added namespace validation for custom resources #1523

mgsh · 2022-07-19T11:19:23Z

mgsh · 2022-07-19T11:22:11Z

Hi @fedepaol , I've attempted a fix for namespace validation. Can you please review when you get a chance and suggest if any changes?

fedepaol · 2022-07-19T12:00:08Z

Hi @fedepaol , I've attempted a fix for namespace validation. Can you please review when you get a chance and suggest if any changes?

sure thing, and thanks for the contribution! ❤️

fedepaol · 2022-07-20T07:50:01Z

Looks good! A couple of quick nits:

Can you change the commit message according to https://chris.beams.io/posts/git-commit/
Can you add an e2e test under https://github.com/metallb/metallb/blob/main/e2etest/webhookstests/webhooks.go ?
I will ask you to add it to the release notes, but it will probably end up in a latter release so adding to 0.13.4 doesn't make sense now. Let's see if we are able to cut a release today

mgsh · 2022-07-21T05:15:39Z

Sure @fedepaol. I'll try and resolve your changes by today.

fedepaol · 2022-07-21T07:23:31Z

Sure @fedepaol. I'll try and resolve your changes by today.

no rush!

mgsh · 2022-07-22T11:37:37Z

Just an update on status:
It took me some time to understand ginkgo setup and testing. I have created test cases and it's working as expected for all CRs except BFDProfiles which is not failing as expected when tested using the e2etests. I'm still debugging. Should be done by tomorrow.

fedepaol · 2022-07-22T13:46:30Z

Just an update on status: It took me some time to understand ginkgo setup and testing. I have created test cases and it's working as expected for all CRs except BFDProfiles which is not failing as expected when tested using the e2etests. I'm still debugging. Should be done by tomorrow.

Sure thing! Again, no rush :-)

mgsh · 2022-07-23T07:59:29Z

@fedepaol, I've added e2tests and pushed another commit (BFDProfile test was failing earlier because its webhook config did NOT have a CREATE hook registered, I've added it now, hope that's fine).

As for clear commit message, I currently have 2 separate commits which I've pushed already. Would you recommend that I rebase/squash both commits into one single commit and force push in its current branch (I was reluctant to try it without checking first, because it's usually not advised)? OR perhaps a new PR with just the changes applied as a single commit with a clear commit message? Please advise.

As for the message content, I think your description on the issue was sufficiently verbose. Based on your advise on rebase/squash or squash/merge we can use the below message accordingly (with your changes if any).

Added namespace validation in the create webhook for all CRs

Currently, there's nothing preventing the CRs to be created in a
namespace different from the one metallb is deployed to. This change
adds namespace validation to prevent creation of CRs in a different
namespace.

fedepaol · 2022-07-26T13:22:15Z

e2etest/webhookstests/webhooks.go

+	})
+
+	ginkgo.Context("For BFDProfile", func() {
+		ginkgo.It("Should reject creating BFDProfile in a different namespace", func() {


I think you could use a Table test here, providing resources as a table entry. This will avoid duplication, since we always expect the same behaviour.
See

metallb/e2etest/bgptests/bgp.go

Line 152 in 65a54f3

table.DescribeTable("A service of protocol load balancer should work with ETP=local", func(pairingIPFamily ipfamily.Family, poolAddresses []string, tweak testservice.Tweak) {

for example

Thanks! Wasn't aware of it. I've refactored it now to use DescribeTable.

fedepaol · 2022-07-26T13:23:03Z

e2etest/webhookstests/webhooks.go

+var _ = ginkgo.Describe("Webhooks", func() {
+	ginkgo.BeforeEach(func() {
+		ginkgo.By("Clearing any previous configuration")
+		err := ConfigUpdaterOtherNS.Clean()


I'd expect there's no need for cleaning before or after, as all these tests won't add anything

The latest version doesn't use setup code for namespace validation.

fedepaol · 2022-07-26T13:23:57Z

e2etest/webhookstests/webhooks.go

 	})
 })
+
+var _ = ginkgo.Describe("Webhooks", func() {


I'd add it under the same describe, just as a different Context

The existing Describe has setup code which we don't need for the new specs. So I've retained it as a separate set of specs under a separate DescribeTable (since we don't need the setup code for it). Is that ok?

