Selective policy enforcement #57

imiller0 · 2022-06-06T12:37:05Z

Proposal to create a mechanism through which an inform policy can be selectively enforced on a subset of the clusters it is bound to.

Initial draft for review Signed-off-by: Ian Miller <imiller@redhat.com>

Signed-off-by: Ian Miller <imiller@redhat.com>

JustinKuli

I think I like the idea of using an annotation on the replicated policy in order to determine whether to update that policy's enforcement. That, and possibly having a separate controller to manage those annotations, seems like a good solution that can be adjusted based on users' needs.

But I feel like this proposal asserts that the only field that should ever be selectively rolled out is the remediationAction. What if users want to selectively roll out changes to policies, while keeping them in "enforce" mode?

Along those lines, is the new remediationAction value of "controlled" required? Or could this just be implemented via an annotation on replicated policies, and by adding logic to the propagator so that any updates to the parent policy are passed to the replicated policy only if the annotation allows it? The annotation might behave more like a "pause" feature in that case.

enhancements/sig-policy/28-selective-policy-enforcment/README.md

imiller0 · 2022-06-07T15:46:46Z

@JustinKuli Thanks for the comments!

One of the thoughts in writing the proposal was to keep the child policies in sync with the parent policies at all times to reduce complexity in creating/maintaining the child policies. The only deviation would be adding the annotation to the child (hopefully easy to manage this difference). This way any changes in the parent policy are always reflected in the child but only the enforcement onto the cluster is affected.

I don't think the "controlled" remediation action is strictly required. This could be done with only the existing "inform" remediationAction and knowledge in the controller with respect to the annotation. Having the "controlled" value makes it more explicit that this behavior is an "opt-in", but has a couple downsides:

An additional state that has to be understood/displayed/reported in various UIs
Existing users of policy cannot begin making use of this feature without updating the remediationAction of their policy. If we allow the annotation to work with any "inform" policy then any existing installation could benefit from it.

You also make a good point that this could be reversed and implemented as a "pause" on an enforce policy. In our use case the inform with selective enforcement seemed to fit a bit closer.

enhancements/sig-policy/28-selective-policy-enforcment/README.md

Signed-off-by: Ian Miller <imiller@redhat.com>

imiller0 · 2022-07-14T20:08:56Z

Summarizing an enforcement approach discussed with @mprahl @gparvin @JustinKuli @serngawy @jc-rh and @imiller0.
Enforcement is by creation of additional PlacementRule/PlacementBinding:

remediationActionOverride in PlacementBinding – can only be set to enforce
By default the override PB/PR selects from the full set of managed clusters
Optional field in PlacementBinding allows sub-filtering to select from only managed clusters bound via non-sub-filtered placement rules

An update to the enhancment for review will be posted shortly

Based on feedback and discussion update the mechanism for selecting clusters for enforcement to use existing Placement APIs with optional remediationActionOverride directives. Signed-off-by: Ian Miller <imiller@redhat.com>

Signed-off-by: Ian Miller <imiller@redhat.com>

gparvin

I had one minor comment to mention this should work with PolicySet also. I don't think it really changes anything in the proposal.

enhancements/sig-policy/28-selective-policy-enforcment/README.md

Signed-off-by: Ian Miller <imiller@redhat.com>

enhancements/sig-policy/28-selective-policy-enforcment/README.md

Clarify behavior when there are multiple PlacementBindings. Signed-off-by: Ian Miller <imiller@redhat.com>

mprahl

Nice job! This is a great and well thought out feature.

/hold for others to review

enhancements/sig-policy/28-selective-policy-enforcment/README.md

The subFilter is a generic concept, not necessarily limited to the remediationActionOverride. Moving it to the top level allows future extensions of this functionality to other overrides/transforms which can also make use of the subFilter. Signed-off-by: Ian Miller <imiller@redhat.com>

mprahl

Nice!

jc-rh · 2022-08-05T13:32:11Z

/lgtm

openshift-ci · 2022-08-05T13:32:13Z

@jc-rh: changing LGTM is restricted to collaborators

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2022-08-05T14:13:33Z

@jc-rh: changing LGTM is restricted to collaborators

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

JustinKuli

/lgtm

Very well-written! I feel good about this.

JustinKuli · 2022-08-05T14:09:59Z

enhancements/sig-policy/28-selective-policy-enforcment/README.md

+supporting this as a feature users, or higher level
+controllers/orchestrators, do not have to implement a procedural
+pattern of copying policies and manipulating bindings/labels to
+progressivly enforce the policy on clusters.


Nit

Suggested change

progressivly enforce the policy on clusters.

progressively enforce the policy on clusters.

enhancements/sig-policy/28-selective-policy-enforcment/README.md

@JustinKuli

Adding diagram depicting the selection logic for multiple PlacementBindings with various subFilter and remediationActionOverride settings. Courtesy of @JustinKuli Signed-off-by: Ian Miller <imiller@redhat.com>

mprahl

Nice!

openshift-ci · 2022-08-10T13:42:18Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: imiller0, jc-rh, JustinKuli, mprahl

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~enhancements/sig-policy/OWNERS~~ [mprahl]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

imiller0 · 2022-08-10T14:14:02Z

/lgtm

openshift-ci · 2022-08-10T14:14:02Z

@imiller0: you cannot LGTM your own PR.

