Add scope configuration check. #6864

maikelvl · 2021-02-10T18:56:48Z

What this PR does / why we need it:

A specific configuration of scope variables result in errors in runtime.

config	Helm render	Kubernetes runtime
`helm template charts/ingress-nginx \` `--output-dir=_manifests \` `--set=controller.scope.enabled=true \` `--set=rbac.scope=true`	✅	✅
`helm template charts/ingress-nginx \` `--output-dir=_manifests \` `--set=controller.scope.enabled=false \` `--set=rbac.scope=false`	✅	✅
`helm template charts/ingress-nginx \` `--output-dir=_manifests \` `--set=controller.scope.enabled=true \` `--set=rbac.scope=false`	✅	✅
`helm template charts/ingress-nginx \` `--output-dir=_manifests \` `--set=controller.scope.enabled=false \` `--set=rbac.scope=true`	✔️	❌

Reproduction

$ helm install nginx-ingress charts/ingress-nginx \
    --set=controller.scope.enabled=false \
    --set=rbac.scope=true

results in runtime in

$ kubectl logs -f nginx-ingress-controller-5566dbf6f-cr4ms

 ❌ Failed to watch *v1beta1.Ingress: failed to list *v1beta1.Ingress: ingresses.networking.k8s.io is forbidden: User "system:serviceaccount:default:nginx-ingress" cannot list resource "ingresses" in API group "networking.k8s.io" at the cluster scope

By checking these config incompatibility during rendering the chart we can catch this early on.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)

How Has This Been Tested?

$ helm template charts/ingress-nginx \
    --output-dir=_manifests \
    --set=controller.scope.enabled=false \
    --set=rbac.scope=true

  Invalid configuration: 'rbac.scope' should be equal to 'controller.scope.enabled' (true/false).

config	Helm render	Kubernetes runtime
`helm template charts/ingress-nginx \` `--output-dir=_manifests \` `--set=controller.scope.enabled=true \` `--set=rbac.scope=true`	✅	✅
`helm template charts/ingress-nginx \` `--output-dir=_manifests \` `--set=controller.scope.enabled=false \` `--set=rbac.scope=false`	✅	✅
`helm template charts/ingress-nginx \` `--output-dir=_manifests \` `--set=controller.scope.enabled=true \` `--set=rbac.scope=false`	✅	✅
`helm template charts/ingress-nginx \` `--output-dir=_manifests \` `--set=controller.scope.enabled=false \` `--set=rbac.scope=true`	✖️

Checklist:

~~My change requires a change to the documentation.~~
~~I have updated the documentation accordingly.~~
I've read the CONTRIBUTION guide
~~I have added tests to cover my changes.~~
All ~~new and~~ existing tests passed.

k8s-ci-robot · 2021-02-10T18:56:51Z

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://git.k8s.io/community/CLA.md#the-contributor-license-agreement to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized.
If you have done the above and are still having issues with the CLA being reported as unsigned, please log a ticket with the Linux Foundation Helpdesk: https://support.linuxfoundation.org/
Should you encounter any issues with the Linux Foundation Helpdesk, send a message to the backup e-mail support address at: [email protected]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

k8s-ci-robot · 2021-02-10T18:56:55Z

Welcome @maikelvl!

It looks like this is your first PR to kubernetes/ingress-nginx 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/ingress-nginx has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2021-02-10T18:56:56Z

Hi @maikelvl. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

maikelvl · 2021-02-10T19:16:15Z

I've signed the CLA

fejta-bot · 2021-05-15T21:49:15Z

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

tao12345666333

/remove-lifecycle stale

tao12345666333 · 2021-05-16T11:26:45Z

charts/ingress-nginx/templates/clusterrole.yaml

-{{- if and .Values.rbac.create (not .Values.rbac.scope) -}}
+{{- if .Values.rbac.create }}
+
+{{- if and .Values.rbac.scope (not .Values.controller.scope.enabled) -}}


Why not use the0 eq function directly?

@tao12345666333 Because this validation error should only trigger when rbac.scope=true and controller.scope.enabled=false.

Using eq would also trigger the validation error if rbac.scope=false and controller.scope.enabled=true.

Is it necessary for us to keep them unequal?

Sorry, I don't quite understand your question. 🤔 The valid values of these variables could be found in the description above.

The controller.scope.enabled value is also used in the controller pod where --watch-namespace is added. If controller.scope.enabled=false and rbac.scope=true this causes issues in Kubernetes runtime and this check prevents this misconfiguration.

I mean, if we use the same configuration item to control them, is it more direct?

In other words, no longer distinguish between controller.scope.enabled and rbac.scope, but use the configuration of global.scope for control. WDYH?

let's put it forward.

rikatz · 2021-06-06T15:02:28Z

/area helm

tao12345666333

/ok-to-test

tao12345666333

/lgtm

tao12345666333

/lgtm

rikatz · 2021-08-05T13:06:39Z

/approve
Thanks

k8s-ci-robot · 2021-08-05T13:06:48Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: maikelvl, rikatz, tao12345666333

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~charts/ingress-nginx/OWNERS~~ [rikatz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Add scope configuration check.

1e11136

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Feb 10, 2021

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Feb 10, 2021

k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Feb 10, 2021

k8s-ci-robot requested review from ChiefAlexander and ElvinEfendi February 10, 2021 18:57

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Feb 10, 2021

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 15, 2021

tao12345666333 reviewed May 16, 2021

View reviewed changes

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 16, 2021

tao12345666333 reviewed May 16, 2021

View reviewed changes

k8s-ci-robot added the area/helm Issues or PRs related to helm charts label Jun 6, 2021

tao12345666333 reviewed Jun 10, 2021

View reviewed changes

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 10, 2021

tao12345666333 reviewed Jul 1, 2021

View reviewed changes

tao12345666333 approved these changes Jul 1, 2021

View reviewed changes

k8s-ci-robot assigned tao12345666333 Jul 1, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 1, 2021

rikatz changed the base branch from master to main July 16, 2021 12:49

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 5, 2021

k8s-ci-robot merged commit 46be938 into kubernetes:main Aug 5, 2021

rchshld pushed a commit to joomcode/ingress-nginx that referenced this pull request May 19, 2023

Add scope configuration check. (kubernetes#6864)

4cc87a2

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add scope configuration check. #6864

Add scope configuration check. #6864

maikelvl commented Feb 10, 2021 •

edited

Loading

k8s-ci-robot commented Feb 10, 2021

k8s-ci-robot commented Feb 10, 2021

k8s-ci-robot commented Feb 10, 2021

maikelvl commented Feb 10, 2021

fejta-bot commented May 15, 2021

tao12345666333 left a comment

tao12345666333 May 16, 2021

maikelvl May 16, 2021

tao12345666333 May 16, 2021

maikelvl May 16, 2021

tao12345666333 May 17, 2021

tao12345666333 Jul 1, 2021

rikatz commented Jun 6, 2021

tao12345666333 left a comment

tao12345666333 left a comment

tao12345666333 left a comment

rikatz commented Aug 5, 2021

k8s-ci-robot commented Aug 5, 2021

Add scope configuration check. #6864

Add scope configuration check. #6864

Conversation

maikelvl commented Feb 10, 2021 • edited Loading

What this PR does / why we need it:

Reproduction

Types of changes

How Has This Been Tested?

Checklist:

k8s-ci-robot commented Feb 10, 2021

k8s-ci-robot commented Feb 10, 2021

k8s-ci-robot commented Feb 10, 2021

maikelvl commented Feb 10, 2021

fejta-bot commented May 15, 2021

tao12345666333 left a comment

Choose a reason for hiding this comment

tao12345666333 May 16, 2021

Choose a reason for hiding this comment

maikelvl May 16, 2021

Choose a reason for hiding this comment

tao12345666333 May 16, 2021

Choose a reason for hiding this comment

maikelvl May 16, 2021

Choose a reason for hiding this comment

tao12345666333 May 17, 2021

Choose a reason for hiding this comment

tao12345666333 Jul 1, 2021

Choose a reason for hiding this comment

rikatz commented Jun 6, 2021

tao12345666333 left a comment

Choose a reason for hiding this comment

tao12345666333 left a comment

Choose a reason for hiding this comment

tao12345666333 left a comment

Choose a reason for hiding this comment

rikatz commented Aug 5, 2021

k8s-ci-robot commented Aug 5, 2021

maikelvl commented Feb 10, 2021 •

edited

Loading