Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ValidatingAdmissionPolicy: expended type checking to messageExpression #119209

Merged
merged 1 commit into from
Jul 11, 2023
Merged

ValidatingAdmissionPolicy: expended type checking to messageExpression #119209

merged 1 commit into from
Jul 11, 2023

Conversation

jiahuif
Copy link
Member

@jiahuif jiahuif commented Jul 10, 2023 •
edited

What type of PR is this?

/kind feature

What this PR does / why we need it:

This PR:

  • refactor the type checker to be reuseable across fields of a policy definition
  • refactor type checker API to be more easily reused client-side.
  • type checking for validations[].messageExpression
  • (follow-up) type checking for variables[].expression once it's merged.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?

A ValidatingAdmissionPolicy now has its `messageExpression` field checked against resolved types.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/feature Categorizes issue or PR as related to a new feature. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Jul 10, 2023
@k8s-ci-robot k8s-ci-robot added area/apiserver sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. and removed do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Jul 10, 2023
@jiahuif
Copy link
Member Author

jiahuif commented Jul 10, 2023

/assign @cici37 @alexzielenski

@jiahuif jiahuif changed the title expended type checking. ValidatingAdmissionPolicy: expended type checking Jul 10, 2023
alexzielenski
alexzielenski reviewed Jul 11, 2023
View reviewed changes
Copy link
Contributor

@alexzielenski alexzielenski left a comment •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like a clean refactoring and adds support for messageExpression errors as advertised. No critiques that I could find

lgtm

@cici37 cici37 mentioned this pull request Jul 11, 2023
Merged
@cici37
Copy link
Contributor

cici37 commented Jul 11, 2023

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 11, 2023
@k8s-ci-robot
Copy link
Contributor

LGTM label has been added.

Git tree hash: ee270a26d5206d35e74af73c12a38611b707b7e6

@jiahuif
Copy link
Member Author

jiahuif commented Jul 11, 2023 •
edited

Let's limit the size of PRs and speed up reviews. This PR will be limited to messageExpression and I will send follow-ups right after this one merges.

@jiahuif jiahuif changed the title ValidatingAdmissionPolicy: expended type checking ValidatingAdmissionPolicy: expended type checking to messageExpression Jul 11, 2023
@alexzielenski
Copy link
Contributor

/approve

@alexzielenski
Copy link
Contributor

/hold

in case you wanted to control merge order

@k8s-ci-robot k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 11, 2023
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alexzielenski, jiahuif

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 11, 2023
@jiahuif
Copy link
Member Author

jiahuif commented Jul 11, 2023

/hold cancel
The PR is designed not to conflict with the controller refactor PR. Should be green to merge.

@k8s-ci-robot k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 11, 2023
jpbetz
jpbetz suggested changes Jul 11, 2023
View reviewed changes
Copy link
Contributor

@jpbetz jpbetz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few nits then LGTM

staging/src/k8s.io/apiserver/pkg/admission/plugin/validatingadmissionpolicy/typechecking.go Outdated
Comment on lines 74 to 76
func (r *TypeCheckingResult) GVK() schema.GroupVersionKind {
return r.gvk
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider either exporting gvks field (if callers can be trusted to not modify the slice), or copying the slice here (if callers cannot be trusted)?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's export these. The struct is a result type. The caller has the ownership of it.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done. PTAL. Thank you.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Diff: https://github.com/kubernetes/kubernetes/compare/26c25744dfbbc52f8746db01b41b608a8d7fadd5..ee2bb1b1b27cb2232c8355ff172b6966b25c4c75

staging/src/k8s.io/apiserver/pkg/admission/plugin/validatingadmissionpolicy/typechecking.go Outdated
Comment on lines 79 to 81
func (r *TypeCheckingResult) Issues() *cel.Issues {
return r.issues
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here, either export field or make a safe copy?

staging/src/k8s.io/apiserver/pkg/admission/plugin/validatingadmissionpolicy/typechecking.go Outdated
Comment on lines 83 to 74
// Err returns possible error that was encounter during type checking.
func (r *TypeCheckingResult) Err() error {
return r.err
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If other fields are exposed, expose this one too?

@jiahuif jiahuif force-pushed the feature/validating-admission-policy/typechecking-expension branch from 26c2574 to ee2bb1b Compare July 11, 2023 18:29
@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 11, 2023
@jiahuif jiahuif force-pushed the feature/validating-admission-policy/typechecking-expension branch 3 times, most recently from d647122 to e655931 Compare July 11, 2023 19:58
@alexzielenski
Copy link
Contributor

/triage accepted

@k8s-ci-robot k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Jul 11, 2023
@jiahuif
Copy link
Member Author

jiahuif commented Jul 11, 2023

/retest

sig storage test flak

@jpbetz
Copy link
Contributor

jpbetz commented Jul 11, 2023

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 11, 2023
@k8s-ci-robot
Copy link
Contributor

LGTM label has been added.

Git tree hash: 3e35e18e7312a548a5227ba5b5ff33a8dd31dc17

@k8s-ci-robot k8s-ci-robot merged commit da89741 into kubernetes:master Jul 11, 2023
12 checks passed
@k8s-ci-robot k8s-ci-robot added this to the v1.28 milestone Jul 11, 2023
@jiahuif jiahuif deleted the feature/validating-admission-policy/typechecking-expension branch July 11, 2023 21:23
@jiahuif
Copy link
Member Author

jiahuif commented Jul 13, 2023

Thank you all for reviewing!

@cici37 cici37 mentioned this pull request Jul 17, 2023
Open
16 tasks
@jaskaransarkaria jaskaransarkaria mentioned this pull request Jun 5, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jpbetz jpbetz jpbetz requested changes

@alexzielenski alexzielenski Awaiting requested review from alexzielenski

@cici37 cici37 Awaiting requested review from cici37

Assignees

@alexzielenski alexzielenski

@jpbetz jpbetz

@cici37 cici37

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/apiserver cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
None yet
Milestone
v1.28
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@jiahuif @cici37 @k8s-ci-robot @alexzielenski @jpbetz