Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(): offboard ns when invalid labels are applied to ns #409

Closed
wants to merge 24 commits into from
Closed

fix(): offboard ns when invalid labels are applied to ns #409

wants to merge 24 commits into from

Conversation

gourishkb
Copy link
Contributor

Description

When a namespace is applied labels and/or annotations that are not part of the sliceconfig spec,
worker operator does remove the labels/annotations and hence, the workloads may come up with unnecessary labels/annotations.
This issue is now fixed under the changes in this PR
Fixes #

How Has This Been Tested?

test-cases

  • namespace with the kubeslice labels but not part of any sliceconfig is offboarded
  • namespace with the kubeslice annotations but not part of any sliceconfig is offboarded
  • namespace with valid kubeslice labels/annotations work as expected
  • namespace when replicated from cluster "worker-1" having valid sliceconfig to another cluster "worker-2", the workloads do not have invalid kubeslice labels/annotations

Checklist:

  • The title of the PR states what changed and the related issues number (used for the release note).
  • Does this PR requires documentation updates?
  • I've updated documentation as required by this PR.
  • I have ran go fmt
  • I have updated the helm chart as required by this PR.
  • I have performed a self-review of my own code.
  • I have commented my code, particularly in hard-to-understand areas.
  • I have tested it for all user roles.
  • I have added all the required unit test cases.
  • I have verified the E2E test cases with new code changes.
  • I have added all the required E2E test cases.

Does this PR introduce a breaking change?

gourishkb and others added 10 commits October 21, 2024 18:08
@gourishkb
fix(): initial changes for offboarding replicated ns
a1f77d7 
Signed-off-by: gourishkb <[email protected]>
@gourishkb
fix(): expose offBoardPod function
6973574 
Signed-off-by: gourishkb <[email protected]>
@gourishkb
fix(): offboard objects, while cleaning up ns
10ebd09 
Signed-off-by: gourishkb <[email protected]>
@mridulgain
select the slice gateway services only
acea6a8 
This filter is to prevent envoy gateway services to be fetched in the slice gateway edge list
@gourishkb
fix(): offboardRequired function
242a323 
Signed-off-by: gourishkb <[email protected]>
@KRANTHI0918
fix(): Add ignore_critical parameter to pipeline config
81f2f58
@KRANTHI0918
fix(): Set ignore_critical to false in pipeline configuration
a693a2e
@KRANTHI0918
fix(): Add update_trivy flag with default 'false'
91094ac
@gourishkb
fix(): vulnerabilities
07d43aa 
CVE-2024-24790
CVE-2023-45288
CVE-2024-24788
CVE-2024-34156
CVE-2024-24789
CVE-2024-24791
CVE-2024-34155
CVE-2024-34158

Signed-off-by: gourishkb <[email protected]>
@gourishkb
fix(): code cleanup
210435b 
Signed-off-by: gourishkb <[email protected]>
KRANTHI0918 and others added 12 commits November 5, 2024 15:33
@KRANTHI0918
fix(): Update Jenkinsfile
5db5228
@uma-kt @gourishkb
Update README.md
01e1136 
worker-operator

Updated the docs URL link
@uma-kt @gourishkb
Update README.md
247409d
@priyank-upadhyay @gourishkb
fix(): configurable ns exclusion list (#408)
fbf2dec 
* fix(): configurable ns exclusion list

Signed-off-by: Priyank Upadhyay <[email protected]>

* fix(): refactors

Signed-off-by: Priyank Upadhyay <[email protected]>

---------

Signed-off-by: Priyank Upadhyay <[email protected]>
@bharath-avesha @gourishkb
fix(): Fixed tunnel status reporting in the slicegw CR (#406)
f3eb9a5 
Signed-off-by: Bharath Horatti <[email protected]>
@mridulgain @gourishkb
fix(): update gw deploy if gateway sidecar image has been changed in …
63cb4aa 
…worker env vars

Signed-off-by: Mridul Gain <[email protected]>
@mridulgain @gourishkb
add empty string check for sidecar image name
ffb8b62 
Signed-off-by: Mridul Gain <[email protected]>
@mridulgain @gourishkb
fix(): test build
3e5301d 
Signed-off-by: Mridul Gain <[email protected]>
@mridulgain @gourishkb
fix(): update gw deploy if gateway sidecar image pull policy is chang…
71628a8 
…ed in worker env vars

