Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update allowedNamespaces type in AzureClusterIdentity #1331

Merged
merged 1 commit into from
May 3, 2021
Merged

Update allowedNamespaces type in AzureClusterIdentity #1331

merged 1 commit into from
May 3, 2021

Conversation

nader-ziada
Copy link
Contributor

What type of PR is this?
/kind feature

What this PR does / why we need it:

  • Change rules for allowedNamespaces in AzureClusterIdentity to be consistent with other providers
empty allowedNamespaces --> allows all namespaces
nil allowedNamespaces --> blocks all namespaces

nil NamespaceList --> blocks all
nil Selector --> blocks all

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #1288

Special notes for your reviewer:

Please confirm that if this PR changes any image versions, then that's the sole change this PR makes.

TODOs:

  • squashed commits
  • includes documentation
  • adds unit tests

Release note:

Update AzureClusterIdentity to be more restrictive with the following rules
  - empty allowedNamespaces --> allows all namespaces
  - nil allowedNamespaces --> blocks all namespaces
  - nil NamespaceList --> blocks all
  - nil Selector --> blocks all

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/feature Categorizes issue or PR as related to a new feature. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. area/provider/azure Issues or PRs related to azure provider sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. labels Apr 21, 2021
@k8s-ci-robot k8s-ci-robot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Apr 21, 2021
shysank
shysank reviewed Apr 22, 2021
View reviewed changes
api/v1alpha4/azureclusteridentity_types.go Outdated Show resolved Hide resolved
api/v1alpha4/azureclusteridentity_types.go Outdated Show resolved Hide resolved
api/v1alpha4/azureclusteridentity_types.go Outdated Show resolved Hide resolved
api/v1alpha4/azureclusteridentity_types.go
// Namespaces can be selected either using an array of namespaces or with label selector.
// An empty allowedNamespaces object indicates that AzureClusters can use this identity from any namespace.
// If this object is nil, no namespaces will be allowed (default behaviour, if this field is not provided)
// A namespace should be either in the NamespaceList or match with Selector to use the identity.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If both namespaceList and selectors are specified, which one takes precedence?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see that namespaceList takes precedence. Maybe worth pointing this out somewhere?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good point, will add in desc here and docs

azure/scope/identity.go Outdated Show resolved Hide resolved
azure/scope/identity.go Outdated Show resolved Hide resolved
api/v1alpha3/azureclusteridentity_conversion.go
return err
}

if len(src.Spec.AllowedNamespaces) > 0 {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't this conversion be from the restored spec?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

restored is the v1alpha4 type

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IIUC, we must restore the extra fields (selector in this case) that will get lost in down conversion here, right?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you mean in an annotation? doesn't it get saved automatically?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah from the data annotation, something like this:

cluster-api-provider-azure/api/v1alpha3/azurecluster_conversion.go

Line 52 in f8b2304

dst.Spec.NetworkSpec.PrivateDNSZoneName = restored.Spec.NetworkSpec.PrivateDNSZoneName
?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh i get it now, my bad, just fixed it

api/v1alpha3/azureclusteridentity_conversion.go Outdated Show resolved Hide resolved
api/v1alpha3/azureclusteridentity_conversion.go Outdated Show resolved Hide resolved
@nader-ziada
Copy link
Contributor Author

@shysank please take another look

@shysank
Copy link
Contributor

shysank commented Apr 26, 2021

lgtm with one clarification on the conversion logic.

nader-ziada
nader-ziada commented Apr 27, 2021
View reviewed changes
azure/scope/identity.go
@@ -161,3 +163,45 @@ func getAzureIdentityType(identity *infrav1.AzureClusterIdentity) (aadpodv1.Iden
return 0, errors.New("AzureIdentity does not have a vaild type")

}

// IsClusterNamespaceAllowed indicates if the cluster namespace is allowed
func IsClusterNamespaceAllowed(ctx context.Context, k8sClient client.Client, allowedNamespaces *infrav1.AllowedNamespaces, namespace string) bool {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@devigned can you take a look at this and see if it makes sense based on all the previous conversations?

devigned
devigned approved these changes Apr 29, 2021
View reviewed changes
Copy link
Contributor

@devigned devigned left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@CecileRobertMichon or @shysank any other feedback?

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 29, 2021
@shysank
Copy link
Contributor

shysank commented Apr 29, 2021

/lgtm

@devigned
Copy link
Contributor

/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: devigned

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 30, 2021
@nader-ziada
Copy link
Contributor Author

/retest

@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 30, 2021
@nader-ziada
Copy link
Contributor Author

did a rebase because the check jobs were stuck, will need a new lgtm :)

@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Apr 30, 2021 •
edited
Loading

@nader-ziada: The following test failed, say /retest to rerun all failed tests:

Test name Commit Details Rerun command
pull-cluster-api-provider-azure-apidiff 24c352a link /test pull-cluster-api-provider-azure-apidiff

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@nader-ziada
Copy link
Contributor Author

/test pull-cluster-api-provider-azure-e2e

@devigned
Copy link
Contributor

devigned commented May 3, 2021

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 3, 2021
@k8s-ci-robot k8s-ci-robot merged commit a92161f into kubernetes-sigs:master May 3, 2021
@k8s-ci-robot k8s-ci-robot added this to the v0.5.0 milestone May 3, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@shysank shysank shysank left review comments

@devigned devigned devigned approved these changes

Assignees

@devigned devigned

@shysank shysank

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/provider/azure Issues or PRs related to azure provider cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files.
Projects
None yet
Milestone
v0.5.0
Development

Successfully merging this pull request may close these issues.

Change multi-tenancy allowed namespaces to be more restrictive
4 participants
@nader-ziada @shysank @devigned @k8s-ci-robot