OCPBUGS-31384: UPSTREAM: <carry>: allow type mutation for specific secrets #1932

p0lyn0mial · 2024-04-04T08:49:47Z

This PR relaxes the restrictions on allowed type mutation transitions.

initially, the check was stricter.
however, due to the platform's long history (spanning several years)
and the complexity of ensuring that resources were consistently created with only one type,
it is now permissible for (SecretTypeTLS, core.SecretTypeOpaque) type to transition to "kubernetes.io/tls".

additionally, it should be noted that default values might also be applied in some cases.
(

kubernetes/pkg/apis/core/v1/defaults.go

Lines 280 to 284 in 258f1d5

    
           func SetDefaults_Secret(obj *v1.Secret) { 
        
           	if obj.Type == "" { 
        
           		obj.Type = v1.SecretTypeOpaque 
        
           	} 
        
           }

)

openshift-ci-robot · 2024-04-04T08:49:57Z

@p0lyn0mial: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

8662730|UPSTREAM: : allow type mutation for specific secrets: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

p0lyn0mial · 2024-04-04T08:50:05Z

/assign @tkashem @vrutkovs

openshift-ci-robot · 2024-04-04T08:50:31Z

@p0lyn0mial: This pull request references Jira Issue OCPBUGS-31384, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.16.0) matches configured target version for branch (4.16.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @wangke19

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

This PR relaxes the restrictions on allowed type mutation transitions.

initially, the check was stricter.
however, due to the platform's long history (spanning several years)
and the complexity of ensuring that resources were consistently created with only one type,
it is now permissible for any type to transition to "kubernetes.io/tls".

additionally, it should be noted that default values might also be applied in some cases.
(

kubernetes/pkg/apis/core/v1/defaults.go

Lines 280 to 284 in 258f1d5

func SetDefaults_Secret(obj *v1.Secret) {

if obj.Type == "" {

obj.Type = v1.SecretTypeOpaque

}

}

)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

p0lyn0mial · 2024-04-04T09:36:26Z

/cc @benluddy

p0lyn0mial · 2024-04-04T10:51:51Z

/retest-required

tkashem · 2024-04-04T11:50:53Z

pkg/apis/core/validation/validation_patch.go

+	//
+	// additionally, it should be noted that default values might also be applied in some cases.
+	// (https://github.com/openshift/kubernetes/blob/258f1d5fb6491ba65fd8201c827e179432430627/pkg/apis/core/v1/defaults.go#L280-L284)
+	if oldSecret.Type != core.SecretTypeTLS && newSecret.Type == core.SecretTypeTLS {


nit: do we care about the type of the old secret object - if newSecret.Type == core.SecretTypeTLS { ?

i don't think so, initially we didn't want to allow changes from oldSecret.Type = core.SecretTypeTLS

now I think that maybe we should only allow to transition from “”, Opaque and SecretTypeTLS, especially that https://github.com/kubernetes/kubernetes/blob/8628c3c4da6746b1dc967cc520b189a04ebd78d1/pkg/apis/core/validation/validation.go#L6393

tkashem · 2024-04-04T11:51:25Z

pkg/apis/core/validation/validation_patch_test.go

+					t.Errorf("expected error: %v, diff: %s", errExpected, cmp.Diff(errExpected, errGot))
+				}
+
+				// verify that kbernetes.io/tls validation ar enforced


typo: are

openshift-ci-robot · 2024-04-04T12:34:59Z

@p0lyn0mial: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

852fcc4|UPSTREAM: : allow type mutation for specific secrets: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

openshift-ci-robot · 2024-04-04T12:35:47Z

@p0lyn0mial: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

652a9ef|UPSTREAM: : allow type mutation for specific secrets: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

tkashem · 2024-04-04T13:10:19Z

/remove-label backports/unvalidated-commits
/label backports/validated-commits
/lgtm
/approve

/hold
(cancel when you want to merge it)

/cc @soltysh

p0lyn0mial · 2024-04-04T13:16:06Z

/retest unit

openshift-ci · 2024-04-04T13:16:13Z

@p0lyn0mial: The /retest command does not accept any targets.
The following commands are available to trigger required jobs:

