github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Move conditional validation for SCTPSupport to validation functions with knowledge of old objects

Browse Source
This commit is contained in:
Jordan Liggitt
2019-02-05 18:07:06 -05:00
parent 9384e93dc1
commit 34ac165a44
8 changed files with 583 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
pkg/apis/networking/validation/BUILD
View File

@@ -8,13 +8,17 @@ load(
go_test(
name = "go_default_test",
srcs = ["validation_test.go"],
srcs = [
"conditional_validation_test.go",
"validation_test.go",
],
embed = [":go_default_library"],
deps = [
"//pkg/apis/core:go_default_library",
"//pkg/apis/networking:go_default_library",
"//pkg/features:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/util/diff:go_default_library",
"//staging/src/k8s.io/apimachinery/pkg/util/intstr:go_default_library",
"//staging/src/k8s.io/apiserver/pkg/util/feature:go_default_library",
"//staging/src/k8s.io/apiserver/pkg/util/feature/testing:go_default_library",
@@ -23,7 +27,10 @@ go_test(
go_library(
name = "go_default_library",
srcs = ["validation.go"],
srcs = [
"conditional_validation.go",
"validation.go",
],
importpath = "k8s.io/kubernetes/pkg/apis/networking/validation",
deps = [
"//pkg/apis/core:go_default_library",

59
pkg/apis/networking/validation/conditional_validation.go Normal file
View File

@@ -0,0 +1,59 @@
/*
Copyright 2019 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package validation
import (
"k8s.io/apimachinery/pkg/util/validation/field"
utilfeature "k8s.io/apiserver/pkg/util/feature"
api "k8s.io/kubernetes/pkg/apis/core"
"k8s.io/kubernetes/pkg/apis/networking"
"k8s.io/kubernetes/pkg/features"
)
// ValidateConditionalNetworkPolicy validates conditionally valid fields.
func ValidateConditionalNetworkPolicy(np, oldNP *networking.NetworkPolicy) field.ErrorList {
var errs field.ErrorList
// If the SCTPSupport feature is disabled, and the old object isn't using the SCTP feature, prevent the new object from using it
if !utilfeature.DefaultFeatureGate.Enabled(features.SCTPSupport) && len(sctpFields(oldNP)) == 0 {
for _, f := range sctpFields(np) {
errs = append(errs, field.NotSupported(f, api.ProtocolSCTP, []string{string(api.ProtocolTCP), string(api.ProtocolUDP)}))
}
}
return errs
}
func sctpFields(np *networking.NetworkPolicy) []*field.Path {
if np == nil {
return nil
}
fields := []*field.Path{}
for iIndex, e := range np.Spec.Ingress {
for pIndex, p := range e.Ports {
if p.Protocol != nil && *p.Protocol == api.ProtocolSCTP {
fields = append(fields, field.NewPath("spec.ingress").Index(iIndex).Child("ports").Index(pIndex).Child("protocol"))
}
}
}
for eIndex, e := range np.Spec.Egress {
for pIndex, p := range e.Ports {
if p.Protocol != nil && *p.Protocol == api.ProtocolSCTP {
fields = append(fields, field.NewPath("spec.egress").Index(eIndex).Child("ports").Index(pIndex).Child("protocol"))
}
}
}
return fields
}

108
pkg/apis/networking/validation/conditional_validation_test.go Normal file
View File

