Print warning only instead of error if no permission on ingressclass #7578

yong-jie-gong · 2021-09-02T09:05:23Z

…ter level resource IngressClass

What this PR does / why we need it:

for backaward compatibility, if serviceaccount who run the ingress-controller don't have permission on cluster level resource IngressClass, ingress-controller will fail directly. Add this PR to provide backaward compabitiltiy

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)

Which issue/s this PR fixes

fixes #7510
#7510

How Has This Been Tested?

Compile new ingress-controller and start with serviceaccount who don't have Permission on IngressClass

Checklist:

My change requires a change to the documentation.
I have updated the documentation accordingly.
I've read the CONTRIBUTION guide
I have added tests to cover my changes.
All new and existing tests passed.

k8s-ci-robot · 2021-09-02T09:05:31Z

Hi @yongjie-gong. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tao12345666333

/ok-to-test

yong-jie-gong · 2021-09-02T09:45:26Z

/test pull-ingress-nginx-gofmt

yong-jie-gong · 2021-09-02T09:49:14Z

/test pull-ingress-nginx-gofmt

rikatz · 2021-09-07T18:13:44Z

/assign

Maybe canary error is valid, will look again

rikatz · 2021-09-16T21:34:19Z

cmd/nginx/main.go

+			if errors.IsUnauthorized(err) {
 				klog.Fatalf("Error searching IngressClass: Please verify your RBAC and allow Ingress Controller to list and get Ingress Classes: %v", err)
+			} else if errors.IsForbidden(err) {


What is the difference between unauthorized an forbidden?

When one can happen and other not?

After that clarification, lgtm

@yongjie-gong friendly reminder

So the difference here is code 401 (user not authenticated) vs 403 (user without permission to do that action).

We should rely on 403 always, but anyway seems like a good safeguard also to look into 401.

I'm going to merge this, but improve the logics on a follow up PR, leaving both 401 and 403 as situations to ignore IngressClass and adding some e2e tests for this.

rikatz · 2021-09-21T00:02:35Z

@yongjie-gong I'm leaving this to v1.0.2 but we need to fix it ASAP :)

Thanks!

iamNoah1 · 2021-09-22T07:57:21Z

/priority important-soon
/triage-accepted
/kind bug

iamNoah1 · 2021-09-22T07:57:46Z

/triage accepted

rikatz · 2021-10-10T19:43:25Z

/lgtm
/approve
Will open a follow up on this.

Thanks!

k8s-ci-robot · 2021-10-10T19:43:41Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rikatz, yongjie-gong

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [rikatz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

…ubernetes#7578) * skip ingressclass check if ingressclass is not enabled * reformat with gofmt

skip ingressclass check if ingressclass is not enabled

b26dc7e

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-kind Indicates a PR lacks a `kind/foo` label and requires one. labels Sep 2, 2021

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. needs-priority size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Sep 2, 2021

k8s-ci-robot requested review from ElvinEfendi and rikatz September 2, 2021 09:05

yong-jie-gong mentioned this pull request Sep 2, 2021

Print warning only instead of error if there is no permission on clus… #7532

Closed

8 tasks

tao12345666333 reviewed Sep 2, 2021

View reviewed changes

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 2, 2021

reformat with gofmt

6b0501d

rikatz added this to the v1.0.1 milestone Sep 7, 2021

k8s-ci-robot assigned rikatz Sep 7, 2021

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 11, 2021

Merge branch 'main' into main

f799f16

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 16, 2021

rikatz reviewed Sep 16, 2021

View reviewed changes

rikatz modified the milestones: v1.0.1, v1.0.2 Sep 20, 2021

rikatz mentioned this pull request Sep 21, 2021

preparing release v1.0.1 #7681

Merged

10 tasks

k8s-ci-robot added the priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. label Sep 22, 2021

k8s-ci-robot added kind/bug Categorizes issue or PR as related to a bug. and removed needs-priority needs-kind Indicates a PR lacks a `kind/foo` label and requires one. labels Sep 22, 2021

k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Sep 22, 2021

rikatz modified the milestones: v1.0.2, v1.1.0, v1.0.3 Sep 26, 2021

rikatz modified the milestones: v1.0.3, v1.0.4 Oct 10, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 10, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 10, 2021

k8s-ci-robot merged commit 6499393 into kubernetes:main Oct 10, 2021

rikatz mentioned this pull request Oct 10, 2021

Add e2e test for non ingressclass enabled ingress #7785

Merged

phillebaba mentioned this pull request Feb 22, 2022

Update Ingress Nginx version XenitAB/terraform-modules#565

Merged

yong-jie-gong deleted the main branch February 27, 2023 05:46

rchshld pushed a commit to joomcode/ingress-nginx that referenced this pull request May 19, 2023

Print warning only instead of error if no permission on ingressclass (k…

f07b6c2

…ubernetes#7578) * skip ingressclass check if ingressclass is not enabled * reformat with gofmt

yong-jie-gong restored the main branch November 14, 2023 09:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Print warning only instead of error if no permission on ingressclass #7578

Print warning only instead of error if no permission on ingressclass #7578

yong-jie-gong commented Sep 2, 2021

k8s-ci-robot commented Sep 2, 2021

tao12345666333 left a comment

yong-jie-gong commented Sep 2, 2021

yong-jie-gong commented Sep 2, 2021

rikatz commented Sep 7, 2021

rikatz Sep 16, 2021

iamNoah1 Sep 22, 2021

rikatz Oct 10, 2021

rikatz commented Sep 21, 2021

iamNoah1 commented Sep 22, 2021

iamNoah1 commented Sep 22, 2021

rikatz commented Oct 10, 2021

k8s-ci-robot commented Oct 10, 2021

Print warning only instead of error if no permission on ingressclass #7578

Print warning only instead of error if no permission on ingressclass #7578

Conversation

yong-jie-gong commented Sep 2, 2021

What this PR does / why we need it:

Types of changes

Which issue/s this PR fixes

How Has This Been Tested?

Checklist:

k8s-ci-robot commented Sep 2, 2021

tao12345666333 left a comment

Choose a reason for hiding this comment

yong-jie-gong commented Sep 2, 2021

yong-jie-gong commented Sep 2, 2021

rikatz commented Sep 7, 2021

rikatz Sep 16, 2021

Choose a reason for hiding this comment

iamNoah1 Sep 22, 2021

Choose a reason for hiding this comment

rikatz Oct 10, 2021

Choose a reason for hiding this comment

rikatz commented Sep 21, 2021

iamNoah1 commented Sep 22, 2021

iamNoah1 commented Sep 22, 2021

rikatz commented Oct 10, 2021

k8s-ci-robot commented Oct 10, 2021