Skip to content

[2315] Add OpenstackCreds validating webhook scaffold - #2348

Open
OmkarDeshpande7 wants to merge 6 commits into
mainfrom
feature/openstackcreds-validating-webhook
Open

[2315] Add OpenstackCreds validating webhook scaffold#2348
OmkarDeshpande7 wants to merge 6 commits into
mainfrom
feature/openstackcreds-validating-webhook

Conversation

@OmkarDeshpande7

@OmkarDeshpande7 OmkarDeshpande7 commented Aug 31, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Registers OpenstackCredsCustomValidator via kubebuilder webhook scaffolding for admission-time validation of OpenstackCreds resources
  • Adds certmanager, webhook service, manifests, and kustomize patches for CA injection
  • Upgrades golangci-lint from v2.1.6 → v2.13.2 (v2.1.6 is incompatible with Go 1.27's export data format) and pins CI and both Go modules to Go 1.27
  • Adds targeted .golangci.yml exclusions for pre-existing findings surfaced by the linter upgrade (goconst, gosec/G118, staticcheck/SA1019)

Validation logic

The webhook methods are currently scaffolding (no-ops). Follow-up: #2347

Test plan

  • cd k8s/migration && make test passes locally
  • golangci-lint run reports 0 issues
  • CI golangci-lint action passes with Go 1.27 + v2.13.2

Commits

  1. [2315] Add OpenstackCreds validating webhook scaffold
  2. Upgrade golangci-lint to v2.13.2 and suppress pre-existing findings
  3. ci: upgrade golangci-lint action to v2.13.2, Go modules to 1.27.0

Closes #2347

🤖 Generated with Claude Code

@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

✅ Security Vulnerability Summary

No change in security posture

📊 Overall Changes

Metric Count
Total Added 0
Total Fixed 0
Net Change 0

🔍 Detailed Breakdown

📦 Gosec (Static Analysis)

Current Baseline Added Fixed Method
0 0 0 0 artifact

📦 Trivy (Dependency Scan)

Current Baseline Added Fixed Method
95 95 0 0 artifact

📋 Baseline Methods

  • 📦 artifact: Used stored report from main branch
  • 🔄 live_scan: Scanned base branch in real-time
  • ⚠️ no_baseline: No baseline available (all vulnerabilities treated as new)

Only HIGH and CRITICAL severity vulnerabilities are tracked
Baseline: 81607bf57c9eeed6d2f4a9eaa4c2522bef9e9175

1 similar comment
@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

✅ Security Vulnerability Summary

No change in security posture

📊 Overall Changes

Metric Count
Total Added 0
Total Fixed 0
Net Change 0

🔍 Detailed Breakdown

📦 Gosec (Static Analysis)

Current Baseline Added Fixed Method
0 0 0 0 artifact

📦 Trivy (Dependency Scan)

Current Baseline Added Fixed Method
95 95 0 0 artifact

📋 Baseline Methods

  • 📦 artifact: Used stored report from main branch
  • 🔄 live_scan: Scanned base branch in real-time
  • ⚠️ no_baseline: No baseline available (all vulnerabilities treated as new)

Only HIGH and CRITICAL severity vulnerabilities are tracked
Baseline: 81607bf57c9eeed6d2f4a9eaa4c2522bef9e9175

@OmkarDeshpande7

OmkarDeshpande7 commented Sep 3, 2026

Copy link
Copy Markdown
Collaborator Author

CRITICAL · k8s/migration/config/default/kustomization.yaml

manager_webhook_patch.yaml is enabled, adding a volume mount for Secret webhook-server-cert to the controller-manager container (lands in generated deploy/05controller-deployment.yaml and deploy/installer.yaml). But ../certmanager and webhookcainjection_patch.yaml are both still commented out in the same file — nothing creates that secret. The certificate.yaml this PR adds under config/certmanager/ is never referenced by any enabled overlay.

On the next rollout of migration-controller-manager, the pod's volume references a Secret that doesn't exist, so it can't start — taking down the entire controller-manager (every controller it runs), not just OpenstackCreds validation. main.go defaults ENABLE_WEBHOOKS to true, so this triggers unconditionally unless someone sets the env var to "false" first.

Fix: fully wire cert-manager (uncomment ../certmanager and webhookcainjection_patch.yaml, confirm cert-manager is actually installed in the target cluster) before enabling manager_webhook_patch.yaml, then re-run make generate-manifests and confirm the generated Deployment doesn't reference an unbacked secret.

@OmkarDeshpande7

OmkarDeshpande7 commented Sep 3, 2026

Copy link
Copy Markdown
Collaborator Author

LOGIC · k8s/migration/config/crd/kustomization.yaml, deploy/00crds.yaml:1962-1968, deploy/installer.yaml

Enabling patches/webhook_in_openstackcreds.yaml set spec.conversion.strategy: Webhook (path /convert) on the OpenstackCreds CRD. That's kubebuilder's default conversion-webhook scaffold, distinct from the validating-webhook config in config/webhook/manifests.yaml (path /validate-...), which is correct and unaffected.

