Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Move the common logic of checking for kms-plugin's version into gRPC client interceptor. #84387

Merged
merged 1 commit into from Oct 30, 2019
Merged

Move the common logic of checking for kms-plugin's version into gRPC client interceptor. #84387

merged 1 commit into from Oct 30, 2019

Conversation

immutableT
Copy link
Contributor

What type of PR is this?
/kind cleanup
What this PR does / why we need it:
This PR reduces code duplication that currently exist between the Encrypt and Decrypt methods of KMS service.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. area/apiserver sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/auth Categorizes an issue or PR as relevant to SIG Auth. and removed needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Oct 25, 2019
@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 25, 2019
@immutableT
Copy link
Contributor Author

/test pull-kubernetes-kubemark-e2e-gce-big

@immutableT
Copy link
Contributor Author

/assign @liggitt

liggitt
liggitt reviewed Oct 28, 2019
View reviewed changes
staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/grpc_service.go Outdated
}

err := invoker(ctx, method, req, reply, cc, opts...)
klog.V(5).Infof("Invoked method:%s, error:%v", method, err)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we really want to log on every encrypt/decrypt call? this seems so verbose as to be useless

liggitt
liggitt reviewed Oct 28, 2019
View reviewed changes
staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/grpc_service.go Outdated
invoker grpc.UnaryInvoker,
opts ...grpc.CallOption,
) error {
if method != "/v1beta1.KeyManagementService/Version" {
Copy link
Member

@liggitt liggitt Oct 28, 2019 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this leaks details of the v1beta1 implementation in k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v1beta1, and if we switch to v1 in the future, would silently be skipped. that needs to be protected against.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@liggitt, all makes sense, PTAL.

liggitt
liggitt reviewed Oct 29, 2019
View reviewed changes
staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/grpc_service.go Outdated
invoker grpc.UnaryInvoker,
opts ...grpc.CallOption,
) error {
if !strings.HasSuffix(method, ".KeyManagementService/Version") {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was thinking more of letting this be a check in the api package (e.g. IsVersionCheckMethod(method)) to prevent other packages from needing to know about the service/method name

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@liggitt, I like the idea of IsVersionCheckMethod, though I am not sure what you mean by the "api package". Could you, please, clarify this for me.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v1beta1 package is the one that knows the service/method name corresponding to the version check. It would make sense to contain that knowledge to that package.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@liggitt Makes sense. PTAL.

liggitt
liggitt reviewed Oct 30, 2019
View reviewed changes
staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/v1beta1/v1beta1.go Outdated
@@ -0,0 +1,23 @@
/*
Copyright 2017 The Kubernetes Authors.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: 2019

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

@liggitt
Copy link
Member

liggitt commented Oct 30, 2019

nit on copyright, lgtm otherwise

/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: immutableT, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@liggitt
Copy link
Member

liggitt commented Oct 30, 2019

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 30, 2019
@k8s-ci-robot k8s-ci-robot merged commit 48bc59a into kubernetes:master Oct 30, 2019
@k8s-ci-robot k8s-ci-robot added this to the v1.17 milestone Oct 30, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@liggitt liggitt liggitt left review comments

@lavalamp lavalamp Awaiting requested review from lavalamp

@wojtek-t wojtek-t Awaiting requested review from wojtek-t

Assignees

@liggitt liggitt

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/apiserver cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. release-note-none Denotes a PR that doesn't merit a release note. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/auth Categorizes an issue or PR as relevant to SIG Auth. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
v1.17
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@immutableT @liggitt @k8s-ci-robot