Skip to content

MCO-2142: OSImageStream.spec.defaultStream validation #2736

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pablintino wants to merge 1 commit into
base: master
Choose a base branch
from
+269 −2
Open

MCO-2142: OSImageStream.spec.defaultStream validation #2736

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
214 changes: 214 additions & 0 deletions ...figuration/v1alpha1/tests/osimagestreams.machineconfiguration.openshift.io/OSStreams.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -305,6 +305,85 @@ tests:
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e

- name: Should reject updating spec.defaultStream to a stream not in status.availableStreams
initial: |
apiVersion: machineconfiguration.openshift.io/v1alpha1
kind: OSImageStream
metadata:
name: cluster
spec:
defaultStream: rhel-coreos
status:
defaultStream: rhel-coreos
availableStreams:
- name: rhel-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8
- name: rhel10-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e
updated: |
apiVersion: machineconfiguration.openshift.io/v1alpha1
kind: OSImageStream
metadata:
name: cluster
spec:
defaultStream: non-existent-stream
status:
defaultStream: rhel-coreos
availableStreams:
- name: rhel-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8
- name: rhel10-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e
expectedError: "spec.defaultStream must reference an existing stream name from status.availableStreams"

- name: Should accept status update removing a stream when spec is unchanged
initial: |
apiVersion: machineconfiguration.openshift.io/v1alpha1
kind: OSImageStream
metadata:
name: cluster
spec:
defaultStream: rhel-coreos
status:
defaultStream: rhel-coreos
availableStreams:
- name: rhel-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8
- name: rhel10-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e
updated: |
apiVersion: machineconfiguration.openshift.io/v1alpha1
kind: OSImageStream
metadata:
name: cluster
spec:
defaultStream: rhel-coreos
status:
defaultStream: rhel10-coreos
availableStreams:
- name: rhel10-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e
expected: |
apiVersion: machineconfiguration.openshift.io/v1alpha1
kind: OSImageStream
metadata:
name: cluster
spec:
defaultStream: rhel-coreos
status:
defaultStream: rhel10-coreos
availableStreams:
- name: rhel10-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e

- name: Should reject an status update without defaultStream
initial: |
apiVersion: machineconfiguration.openshift.io/v1alpha1
Expand Down Expand Up @@ -434,3 +513,138 @@ tests:
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8
expectedStatusError: "status.defaultStream: Too long: may not be more than 253 bytes"

- name: Should allow status update when spec.defaultStream is stale after forced upgrade
initial: |
apiVersion: machineconfiguration.openshift.io/v1alpha1
kind: OSImageStream
metadata:
name: cluster
spec:
defaultStream: old-removed-stream
status:
defaultStream: rhel-coreos
availableStreams:
- name: rhel-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8
- name: rhel10-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e
updated: |
apiVersion: machineconfiguration.openshift.io/v1alpha1
kind: OSImageStream
metadata:
name: cluster
spec:
defaultStream: old-removed-stream
status:
defaultStream: rhel10-coreos
availableStreams:
- name: rhel-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8
- name: rhel10-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e
expected: |
apiVersion: machineconfiguration.openshift.io/v1alpha1
kind: OSImageStream
metadata:
name: cluster
spec:
defaultStream: old-removed-stream
status:
defaultStream: rhel10-coreos
availableStreams:
- name: rhel-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8
- name: rhel10-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e

- name: Should reject changing stale spec.defaultStream to another invalid value after forced upgrade
initial: |
apiVersion: machineconfiguration.openshift.io/v1alpha1
kind: OSImageStream
metadata:
name: cluster
spec:
defaultStream: old-removed-stream
status:
defaultStream: rhel-coreos
availableStreams:
- name: rhel-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8
- name: rhel10-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e
updated: |
apiVersion: machineconfiguration.openshift.io/v1alpha1
kind: OSImageStream
metadata:
name: cluster
spec:
defaultStream: another-invalid-stream
status:
defaultStream: rhel-coreos
availableStreams:
- name: rhel-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8
- name: rhel10-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e
expectedError: "spec.defaultStream must reference an existing stream name from status.availableStreams"