/test artifacts
/test configmap-scale
/test e2e-aws-crun-wasm
/test e2e-aws-jenkins
/test e2e-aws-ovn-cgroupsv2
/test e2e-aws-ovn-crun
/test e2e-aws-ovn-downgrade
/test e2e-aws-ovn-fips
/test e2e-aws-ovn-serial
/test e2e-aws-ovn-upgrade
/test e2e-azure-ovn-upgrade
/test e2e-gcp
/test e2e-gcp-ovn-upgrade
/test images
/test integration
/test k8s-e2e-conformance-aws
/test k8s-e2e-gcp-ovn
/test k8s-e2e-gcp-serial
/test unit
/test verify
/test verify-commits

The following commands are available to trigger optional jobs:

/test e2e-agnostic-ovn-cmd
/test e2e-aws
/test e2e-aws-csi
/test e2e-aws-disruptive
/test e2e-aws-multitenant
/test e2e-aws-ovn
/test e2e-aws-single-node
/test e2e-azure
/test e2e-metal-ipi
/test e2e-metal-ipi-ovn-dualstack
/test e2e-metal-ipi-ovn-ipv6
/test e2e-openstack
/test e2e-openstack-csi-cinder
/test e2e-openstack-csi-manila
/test e2e-vsphere
/test k8s-e2e-aws
/test k8s-e2e-aws-ovn-serial
/test k8s-e2e-gcp-five-control-plane-replicas

Use /test all to run the following jobs that were automatically triggered:

pull-ci-openshift-kubernetes-master-e2e-agnostic-ovn-cmd
pull-ci-openshift-kubernetes-master-e2e-aws-crun-wasm
pull-ci-openshift-kubernetes-master-e2e-aws-csi
pull-ci-openshift-kubernetes-master-e2e-aws-ovn-cgroupsv2
pull-ci-openshift-kubernetes-master-e2e-aws-ovn-crun
pull-ci-openshift-kubernetes-master-e2e-aws-ovn-fips
pull-ci-openshift-kubernetes-master-e2e-aws-ovn-serial
pull-ci-openshift-kubernetes-master-e2e-gcp
pull-ci-openshift-kubernetes-master-e2e-gcp-ovn-upgrade
pull-ci-openshift-kubernetes-master-images
pull-ci-openshift-kubernetes-master-integration
pull-ci-openshift-kubernetes-master-k8s-e2e-aws-ovn-serial
pull-ci-openshift-kubernetes-master-k8s-e2e-conformance-aws
pull-ci-openshift-kubernetes-master-k8s-e2e-gcp-ovn
pull-ci-openshift-kubernetes-master-k8s-e2e-gcp-serial
pull-ci-openshift-kubernetes-master-unit
pull-ci-openshift-kubernetes-master-verify
pull-ci-openshift-kubernetes-master-verify-commits

In response to this:

/retest unit

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

benluddy · 2024-04-04T14:46:37Z

pkg/apis/core/validation/validation_patch.go

+	// "", core.SecretTypeOpaque seems safe because
+	//   https://github.com/kubernetes/kubernetes/blob/8628c3c4da6746b1dc967cc520b189a04ebd78d1/pkg/apis/core/validation/validation.go#L6393


We should never see "" in an the old secret of an update, right?

Just playing it safe here, considering that these secrets could be created and then never changed, I don't think there is a way to ensure that resources were created only with one type.

But if a client serializes a Secret that omits the type field or encodes it as "", its type would have been defaulted to Opaque. How would someone persist a Secret with type ""?

isn't the default value applied on the server-side?

Exactly. How would a Secret with type "" be persisted?

Due to an incorrect patch applied to our server :) ?
Would you be okay to allow core.SecretTypeOpaque and SecretTypeTLS ?

OK. I just don't want to conceal any other potential issues with type defaulting or validation. If we find out that there are clusters with empty-type secrets that we should migrate then we can deal with that separately.

