Gate #57

davidhadas · 2022-09-25T11:01:17Z

This PR finalizes the guard-gate

knative-prow · 2022-09-25T11:01:19Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: davidhadas

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [davidhadas]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

codecov · 2022-09-26T08:31:06Z

Codecov Report

Merging #57 (68080b9) into main (11ee095) will increase coverage by 2.10%.
The diff coverage is 84.46%.

❗ Current head 68080b9 differs from pull request most recent head 098db68. Consider uploading reports for the commit 098db68 to get more accurate results

@@            Coverage Diff             @@
##             main      #57      +/-   ##
==========================================
+ Coverage   79.03%   81.13%   +2.10%     
==========================================
  Files          32       35       +3     
  Lines        2599     2931     +332     
==========================================
+ Hits         2054     2378     +324     
  Misses        433      433              
- Partials      112      120       +8

Impacted Files	Coverage Δ
cmd/guard-service/services.go	`87.50% <0.00%> (+4.16%)`	⬆️
pkg/guard-gate/client.go	`66.97% <33.33%> (-0.31%)`	⬇️
cmd/guard-service/main.go	`72.03% <70.45%> (+72.03%)`	⬆️
pkg/guard-gate/gate.go	`88.54% <88.54%> (ø)`
pkg/guard-gate/session.go	`93.26% <93.26%> (ø)`
pkg/guard-gate/state.go	`94.00% <100.00%> (ø)`
pkg/guard-utils/santize.go	`100.00% <100.00%> (ø)`

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

davidhadas · 2022-09-26T10:43:17Z

/retest all

knative-prow · 2022-09-26T10:43:18Z

@davidhadas: The /retest command does not accept any targets.
The following commands are available to trigger required jobs:

/test build-tests
/test integration-tests
/test unit-tests

Use /test all to run all jobs.

In response to this:

/retest all

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

davidhadas · 2022-09-26T10:43:36Z

/test all

davidhadas · 2022-09-26T12:22:06Z

/hold
update #58 first to make this PR simpler

davidhadas · 2022-09-26T19:21:39Z

/unhold

psschwei · 2022-09-29T19:57:00Z

pkg/guard-gate/gate.go

+	utils "knative.dev/security-guard/pkg/guard-utils"
+)
+
+const plugVersion string = "0.0.1"


ideally we could pick this dynamically rather than having to hardcore (and have to remember to update on each release)... pretty sure we do this elsewhere in knative, let me find an example...

It seems for executables there is a way todo that using ldflags - from outside during the build of a new release
go build -ldflags="-X 'main.Version=v1.0.0'"

I don't know for packages - or if it makes sense.

Think I was thinking of a combination of knative/pkg#2548 and knative-extensions/kn-plugin-quickstart#327

Still wonder if there's a better way to get this info (maybe similar to what we do in serving to add the version as a label), but it isn't blocking

cmd/guard-service/main.go

pkg/guard-gate/client.go

psschwei

Are the various "Log entries created from user input" warnings something we should address?

psschwei · 2022-09-30T14:30:48Z

config/deploy-queue-proxy.yaml

@@ -0,0 +1,27 @@
+# Copyright 2019 The Knative Authors


Need to double-check that this doesn't overwrite the existing config-deployment... might be better to just have the setup-guard-service script patch the existing configmap with the current QP image...

I tested by adding a test: boom parameter to config.deployment - this parameter remains when doing security-guard ko apply -Rf ./config while the image changes - note that the _example is removed after such a change.

after ko apply -Rf config/core at serving

data: _example: |- ################################ # # # EXAMPLE CONFIGURATION # # # ################################ # This block is not actually functional configuration, ... # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE concurrency-state-endpoint: "" queueSidecarImage: us.icr.io/knat/queue-39be6f1d08a095bd076a71d288d295b6@sha256:086b8a7d8bc2104672609a1918274f2e4b075076f52c0fbbc4c3f044b64eb5fe test: boom

after ko apply -Rf ./config at security-guard

data: queue-sidecar-image: us.icr.io/knat/queue-958f2fa0da7e00e1e412a537ecf9d1cc@sha256:021e6438111346ea5d5aff064d6c3ad2cea6c3a92cc7e7708f644f8a1fc34a1e test: boom

hack/update-guard-service.sh

hack/setup-guard-service.sh

hack/update-guard-service.sh

psschwei · 2022-09-30T14:43:53Z

pkg/guard-gate/gate.go

+	utils "knative.dev/security-guard/pkg/guard-utils"
+)
+
+const plugVersion string = "0.0.1"


Think I was thinking of a combination of knative/pkg#2548 and knative-extensions/kn-plugin-quickstart#327

Still wonder if there's a better way to get this info (maybe similar to what we do in serving to add the version as a label), but it isn't blocking

pkg/guard-gate/session.go

davidhadas · 2022-10-01T12:50:45Z

Are the various "Log entries created from user input" warnings something we should address?

This seems like a false positive - the data is sanitized in place, maybe this is why the alert is issued.

psschwei · 2022-10-03T12:28:17Z

Are the various "Log entries created from user input" warnings something we should address?

This seems like a false positive - the data is sanitized in place, maybe this is why the alert is issued.