fedepaol · 2022-07-26T13:25:17Z

config/crd/bases/metallb.io_addresspools.yaml

 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.7.0
+    controller-gen.kubebuilder.io/version: v0.9.2


Can you use the same kubebuilder versoin? I know it's pretty old, but I'd be deliberate in changing the CRDs for that (I guess that's what is removing the status and adding x-kubernetes-map-type: atomic below)

I've used the exact version of controller-gen and retested it in the latest changes.

fedepaol · 2022-07-26T13:26:54Z

@fedepaol, I've added e2tests and pushed another commit (BFDProfile test was failing earlier because its webhook config did NOT have a CREATE hook registered, I've added it now, hope that's fine).

As for clear commit message, I currently have 2 separate commits which I've pushed already. Would you recommend that I rebase/squash both commits into one single commit and force push in its current branch (I was reluctant to try it without checking first, because it's usually not advised)? OR perhaps a new PR with just the changes applied as a single commit with a clear commit message? Please advise.

As for the message content, I think your description on the issue was sufficiently verbose. Based on your advise on rebase/squash or squash/merge we can use the below message accordingly (with your changes if any).
Added namespace validation in the create webhook for all CRs

Currently, there's nothing preventing the CRs to be created in a
namespace different from the one metallb is deployed to. This change
adds namespace validation to prevent creation of CRs in a different
namespace.

Commit message is fine. We normally split the changes with a commit for the changes and another one for the tests.
Rebasing is fine.
I'd also add a section to the release notes (you can create v0.13.5) in a separate commit to mention this change.

Add a mention to metallb#1523

mgsh · 2022-07-28T00:26:51Z

Let me check the e2e failures and fix, certain scenarios are failing.

Add a mention to metallb#1523

mgsh · 2022-07-28T04:09:47Z

My bad that I hadn't run all test possibilities (am exploring the use of act to run github actions locally before pushing changes, yet to get it fully working).

The helm based e2etests were failing. I had to make 2 changes:

Add CREATE op in the helm chart bfdprofile validation webhook config (and also fixed a possible typo) 163cf03#diff-dbf01c8949b94f349b1a6e20f162b6cacb22d3348e400200384e29100b990669
Updated the e2etest setup to use kube-system as the other namespace to expect failures in CR creation. I had used default earlier, but the helm based tests are using the default namespace to install metallb. Is this expected, shouldn't we be testing with helm install --create-namespace --namespace metallb-system ...?

mgsh · 2022-07-28T12:22:45Z

The operator based e2etest required a change in the metallb-operator repo (to enable validation webhook for BFDProfile create op). Tracking that change under metallb/metallb-operator#240 (from what I understand, it fetches configs from this repo and that's causing its manifest validation tests to fail, looking into it).

Currently, there's nothing preventing the CRs to be created in a namespace different from the one metallb is deployed to. This change adds namespace validation to prevent creation of CRs in a different namespace.

Add a mention to metallb#1523

fedepaol · 2022-07-29T15:15:34Z

* Updated the e2etest setup to use `kube-system` as the other namespace to expect failures in CR creation. I had used `default` earlier, but the helm based tests are using the `default` namespace to install metallb. Is this expected, shouldn't we be testing with `helm install --create-namespace --namespace metallb-system ...`?

Yep, this is something that we can definitely improve. Regarding the 'other namespace', why not creating one? Despite it's reasonable to expect kube-system , maybe it makes sense to be more in control with that (deleting the namespace when the suite exits)

Add a mention to metallb#1523

mgsh · 2022-08-01T11:37:50Z

I've made these two changes:

create a different namespace for the namespace validation tests.
use the fork version of metallb-operator (needs to be changed back to main once that fork is merged).

fedepaol · 2022-08-01T11:40:00Z

2. use the fork version of metallb-operator (needs to be changed back to main once that fork is merged).

when we deal with this chicken-egg situations, it's fine to have the operator lane temporary failing. I'd go that way, to avoid the need of reverting again.

mgsh · 2022-08-01T11:51:52Z

when we deal with this chicken-egg situations, it's fine to have the operator lane temporary failing. I'd go that way, to avoid the need of reverting again.