OpenstackCreds has one served/stored version, and openstackcreds_webhook.go registers only a Validator — there's no /convert route anywhere. The CRD now advertises a conversion capability that doesn't exist, with a clientConfig carrying no caBundle (per Finding 1), on a resource that doesn't even need conversion.

Fix: comment out patches/webhook_in_openstackcreds.yaml in config/crd/kustomization.yaml, drop spec.conversion from the CRD, and re-run make generate-manifests.

@OmkarDeshpande7

OmkarDeshpande7 commented Sep 3, 2026

Copy link
Copy Markdown
Collaborator Author

MISSING TEST · k8s/migration/api/v1alpha1/openstackcreds_webhook_test.go

Both It(...) blocks are empty kubebuilder scaffolding (// TODO(user): Add your logic here) — the suite passes without exercising ValidateCreate/ValidateUpdate/ValidateDelete at all. Those aren't pure no-ops today: they do a type assertion and return an error on mismatch, which is real logic shipped in this PR and currently uncovered.

Per the constitution's Test-First principle and CLAUDE.md's rule to always add unit tests for new Go code, this needs a test asserting: correct-type object → (nil, nil); wrong-type object → non-nil error. The real business-rule validation can stay deferred to #2347.

Fix: add a plain _test.go (or fill in the Ginkgo It blocks) calling the three methods directly with a wrong-type runtime.Object and asserting the error, plus the happy path.

@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

🚨 Security Vulnerability Summary

Security posture degraded

📊 Overall Changes

Metric Count
Total Added 8
Total Fixed 0
Net Change +8

🔍 Detailed Breakdown

📦 Gosec (Static Analysis)

Current Baseline Added Fixed Method
0 0 0 0 artifact

📦 Trivy (Dependency Scan)

Current Baseline Added Fixed Method
103 95 8 0 artifact

📋 Baseline Methods

  • 📦 artifact: Used stored report from main branch
  • 🔄 live_scan: Scanned base branch in real-time
  • ⚠️ no_baseline: No baseline available (all vulnerabilities treated as new)

🚨 Added Vulnerabilities

Trivy (Dependencies) - 8 Added

Target: k8s/migration/go.mod
Package: golang.org/x/crypto v0.44.0
Vulnerability: CVE-2026-56854
Severity: CRITICAL
Title: golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions

Target: k8s/migration/go.mod
Package: google.golang.org/grpc v1.75.1
Vulnerability: CVE-2026-84304
Severity: HIGH
Title: gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, in ...

Target: pkg/common/go.mod
Package: google.golang.org/grpc v1.75.1
Vulnerability: CVE-2026-84304
Severity: HIGH
Title: gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, in ...

Target: pkg/vpwned/go.mod
Package: golang.org/x/crypto v0.44.0
Vulnerability: CVE-2026-56854
Severity: CRITICAL
Title: golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions

Target: pkg/vpwned/go.mod
Package: google.golang.org/grpc v1.75.1
Vulnerability: CVE-2026-84304
Severity: HIGH
Title: gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, in ...

Target: ui/package-lock.json
Package: nanoid 5.1.5
Vulnerability: CVE-2026-73086
Severity: HIGH
Title: nanoid: nanoid: Predictable ID generation due to integer overflow

Target: ui/yarn.lock
Package: nanoid 5.1.5
Vulnerability: CVE-2026-73086
Severity: HIGH
Title: nanoid: nanoid: Predictable ID generation due to integer overflow

Target: v2v-helper/go.mod
Package: golang.org/x/crypto v0.44.0
Vulnerability: CVE-2026-56854
Severity: CRITICAL
Title: golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions

Only HIGH and CRITICAL severity vulnerabilities are tracked
Baseline: 81607bf57c9eeed6d2f4a9eaa4c2522bef9e9175

1 similar comment
@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

🚨 Security Vulnerability Summary

Security posture degraded

📊 Overall Changes

Metric Count
Total Added 8
Total Fixed 0
Net Change +8

🔍 Detailed Breakdown

📦 Gosec (Static Analysis)

Current Baseline Added Fixed Method
0 0 0 0 artifact

📦 Trivy (Dependency Scan)

Current Baseline Added Fixed Method
103 95 8 0 artifact

📋 Baseline Methods

  • 📦 artifact: Used stored report from main branch
  • 🔄 live_scan: Scanned base branch in real-time
  • ⚠️ no_baseline: No baseline available (all vulnerabilities treated as new)

🚨 Added Vulnerabilities

Trivy (Dependencies) - 8 Added

Target: k8s/migration/go.mod
Package: golang.org/x/crypto v0.44.0
Vulnerability: CVE-2026-56854
Severity: CRITICAL
Title: golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions

Target: k8s/migration/go.mod
Package: google.golang.org/grpc v1.75.1
Vulnerability: CVE-2026-84304
Severity: HIGH
Title: gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, in ...

