Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[WIP] OCPBUGS-39148: Add Feature Gate AND on NetworkLoadBalancer CEL #2131

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

gcs278
Copy link
Contributor

@gcs278 gcs278 commented Jan 3, 2025

Previously, the AWSNetworkLoadBalancerParameters struct had CEL that referenced both Subnets and EIPAllocations, but only was gated on the EIPAllocations feature gate. This means if the subnets feature gate was ever disabled, then the IngressController CRD would be invalid because the CEL would still be present, causing an error when installing the CRD.

We are now able to add "AND" logic to the FeatureGateAwareXValidation tag which enables us to feature gate the CEL on both Subnets and EIPAllocations feature gates.

@openshift-ci-robot openshift-ci-robot added jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Jan 3, 2025
@openshift-ci-robot
Copy link

@gcs278: This pull request references Jira Issue OCPBUGS-39148, which is invalid:

  • expected the bug to target the "4.19.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Previously, the AWSNetworkLoadBalancerParameters struct had CEL that referenced both Subnets and EIPAllocations, but only was gated on the EIPAllocations feature gate. This means if the subnets feature gate was ever disabled, then the IngressController CRD would be invalid because the CEL would still be present, causing an error when installing the CRD.

We are now able to add "AND" logic to the FeatureGateAwareXValidation tag which enables us to feature gate the CEL on both Subnets and EIPAllocations feature gates.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Copy link
Contributor

openshift-ci bot commented Jan 3, 2025

Hello @gcs278! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

@openshift-ci openshift-ci bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jan 3, 2025
@openshift-ci openshift-ci bot requested review from bparees and JoelSpeed January 3, 2025 15:37
Copy link
Contributor

openshift-ci bot commented Jan 3, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: gcs278
Once this PR has been reviewed and has the lgtm label, please assign knobunc for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@gcs278
Copy link
Contributor Author

gcs278 commented Jan 3, 2025

/jira refresh

@openshift-ci-robot openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Jan 3, 2025
@openshift-ci-robot
Copy link

@gcs278: This pull request references Jira Issue OCPBUGS-39148, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.19.0) matches configured target version for branch (4.19.0)
  • bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @lihongan

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot openshift-ci-robot removed the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Jan 3, 2025
@openshift-ci openshift-ci bot requested a review from lihongan January 3, 2025 15:46
// +openshift:validation:FeatureGateAwareXValidation:featureGate=SetEIPForNLBIngressController,rule=`has(self.subnets) && has(self.subnets.ids) && has(self.subnets.names) && has(self.eipAllocations) ? size(self.subnets.ids + self.subnets.names) == size(self.eipAllocations) : true`,message="number of subnets must be equal to number of eipAllocations"
// +openshift:validation:FeatureGateAwareXValidation:featureGate=SetEIPForNLBIngressController,rule=`has(self.subnets) && has(self.subnets.ids) && !has(self.subnets.names) && has(self.eipAllocations) ? size(self.subnets.ids) == size(self.eipAllocations) : true`,message="number of subnets must be equal to number of eipAllocations"
// +openshift:validation:FeatureGateAwareXValidation:featureGate=SetEIPForNLBIngressController,rule=`has(self.subnets) && has(self.subnets.names) && !has(self.subnets.ids) && has(self.eipAllocations) ? size(self.subnets.names) == size(self.eipAllocations) : true`,message="number of subnets must be equal to number of eipAllocations"
// +openshift:validation:FeatureGateAwareXValidation:featureGate=SetEIPForNLBIngressController;IngressControllerLBSubnetsAWS,rule=`has(self.subnets) && has(self.subnets.ids) && has(self.subnets.names) && has(self.eipAllocations) ? size(self.subnets.ids + self.subnets.names) == size(self.eipAllocations) : true`,message="number of subnets must be equal to number of eipAllocations"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you tested this? I think we added a separate field, so it may need to be

Suggested change
// +openshift:validation:FeatureGateAwareXValidation:featureGate=SetEIPForNLBIngressController;IngressControllerLBSubnetsAWS,rule=`has(self.subnets) && has(self.subnets.ids) && has(self.subnets.names) && has(self.eipAllocations) ? size(self.subnets.ids + self.subnets.names) == size(self.eipAllocations) : true`,message="number of subnets must be equal to number of eipAllocations"
// +openshift:validation:FeatureGateAwareXValidation:requiredFeatureGate=SetEIPForNLBIngressController;IngressControllerLBSubnetsAWS,rule=`has(self.subnets) && has(self.subnets.ids) && has(self.subnets.names) && has(self.eipAllocations) ? size(self.subnets.ids + self.subnets.names) == size(self.eipAllocations) : true`,message="number of subnets must be equal to number of eipAllocations"

Copy link
Contributor Author

@gcs278 gcs278 Jan 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yea sorry, I notice this too, and I was trying to change to use requiredFeatureGate, but now I get:

