Skip to content

Commit 611d390

Browse files
sairameshvsairameshv
committed
Add a CEL validation to deny setting "v1" for cgroupMode field
- Cgroupsv1 support is removed from OCP 4.19. Hence, denying the user when the `nodes.config` object's `cgroupMode` field is set to `"v1"` - Added integration tests to validate the newly introduced CEL validation on the cgroupMode field Signed-off-by: Sai Ramesh Vanka <[email protected]>
1 parent 1ee1ef8 commit 611d390

12 files changed

+137
-0
lines changed

‎config/v1/tests/nodes.config.openshift.io/AAA_ungated.yaml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,99 @@ tests:
1212
apiVersion: config.openshift.io/v1
1313
kind: Node
1414
spec: {}
15+
- name: Should be able to create a Node object with cgroupMode set to "v2"
16+
initial: |
17+
apiVersion: config.openshift.io/v1
18+
kind: Node
19+
spec:
20+
cgroupMode: "v2"
21+
expected: |
22+
apiVersion: config.openshift.io/v1
23+
kind: Node
24+
spec:
25+
cgroupMode: "v2"
26+
- name: Should not allow to create a Node object with the cgroupMode set to "v1"
27+
initial: |
28+
apiVersion: config.openshift.io/v1
29+
kind: Node
30+
spec:
31+
cgroupMode: "v1"
32+
expectedError: "cgroupMode \"v1\" is not supported, please update to cgroupMode \"v2\""
33+
- name: Should not allow to create a Node object with the cgroupMode set to some random value
34+
initial: |
35+
apiVersion: config.openshift.io/v1
36+
kind: Node
37+
spec:
38+
cgroupMode: "unknown"
39+
expectedError: "spec.cgroupMode: Unsupported value: \"unknown\""
40+
onUpdate:
41+
- name: Should be able to update a Node object with cgroupMode set to "v2"
42+
initial: |
43+
apiVersion: config.openshift.io/v1
44+
kind: Node
45+
spec: {}
46+
updated: |
47+
apiVersion: config.openshift.io/v1
48+
kind: Node
49+
spec:
50+
cgroupMode: "v2"
51+
expected: |
52+
apiVersion: config.openshift.io/v1
53+
kind: Node
54+
spec:
55+
cgroupMode: "v2"
56+
- name: Should not allow update of cgroupMode from "v2" to "v1"
57+
initial: |
58+
apiVersion: config.openshift.io/v1
59+
kind: Node
60+
spec:
61+
cgroupMode: "v2"
62+
updated: |
63+
apiVersion: config.openshift.io/v1
64+
kind: Node
65+
spec:
66+
cgroupMode: "v1"
67+
expectedError: "cgroupMode \"v1\" is not supported, please update to cgroupMode \"v2\""
68+
- name: Should allow changing other fields when a persisted value is no longer valid
69+
initialCRDPatches:
70+
- op: remove
71+
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/cgroupMode/x-kubernetes-validations
72+
initial: |
73+
apiVersion: config.openshift.io/v1
74+
kind: Node
75+
spec:
76+
cgroupMode: "v1"
77+
updated: |
78+
apiVersion: config.openshift.io/v1
79+
kind: Node
80+
spec:
81+
cgroupMode: "v1"
82+
workerLatencyProfile: "MediumUpdateAverageReaction"
83+
expected: |
84+
apiVersion: config.openshift.io/v1
85+
kind: Node
86+
spec:
87+
cgroupMode: "v1"
88+
workerLatencyProfile: "MediumUpdateAverageReaction"
89+
- name: Should allow updating a persisted value that is no longer valid to a valid value
90+
initialCRDPatches:
91+
- op: remove
92+
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/cgroupMode/x-kubernetes-validations
93+
initial: |
94+
apiVersion: config.openshift.io/v1
95+
kind: Node
96+
spec:
97+
cgroupMode: "v1"
98+
workerLatencyProfile: "MediumUpdateAverageReaction"
99+
updated: |
100+
apiVersion: config.openshift.io/v1
101+
kind: Node
102+
spec:
103+
cgroupMode: "v2"
104+
workerLatencyProfile: "MediumUpdateAverageReaction"
105+
expected: |
106+
apiVersion: config.openshift.io/v1
107+
kind: Node
108+
spec:
109+
cgroupMode: "v2"
110+
workerLatencyProfile: "MediumUpdateAverageReaction"