Target: pkg/common/go.mod
Package: google.golang.org/grpc v1.75.1
Vulnerability: CVE-2026-84304
Severity: HIGH
Title: gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, in ...

Target: pkg/vpwned/go.mod
Package: golang.org/x/crypto v0.44.0
Vulnerability: CVE-2026-56854
Severity: CRITICAL
Title: golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions

Target: pkg/vpwned/go.mod
Package: google.golang.org/grpc v1.75.1
Vulnerability: CVE-2026-84304
Severity: HIGH
Title: gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, in ...

Target: ui/package-lock.json
Package: nanoid 5.1.5
Vulnerability: CVE-2026-73086
Severity: HIGH
Title: nanoid: nanoid: Predictable ID generation due to integer overflow

Target: ui/yarn.lock
Package: nanoid 5.1.5
Vulnerability: CVE-2026-73086
Severity: HIGH
Title: nanoid: nanoid: Predictable ID generation due to integer overflow

Target: v2v-helper/go.mod
Package: golang.org/x/crypto v0.44.0
Vulnerability: CVE-2026-56854
Severity: CRITICAL
Title: golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions

Only HIGH and CRITICAL severity vulnerabilities are tracked
Baseline: 81607bf57c9eeed6d2f4a9eaa4c2522bef9e9175

OmkarDeshpande7 and others added 6 commits September 3, 2026 12:18
@OmkarDeshpande7 @claude @sarika-pf9
[2315] Add OpenstackCreds validating webhook scaffold
66b62b2 
Registers OpenstackCredsCustomValidator via kubebuilder webhook scaffolding.
Includes certmanager, webhook manifests, kustomize patches, and test suite.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@OmkarDeshpande7 @claude @sarika-pf9
Upgrade golangci-lint to v2.13.2 and suppress pre-existing findings
f966d97 
v2.1.6 is incompatible with Go 1.27 (export data version mismatch).
v2.13.2 surfaces pre-existing goconst/gosec/staticcheck findings in
unchanged files; add targeted exclusions to restore a clean baseline.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@OmkarDeshpande7 @claude @sarika-pf9
ci: upgrade golangci-lint action to v2.13.2
0618588 
Aligns CI with the version pinned in k8s/migration/Makefile.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@OmkarDeshpande7 @claude @sarika-pf9
build(vpwned): upgrade Go to 1.27 in Dockerfile and go.mod
232dc3f 
k8s/migration now requires go >= 1.27.0; vpwned replaces it locally,
so its Docker builder must also use Go 1.27 to satisfy the constraint.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@OmkarDeshpande7 @claude @sarika-pf9
fix: address review findings on webhook scaffold
6c2388c 
- Comment out manager_webhook_patch.yaml and ../webhook in
  config/default/kustomization.yaml — cert-manager not wired, enabling
  these caused missing Secret volume → controller-manager pod crash
- Comment out webhook_in_openstackcreds.yaml and kustomizeconfig in
  config/crd/kustomization.yaml — conversion webhook strategy set on CRD
  but no /convert handler exists; only a validating webhook is registered
- Add unit tests to openstackcreds_webhook_test.go covering type-assertion
  logic: correct type → (nil, nil), wrong type → non-nil error
- Regenerate deploy/ manifests with webhook resources removed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@OmkarDeshpande7 @claude @sarika-pf9
feat: wire cert-manager and validating webhook into kustomize config
eecafa1 
Enable the kubebuilder-scaffolded webhook and cert-manager sections in
config/default/kustomization.yaml (ValidatingWebhookConfiguration,
webhook Service, cert-manager Certificate/Issuer, CA injection via
replacements block, and manager_webhook_patch for port 9443 + cert
volume mount). Remove the MutatingWebhookConfiguration from
webhookcainjection_patch.yaml since only a validating webhook exists.
Keep webhook_in_openstackcreds.yaml (conversion webhook) commented in
config/crd/kustomization.yaml as no conversion handler is implemented.
Regenerate deploy/ manifests to include webhook resources.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@sarika-pf9
sarika-pf9 force-pushed the feature/openstackcreds-validating-webhook branch from b35ac87 to eecafa1 Compare September 3, 2026 06:48
@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

✅ Security Vulnerability Summary

No change in security posture

📊 Overall Changes

Metric Count
Total Added 0
Total Fixed 0
Net Change 0

🔍 Detailed Breakdown

📦 Gosec (Static Analysis)

Current Baseline Added Fixed Method
0 0 0 0 artifact

📦 Trivy (Dependency Scan)

Current Baseline Added Fixed Method
103 103 0 0 artifact

📋 Baseline Methods

  • 📦 artifact: Used stored report from main branch
  • 🔄 live_scan: Scanned base branch in real-time
  • ⚠️ no_baseline: No baseline available (all vulnerabilities treated as new)

Only HIGH and CRITICAL severity vulnerabilities are tracked
Baseline: 235dbea5b16b653d062d1cff3f010065d52a4dd1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Add validation logic to OpenstackCreds webhook

1 participant

@OmkarDeshpande7