F0103 11:03:44.606428 1073642 root.go:64] Error running codegen: 
error running generator schemapatch on group imageregistry.operator.openshift.io: 
	could not run schemapatch generator for group/version imageregistry.operator.openshift.io/v1: 
		could not execute schemapatch for manifest /home/gspence/src/github.com/openshift/api/imageregistry/v1/zz_generated.featuregated-crd-manifests/configs.imageregistry.operator.openshift.io/AAA_ungated.yaml: 
			github.com/openshift/api/imageregistry/v1:-: unable to locate schema for type "github.com/openshift/api/operator/v1".OperatorStatus
			github.com/openshift/api/imageregistry/v1:-: unable to locate schema for type "github.com/openshift/api/operator/v1".OperatorSpec
			/home/gspence/src/github.com/openshift/api/operator/v1/types_ingress.go:806:1: missing argument "featureGate" (at <input>:1:337)
			/home/gspence/src/github.com/openshift/api/operator/v1/types_ingress.go:807:1: missing argument "featureGate" (at <input>:1:317)
			/home/gspence/src/github.com/openshift/api/operator/v1/types_ingress.go:808:1: missing argument "featureGate" (at <input>:1:319)
			github.com/openshift/api/operator/v1:-: unknown type "github.com/openshift/api/operator/v1".OperatorSpec
			github.com/openshift/api/operator/v1:-: unknown type "github.com/openshift/api/operator/v1".OperatorStatus
error running generator schemapatch on group operator.openshift.io: 
	could not run schemapatch generator for group/version operator.openshift.io/v1alpha1: 
		could not execute schemapatch for manifest /home/gspence/src/github.com/openshift/api/operator/v1alpha1/zz_generated.featuregated-crd-manifests/clusterversionoperators.operator.openshift.io/ClusterVersionOperatorConfiguration.yaml: 
			github.com/openshift/api/operator/v1alpha1:-: unable to locate schema for type "github.com/openshift/api/operator/v1".LogLevel
			/home/gspence/src/github.com/openshift/api/operator/v1/types_ingress.go:806:1: missing argument "featureGate" (at <input>:1:337)
			/home/gspence/src/github.com/openshift/api/operator/v1/types_ingress.go:807:1: missing argument "featureGate" (at <input>:1:317)
			/home/gspence/src/github.com/openshift/api/operator/v1/types_ingress.go:808:1: missing argument "featureGate" (at <input>:1:319)
			github.com/openshift/api/operator/v1:-: unknown type "github.com/openshift/api/operator/v1".LogLevel
	could not run schemapatch generator for group/version operator.openshift.io/v1: 
		could not execute schemapatch for manifest /home/gspence/src/github.com/openshift/api/operator/v1/manual-override-crd-manifests/clustercsidrivers.operator.openshift.io/AAA_ungated.yaml: 
			/home/gspence/src/github.com/openshift/api/operator/v1/types_ingress.go:806:1: missing argument "featureGate" (at <input>:1:337)
			/home/gspence/src/github.com/openshift/api/operator/v1/types_ingress.go:807:1: missing argument "featureGate" (at <input>:1:317)
			/home/gspence/src/github.com/openshift/api/operator/v1/types_ingress.go:808:1: missing argument "featureGate" (at <input>:1:319)
error running generator schemapatch on group samples.operator.openshift.io: 
	could not run schemapatch generator for group/version samples.operator.openshift.io/v1: 
		could not execute schemapatch for manifest /home/gspence/src/github.com/openshift/api/samples/v1/zz_generated.featuregated-crd-manifests/configs.samples.operator.openshift.io/AAA_ungated.yaml: 
			github.com/openshift/api/samples/v1:-: unable to locate schema for type "github.com/openshift/api/operator/v1".ManagementState
			/home/gspence/src/github.com/openshift/api/operator/v1/types_ingress.go:806:1: missing argument "featureGate" (at <input>:1:337)
			/home/gspence/src/github.com/openshift/api/operator/v1/types_ingress.go:807:1: missing argument "featureGate" (at <input>:1:317)
			/home/gspence/src/github.com/openshift/api/operator/v1/types_ingress.go:808:1: missing argument "featureGate" (at <input>:1:319)
			github.com/openshift/api/operator/v1:-: unknown type "github.com/openshift/api/operator/v1".ManagementState

I'm not totally sure why I'm getting missing argument "featureGate", I might be doing something silly...any help is appreciated.

Previously, the AWSNetworkLoadBalancerParameters struct had CEL that
referenced both Subnets and EIPAllocations, but only was gated on the
EIPAllocations feature gate. This means if the subnets feature gate was
ever disabled, then the IngressController CRD would be invalid because
the CEL would still be present, causing an error when installing the
CRD.

We are now able to add "AND" logic to the FeatureGateAwareXValidation
tag which enables us to feature gate the CEL on both Subnets and
EIPAllocations feature gates.
@gcs278 gcs278 force-pushed the OCPBUGS-39148-missing-feature-gate-for-cel-subnets branch from 7017b04 to 3b80fa4 Compare January 3, 2025 17:45
@openshift-ci openshift-ci bot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jan 3, 2025
@gcs278 gcs278 changed the title OCPBUGS-39148: Add Feature Gate AND on NetworkLoadBalancer CEL [WIP] OCPBUGS-39148: Add Feature Gate AND on NetworkLoadBalancer CEL Jan 3, 2025
@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 3, 2025
Copy link
Contributor

openshift-ci bot commented Jan 3, 2025

@gcs278: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/verify 3b80fa4 link true /test verify

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants