Skip to content

Commit 8368b38

Browse files
committed
Loosen KMS validation to allow nil KMSConfig
1 parent 6457144 commit 8368b38

10 files changed

Lines changed: 42 additions & 45 deletions

config/v1/tests/apiservers.config.openshift.io/KMSEncryptionProvider.yaml

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -54,16 +54,22 @@ tests:
5454
aws:
5555
keyARN: arn:aws:kms:us-east-1:101010101010:key/9a512e29-0d9c-4cf5-8174-fc1a5b22cd6a
5656
region: us-east-1
57-
expectedError: "kms config is required when encryption type is KMS, and forbidden otherwise"
58-
- name: Should fail to create with an empty KMS config
57+
expectedError: "kms config is forbidden when encryption type is not KMS"
58+
- name: Should be able to create with KMS type and nil kms config
5959
initial: |
6060
apiVersion: config.openshift.io/v1
6161
kind: APIServer
6262
spec:
6363
encryption:
6464
type: KMS
65-
kms: {}
66-
expectedError: "spec.encryption.kms.type: Required value"
65+
expected: |
66+
apiVersion: config.openshift.io/v1
67+
kind: APIServer
68+
spec:
69+
audit:
70+
profile: Default
71+
encryption:
72+
type: KMS
6773
- name: Should fail to create with kms type AWS but without aws config
6874
initial: |
6975
apiVersion: config.openshift.io/v1

config/v1/types_apiserver.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,7 @@ type APIServerNamedServingCert struct {
175175
}
176176

177177
// APIServerEncryption is used to encrypt sensitive resources on the cluster.
178-
// +openshift:validation:FeatureGateAwareXValidation:featureGate=KMSEncryptionProvider,rule="has(self.type) && self.type == 'KMS' ? has(self.kms) : !has(self.kms)",message="kms config is required when encryption type is KMS, and forbidden otherwise"
178+
// +openshift:validation:FeatureGateAwareXValidation:featureGate=KMSEncryptionProvider,rule="self.type != 'KMS' ? !has(self.kms) : true",message="kms config is forbidden when encryption type is not KMS"
179179
// +union
180180
type APIServerEncryption struct {
181181
// type defines what encryption type should be used to encrypt resources at the datastore layer.

config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -245,10 +245,8 @@ spec:
245245
type: string
246246
type: object
247247
x-kubernetes-validations:
248-
- message: kms config is required when encryption type is KMS, and
249-
forbidden otherwise
250-
rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
251-
!has(self.kms)'
248+
- message: kms config is forbidden when encryption type is not KMS
249+
rule: 'self.type != ''KMS'' ? !has(self.kms) : true'
252250
servingCerts:
253251
description: |-
254252
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates

config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -245,10 +245,8 @@ spec:
245245
type: string
246246
type: object
247247
x-kubernetes-validations:
248-
- message: kms config is required when encryption type is KMS, and
249-
forbidden otherwise
250-
rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
251-
!has(self.kms)'
248+
- message: kms config is forbidden when encryption type is not KMS
249+
rule: 'self.type != ''KMS'' ? !has(self.kms) : true'
252250
servingCerts:
253251
description: |-
254252
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates

config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -245,10 +245,8 @@ spec:
245245
type: string
246246
type: object
247247
x-kubernetes-validations:
248-
- message: kms config is required when encryption type is KMS, and
249-
forbidden otherwise
250-
rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
251-
!has(self.kms)'
248+
- message: kms config is forbidden when encryption type is not KMS
249+
rule: 'self.type != ''KMS'' ? !has(self.kms) : true'
252250
servingCerts:
253251
description: |-
254252
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates

config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryptionProvider.yaml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -245,10 +245,8 @@ spec:
245245
type: string
246246
type: object
247247
x-kubernetes-validations:
248-
- message: kms config is required when encryption type is KMS, and
249-
forbidden otherwise
250-
rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
251-
!has(self.kms)'
248+
- message: kms config is forbidden when encryption type is not KMS
249+
rule: 'self.type != ''KMS'' ? !has(self.kms) : true'
252250
servingCerts:
253251
description: |-
254252
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates

openapi/openapi.json

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -9533,7 +9533,7 @@
95339533
}
95349534
},
95359535
"com.github.openshift.api.config.v1.OIDCClientConfig": {
9536-
"description": "OIDCClientConfig configures how platform clients interact with identity providers as an authentication method",
9536+
"description": "OIDCClientConfig configures how platform clients interact with identity providers as an authentication method.",
95379537
"type": "object",
95389538
"required": [
95399539
"componentName",
@@ -10252,7 +10252,7 @@
1025210252
"$ref": "#/definitions/com.github.openshift.api.config.v1.PowerVSPlatformSpec"
1025310253
},
1025410254
"type": {
10255-
"description": "type is the underlying infrastructure provider for the cluster. This value controls whether infrastructure automation such as service load balancers, dynamic volume provisioning, machine creation and deletion, and other integrations are enabled. If None, no infrastructure automation is enabled. Allowed values are \"AWS\", \"Azure\", \"BareMetal\", \"GCP\", \"Libvirt\", \"OpenStack\", \"VSphere\", \"oVirt\", \"KubeVirt\", \"EquinixMetal\", \"PowerVS\", \"AlibabaCloud\", \"Nutanix\" and \"None\". Individual components may not support all platforms, and must handle unrecognized platforms as None if they do not support that platform.",
10255+
"description": "type is the underlying infrastructure provider for the cluster. This value controls whether infrastructure automation such as service load balancers, dynamic volume provisioning, machine creation and deletion, and other integrations are enabled. If None, no infrastructure automation is enabled. Allowed values are \"AWS\", \"Azure\", \"BareMetal\", \"GCP\", \"Libvirt\", \"OpenStack\", \"VSphere\", \"oVirt\", \"IBMCloud\", \"KubeVirt\", \"EquinixMetal\", \"PowerVS\", \"AlibabaCloud\", \"Nutanix\", \"External\", and \"None\". Individual components may not support all platforms, and must handle unrecognized platforms as None if they do not support that platform.",
1025610256
"type": "string",
1025710257
"default": ""
1025810258
},
@@ -10547,7 +10547,7 @@
1054710547
"default": ""
1054810548
},
1054910549
"prefix": {
10550-
"description": "prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes.\n\nWhen omitted (\"\"), no prefix is applied to the cluster identity attribute.\n\nExample: if `prefix` is set to \"myoidc:\" and the `claim` in JWT contains an array of strings \"a\", \"b\" and \"c\", the mapping will result in an array of string \"myoidc:a\", \"myoidc:b\" and \"myoidc:c\".",
10550+
"description": "prefix is an optional field that configures the prefix that will be applied to the cluster identity attribute during the process of mapping JWT claims to cluster identity attributes.\n\nWhen omitted (\"\"), no prefix is applied to the cluster identity attribute.\n\nExample: if `prefix` is set to \"myoidc:\" and the `claim` in JWT contains an array of strings \"a\", \"b\" and \"c\", the mapping will result in an array of string \"myoidc:a\", \"myoidc:b\" and \"myoidc:c\".",
1055110551
"type": "string",
1055210552
"default": ""
1055310553
}
@@ -14677,11 +14677,15 @@
1467714677
"x-kubernetes-list-type": "map"
1467814678
},
1467914679
"method": {
14680-
"description": "method is the fencing method used by this agent (e.g., \"redfish\", \"ipmi\", \"fence_aws\"). This is extracted from the pacemaker resource agent type.",
14681-
"type": "string"
14680+
"description": "method is the fencing method used by this agent. Valid values are \"Redfish\" and \"IPMI\". Redfish is a standard RESTful API for server management. IPMI (Intelligent Platform Management Interface) is a hardware management interface.\n\nPossible enum values:\n - `\"IPMI\"` uses IPMI (Intelligent Platform Management Interface), a hardware management interface.\n - `\"Redfish\"` uses Redfish, a standard RESTful API for server management.",
14681+
"type": "string",
14682+
"enum": [
14683+
"IPMI",
14684+
"Redfish"
14685+
]
1468214686
},
1468314687
"name": {
14684-
"description": "name is the pacemaker resource name of the fencing agent (e.g., \"master-0_redfish\"). The name consists of the target node name followed by an underscore and the fencing method. Currently only \"redfish\" is supported as a fencing method. The node name portion must be a valid RFC 1123 subdomain (max 253 chars). Maximum total length is 261 characters (253 + 1 + 7 for \"_redfish\").",
14688+
"description": "name is the unique identifier for this fencing agent (e.g., \"master-0_redfish\"). The name must be unique within the fencingAgents array for this node. It may contain alphanumeric characters, dots, hyphens, and underscores. Maximum length is 300 characters, providing headroom beyond the typical format of <node_name>_<type> (253 for RFC 1123 node name + 1 underscore + type).",
1468514689
"type": "string"
1468614690
}
1468714691
}
@@ -14721,14 +14725,14 @@
1472114725
"type": "object",
1472214726
"required": [
1472314727
"conditions",
14724-
"name",
14728+
"nodeName",
1472514729
"addresses",
1472614730
"resources",
1472714731
"fencingAgents"
1472814732
],
1472914733
"properties": {
1473014734
"addresses": {
14731-
"description": "addresses is a list of IP addresses reachable to the node. Pacemaker allows multiple IP addresses for Corosync communication between nodes. The first address in this list is used for IP-based peer URLs for etcd membership. Each address must be a valid global unicast IPv4 or IPv6 address in canonical form (e.g., \"192.168.1.1\" not \"192.168.001.001\", or \"2001:db8::1\" not \"2001:0db8::1\"). This excludes loopback, link-local, and multicast addresses.",
14735+
"description": "addresses is a list of IP addresses for the node. Pacemaker allows multiple IP addresses for Corosync communication between nodes. The first address in this list is used for IP-based peer URLs for etcd membership. Each address must be a valid global unicast IPv4 or IPv6 address in canonical form (e.g., \"192.168.1.1\" not \"192.168.001.001\", or \"2001:db8::1\" not \"2001:0db8::1\"). This excludes loopback, link-local, and multicast addresses.",
1473214736
"type": "array",
1473314737
"items": {
1473414738
"default": {},
@@ -14749,7 +14753,7 @@
1474914753
"x-kubernetes-list-type": "map"
1475014754
},
1475114755
"fencingAgents": {
14752-
"description": "fencingAgents contains the status of fencing agents that can fence this node. Unlike resources (which are scheduled to run on this node), fencing agents are mapped to the node they can fence (their target), not the node where monitoring operations run. Each fencing agent entry includes the agent name, fencing method, and health conditions. A node is considered fence-capable if at least one fencing agent is healthy. Expected to have 1 fencing agent per node, but up to 8 are supported for redundancy.",
14756+
"description": "fencingAgents contains the status of fencing agents that can fence this node. Unlike resources (which are scheduled to run on this node), fencing agents are mapped to the node they can fence (their target), not the node where monitoring operations run. Each fencing agent entry includes a unique name, fencing type, target node, and health conditions. A node is considered fence-capable if at least one fencing agent is healthy. Expected to have 1 fencing agent per node, but up to 8 are supported for redundancy. Names must be unique within this array.",
1475314757
"type": "array",
1475414758
"items": {
1475514759
"default": {},
@@ -14760,8 +14764,8 @@
1476014764
],
1476114765
"x-kubernetes-list-type": "map"
1476214766
},
14763-
"name": {
14764-
"description": "name is the name of the node. This is expected to match the Kubernetes node's name, which must be a lowercase RFC 1123 subdomain consisting of lowercase alphanumeric characters, '-' or '.', starting and ending with an alphanumeric character, and be at most 253 characters in length.",
14767+
"nodeName": {
14768+
"description": "nodeName is the name of the node. This is expected to match the Kubernetes node's name, which must be a lowercase RFC 1123 subdomain consisting of lowercase alphanumeric characters, '-' or '.', starting and ending with an alphanumeric character, and be at most 253 characters in length.",
1476514769
"type": "string"
1476614770
},
1476714771
"resources": {
@@ -14837,10 +14841,11 @@
1483714841
"description": "nodes provides detailed status for each control-plane node in the Pacemaker cluster. While Pacemaker supports up to 32 nodes, the limit is set to 5 (max OpenShift control-plane nodes). For Two Node OpenShift with Fencing, exactly 2 nodes are expected in a healthy cluster. An empty list indicates a catastrophic failure where Pacemaker reports no nodes.",
1483814842
"type": "array",
1483914843
"items": {
14844+
"default": {},
1484014845
"$ref": "#/definitions/com.github.openshift.api.etcd.v1alpha1.PacemakerClusterNodeStatus"
1484114846
},
1484214847
"x-kubernetes-list-map-keys": [
14843-
"name"
14848+
"nodeName"
1484414849
],
1484514850
"x-kubernetes-list-type": "map"
1484614851
}

payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -245,10 +245,8 @@ spec:
245245
type: string
246246
type: object
247247
x-kubernetes-validations:
248-
- message: kms config is required when encryption type is KMS, and
249-
forbidden otherwise
250-
rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
251-
!has(self.kms)'
248+
- message: kms config is forbidden when encryption type is not KMS
249+
rule: 'self.type != ''KMS'' ? !has(self.kms) : true'
252250
servingCerts:
253251
description: |-
254252
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates

payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -245,10 +245,8 @@ spec:
245245
type: string
246246
type: object
247247
x-kubernetes-validations:
248-
- message: kms config is required when encryption type is KMS, and
249-
forbidden otherwise
250-
rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
251-
!has(self.kms)'
248+
- message: kms config is forbidden when encryption type is not KMS
249+
rule: 'self.type != ''KMS'' ? !has(self.kms) : true'
252250
servingCerts:
253251
description: |-
254252
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates

payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -245,10 +245,8 @@ spec:
245245
type: string
246246
type: object
247247
x-kubernetes-validations:
248-
- message: kms config is required when encryption type is KMS, and
249-
forbidden otherwise
250-
rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
251-
!has(self.kms)'
248+
- message: kms config is forbidden when encryption type is not KMS
249+
rule: 'self.type != ''KMS'' ? !has(self.kms) : true'
252250
servingCerts:
253251
description: |-
254252
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates

0 commit comments

Comments
 (0)