Skip to content

OCPBUGS-32158: Add CEL validation for RegistrySources in Image API #1859

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Feb 24, 2025
Merged

OCPBUGS-32158: Add CEL validation for RegistrySources in Image API #1859

merged 1 commit into from
Feb 24, 2025

Conversation

muraee
Copy link
Contributor

@muraee muraee commented Apr 17, 2024

HyperShift embeds Image config API directly, so any webhook validation will not be triggered.
This adds CEL validation to the CRD directly to mitigate that.

ref: https://issues.redhat.com/browse/OCPBUGS-32158

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Apr 17, 2024
@openshift-ci-robot
Copy link

@muraee: This pull request references Jira Issue OCPBUGS-32158, which is invalid:

  • expected the bug to target the "4.16.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

HyperShift embeds Image config API directly, so any webhook validation will not be triggered.
This adds CEL validation to the CRD directly to mitigate that.

ref: https://issues.redhat.com/browse/OCPBUGS-32158

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Apr 17, 2024
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Apr 17, 2024

Hello @muraee! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

@muraee
Copy link
Contributor Author

muraee commented Apr 17, 2024

/jira refresh

@openshift-ci-robot openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Apr 17, 2024
@openshift-ci-robot
Copy link

@muraee: This pull request references Jira Issue OCPBUGS-32158, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.16.0) matches configured target version for branch (4.16.0)
  • bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Apr 17, 2024
@openshift-ci openshift-ci bot requested review from mfojtik and soltysh April 17, 2024 15:35
@muraee muraee force-pushed the types_image_validiation branch from 80a0f74 to 699c773 Compare April 17, 2024 15:53
@muraee
Copy link
Contributor Author

muraee commented Apr 18, 2024

/retest-required

@muraee muraee force-pushed the types_image_validiation branch from 699c773 to ad2927a Compare April 18, 2024 10:37
@muraee
Copy link
Contributor Author

muraee commented Apr 24, 2024

/retest-required

2 similar comments
@muraee
Copy link
Contributor Author

muraee commented Apr 26, 2024

/retest-required

@muraee
Copy link
Contributor Author

muraee commented Apr 30, 2024

/retest-required

@csrwng
Copy link
Contributor

csrwng commented Apr 30, 2024

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Apr 30, 2024
@muraee
Copy link
Contributor Author

muraee commented May 10, 2024

cc @deads2k

@flavianmissi
Copy link
Member

looks good to me from a registry perspective 👍🏼

@muraee muraee force-pushed the types_image_validiation branch from ad2927a to 4db0990 Compare August 29, 2024 13:17
@openshift-ci openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Aug 29, 2024
@muraee
Copy link
Contributor Author

muraee commented Aug 29, 2024

cc @JoelSpeed @deads2k could take a look please.

@JoelSpeed
Copy link
Contributor

Can you please link to where this is validated in a webhook for core OCP?

When was this CRD introduced into HyperShift, could there be existing resources that become broken by the addition of this CEL?

@JoelSpeed
Copy link
Contributor

Some code generation issues here as well, will need to rerun the CRD generation

@muraee
Copy link
Contributor Author

muraee commented Sep 2, 2024 •
edited
Loading

@JoelSpeed not sure where/if the webhook exist, I was just saying, if it exists then it won't run for Hypershift.

This is validated in the MCO code directly, see:
https://github.com/openshift/machine-config-operator/blob/eeea7495bc40d0f73dd9c2ba030e678ec598d8b1/pkg/controller/container-runtime-config/helpers.go#L504-L506

and its also mentioned on the field description

api/config/v1/types_image.go

Line 178 in 85dc560

// Only one of BlockedRegistries or AllowedRegistries may be set.

@muraee muraee force-pushed the types_image_validiation branch from 4db0990 to 0584006 Compare September 2, 2024 10:26
@openshift-ci openshift-ci bot removed the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Sep 2, 2024
@muraee
Copy link
Contributor Author

muraee commented Feb 3, 2025

@JoelSpeed can we process with this PR, or do you want to use the Ratcheting validation you mentioned instead?