OK, thanks for your feedback, pushed, PTAL.

squash with the previous PRs during the rebase openshift#1924 openshift#1929

openshift-ci-robot · 2024-04-04T15:13:46Z

@p0lyn0mial: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

4665c05|UPSTREAM: : allow type mutation for specific secrets: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

benluddy · 2024-04-04T15:15:09Z

/lgtm

p0lyn0mial · 2024-04-04T15:15:57Z

/hold cancel

p0lyn0mial · 2024-04-04T15:18:40Z

/payload 4.16 ci blocking

sorry, @vrutkovs wanted to test blocking jobs

/hold

@tkashem please remove the hold once the payload job is green, thanks.

openshift-ci · 2024-04-04T15:19:21Z

@p0lyn0mial: trigger 5 job(s) of type blocking for the ci release of OCP 4.16

periodic-ci-openshift-release-master-ci-4.16-upgrade-from-stable-4.15-e2e-aws-ovn-upgrade
periodic-ci-openshift-release-master-ci-4.16-upgrade-from-stable-4.15-e2e-azure-sdn-upgrade
periodic-ci-openshift-release-master-ci-4.16-e2e-gcp-ovn-upgrade
periodic-ci-openshift-release-master-ci-4.16-e2e-aws-sdn-serial
periodic-ci-openshift-hypershift-release-4.16-periodics-e2e-aws-ovn

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/9eb3be20-f296-11ee-850b-9b978875664d-0

openshift-ci · 2024-04-04T15:19:39Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: benluddy, p0lyn0mial, tkashem

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~DOWNSTREAM_OWNERS~~ [tkashem]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tkashem · 2024-04-04T15:24:52Z

/remove-label backports/unvalidated-commits
/label backports/validated-commits

tkashem · 2024-04-04T18:18:36Z

/retest-required

tkashem · 2024-04-05T01:19:51Z

/retest-required

p0lyn0mial · 2024-04-05T05:45:41Z

/retest-required

vrutkovs · 2024-04-05T06:31:57Z

/hold cancel

No regressions found in payload tests

openshift-ci-robot · 2024-04-05T07:22:38Z

@p0lyn0mial: This pull request references Jira Issue OCPBUGS-31384, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.16.0) matches configured target version for branch (4.16.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @wangke19

In response to this:

This PR relaxes the restrictions on allowed type mutation transitions.

initially, the check was stricter.
however, due to the platform's long history (spanning several years)
and the complexity of ensuring that resources were consistently created with only one type,
it is now permissible for (SecretTypeTLS, core.SecretTypeOpaque) type to transition to "kubernetes.io/tls".

additionally, it should be noted that default values might also be applied in some cases.
(

kubernetes/pkg/apis/core/v1/defaults.go

Lines 280 to 284 in 258f1d5

func SetDefaults_Secret(obj *v1.Secret) {

if obj.Type == "" {

obj.Type = v1.SecretTypeOpaque

}

}

)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2024-04-05T08:11:27Z

@p0lyn0mial: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-ci-robot · 2024-04-05T08:16:05Z

@p0lyn0mial: Jira Issue OCPBUGS-31384: Some pull requests linked via external trackers have merged:

The following pull requests linked via external trackers have not merged:

openshift/cluster-etcd-operator#1234 is open

These pull request must merge or be unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-31384 has not been moved to the MODIFIED state.

In response to this:

This PR relaxes the restrictions on allowed type mutation transitions.

initially, the check was stricter.
however, due to the platform's long history (spanning several years)
and the complexity of ensuring that resources were consistently created with only one type,
it is now permissible for (SecretTypeTLS, core.SecretTypeOpaque) type to transition to "kubernetes.io/tls".

additionally, it should be noted that default values might also be applied in some cases.
(

kubernetes/pkg/apis/core/v1/defaults.go

Lines 280 to 284 in 258f1d5

func SetDefaults_Secret(obj *v1.Secret) {

if obj.Type == "" {

obj.Type = v1.SecretTypeOpaque

}

}

)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-bot · 2024-04-05T12:30:49Z

[ART PR BUILD NOTIFIER]

This PR has been included in build openshift-enterprise-pod-container-v4.16.0-202404050813.p0.ge994e5d.assembly.stream.el9 for distgit openshift-enterprise-pod.
All builds following this will include this PR.