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

mprahl · 2022-08-10T14:52:30Z

/unhold

imiller0 added 2 commits May 19, 2022 11:31

Selective Policy Enforcement Enhancement

886cc96

Initial draft for review Signed-off-by: Ian Miller <imiller@redhat.com>

Update enable mechanism to close race conditions

4481b90

Signed-off-by: Ian Miller <imiller@redhat.com>

openshift-ci bot requested review from dhaiducek and mprahl June 6, 2022 12:37

JustinKuli reviewed Jun 6, 2022

View reviewed changes

enhancements/sig-policy/28-selective-policy-enforcment/README.md Outdated Show resolved Hide resolved

mprahl reviewed Jun 8, 2022

View reviewed changes

enhancements/sig-policy/28-selective-policy-enforcment/README.md Outdated Show resolved Hide resolved

mprahl reviewed Jun 8, 2022

View reviewed changes

enhancements/sig-policy/28-selective-policy-enforcment/README.md Outdated Show resolved Hide resolved

mprahl reviewed Jun 8, 2022

View reviewed changes

enhancements/sig-policy/28-selective-policy-enforcment/README.md Show resolved Hide resolved

dhaiducek reviewed Jun 8, 2022

View reviewed changes

enhancements/sig-policy/28-selective-policy-enforcment/README.md Outdated Show resolved Hide resolved

Remove unneeded paragraphs

099620b

Signed-off-by: Ian Miller <imiller@redhat.com>

Update cluster selection mechanism

c455c06

Based on feedback and discussion update the mechanism for selecting clusters for enforcement to use existing Placement APIs with optional remediationActionOverride directives. Signed-off-by: Ian Miller <imiller@redhat.com>

imiller0 force-pushed the selectivePolicyEnforcement branch from 221d89c to c455c06 Compare July 14, 2022 21:52

Improve clarity of the new API description.

ba7763c

Signed-off-by: Ian Miller <imiller@redhat.com>

gparvin reviewed Jul 20, 2022

View reviewed changes

enhancements/sig-policy/28-selective-policy-enforcment/README.md Show resolved Hide resolved

Improve clarity of the new API description.

c45143e

Signed-off-by: Ian Miller <imiller@redhat.com>

mprahl suggested changes Aug 3, 2022

View reviewed changes

openshift-ci bot assigned mprahl Aug 3, 2022

Update based on comments.

c677538

Clarify behavior when there are multiple PlacementBindings. Signed-off-by: Ian Miller <imiller@redhat.com>

mprahl approved these changes Aug 4, 2022

View reviewed changes

openshift-ci bot added do-not-merge/hold lgtm approved labels Aug 4, 2022

jc-rh reviewed Aug 4, 2022

View reviewed changes

enhancements/sig-policy/28-selective-policy-enforcment/README.md Show resolved Hide resolved

jc-rh reviewed Aug 4, 2022

View reviewed changes

enhancements/sig-policy/28-selective-policy-enforcment/README.md Outdated Show resolved Hide resolved

openshift-ci bot removed the lgtm label Aug 5, 2022

mprahl approved these changes Aug 5, 2022

View reviewed changes

openshift-ci bot added the lgtm label Aug 5, 2022

jc-rh approved these changes Aug 5, 2022

View reviewed changes

JustinKuli approved these changes Aug 5, 2022

View reviewed changes

openshift-ci bot assigned JustinKuli Aug 5, 2022

openshift-ci bot removed the lgtm label Aug 9, 2022

Add diagram for multiple PlacementBinding selection

dc38996

Adding diagram depicting the selection logic for multiple PlacementBindings with various subFilter and remediationActionOverride settings. Courtesy of @JustinKuli Signed-off-by: Ian Miller <imiller@redhat.com>

imiller0 force-pushed the selectivePolicyEnforcement branch from c720ab7 to dc38996 Compare August 9, 2022 21:48

mprahl approved these changes Aug 10, 2022

View reviewed changes

openshift-ci bot added the lgtm label Aug 10, 2022

JustinKuli approved these changes Aug 10, 2022

View reviewed changes

openshift-ci bot removed the do-not-merge/hold label Aug 10, 2022

openshift-merge-robot merged commit 31ba6f4 into open-cluster-management-io:main Aug 10, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Selective policy enforcement #57

Selective policy enforcement #57

imiller0 commented Jun 6, 2022

JustinKuli left a comment

imiller0 commented Jun 7, 2022

imiller0 commented Jul 14, 2022

gparvin left a comment

mprahl left a comment

mprahl left a comment

jc-rh commented Aug 5, 2022

openshift-ci bot commented Aug 5, 2022

openshift-ci bot commented Aug 5, 2022

JustinKuli left a comment

JustinKuli Aug 5, 2022

mprahl left a comment

openshift-ci bot commented Aug 10, 2022

imiller0 commented Aug 10, 2022

openshift-ci bot commented Aug 10, 2022

mprahl commented Aug 10, 2022

	progressivly enforce the policy on clusters.
	progressively enforce the policy on clusters.

Selective policy enforcement #57

Selective policy enforcement #57

Conversation

imiller0 commented Jun 6, 2022

JustinKuli left a comment

Choose a reason for hiding this comment

imiller0 commented Jun 7, 2022

imiller0 commented Jul 14, 2022

gparvin left a comment

Choose a reason for hiding this comment

mprahl left a comment

Choose a reason for hiding this comment

mprahl left a comment

Choose a reason for hiding this comment

jc-rh commented Aug 5, 2022

openshift-ci bot commented Aug 5, 2022

openshift-ci bot commented Aug 5, 2022

JustinKuli left a comment

Choose a reason for hiding this comment

JustinKuli Aug 5, 2022

Choose a reason for hiding this comment

mprahl left a comment

Choose a reason for hiding this comment

openshift-ci bot commented Aug 10, 2022

imiller0 commented Aug 10, 2022

openshift-ci bot commented Aug 10, 2022

mprahl commented Aug 10, 2022