@JoelSpeed
Copy link
Contributor

This validation should ratchet already, what I'd like to see is a test case added that shows this. Check the tests folder readme on how to set up a ratcheting validation integration test for this. #2142 also provides some examples of adding ratcheting tests

@muraee muraee force-pushed the types_image_validiation branch 2 times, most recently from 9f8eba8 to 5cc319e Compare February 7, 2025 13:46
@openshift-ci openshift-ci bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Feb 7, 2025
@muraee
Copy link
Contributor Author

muraee commented Feb 7, 2025 •
edited
Loading

@JoelSpeed I added some tests, and adjusted the CEL to make the fields mutually exclusive, as self.blockedRegistries.size() == 0 || self.allowedRegistries.size() == 0 allowed both fields to be set and made at least one of them required, whereas it's allowed for both to be empty.

@muraee muraee force-pushed the types_image_validiation branch from 5cc319e to 79fcfda Compare February 12, 2025 17:00
@JoelSpeed
Copy link
Contributor

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Feb 13, 2025
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Feb 13, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: csrwng, JoelSpeed, muraee

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 13, 2025
@openshift-ci-robot
Copy link

/retest-required

Remaining retests: 0 against base HEAD ead8ee7 and 2 for PR HEAD 79fcfda in total

@openshift-ci-robot
Copy link

/retest-required

Remaining retests: 0 against base HEAD cfbda0b and 1 for PR HEAD 79fcfda in total

@openshift-ci-robot
Copy link

/retest-required

Remaining retests: 0 against base HEAD 744790f and 2 for PR HEAD 79fcfda in total

@muraee
Copy link
Contributor Author

muraee commented Feb 20, 2025

/retest-required

@openshift-ci-robot
Copy link

/retest-required

Remaining retests: 0 against base HEAD 744790f and 2 for PR HEAD 79fcfda in total

2 similar comments
@openshift-ci-robot
Copy link

/retest-required

Remaining retests: 0 against base HEAD 744790f and 2 for PR HEAD 79fcfda in total

@openshift-ci-robot
Copy link

/retest-required

Remaining retests: 0 against base HEAD 744790f and 2 for PR HEAD 79fcfda in total

@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Feb 24, 2025 •
edited
Loading

@muraee: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-upgrade-minor ad2927a link true /test e2e-upgrade-minor

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@muraee
Copy link
Contributor Author

muraee commented Feb 24, 2025

/retest-required

@openshift-merge-bot openshift-merge-bot bot merged commit 544b3ca into openshift:master Feb 24, 2025
22 checks passed
@openshift-ci-robot
Copy link

@muraee: Jira Issue OCPBUGS-32158: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-32158 has been moved to the MODIFIED state.

In response to this:

HyperShift embeds Image config API directly, so any webhook validation will not be triggered.
This adds CEL validation to the CRD directly to mitigate that.

ref: https://issues.redhat.com/browse/OCPBUGS-32158

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-bot
Copy link

[ART PR BUILD NOTIFIER]

Distgit: ose-cluster-config-api
This PR has been included in build ose-cluster-config-api-container-v4.19.0-202502242108.p0.g544b3ca.assembly.stream.el9.
All builds following this will include this PR.

@muraee
Copy link
Contributor Author

muraee commented Mar 5, 2025

/cherry-pick release-4.18

@openshift-cherrypick-robot
Copy link

@muraee: new pull request created: #2218

In response to this:

/cherry-pick release-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-cherrypick-robot openshift-cherrypick-robot mentioned this pull request Mar 5, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@JoelSpeed JoelSpeed JoelSpeed left review comments

@mfojtik mfojtik Awaiting requested review from mfojtik

@soltysh soltysh Awaiting requested review from soltysh

Assignees

@csrwng csrwng

@JoelSpeed JoelSpeed

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
8 participants
@muraee @openshift-ci-robot @csrwng @flavianmissi @JoelSpeed @yuqi-zhang @openshift-bot @openshift-cherrypick-robot