‎config/v1/types_node.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ type NodeStatus struct {
7777
}
7878

7979
// +kubebuilder:validation:Enum=v1;v2;""
80+
// +kubebuilder:validation:XValidation:rule="self != \"v1\"",message="cgroupMode \"v1\" is not supported, please update to cgroupMode \"v2\""
8081
type CgroupMode string
8182

8283
const (

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_nodes-CustomNoUpgrade.crd.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,10 @@ spec:
5353
- v2
5454
- ""
5555
type: string
56+
x-kubernetes-validations:
57+
- message: cgroupMode "v1" is not supported, please update to cgroupMode
58+
"v2"
59+
rule: self != "v1"
5660
minimumKubeletVersion:
5761
description: |-
5862
minimumKubeletVersion is the lowest version of a kubelet that can join the cluster.

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_nodes-Default.crd.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,10 @@ spec:
5353
- v2
5454
- ""
5555
type: string
56+
x-kubernetes-validations:
57+
- message: cgroupMode "v1" is not supported, please update to cgroupMode
58+
"v2"
59+
rule: self != "v1"
5660
workerLatencyProfile:
5761
description: |-
5862
workerLatencyProfile determins the how fast the kubelet is updating

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_nodes-DevPreviewNoUpgrade.crd.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,10 @@ spec:
5353
- v2
5454
- ""
5555
type: string
56+
x-kubernetes-validations:
57+
- message: cgroupMode "v1" is not supported, please update to cgroupMode
58+
"v2"
59+
rule: self != "v1"
5660
minimumKubeletVersion:
5761
description: |-
5862
minimumKubeletVersion is the lowest version of a kubelet that can join the cluster.

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_nodes-TechPreviewNoUpgrade.crd.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,10 @@ spec:
5353
- v2
5454
- ""
5555
type: string
56+
x-kubernetes-validations:
57+
- message: cgroupMode "v1" is not supported, please update to cgroupMode
58+
"v2"
59+
rule: self != "v1"
5660
minimumKubeletVersion:
5761
description: |-
5862
minimumKubeletVersion is the lowest version of a kubelet that can join the cluster.

‎config/v1/zz_generated.featuregated-crd-manifests/nodes.config.openshift.io/AAA_ungated.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,10 @@ spec:
5353
- v2
5454
- ""
5555
type: string
56+
x-kubernetes-validations:
57+
- message: cgroupMode "v1" is not supported, please update to cgroupMode
58+
"v2"
59+
rule: self != "v1"
5660
workerLatencyProfile:
5761
description: |-
5862
workerLatencyProfile determins the how fast the kubelet is updating

‎config/v1/zz_generated.featuregated-crd-manifests/nodes.config.openshift.io/MinimumKubeletVersion.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,10 @@ spec:
5353
- v2
5454
- ""
5555
type: string
56+
x-kubernetes-validations:
57+
- message: cgroupMode "v1" is not supported, please update to cgroupMode
58+
"v2"
59+
rule: self != "v1"
5660
minimumKubeletVersion:
5761
description: |-
5862
minimumKubeletVersion is the lowest version of a kubelet that can join the cluster.

‎payload-manifests/crds/0000_10_config-operator_01_nodes-CustomNoUpgrade.crd.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,10 @@ spec:
5353
- v2
5454
- ""
5555
type: string
56+
x-kubernetes-validations:
57+
- message: cgroupMode "v1" is not supported, please update to cgroupMode
58+
"v2"
59+
rule: self != "v1"
5660
minimumKubeletVersion:
5761
description: |-
5862
minimumKubeletVersion is the lowest version of a kubelet that can join the cluster.

‎payload-manifests/crds/0000_10_config-operator_01_nodes-Default.crd.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,10 @@ spec:
5353
- v2
5454
- ""
5555
type: string
56+
x-kubernetes-validations:
57+
- message: cgroupMode "v1" is not supported, please update to cgroupMode
58+
"v2"
59+
rule: self != "v1"
5660
workerLatencyProfile:
5761
description: |-
5862
workerLatencyProfile determins the how fast the kubelet is updating

0 commit comments

Comments
 (0)