Got it. In that case, let me remove that commit (6c78ab3) and push it again. I've tested the above commit already for all tests passing in my forked repo (mgsh#1), to cross-check that it was the only missing dependency. So once the metallb-operator changes are sorted out e2e-use-operator tests will be automatically fixed.

fedepaol · 2022-08-01T14:05:03Z

e2etest/e2etest_suite_test.go


+	// for testing namespace validation, we need an existing namespace that's different from the
+	// metallb installation namespace
+	otherNamespace := fmt.Sprintf("%s-other", metallb.Namespace)


Can you delete this in aftersuite?
Also, ignore the err if it is AlreadyExists, so if we interrupt the tests before aftersuite the new run won't fail.

fedepaol · 2022-08-01T14:05:36Z

e2etest/webhookstests/webhooks.go

+var _ = table.DescribeTable("Webhooks namespace validation",
+	func(resources *metallbconfig.ClusterResources) {
+		err := ConfigUpdaterOtherNS.Update(*resources)
+		framework.ExpectError(err)


I guess this is not necessary given the next row

do you mean that framework.ExpectError is redundant because of the following Expect(err.Error()).To(...)?

yes, if err is nil that row will complain

@fedepaol ☝🏽 if that was your suggestion, won't err.Error() panic if it's nil and we remove the framework.ExpectError before it?

That's right. I misread the string checking line.

I suggest using
Expect(err).To(MatchError(ContainSubstring(....))

That will avoid adding the double check

fedepaol · 2022-08-01T14:06:12Z

Couple of small nits, and I think this is good to land!

Add a mention to metallb#1523

For each CR, we try creating a resource in a namespace other than the metallb namespace and expect a failure.

Add a mention to metallb#1523

fedepaol · 2022-08-02T15:57:04Z

LGTM, thanks!

Add a mention to metallb#1523

Add a mention to #1523

Add a mention to metallb#1523

Add a mention to metallb/metallb#1523

mgsh requested review from fedepaol, gclawes, johananl, oribon, rata and russellb as code owners July 19, 2022 11:19

mgsh force-pushed the feature/validate-cr-ns branch from 952325b to 9d16c96 Compare July 19, 2022 11:20

fedepaol mentioned this pull request Jul 20, 2022

LoadBalancer stays in pending state for ExternalIp #1526

Closed

mgsh closed this Jul 21, 2022

mgsh reopened this Jul 21, 2022

mgsh force-pushed the feature/validate-cr-ns branch from 9d16c96 to c890960 Compare July 23, 2022 07:25

fedepaol reviewed Jul 26, 2022

View reviewed changes

mgsh added a commit to mgsh/metallb that referenced this pull request Jul 27, 2022

Release notes: add namespace validation for CRs

90ed280

Add a mention to metallb#1523

mgsh force-pushed the feature/validate-cr-ns branch from 74a971d to 90ed280 Compare July 27, 2022 14:26

mgsh added a commit to mgsh/metallb that referenced this pull request Jul 28, 2022

Release notes: add namespace validation for CRs

0ded6e5

Add a mention to metallb#1523

mgsh force-pushed the feature/validate-cr-ns branch from 90ed280 to 0ded6e5 Compare July 28, 2022 04:01

Added namespace validation in the create webhook for all CRs

5e9c019

Currently, there's nothing preventing the CRs to be created in a namespace different from the one metallb is deployed to. This change adds namespace validation to prevent creation of CRs in a different namespace.

mgsh added a commit to mgsh/metallb that referenced this pull request Jul 28, 2022

Release notes: add namespace validation for CRs

392daca

Add a mention to metallb#1523

mgsh added a commit to mgsh/metallb that referenced this pull request Aug 1, 2022

Release notes: add namespace validation for CRs

ae1ed4e

Add a mention to metallb#1523

mgsh force-pushed the feature/validate-cr-ns branch from 392daca to 6c78ab3 Compare August 1, 2022 11:31

mgsh force-pushed the feature/validate-cr-ns branch from 6c78ab3 to ae1ed4e Compare August 1, 2022 11:55

fedepaol reviewed Aug 1, 2022

View reviewed changes

mgsh added a commit to mgsh/metallb that referenced this pull request Aug 2, 2022

Release notes: add namespace validation for CRs

c2e3f26

Add a mention to metallb#1523

mgsh force-pushed the feature/validate-cr-ns branch from 15dd689 to c2e3f26 Compare August 2, 2022 09:13

mgsh added a commit to mgsh/metallb that referenced this pull request Aug 2, 2022

Release notes: add namespace validation for CRs

445abc8

Add a mention to metallb#1523

mgsh force-pushed the feature/validate-cr-ns branch from c2e3f26 to 445abc8 Compare August 2, 2022 12:48

mgsh added a commit to mgsh/metallb that referenced this pull request Aug 2, 2022

Release notes: add namespace validation for CRs

9016108

Add a mention to metallb#1523

mgsh force-pushed the feature/validate-cr-ns branch from 445abc8 to 9016108 Compare August 2, 2022 13:27

mgsh added 2 commits August 2, 2022 19:12

E2E: Added namespace validation tests for all CRs

d2c2b5b

For each CR, we try creating a resource in a namespace other than the metallb namespace and expect a failure.

Release notes: add namespace validation for CRs

86f0a49

Add a mention to metallb#1523

mgsh force-pushed the feature/validate-cr-ns branch from 9016108 to 86f0a49 Compare August 2, 2022 13:42

Merge branch 'main' into feature/validate-cr-ns

5fc0c45

fedepaol merged commit d4a5f97 into metallb:main Aug 2, 2022

pperiyasamy pushed a commit to pperiyasamy/metallb that referenced this pull request Aug 17, 2022

Release notes: add namespace validation for CRs

fb22deb

Add a mention to metallb#1523

fedepaol pushed a commit that referenced this pull request Sep 1, 2022

Release notes: add namespace validation for CRs

1404076

Add a mention to #1523

pperiyasamy pushed a commit to pperiyasamy/metallb that referenced this pull request Sep 6, 2022

Release notes: add namespace validation for CRs

1bcee88

Add a mention to metallb#1523

pperiyasamy pushed a commit to pperiyasamy/metallb that referenced this pull request Sep 7, 2022

Release notes: add namespace validation for CRs

4ea59f2

Add a mention to metallb#1523

cprivitere mentioned this pull request Oct 12, 2022

Add MetalLB 0.13 support kubernetes-sigs/cloud-provider-equinix-metal#322

Closed

eyenx mentioned this pull request Oct 19, 2022

chore(misc/metallb): update to 0.13.x adfinis/helm-charts#834

Merged

6 tasks

muffl0n mentioned this pull request Aug 1, 2023

Validating webhooks: make sure the crs are created in the metallb namespace #1517

Closed

novad03 pushed a commit to novad03/k8s-meta that referenced this pull request Nov 25, 2023

Release notes: add namespace validation for CRs

f980699

Add a mention to metallb/metallb#1523

added namespace validation for custom resources #1523

added namespace validation for custom resources #1523

Uh oh!

Conversation

mgsh commented Jul 19, 2022

Uh oh!

mgsh commented Jul 19, 2022

Uh oh!

fedepaol commented Jul 19, 2022

Uh oh!

fedepaol commented Jul 20, 2022

Uh oh!

mgsh commented Jul 21, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fedepaol commented Jul 21, 2022

Uh oh!

mgsh commented Jul 22, 2022

Uh oh!

fedepaol commented Jul 22, 2022

Uh oh!

mgsh commented Jul 23, 2022

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fedepaol commented Jul 26, 2022

Uh oh!

mgsh commented Jul 28, 2022

Uh oh!

mgsh commented Jul 28, 2022

Uh oh!

mgsh commented Jul 28, 2022

Uh oh!

fedepaol commented Jul 29, 2022

Uh oh!

mgsh commented Aug 1, 2022

Uh oh!

fedepaol commented Aug 1, 2022

Uh oh!

mgsh commented Aug 1, 2022

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fedepaol commented Aug 1, 2022

Uh oh!

fedepaol commented Aug 2, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mgsh commented Jul 21, 2022 •

edited

Loading