policy/api: add more CRD validations #32814
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
/test |
learnitall
reviewed
May 31, 2024
pkg/k8s/apis/cilium.io/client/crds/v2/ciliumclusterwidenetworkpolicies.yaml
Show resolved
Hide resolved
learnitall
approved these changes
May 31, 2024
There was a problem hiding this comment.
LGTM. Do you think it would make sense to add something to the upgrade notes? I'm assuming this wouldn't impact existing policies after an upgrade, but if folks are using a GitOps setup and reapplying resources related to these CRDs, they may run into new validation errors that weren't caught before, right?
@learnitall not a bad idea, I'll update the release notes. Any policies caught by this would have been silently rejected before, which is arguably worse :-). |
gandro
approved these changes
Jun 10, 2024
|
Holding until I add the release notes. |
Copying some logic from `Sanitize()` in to CRD validations: - use the OpenAPI `cidr` format directly, remove baroque regex - add OneOf for FQDN selector pattern vs. name - add pre-existing MaxItems for port & ICMP rules - add OneOf for L7 filter types None of these add any new restrictions; they were always in the policy engine. Now these validation errors will be caught by the apiserver. Signed-off-by: Casey Callendrello <cdc@isovalent.com>
7a350f3 to
d543969
Compare
qmonnet
approved these changes
Jun 10, 2024
|
/test |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Copying some logic from
Sanitize()in to CRD validations:cidrformat directly, remove baroque regexNone of these add any new restrictions; they were always in the policy engine. Now these validation errors will be caught by the apiserver.