openshift-ci-robot added the backports/unvalidated-commits Indicates that not all commits come to merged upstream PRs. label Apr 4, 2024

openshift-ci bot assigned tkashem and vrutkovs Apr 4, 2024

p0lyn0mial changed the title ~~UPSTREAM: <carry>: allow type mutation for specific secrets~~ OCPBUGS-31384: UPSTREAM: <carry>: allow type mutation for specific secrets Apr 4, 2024

openshift-ci bot requested review from wangke19, deads2k and soltysh April 4, 2024 08:50

p0lyn0mial mentioned this pull request Apr 4, 2024

OCPBUGS-31384: use RotatedSigningCASecret controller in update only mode openshift/cluster-kube-apiserver-operator#1659

Merged

openshift-ci bot requested a review from benluddy April 4, 2024 09:36

tkashem reviewed Apr 4, 2024

View reviewed changes

p0lyn0mial force-pushed the downstream-secret-hack-relax-type-validation branch from 8662730 to 852fcc4 Compare April 4, 2024 12:34

p0lyn0mial force-pushed the downstream-secret-hack-relax-type-validation branch from 852fcc4 to 652a9ef Compare April 4, 2024 12:35

benluddy reviewed Apr 4, 2024

View reviewed changes

UPSTREAM: <carry>: allow type mutation for specific secrets

4665c05

squash with the previous PRs during the rebase openshift#1924 openshift#1929

p0lyn0mial force-pushed the downstream-secret-hack-relax-type-validation branch from 652a9ef to 4665c05 Compare April 4, 2024 15:13

openshift-ci-robot added backports/unvalidated-commits Indicates that not all commits come to merged upstream PRs. and removed backports/validated-commits Indicates that all commits come to merged upstream PRs. labels Apr 4, 2024

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Apr 4, 2024

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 4, 2024

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 4, 2024

openshift-ci bot assigned benluddy Apr 4, 2024

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Apr 4, 2024

openshift-ci bot added backports/validated-commits Indicates that all commits come to merged upstream PRs. and removed backports/unvalidated-commits Indicates that not all commits come to merged upstream PRs. labels Apr 4, 2024

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 5, 2024

openshift-merge-bot bot merged commit e994e5d into openshift:master Apr 5, 2024
19 checks passed

p0lyn0mial mentioned this pull request Apr 5, 2024

OCPBUGS-31807: UPSTREAM: <carry>: allow type mutation for specific secrets #1939

Merged

	func SetDefaults_Secret(obj *v1.Secret) {
	if obj.Type == "" {
	obj.Type = v1.SecretTypeOpaque
	}
	}

		// "", core.SecretTypeOpaque seems safe because
		// https://github.com/kubernetes/kubernetes/blob/8628c3c4da6746b1dc967cc520b189a04ebd78d1/pkg/apis/core/validation/validation.go#L6393

OCPBUGS-31384: UPSTREAM: <carry>: allow type mutation for specific secrets #1932

OCPBUGS-31384: UPSTREAM: <carry>: allow type mutation for specific secrets #1932

Conversation

p0lyn0mial commented Apr 4, 2024 • edited

openshift-ci-robot commented Apr 4, 2024

p0lyn0mial commented Apr 4, 2024

openshift-ci-robot commented Apr 4, 2024

p0lyn0mial commented Apr 4, 2024

p0lyn0mial commented Apr 4, 2024

Choose a reason for hiding this comment

p0lyn0mial Apr 4, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

openshift-ci-robot commented Apr 4, 2024

openshift-ci-robot commented Apr 4, 2024

tkashem commented Apr 4, 2024 • edited

p0lyn0mial commented Apr 4, 2024

openshift-ci bot commented Apr 4, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

openshift-ci-robot commented Apr 4, 2024

benluddy commented Apr 4, 2024

p0lyn0mial commented Apr 4, 2024

p0lyn0mial commented Apr 4, 2024

openshift-ci bot commented Apr 4, 2024

openshift-ci bot commented Apr 4, 2024

tkashem commented Apr 4, 2024

tkashem commented Apr 4, 2024

tkashem commented Apr 5, 2024

p0lyn0mial commented Apr 5, 2024

vrutkovs commented Apr 5, 2024

openshift-ci-robot commented Apr 5, 2024

openshift-ci bot commented Apr 5, 2024

openshift-ci-robot commented Apr 5, 2024

openshift-bot commented Apr 5, 2024

p0lyn0mial commented Apr 4, 2024 •

edited

p0lyn0mial Apr 4, 2024 •

edited

tkashem commented Apr 4, 2024 •

edited