Signed-off-by: Mridul Gain <[email protected]>
@mridulgain @gourishkb
fix: getNodeIp logic for no-network mode
46a48e9 
Signed-off-by: Mridul Gain <[email protected]>
@mridulgain @gourishkb
address review comments
403decd 
Signed-off-by: Mridul Gain <[email protected]>
@KRANTHI0918 @gourishkb
Set custom Trivy DB repository in GitHub Action env
d54ebc5
github-advanced-security[bot]
github-advanced-security bot found potential problems Nov 18, 2024
View reviewed changes
controllers/slicegateway/slicegateway.go Outdated
if isClient(slicegateway) {
// get the remote port number this gw pod is connected to on the remote cluster
_, remotePortInUse := getClientGwRemotePortInUse(ctx, r.Client, slicegateway, GetDepNameFromPodName(slicegateway.Status.Config.SliceGatewayID, gwPod.PodName))
gwPod.RemotePort = int32(remotePortInUse)

Check failure

Code scanning / CodeQL

Incorrect conversion between integer types High

Incorrect conversion of an integer with architecture-dependent bit size from
strconv.Atoi
Loading
to a lower bit size type int32 without an upper bound check.

Copilot Autofix AI about 1 month ago

To fix the problem, we need to ensure that the integer value obtained from strconv.Atoi is within the bounds of the int32 type before casting it. This can be achieved by using strconv.ParseInt with a specified bit size of 32, which directly returns an int64 that can be safely cast to int32 after ensuring it is within the valid range.

  1. Replace the use of strconv.Atoi with strconv.ParseInt specifying a bit size of 32.
  2. Add bounds checking to ensure the parsed integer is within the range of int32 before casting.
Suggested changeset 2
controllers/slicegateway/slicegateway.go

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/controllers/slicegateway/slicegateway.go b/controllers/slicegateway/slicegateway.go
--- a/controllers/slicegateway/slicegateway.go
+++ b/controllers/slicegateway/slicegateway.go
@@ -683,3 +683,8 @@
 			_, remotePortInUse := getClientGwRemotePortInUse(ctx, r.Client, slicegateway, GetDepNameFromPodName(slicegateway.Status.Config.SliceGatewayID, gwPod.PodName))
-			gwPod.RemotePort = int32(remotePortInUse)
+			if remotePortInUse >= math.MinInt32 && remotePortInUse <= math.MaxInt32 {
+				gwPod.RemotePort = int32(remotePortInUse)
+			} else {
+				log.Error(fmt.Errorf("remote port out of int32 range"), "Invalid remote port", "remotePortInUse", remotePortInUse)
+				gwPod.RemotePort = 0 // or some default value
+			}
 		}
EOF
@@ -683,3 +683,8 @@
_, remotePortInUse := getClientGwRemotePortInUse(ctx, r.Client, slicegateway, GetDepNameFromPodName(slicegateway.Status.Config.SliceGatewayID, gwPod.PodName))
gwPod.RemotePort = int32(remotePortInUse)
if remotePortInUse >= math.MinInt32 && remotePortInUse <= math.MaxInt32 {
gwPod.RemotePort = int32(remotePortInUse)
} else {
log.Error(fmt.Errorf("remote port out of int32 range"), "Invalid remote port", "remotePortInUse", remotePortInUse)
gwPod.RemotePort = 0 // or some default value
}
}
controllers/slicegateway/utils.go
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/controllers/slicegateway/utils.go b/controllers/slicegateway/utils.go
--- a/controllers/slicegateway/utils.go
+++ b/controllers/slicegateway/utils.go
@@ -336,5 +336,6 @@
 				if envVar.Name == "NODE_PORT" {
-					nodePort, err := strconv.Atoi(envVar.Value)
+					nodePort64, err := strconv.ParseInt(envVar.Value, 10, 32)
 					if err == nil {
-						return true, nodePort
+						nodePort := int32(nodePort64)
+						return true, int(nodePort)
 					}
EOF
@@ -336,5 +336,6 @@
if envVar.Name == "NODE_PORT" {
nodePort, err := strconv.Atoi(envVar.Value)
nodePort64, err := strconv.ParseInt(envVar.Value, 10, 32)
if err == nil {
return true, nodePort
nodePort := int32(nodePort64)
return true, int(nodePort)
}
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
@gourishkb gourishkb closed this Nov 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mridulgain mridulgain mridulgain approved these changes

@narmidm narmidm Awaiting requested review from narmidm narmidm is a code owner

@bharath-avesha bharath-avesha Awaiting requested review from bharath-avesha bharath-avesha is a code owner

@richiesebastian richiesebastian Awaiting requested review from richiesebastian richiesebastian is a code owner

@Rahul-D78 Rahul-D78 Awaiting requested review from Rahul-D78 Rahul-D78 is a code owner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@gourishkb @mridulgain @KRANTHI0918 @uma-kt @priyank-upadhyay @bharath-avesha