Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OCPNODE-1632: Implement ImagePolicy and ClusterImagePolicy #3786

Draft
wants to merge 3 commits into
base: master
Choose a base branch
from
Draft

OCPNODE-1632: Implement ImagePolicy and ClusterImagePolicy #3786

wants to merge 3 commits into from

Conversation

QiWang19
Copy link
Member

@QiWang19 QiWang19 commented Jul 9, 2023 •
edited

- What I did
Follow the design from the enhancement. Add the implementation to ContainerruntimConfig controller for policy.json configuration.
- How to verify it

- Description for the changelog

@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 9, 2023
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jul 9, 2023

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@QiWang19 QiWang19 force-pushed the verndor-sigstore-api branch 5 times, most recently from 3663151 to 0af1660 Compare July 10, 2023 23:55
@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 25, 2023
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 25, 2023
@QiWang19 QiWang19 force-pushed the verndor-sigstore-api branch 2 times, most recently from ca46c02 to bf82584 Compare September 26, 2023 21:51
@QiWang19 QiWang19 force-pushed the verndor-sigstore-api branch 4 times, most recently from a154f35 to 4499485 Compare November 8, 2023 21:31
@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 13, 2023
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 14, 2023
@QiWang19 QiWang19 force-pushed the verndor-sigstore-api branch 4 times, most recently from e2b3e60 to 68249ff Compare December 15, 2023 01:37
@QiWang19 QiWang19 changed the title Verndor sigstore api Vendor sigstore api Dec 15, 2023
@QiWang19 QiWang19 force-pushed the verndor-sigstore-api branch 5 times, most recently from 80eb398 to 2a00f2a Compare December 21, 2023 17:28
@QiWang19 QiWang19 changed the title OCPNODE-1632: Vendor sigstore api OCPNODE-1632: Implement ImagePolicy and ClusterImagePolicy Jan 23, 2024
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Jan 23, 2024 •
edited by openshift-ci bot

@QiWang19: This pull request references OCPNODE-1632 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.16.0" version, but no target version was set.

In response to this:

- What I did

- How to verify it
Follow the design from the enhancement. Add the implementation to ContainerruntimConfig controller for policy.json configuration.
- Description for the changelog

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@QiWang19 QiWang19 marked this pull request as ready for review January 26, 2024 12:30
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 26, 2024
@openshift-ci openshift-ci bot requested review from jkyros and mtrmac January 26, 2024 12:31
@QiWang19
Copy link
Member Author

ready for review.

@QiWang19
Copy link
Member Author

/retest

@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Jan 26, 2024 •
edited by openshift-ci bot

@QiWang19: This pull request references OCPNODE-1632 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.16.0" version, but no target version was set.

In response to this:

- What I did
Follow the design from the enhancement. Add the implementation to ContainerruntimConfig controller for policy.json configuration.
- How to verify it

- Description for the changelog

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

mtrmac
mtrmac reviewed Jan 26, 2024
View reviewed changes
pkg/controller/container-runtime-config/helpers.go
return namespaceJSONs, nil
}

func imagePolicyConfigFileList(namespaceJSONs map[string][]byte, sigstoreRegistriesConfigYaml []byte) []generatedConfigFile {
Copy link
Contributor

@mtrmac mtrmac Jan 26, 2024 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CRI-O has to this point no ability to correctly implement per-namespace policies (that has stalled in cri-o/cri-o#7046 , and my further work on that is tracked in https://issues.redhat.com/browse/RUN-1980 ), so isn’t this rather premature?

Of course the code proposed in this PR could be reviewed concurrently, but I don’t think it makes sense to merge it.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alternatively, it might make sense to add the feature that adds a CR to configure the cluster-wide-global /etc/container/policy.json, right now — if that can be reasonably isolated from the other parts of the approved enhancement. It’s just the per-namespace policies that are not currently possible.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mtrmac thank you for the clarification! Do you have plans to continue the CRI-O work (RUN-1980) in the near future?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I’m definitely interested seeing this through to completion, after all the effort, but I don’t think I can spare the time in the next ~month at least.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note https://issues.redhat.com/browse/OTA-1170 ; AFAICS that would benefit from MCO implementing ClusterImagePolicy .

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree that sounds like a plan. If we can deliver the namespaced policies in CRI-O v1.30 (late April) then we can pull those into the MCO implementation afterwards.

Focusing on the cluster policy sounds totally reasonable for now. 👍

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mtrmac @saschagrunert PR #4160 implementing ClusterImagePolicy is ready for review.

wking
wking reviewed Jan 29, 2024
View reviewed changes
install/0000_80_machine-config-operator_00_clusterreader_clusterrole.yaml
- get
- list
- watch
- update
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I understand that that (Cluster)ImagePolicy -> MachineConfig pipe needs the read-access verbs. But I'm not clear on why this system:openshift:machine-config-operator:cluster-reader role would need update write access. Am I missing something?

Copy link
Member Author

@QiWang19 QiWang19 Jan 30, 2024 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will clean this up.

@QiWang19 QiWang19 marked this pull request as draft February 2, 2024 05:50
@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 2, 2024
@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 10, 2024
@QiWang19
cluster-policy
38a1de3 
Signed-off-by: Qi Wang <qiwan@redhat.com>
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 10, 2024
@QiWang19
Update FulcioCAData type to []byte
a041bc8 
Signed-off-by: Qi Wang <qiwan@redhat.com>
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Feb 20, 2024

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: QiWang19
Once this PR has been reviewed and has the lgtm label, please assign djoshy for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@QiWang19
Copy link
Member Author

/retest

@QiWang19
Copy link
Member Author

/test e2e-gcp-op-techpreview

@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Feb 24, 2024 •
edited

@QiWang19: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-openstack 84416e6 link false /test e2e-openstack
ci/prow/e2e-aws-ovn-upgrade-out-of-change 41fa961 link false /test e2e-aws-ovn-upgrade-out-of-change
ci/prow/e2e-gcp-op-single-node 41fa961 link true /test e2e-gcp-op-single-node
ci/prow/e2e-azure-ovn-upgrade-out-of-change 41fa961 link false /test e2e-azure-ovn-upgrade-out-of-change
ci/prow/e2e-hypershift 41fa961 link true /test e2e-hypershift
ci/prow/e2e-aws-ovn-upgrade 41fa961 link true /test e2e-aws-ovn-upgrade
ci/prow/images 41fa961 link true /test images
ci/prow/e2e-gcp-op 41fa961 link true /test e2e-gcp-op
ci/prow/okd-scos-e2e-aws-ovn 41fa961 link false /test okd-scos-e2e-aws-ovn
ci/prow/unit 41fa961 link true /test unit
ci/prow/e2e-aws-ovn 41fa961 link true /test e2e-aws-ovn

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@QiWang19
Copy link
Member Author

/test e2e-gcp-op-techpreview

@openshift-bot
Copy link
Contributor

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

@openshift-ci openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 27, 2024
@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 27, 2024
@openshift-merge-robot
Copy link
Contributor

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@wking wking wking left review comments

@saschagrunert saschagrunert saschagrunert left review comments

@mtrmac mtrmac mtrmac left review comments

@sinnykumari sinnykumari Awaiting requested review from sinnykumari

@umohnani8 umohnani8 Awaiting requested review from umohnani8

@jkyros jkyros Awaiting requested review from jkyros

Assignees
No one assigned
Labels
do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
7 participants
@QiWang19 @openshift-ci-robot @openshift-bot @openshift-merge-robot @wking @saschagrunert @mtrmac