validation: add CEL validation to workload entry #3235
Conversation
howardjohn
added
the
release-notes-none
istio-testing
added
the
size/L
howardjohn
added
do-not-merge/hold
howardjohn
force-pushed
the
cel/workload-entry
branch
from
eb8ecaf
to
b06e569
Compare
| @@ -554,6 +554,7 @@ message ServiceEntry { | |||
|
|
|||
| // One or more endpoints associated with the service. Only one of | |||
| // `endpoints` or `workloadSelector` can be specified. | |||
| // +kubebuilder:validation:MaxItems=4096 | |||
There was a problem hiding this comment.
If we allow 4096 endpoints, then the workloadEntry must exceed the max size limit of a object from etcdm, which is likely 1.5MB
There was a problem hiding this comment.
right now we allow infinity. So this is only making it more restrictive, not less
There was a problem hiding this comment.
I know, could we strict limit it. In real scenario, can limit to 128. If more endpoints associated, we should encourage to use workloadentry separately
There was a problem hiding this comment.
If I was building today I would just do not want to break existing users if they have a lot?
| @@ -554,6 +554,7 @@ message ServiceEntry { | |||
|
|
|||
| // One or more endpoints associated with the service. Only one of | |||
| // `endpoints` or `workloadSelector` can be specified. | |||
| // +kubebuilder:validation:MaxItems=4096 | |||
There was a problem hiding this comment.
We should add documentation around it too. I don't expect folks to have so many entries but we should document our limits clearly.
No description provided.