They aren't being triggered anymore after the most recent commits

config/deploy/guard-service.yaml

Co-authored-by: Paul Schweigert <[email protected]>

psschwei

/lgtm

davidhadas added 2 commits September 25, 2022 13:48

guard-gate

ff2abea

set ns guard-service as default

b0f25d1

knative-prow bot added approved Indicates a PR has been approved by an approver from all required OWNERS files. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Sep 25, 2022

davidhadas added 2 commits September 25, 2022 14:29

test correction

b80c3f1

test correction

ceb4fa1

knative-prow bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Sep 25, 2022

davidhadas added 3 commits September 26, 2022 09:58

fix time based tests

47634cc

fix time based tests

a9e412f

moved to go cancel()

f77de08

davidhadas added 2 commits September 26, 2022 12:34

moved MinimalInterval to const to avoid race during tests

ebe577e

moved MinimalInterval to const to avoid race during tests

909b5d9

knative-prow bot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Sep 26, 2022

avoiding race in ApproveResponse

501ed39

davidhadas added 2 commits September 26, 2022 14:55

fixed fmt.printf use

5034900

alignment

17d57a2

knative-prow bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 26, 2022

davidhadas added 2 commits September 26, 2022 15:27

updates

b815b08

Merge branch 'knative-sandbox:main' into gate

f154ee6

knative-prow bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Sep 26, 2022

davidhadas added 6 commits September 27, 2022 09:18

Merge branch 'knative-sandbox:main' into gate

6aa2d69

bug fix http.client

f13a27a

nits

ad6ed73

nits

bdfbf79

deployment of services

699af57

mv deploy config + add cmd/queue/main.go

74f74ae

knative-prow bot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Sep 29, 2022

davidhadas added 2 commits September 29, 2022 22:39

mv deploy config + add cmd/queue/main.go

5240423

mv deploy config + add cmd/queue/main.go

aa6f2f1

psschwei reviewed Sep 29, 2022

View reviewed changes

davidhadas added 4 commits September 30, 2022 16:36

fix bugs

6abdac6

fix bugs

78e78b7

fix bugs

2f29942

fix bugs

ca2ea32

github-advanced-security bot found potential problems Sep 30, 2022

View reviewed changes

cmd/guard-service/main.go Fixed Show fixed Hide fixed

cmd/guard-service/main.go Fixed Show fixed Hide fixed

pkg/guard-gate/client.go Fixed Show fixed Hide fixed

davidhadas added 3 commits September 30, 2022 17:01

fix bugs

722b424

fix bugs

21a2803

fix bugs

4e7abe9

psschwei reviewed Sep 30, 2022

View reviewed changes

davidhadas added 2 commits October 1, 2022 13:55

review comments

bf92ec5

review comments

68080b9

psschwei reviewed Oct 3, 2022

View reviewed changes

config/deploy/guard-service.yaml Outdated Show resolved Hide resolved

Update config/deploy/guard-service.yaml

098db68

Co-authored-by: Paul Schweigert <[email protected]>

psschwei reviewed Oct 3, 2022

View reviewed changes

knative-prow bot added the lgtm Indicates that a PR is ready to be merged. label Oct 3, 2022

knative-prow bot merged commit 97a0246 into knative-extensions:main Oct 3, 2022

davidhadas deleted the gate branch December 11, 2022 06:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Gate #57

Gate #57

davidhadas commented Sep 25, 2022

knative-prow bot commented Sep 25, 2022

codecov bot commented Sep 26, 2022 •

edited

Loading

davidhadas commented Sep 26, 2022

knative-prow bot commented Sep 26, 2022

davidhadas commented Sep 26, 2022

davidhadas commented Sep 26, 2022

davidhadas commented Sep 26, 2022

psschwei Sep 29, 2022

davidhadas Sep 30, 2022

psschwei Sep 30, 2022

psschwei left a comment

psschwei Sep 30, 2022

davidhadas Oct 1, 2022

psschwei Sep 30, 2022

davidhadas commented Oct 1, 2022

psschwei commented Oct 3, 2022

psschwei left a comment

Gate #57

Gate #57

Conversation

davidhadas commented Sep 25, 2022

knative-prow bot commented Sep 25, 2022

codecov bot commented Sep 26, 2022 • edited Loading

Codecov Report

davidhadas commented Sep 26, 2022

knative-prow bot commented Sep 26, 2022

davidhadas commented Sep 26, 2022

davidhadas commented Sep 26, 2022

davidhadas commented Sep 26, 2022

psschwei Sep 29, 2022

Choose a reason for hiding this comment

davidhadas Sep 30, 2022

Choose a reason for hiding this comment

psschwei Sep 30, 2022

Choose a reason for hiding this comment

psschwei left a comment

Choose a reason for hiding this comment

psschwei Sep 30, 2022

Choose a reason for hiding this comment

davidhadas Oct 1, 2022

Choose a reason for hiding this comment

psschwei Sep 30, 2022

Choose a reason for hiding this comment

davidhadas commented Oct 1, 2022

psschwei commented Oct 3, 2022

psschwei left a comment

Choose a reason for hiding this comment

codecov bot commented Sep 26, 2022 •

edited

Loading