OCPBUGS-18907: add KAS endpoints to Except in router egress rule #3007

sjenning · 2023-09-12T20:48:52Z

Even though the router does not have the KAS mgmt label, it can still access the KAS because the private-router NetworkPolicy allows it.

openshift-ci · 2023-09-12T20:48:56Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci-robot · 2023-09-12T20:48:57Z

@sjenning: This pull request references Jira Issue OCPBUGS-17827, which is invalid:

expected the bug to target the "4.15.0" version, but it targets "4.14.0" instead
expected the bug to be in one of the following states: NEW, ASSIGNED, POST, but it is ON_QA instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Even though the router does not have the KAS mgmt label, it can still access the KAS because the private-router NetworkPolicy allows it.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2023-09-12T20:49:15Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sjenning

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [sjenning]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2023-09-12T20:54:25Z

@sjenning: This pull request references Jira Issue OCPBUGS-18907, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.15.0) matches configured target version for branch (4.15.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (jiezhao@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Even though the router does not have the KAS mgmt label, it can still access the KAS because the private-router NetworkPolicy allows it.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

enxebre · 2023-09-13T07:52:36Z

/hold

enxebre · 2023-09-13T08:33:35Z

I added a commit to include private router in the e2e validation
/hold cancel
/label tide/merge-method-squash
/lgtm

enxebre · 2023-09-13T08:54:53Z

/test e2e-aws

csrwng · 2023-09-13T13:05:15Z

Because changes to the kas endpoints resource should result in updated policy, we should be watching endpoints in the hostedcontrolplane controller.

/hold

enxebre · 2023-09-13T14:14:37Z

hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go

@@ -227,6 +227,7 @@ func (r *HostedClusterReconciler) managedResources() []client.Object {
 		&corev1.Namespace{},
 		&corev1.ServiceAccount{},
 		&corev1.Service{},
+		&corev1.Endpoints{},


we should follow up to filter events for only "kubernetes" endpoint in enqueueHostedClustersFunc
then also consider only caching that resource by letting ObjectSelector to filte by field metadata.Name = "kubernetes"

csrwng · 2023-09-13T14:16:31Z

/hold cancel

sjenning · 2023-09-13T16:54:01Z

AWS IPI failure
/test e2e-kubevirt-aws-ovn

csrwng · 2023-09-13T16:58:53Z

/lgtm

openshift-ci · 2023-09-13T19:53:13Z

@sjenning: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-ci-robot · 2023-09-13T19:56:03Z

@sjenning: Jira Issue OCPBUGS-18907: All pull requests linked via external trackers have merged:

openshift/hypershift#3007

Jira Issue OCPBUGS-18907 has been moved to the MODIFIED state.

In response to this:

Even though the router does not have the KAS mgmt label, it can still access the KAS because the private-router NetworkPolicy allows it.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sjenning · 2023-09-14T01:43:54Z

/cherry-pick release-4.14

openshift-cherrypick-robot · 2023-09-14T01:44:44Z

@sjenning: new pull request created: #3010

In response to this:

/cherry-pick release-4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

…nshift#3007) * add KAS endpoints to Except in router egress rule * Add private router to EnsureLimitedEgressTrafficToManagementKAS e2e test --------- Co-authored-by: enxebre <alberto.garcial@hotmail.com>

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 12, 2023

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Sep 12, 2023

openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Sep 12, 2023

openshift-ci bot added do-not-merge/needs-area area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release labels Sep 12, 2023

openshift-ci bot added approved Indicates a PR has been approved by an approver from all required OWNERS files. and removed do-not-merge/needs-area labels Sep 12, 2023

sjenning changed the title ~~OCPBUGS-17827: add KAS endpoints to Except in router egress rule~~ OCPBUGS-18907: add KAS endpoints to Except in router egress rule Sep 12, 2023

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Sep 12, 2023

openshift-ci bot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. area/testing Indicates the PR includes changes for e2e testing labels Sep 13, 2023

openshift-ci bot added tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. and removed do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. labels Sep 13, 2023

openshift-ci bot assigned enxebre Sep 13, 2023

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 13, 2023

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 13, 2023

sjenning force-pushed the add-kas-ep-except branch from edccc4a to 00ccb33 Compare September 13, 2023 13:26

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Sep 13, 2023

enxebre reviewed Sep 13, 2023

View reviewed changes

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 13, 2023

sjenning marked this pull request as ready for review September 13, 2023 14:22

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 13, 2023

openshift-ci bot requested review from enxebre and hasueki September 13, 2023 14:22

sjenning and others added 2 commits September 13, 2023 09:44

add KAS endpoints to Except in router egress rule

38a6efa

Add private router to EnsureLimitedEgressTrafficToManagementKAS e2e test

39d187c

sjenning force-pushed the add-kas-ep-except branch from 00ccb33 to 39d187c Compare September 13, 2023 14:45

openshift-ci bot assigned csrwng Sep 13, 2023

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 13, 2023

openshift-merge-robot merged commit 8112ade into openshift:main Sep 13, 2023
12 checks passed

openshift-cherrypick-robot mentioned this pull request Sep 14, 2023

[release-4.14] OCPBUGS-18978: add KAS endpoints to Except in router egress rule #3010

Merged

enxebre mentioned this pull request Sep 15, 2023

Private router policy fix for ocp < .14 #3015

Closed

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-18907: add KAS endpoints to Except in router egress rule #3007

OCPBUGS-18907: add KAS endpoints to Except in router egress rule #3007

sjenning commented Sep 12, 2023

openshift-ci bot commented Sep 12, 2023

openshift-ci-robot commented Sep 12, 2023

openshift-ci bot commented Sep 12, 2023

openshift-ci-robot commented Sep 12, 2023

enxebre commented Sep 13, 2023

enxebre commented Sep 13, 2023

enxebre commented Sep 13, 2023

csrwng commented Sep 13, 2023

enxebre Sep 13, 2023

csrwng commented Sep 13, 2023

sjenning commented Sep 13, 2023

csrwng commented Sep 13, 2023

openshift-ci bot commented Sep 13, 2023

openshift-ci-robot commented Sep 13, 2023

sjenning commented Sep 14, 2023

openshift-cherrypick-robot commented Sep 14, 2023

OCPBUGS-18907: add KAS endpoints to Except in router egress rule #3007

OCPBUGS-18907: add KAS endpoints to Except in router egress rule #3007

Conversation

sjenning commented Sep 12, 2023

openshift-ci bot commented Sep 12, 2023

openshift-ci-robot commented Sep 12, 2023

openshift-ci bot commented Sep 12, 2023

openshift-ci-robot commented Sep 12, 2023

enxebre commented Sep 13, 2023

enxebre commented Sep 13, 2023

enxebre commented Sep 13, 2023

csrwng commented Sep 13, 2023

enxebre Sep 13, 2023

Choose a reason for hiding this comment

csrwng commented Sep 13, 2023

sjenning commented Sep 13, 2023

csrwng commented Sep 13, 2023

openshift-ci bot commented Sep 13, 2023

openshift-ci-robot commented Sep 13, 2023

sjenning commented Sep 14, 2023

openshift-cherrypick-robot commented Sep 14, 2023