OCPBUGS-21626: Validate accessTokenInactivityTimeout >= 300s #3110

muraee · 2023-10-20T15:49:33Z

What this PR does / why we need it:
Validates that accessTokenInactivityTimeout >= 300s, similar to Standalone https://github.com/openshift/kubernetes/blob/c0449761f4ad0c3a585990c26aea90a1dadb82cb/openshift-kube-apiserver/admission/customresourcevalidation/oauth/validate_idp.go#L75C1-L81

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #OCPBUGS-21626

Checklist

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

openshift-ci-robot · 2023-10-20T15:49:38Z

@muraee: This pull request references Jira Issue OCPBUGS-21626, which is invalid:

expected the bug to target the "4.15.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #OCPBUGS-21626

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2023-10-20T15:50:03Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

jparrill

/lgtm

jparrill · 2023-10-23T08:38:55Z

/jira refresh

openshift-ci-robot · 2023-10-23T08:39:05Z

@jparrill: This pull request references Jira Issue OCPBUGS-21626, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.15.0) matches configured target version for branch (4.15.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

enxebre · 2023-10-23T08:39:49Z

api/v1beta1/hostedcluster_types.go

@@ -2100,6 +2100,7 @@ type ClusterConfiguration struct {
 	// It is used to configure the integrated OAuth server.
 	// This configuration is only honored when the top level Authentication config has type set to IntegratedOAuth.
 	// +optional
+	// +kubebuilder:validation:XValidation:rule="duration(self.tokenConfig.accessTokenInactivityTimeout).getSeconds() >= 300", message="spec.configuration.oauth.tokenConfig.accessTokenInactivityTimeout minimum acceptable token timeout value is 300 seconds"


how's this being validated in standalone https://github.com/openshift/api/blob/master/config/v1/types_oauth.go#L76

probably using an admission webhook

can we validate that and link the source here?

https://github.com/openshift/kubernetes/blob/c0449761f4ad0c3a585990c26aea90a1dadb82cb/openshift-kube-apiserver/admission/customresourcevalidation/oauth/validate_idp.go#L75C1-L81

openshift-ci-robot · 2023-10-23T09:41:06Z

@muraee: This pull request references Jira Issue OCPBUGS-21626, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.15.0) matches configured target version for branch (4.15.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

In response to this:

What this PR does / why we need it:
Validates that accessTokenInactivityTimeout >= 300s, similar to Standalone https://github.com/openshift/kubernetes/blob/c0449761f4ad0c3a585990c26aea90a1dadb82cb/openshift-kube-apiserver/admission/customresourcevalidation/oauth/validate_idp.go#L75C1-L81

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #OCPBUGS-21626

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

muraee · 2023-10-23T10:00:22Z

/cherry-pick release-4.14

openshift-cherrypick-robot · 2023-10-23T10:00:24Z

@muraee: once the present PR merges, I will cherry-pick it on top of release-4.14 in a new PR and assign it to you.

In response to this:

/cherry-pick release-4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sjenning · 2023-10-23T19:20:00Z

/retest-required

openshift-ci · 2023-10-23T22:07:18Z

@muraee: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-ibmcloud-roks	`fe3cbcc`	link	false	`/test e2e-ibmcloud-roks`
ci/prow/e2e-ibmcloud-iks	`fe3cbcc`	link	false	`/test e2e-ibmcloud-iks`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

enxebre · 2023-10-24T15:42:40Z

/approve

openshift-ci · 2023-10-24T15:46:11Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enxebre, muraee

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [enxebre]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

sjenning · 2023-10-24T17:16:34Z

/lgtm

openshift-ci-robot · 2023-10-24T21:39:10Z

@muraee: Jira Issue OCPBUGS-21626: All pull requests linked via external trackers have merged:

openshift/hypershift#3110

Jira Issue OCPBUGS-21626 has been moved to the MODIFIED state.

In response to this:

What this PR does / why we need it:
Validates that accessTokenInactivityTimeout >= 300s, similar to Standalone https://github.com/openshift/kubernetes/blob/c0449761f4ad0c3a585990c26aea90a1dadb82cb/openshift-kube-apiserver/admission/customresourcevalidation/oauth/validate_idp.go#L75C1-L81

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #OCPBUGS-21626

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-cherrypick-robot · 2023-10-24T21:39:57Z

@muraee: new pull request created: #3130

In response to this:

/cherry-pick release-4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-merge-robot · 2023-10-25T09:31:28Z

Fix included in accepted release 4.15.0-0.nightly-2023-10-25-052621

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Oct 20, 2023

openshift-ci bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. do-not-merge/needs-area labels Oct 20, 2023

jparrill reviewed Oct 23, 2023

View reviewed changes

openshift-ci bot assigned jparrill Oct 23, 2023

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 23, 2023

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Oct 23, 2023

enxebre reviewed Oct 23, 2023

View reviewed changes

muraee marked this pull request as ready for review October 23, 2023 08:42

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 23, 2023

openshift-ci bot requested review from isco-rodriguez and sjenning October 23, 2023 08:43

muraee force-pushed the validate-accessTokenInactivityTimeout branch from 0b6726b to f8aebb6 Compare October 23, 2023 11:02

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 23, 2023

validate accessTokenInactivityTimeout >= 300s

fe3cbcc

muraee force-pushed the validate-accessTokenInactivityTimeout branch from f8aebb6 to fe3cbcc Compare October 23, 2023 11:03

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 24, 2023

openshift-ci bot assigned sjenning Oct 24, 2023

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 24, 2023

openshift-ci bot merged commit cf09187 into openshift:main Oct 24, 2023
12 of 14 checks passed

openshift-cherrypick-robot mentioned this pull request Oct 24, 2023

[release-4.14] OCPBUGS-22360: Validate accessTokenInactivityTimeout >= 300s #3130

Closed

This was referenced Nov 2, 2023

OCPBUGS-22868: Fixed accessTokenInactivityTimeout validation #3157

Merged

[release-4.14] OCPBUGS-22360: Validate accessTokenInactivityTimeout >= 300s #3175

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-21626: Validate accessTokenInactivityTimeout >= 300s #3110

OCPBUGS-21626: Validate accessTokenInactivityTimeout >= 300s #3110

muraee commented Oct 20, 2023 •

edited

openshift-ci-robot commented Oct 20, 2023

openshift-ci bot commented Oct 20, 2023

jparrill left a comment

jparrill commented Oct 23, 2023

openshift-ci-robot commented Oct 23, 2023

enxebre Oct 23, 2023 •

edited

muraee Oct 23, 2023

enxebre Oct 23, 2023

muraee Oct 23, 2023

enxebre Oct 24, 2023

openshift-ci-robot commented Oct 23, 2023

muraee commented Oct 23, 2023

openshift-cherrypick-robot commented Oct 23, 2023

sjenning commented Oct 23, 2023

openshift-ci bot commented Oct 23, 2023

enxebre commented Oct 24, 2023

openshift-ci bot commented Oct 24, 2023

sjenning commented Oct 24, 2023

openshift-ci-robot commented Oct 24, 2023

openshift-cherrypick-robot commented Oct 24, 2023

openshift-merge-robot commented Oct 25, 2023

OCPBUGS-21626: Validate accessTokenInactivityTimeout >= 300s #3110

OCPBUGS-21626: Validate accessTokenInactivityTimeout >= 300s #3110

Conversation

muraee commented Oct 20, 2023 • edited

openshift-ci-robot commented Oct 20, 2023

openshift-ci bot commented Oct 20, 2023

jparrill left a comment

Choose a reason for hiding this comment

jparrill commented Oct 23, 2023

openshift-ci-robot commented Oct 23, 2023

enxebre Oct 23, 2023 • edited

Choose a reason for hiding this comment

muraee Oct 23, 2023

Choose a reason for hiding this comment

enxebre Oct 23, 2023

Choose a reason for hiding this comment

muraee Oct 23, 2023

Choose a reason for hiding this comment

enxebre Oct 24, 2023

Choose a reason for hiding this comment

openshift-ci-robot commented Oct 23, 2023

muraee commented Oct 23, 2023

openshift-cherrypick-robot commented Oct 23, 2023

sjenning commented Oct 23, 2023

openshift-ci bot commented Oct 23, 2023

enxebre commented Oct 24, 2023

openshift-ci bot commented Oct 24, 2023

sjenning commented Oct 24, 2023

openshift-ci-robot commented Oct 24, 2023

openshift-cherrypick-robot commented Oct 24, 2023

openshift-merge-robot commented Oct 25, 2023

muraee commented Oct 20, 2023 •

edited

enxebre Oct 23, 2023 •

edited