel and visibility rules.
Which issue(s) this PR fixes:
Fixes #99876
Special notes for your reviewer:
We do have multiple other tools for validating imports, unfortunately none of them are suitable for this task, there's more on this in the script comments.
The short version:
verify-importsis not capable of handling for this use case and is intended to restrict the imports within a package whileverify-import-bosscan technically express this but is far too expensive to run over the entire source tree and only checks specific directories.Does this PR introduce a user-facing change?
Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:
/sig testing instrumentation
/triage accepted