- name: Should allow updating stale spec.defaultStream to a valid stream after forced upgrade
initial: |
apiVersion: machineconfiguration.openshift.io/v1alpha1
kind: OSImageStream
metadata:
name: cluster
spec:
defaultStream: old-removed-stream
status:
defaultStream: rhel-coreos
availableStreams:
- name: rhel-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8
- name: rhel10-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e
updated: |
apiVersion: machineconfiguration.openshift.io/v1alpha1
kind: OSImageStream
metadata:
name: cluster
spec:
defaultStream: rhel-coreos
status:
defaultStream: rhel-coreos
availableStreams:
- name: rhel-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8
- name: rhel10-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e
expected: |
apiVersion: machineconfiguration.openshift.io/v1alpha1
kind: OSImageStream
metadata:
name: cluster
spec:
defaultStream: rhel-coreos
status:
defaultStream: rhel-coreos
availableStreams:
- name: rhel-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8
- name: rhel10-coreos
osImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
osExtensionsImage: quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e
11 changes: 11 additions & 0 deletions machineconfiguration/v1alpha1/types_osimagestream.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ import (
// +openshift:enable:FeatureGate=OSStreams
// +kubebuilder:metadata:labels=openshift.io/operator-managed=
// +kubebuilder:validation:XValidation:rule="self.metadata.name == 'cluster'",message="osimagestream is a singleton, .metadata.name must be 'cluster'"
// +kubebuilder:validation:XValidation:rule="self.spec == oldSelf.spec || !has(self.spec.defaultStream) || !has(self.status) || self.spec.defaultStream in self.status.availableStreams.map(s, s.name)",message="spec.defaultStream must reference an existing stream name from status.availableStreams"
type OSImageStream struct {
metav1.TypeMeta `json:",inline"`

Expand Down Expand Up @@ -84,6 +85,16 @@ type OSImageStreamSpec struct {
// status.availableStreams to apply as the default for MachineConfigPools
// that do not specify a stream override.
//
// When status.availableStreams has been populated by the operator, updating
// this field requires that the new value references the name of one of the
// streams in status.availableStreams. Status-only updates by the operator
// are not subject to this constraint, allowing the operator to update
// availableStreams independently of this field.
// During initial creation, before the operator has populated status, any
// valid value is accepted.
//
// When omitted, the operator determines the default stream automatically.
//
// It must be a valid RFC 1123 subdomain between 1 and 253 characters in length,
// consisting of lowercase alphanumeric characters, hyphens ('-'), and periods ('.').
//
Expand Down
14 changes: 14 additions & 0 deletions ...ion/v1alpha1/zz_generated.crd-manifests/0000_80_machine-config_01_osimagestreams.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,16 @@ spec:
status.availableStreams to apply as the default for MachineConfigPools
that do not specify a stream override.

When status.availableStreams has been populated by the operator, updating
this field requires that the new value references the name of one of the
streams in status.availableStreams. Status-only updates by the operator
are not subject to this constraint, allowing the operator to update
availableStreams independently of this field.
During initial creation, before the operator has populated status, any
valid value is accepted.

When omitted, the operator determines the default stream automatically.

It must be a valid RFC 1123 subdomain between 1 and 253 characters in length,
consisting of lowercase alphanumeric characters, hyphens ('-'), and periods ('.').
maxLength: 253
Expand Down Expand Up @@ -184,6 +194,10 @@ spec:
x-kubernetes-validations:
- message: osimagestream is a singleton, .metadata.name must be 'cluster'
rule: self.metadata.name == 'cluster'
- message: spec.defaultStream must reference an existing stream name from
status.availableStreams
rule: self.spec == oldSelf.spec || !has(self.spec.defaultStream) || !has(self.status)
|| self.spec.defaultStream in self.status.availableStreams.map(s, s.name)
served: true
storage: true
subresources:
Expand Down
14 changes: 14 additions & 0 deletions ...eaturegated-crd-manifests/osimagestreams.machineconfiguration.openshift.io/OSStreams.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,16 @@ spec:
status.availableStreams to apply as the default for MachineConfigPools
that do not specify a stream override.

When status.availableStreams has been populated by the operator, updating
this field requires that the new value references the name of one of the
streams in status.availableStreams. Status-only updates by the operator
are not subject to this constraint, allowing the operator to update
availableStreams independently of this field.
During initial creation, before the operator has populated status, any
valid value is accepted.

When omitted, the operator determines the default stream automatically.

It must be a valid RFC 1123 subdomain between 1 and 253 characters in length,
consisting of lowercase alphanumeric characters, hyphens ('-'), and periods ('.').
maxLength: 253
Expand Down Expand Up @@ -184,6 +194,10 @@ spec:
x-kubernetes-validations:
- message: osimagestream is a singleton, .metadata.name must be 'cluster'
rule: self.metadata.name == 'cluster'
- message: spec.defaultStream must reference an existing stream name from
status.availableStreams
rule: self.spec == oldSelf.spec || !has(self.spec.defaultStream) || !has(self.status)
|| self.spec.defaultStream in self.status.availableStreams.map(s, s.name)
served: true
storage: true
subresources:
Expand Down
2 changes: 1 addition & 1 deletion machineconfiguration/v1alpha1/zz_generated.swagger_doc_generated.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading