Skip to content

feat: Validate DataStores with CEL using the following rules #762

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 7 commits into from
Mar 31, 2025
Merged

feat: Validate DataStores with CEL using the following rules #762

merged 7 commits into from
Mar 31, 2025

Conversation

aerosouund
Copy link
Contributor

  • certificateAuthority privateKey must have secretReference or content when driver is etcd
  • clientCertificate must have secretReference or content when driver is etcd
  • clientCertificate privateKey must have secretReference or content when driver is etcd
  • When driver is not etcd and tlsConfig exists, certificateAuthority must be null or contain valid content
  • When driver is not etcd and tlsConfig exists, clientCertificate must be null or contain valid content
  • When driver is not etcd and basicAuth exists, username must have secretReference or content
  • When driver is not etcd and basicAuth exists, password must have secretReference or content
  • When driver is not etcd, either tlsConfig or basicAuth must be provided

@aerosouund
feat: Validate DataStores with CEL using the following rules
f5db473 
- certificateAuthority privateKey must have secretReference or content when driver is etcd
- clientCertificate must have secretReference or content when driver is etcd
- clientCertificate privateKey must have secretReference or content when driver is etcd
- When driver is not etcd and tlsConfig exists, certificateAuthority must be null or contain valid content
- When driver is not etcd and tlsConfig exists, clientCertificate must be null or contain valid content
- When driver is not etcd and basicAuth exists, username must have secretReference or content
- When driver is not etcd and basicAuth exists, password must have secretReference or content
- When driver is not etcd, either tlsConfig or basicAuth must be provided

Signed-off-by: aerosouund <aerosound161@gmail.com>
@netlify Netlify
Copy link

netlify bot commented Mar 28, 2025 •
edited
Loading

✅ Deploy Preview for kamaji-documentation canceled.

Name Link
🔨 Latest commit 2cd4e21
🔍 Latest deploy log https://app.netlify.com/sites/kamaji-documentation/deploys/67eaa4be544d940008add144

@prometherion prometherion linked an issue Mar 28, 2025 that may be closed by this pull request
CEL validation for Datastore credentials and TLS configuration #746
Closed
@prometherion
Copy link
Member

Crediting @tobiasgiese's suggestion:

You can use envtest, deploy the datastore CRD and unit-test the API validation
No bash script needed, just common test tables with gomega

@aerosouund
fix: Add extra rule
901126b 
Signed-off-by: aerosouund <aerosound161@gmail.com>
@aerosouund
fix: ginkgo flag ordering
e1d10e5 
Signed-off-by: aerosouund <aerosound161@gmail.com>
@aerosouund
fix: Fix syntax of tls or basic auth rule and remove the certificate …
726fed6 
…authority rule

Signed-off-by: aerosouund <aerosound161@gmail.com>
@aerosouund
test: Add ginkgo tests for validations
9ca4172 
Signed-off-by: aerosouund <aerosound161@gmail.com>
@aerosouund aerosouund marked this pull request as ready for review March 29, 2025 00:29
@aerosouund
Copy link
Contributor Author

@prometherion
PR is ready! please take a look at it whenever you can

@prometherion
Copy link
Member

You did a terrific job, @aerosouund: I'll do my best to review this! 🚀

@prometherion
fix(test): missing default values
9970fd2 
Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
@prometherion
chore(ci): running integration tests as gh job
2cd4e21 
Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>
@prometherion
Copy link
Member

@aerosouund I just added small changes to your PR, mostly because we weren't running the integration tests upon push events, and also spotted a missed validation to avoid having tests failing on CI.

If everything's LGTM and we can merge it.

@prometherion prometherion merged commit 0f3de13 into clastix:master Mar 31, 2025
11 checks passed
@aerosouund
Copy link
Contributor Author

@prometherion
I would be delighted to take on more projects in kamaji when the opportunity arises. Thanks for creating such an awesome technology

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@prometherion prometherion prometherion approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

CEL validation for Datastore credentials and TLS configuration
2 participants
@aerosouund @prometherion