@@ -0,0 +1,108 @@
/*
Copyright 2019 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package validation
import (
"fmt"
"reflect"
"testing"
"k8s.io/apimachinery/pkg/util/diff"
utilfeature "k8s.io/apiserver/pkg/util/feature"
utilfeaturetesting "k8s.io/apiserver/pkg/util/feature/testing"
api "k8s.io/kubernetes/pkg/apis/core"
"k8s.io/kubernetes/pkg/apis/networking"
"k8s.io/kubernetes/pkg/features"
)
func TestValidateNetworkPolicySCTP(t *testing.T) {
sctpProtocol := api.ProtocolSCTP
tcpProtocol := api.ProtocolTCP
objectWithValue := func() *networking.NetworkPolicy {
return &networking.NetworkPolicy{
Spec: networking.NetworkPolicySpec{
Ingress: []networking.NetworkPolicyIngressRule{{Ports: []networking.NetworkPolicyPort{{Protocol: &sctpProtocol}}}},
Egress: []networking.NetworkPolicyEgressRule{{Ports: []networking.NetworkPolicyPort{{Protocol: &sctpProtocol}}}},
},
}
}
objectWithoutValue := func() *networking.NetworkPolicy {
return &networking.NetworkPolicy{
Spec: networking.NetworkPolicySpec{
Ingress: []networking.NetworkPolicyIngressRule{{Ports: []networking.NetworkPolicyPort{{Protocol: &tcpProtocol}}}},
Egress: []networking.NetworkPolicyEgressRule{{Ports: []networking.NetworkPolicyPort{{Protocol: &tcpProtocol}}}},
},
}
}
objectInfo := []struct {
description string
hasValue bool
object func() *networking.NetworkPolicy
}{
{
description: "has value",
hasValue: true,
object: objectWithValue,
},
{
description: "does not have value",
hasValue: false,
object: objectWithoutValue,
},
{
description: "is nil",
hasValue: false,
object: func() *networking.NetworkPolicy { return nil },
},
}
for _, enabled := range []bool{true, false} {
for _, oldNetworkPolicyInfo := range objectInfo {
for _, newNetworkPolicyInfo := range objectInfo {
oldNetworkPolicyHasValue, oldNetworkPolicy := oldNetworkPolicyInfo.hasValue, oldNetworkPolicyInfo.object()
newNetworkPolicyHasValue, newNetworkPolicy := newNetworkPolicyInfo.hasValue, newNetworkPolicyInfo.object()
if newNetworkPolicy == nil {
continue
}
t.Run(fmt.Sprintf("feature enabled=%v, old object %v, new object %v", enabled, oldNetworkPolicyInfo.description, newNetworkPolicyInfo.description), func(t *testing.T) {
defer utilfeaturetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.SCTPSupport, enabled)()
errs := ValidateConditionalNetworkPolicy(newNetworkPolicy, oldNetworkPolicy)
// objects should never be changed
if !reflect.DeepEqual(oldNetworkPolicy, oldNetworkPolicyInfo.object()) {
t.Errorf("old object changed: %v", diff.ObjectReflectDiff(oldNetworkPolicy, oldNetworkPolicyInfo.object()))
}
if !reflect.DeepEqual(newNetworkPolicy, newNetworkPolicyInfo.object()) {
t.Errorf("new object changed: %v", diff.ObjectReflectDiff(newNetworkPolicy, newNetworkPolicyInfo.object()))
}
switch {
case enabled || oldNetworkPolicyHasValue || !newNetworkPolicyHasValue:
if len(errs) > 0 {
t.Errorf("unexpected errors: %v", errs)
}
default:
if len(errs) != 2 {
t.Errorf("expected 2 errors, got %v", errs)
}
}
})
}
}
}
}

10
pkg/apis/networking/validation/validation.go
View File

@@ -23,11 +23,9 @@ import (
"k8s.io/apimachinery/pkg/util/sets"
"k8s.io/apimachinery/pkg/util/validation"
"k8s.io/apimachinery/pkg/util/validation/field"
utilfeature "k8s.io/apiserver/pkg/util/feature"
api "k8s.io/kubernetes/pkg/apis/core"
apivalidation "k8s.io/kubernetes/pkg/apis/core/validation"
"k8s.io/kubernetes/pkg/apis/networking"
"k8s.io/kubernetes/pkg/features"
)
// ValidateNetworkPolicyName can be used to check whether the given networkpolicy
@@ -39,12 +37,8 @@ func ValidateNetworkPolicyName(name string, prefix bool) []string {
// ValidateNetworkPolicyPort validates a NetworkPolicyPort
func ValidateNetworkPolicyPort(port *networking.NetworkPolicyPort, portPath *field.Path) field.ErrorList {
allErrs := field.ErrorList{}
if utilfeature.DefaultFeatureGate.Enabled(features.SCTPSupport) {
if port.Protocol != nil && *port.Protocol != api.ProtocolTCP && *port.Protocol != api.ProtocolUDP && *port.Protocol != api.ProtocolSCTP {
allErrs = append(allErrs, field.NotSupported(portPath.Child("protocol"), *port.Protocol, []string{string(api.ProtocolTCP), string(api.ProtocolUDP), string(api.ProtocolSCTP)}))
}
} else if port.Protocol != nil && *port.Protocol != api.ProtocolTCP && *port.Protocol != api.ProtocolUDP {
allErrs = append(allErrs, field.NotSupported(portPath.Child("protocol"), *port.Protocol, []string{string(api.ProtocolTCP), string(api.ProtocolUDP)}))
if port.Protocol != nil && *port.Protocol != api.ProtocolTCP && *port.Protocol != api.ProtocolUDP && *port.Protocol != api.ProtocolSCTP {
allErrs = append(allErrs, field.NotSupported(portPath.Child("protocol"), *port.Protocol, []string{string(api.ProtocolTCP), string(api.ProtocolUDP), string(api.ProtocolSCTP)}))
}
if port.Port != nil {
if port.Port.Type == intstr.Int {