OCPBUGS-60670: Add ValidatingAdmissionPolicy for EgressIP #2837
Conversation
WalkthroughAdds a single YAML containing four Kubernetes ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding resources that enforce creation and update constraints for the k8s.ovn.org/egressip-mark annotation on EgressIP objects, with explicit service-account exceptions and Deny failure actions. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro Cache: Disabled due to data retention organization setting Knowledge base: Disabled due to 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Tip 📝 Customizable high-level summaries are now available in beta!You can now customize how CodeRabbit generates the high-level summary in your pull requests — including its content, structure, tone, and formatting.
Example instruction:
Note: This feature is currently in beta for Pro-tier users, and pricing will be announced later. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: arghosh93 The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
arghosh93
changed the title
openshift-ci-robot
added
jira/severity-important
|
@arghosh93: This pull request references Jira Issue OCPBUGS-60670, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@arghosh93: This pull request references Jira Issue OCPBUGS-60670, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
Requesting review from QA contact: In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
📒 Files selected for processing (1)
bindata/network/ovn-kubernetes/common/egressip-admission-policy.yaml(1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
bindata/network/ovn-kubernetes/common/egressip-admission-policy.yaml
🔇 Additional comments (2)
bindata/network/ovn-kubernetes/common/egressip-admission-policy.yaml (2)
23-39: CREATE policy validation logic is correct.The expression
!has(object.metadata.annotations) || !("k8s.ovn.org/egressip-mark" in object.metadata.annotations)correctly denies creation only when the egressip-mark annotation is explicitly set in the request, while allowing all other CREATE operations. This aligns with the objective to prevent unauthorized creation with the managed annotation.
41-56: Bindings are correctly structured.Both ValidatingAdmissionPolicyBinding resources properly reference their policies and apply cluster-wide Deny enforcement without exceptions. This is appropriate for governing a system-managed annotation.
| - expression: '!(request.userInfo.username == "system:serviceaccount:ovn-kubernetes:ovnkube-cluster-manager")' | ||
| message: 'A regular user must not add "k8s.ovn.org/egressip-mark" annotation to an EgressIP custom resource.' | ||
| reason: Invalid |
There was a problem hiding this comment.
Critical: Inverted validation logic denies the intended system account.
The validation expression uses negation which produces opposite behavior: it denies the system service account from adding the annotation and allows regular users—the inverse of the design intent.
In ValidatingAdmissionPolicy, when an expression evaluates to FALSE, the validation fails and the request is denied. The current expression:
- System account (
request.userInfo.username == "system:serviceaccount:ovn-kubernetes:ovnkube-cluster-manager"):!(true)→FALSE→ DENIED ❌ - Regular user:
!(false)→TRUE→ ALLOWED ❌
Remove the negation operator to allow only the system service account.
- - expression: '!(request.userInfo.username == "system:serviceaccount:ovn-kubernetes:ovnkube-cluster-manager")'
+ - expression: 'request.userInfo.username == "system:serviceaccount:ovn-kubernetes:ovnkube-cluster-manager"'
message: 'A regular user must not add "k8s.ovn.org/egressip-mark" annotation to an EgressIP custom resource.'
reason: Invalid📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - expression: '!(request.userInfo.username == "system:serviceaccount:ovn-kubernetes:ovnkube-cluster-manager")' | |
| message: 'A regular user must not add "k8s.ovn.org/egressip-mark" annotation to an EgressIP custom resource.' | |
| reason: Invalid | |
| - expression: 'request.userInfo.username == "system:serviceaccount:ovn-kubernetes:ovnkube-cluster-manager"' | |
| message: 'A regular user must not add "k8s.ovn.org/egressip-mark" annotation to an EgressIP custom resource.' | |
| reason: Invalid |
🤖 Prompt for AI Agents
In bindata/network/ovn-kubernetes/common/egressip-admission-policy.yaml around
lines 18 to 20, the validation expression is negated, which incorrectly denies
the system service account and allows regular users; remove the negation so the
expression simply checks request.userInfo.username ==
"system:serviceaccount:ovn-kubernetes:ovnkube-cluster-manager" to ensure only
that service account is allowed to add the k8s.ovn.org/egressip-mark annotation
and update the message/reason if necessary to reflect the corrected logic.
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting
📒 Files selected for processing (1)
bindata/network/ovn-kubernetes/common/egressip-admission-policy.yaml(1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
**
⚙️ CodeRabbit configuration file
-Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity.
Files:
bindata/network/ovn-kubernetes/common/egressip-admission-policy.yaml
🔇 Additional comments (1)
bindata/network/ovn-kubernetes/common/egressip-admission-policy.yaml (1)
8-10: Verify UPDATE policy doesn't allow modification of existing annotations.The
matchConditiononly triggers when the annotation is being added to an EgressIP (present in new object, absent in old). If a regular user attempts to modify an existing annotation value, the condition won't match, and the policy won't apply. Confirm whether this is intentional or if the policy should also prevent modification of pre-existing annotations by non-system users.
| - expression: '!has(object.metadata.annotations) || !("k8s.ovn.org/egressip-mark" in object.metadata.annotations)' | ||
| message: 'EgressIP resources cannot be created with the "k8s.ovn.org/egressip-mark" annotation. This annotation is managed by the system.' | ||
| reason: Invalid |
There was a problem hiding this comment.
Critical: CREATE validation logic appears inverted.
The validation expression !has(object.metadata.annotations) || !("k8s.ovn.org/egressip-mark" in object.metadata.annotations) evaluates to true when the annotation is absent, but with validationActions: [Deny], this causes denial when no annotation is present—the opposite of the intended behavior.
According to the message and PR objectives, creation should be denied when the annotation is present. The expression should be:
has(object.metadata.annotations) && ("k8s.ovn.org/egressip-mark" in object.metadata.annotations)
This ensures requests are rejected only when the annotation exists on the new object.
Apply this diff to fix the logic:
validations:
- - expression: '!has(object.metadata.annotations) || !("k8s.ovn.org/egressip-mark" in object.metadata.annotations)'
+ - expression: 'has(object.metadata.annotations) && ("k8s.ovn.org/egressip-mark" in object.metadata.annotations)'
message: 'EgressIP resources cannot be created with the "k8s.ovn.org/egressip-mark" annotation. This annotation is managed by the system.'
reason: Invalid📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - expression: '!has(object.metadata.annotations) || !("k8s.ovn.org/egressip-mark" in object.metadata.annotations)' | |
| message: 'EgressIP resources cannot be created with the "k8s.ovn.org/egressip-mark" annotation. This annotation is managed by the system.' | |
| reason: Invalid | |
| - expression: 'has(object.metadata.annotations) && ("k8s.ovn.org/egressip-mark" in object.metadata.annotations)' | |
| message: 'EgressIP resources cannot be created with the "k8s.ovn.org/egressip-mark" annotation. This annotation is managed by the system.' | |
| reason: Invalid |
🤖 Prompt for AI Agents
In bindata/network/ovn-kubernetes/common/egressip-admission-policy.yaml around
lines 36 to 38, the CREATE validation expression is inverted and currently
denies requests when the annotation is absent; change the expression so it only
denies creation when the annotation exists by replacing the current expression
with one that checks for the presence of annotations and the specific key (i.e.,
use a logical AND: has(object.metadata.annotations) &&
("k8s.ovn.org/egressip-mark" in object.metadata.annotations)), leaving the
message and reason intact.
This commit is to add couple of ValidatingAdmissionPolicy to take care of following conditions: - k8s.ovn.org/egressip-mark annotation should not be added while creating an EgressIP. - A regular user should not be able to add k8s.ovn.org/egressip-mark annotation. Only a system user is allowed to do so. Signed-off-by: Arnab Ghosh <arnabghosh89@gmail.com>
arghosh93
force-pushed
the
OCPBUGS-60670
branch
from
8c93e4e to
8808de0
Compare
|
@arghosh93: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
This commit is to add couple of ValidatingAdmissionPolicy to take care of following conditions: