Bug OCPBUGS-97953: installer: fix NetworkDeviceSpec CRD incorrectly using format: ipv6#10673
Bug OCPBUGS-97953: installer: fix NetworkDeviceSpec CRD incorrectly using format: ipv6#10673ankimaha-sys wants to merge 2 commits into
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughUpdates vSphere ChangesvSphere NetworkDeviceSpec validation
Estimated code review effort: 2 (Simple) | ~10 minutes Related issues: Fixes vSphere Suggested labels: api-review, vsphere Suggested reviewers: 2uasimojo 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @ankimaha-sys. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
| // +kubebuilder:validation:Format=ipv6 | ||
| // +kubebuilder:example=`192.168.1.100/24` | ||
| // +kubebuilder:example=`2001:DB8:0000:0000:244:17FF:FEB6:D37D/64` | ||
| // +kubebuilder:validation:Required |
There was a problem hiding this comment.
Some level of validation is required, just removing and not replacing won't work here
|
this instead... this is from gemini, you need to test this |
ankimaha-sys
force-pushed
the
fix-vsphere-networkdevice-ipv6-format
branch
from
0cb3220 to
6dd43cd
Compare
|
Thanks for the feedback @jcpowermac! Updated to replace the broken Format markers with CEL XValidation rules instead of removing validation entirely:
Updated the generated CRD YAML as well. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
pkg/types/vsphere/platform.go (1)
340-340: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low valueConsider bounding array size for CEL cost estimation.
self.all(x, isCIDR(x))/self.all(x, isIP(x))iterate overipAddrs/nameservers, but neither field declaresmaxItems. Kubernetes' CRD Validation Rules guidance recommends settingmaxItems/maxLengthon all array/string fields used in CEL rules to keep the estimated cost bounded. GivenNetworkDeviceSpecis nested under a list of hosts, an unbounded inner list technically compounds the estimated cost, though with the small expected list sizes here (a handful of nameservers/IPs per host) this is unlikely to hit real limits in practice.Also applies to: 349-349
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/types/vsphere/platform.go` at line 340, The CEL validation on NetworkDeviceSpec’s ipAddrs and nameservers fields uses self.all(...) without any array size bound, so add maxItems to both array definitions and keep the existing XValidation rules intact. Update the relevant field declarations in platform.go near NetworkDeviceSpec so Kubernetes can estimate CEL cost safely while preserving the CIDR/IP checks.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@pkg/types/vsphere/platform.go`:
- Line 340: The CEL validation on NetworkDeviceSpec’s ipAddrs and nameservers
fields uses self.all(...) without any array size bound, so add maxItems to both
array definitions and keep the existing XValidation rules intact. Update the
relevant field declarations in platform.go near NetworkDeviceSpec so Kubernetes
can estimate CEL cost safely while preserving the CIDR/IP checks.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 9115fed7-8bcb-4730-a6c4-00db34ca051c
⛔ Files ignored due to path filters (1)
data/data/install.openshift.io_installconfigs.yamlis excluded by!data/data/install.openshift.io_installconfigs.yaml
📒 Files selected for processing (1)
pkg/types/vsphere/platform.go
|
/test ? |
|
/test e2e-vsphere-static-ovn |
|
/ok-to-test |
openshift-ci
Bot
added
ok-to-test
@ankimaha-sys please review ^ |
ankimaha-sys
force-pushed
the
fix-vsphere-networkdevice-ipv6-format
branch
from
6dd43cd to
3094cad
Compare
|
Added |
The NetworkDeviceSpec gateway, ipAddrs, and nameservers fields had both +kubebuilder:validation:Format=ipv4 and Format=ipv6 markers. Since controller-gen only keeps the last marker, the generated CRD schema used format: ipv6, causing valid IPv4 addresses to be rejected. Remove the format markers from these fields so both IPv4 and IPv6 addresses are accepted. Fixes: openshift#10377 Signed-off-by: Ankit Mahajan <ankimaha@redhat.com>
ankimaha-sys
force-pushed
the
fix-vsphere-networkdevice-ipv6-format
branch
from
3094cad to
a7a0b0a
Compare
|
/retest-required |
|
/retest |
| // +kubebuilder:validation:Format=ipv4 | ||
| // +kubebuilder:validation:Format=ipv6 | ||
| // +kubebuilder:validation:XValidation:rule="self.all(x, isIP(x))",message="each nameserver must be a valid IPv4 or IPv6 address" | ||
| // +kubebuilder:validation:MaxItems=10 |
There was a problem hiding this comment.
10 seems excessive for nameservers, and I thought there was a maximum anyway
|
@ankimaha-sys there are no unit tests, there probably should be some |
ankimaha-sys
changed the title
openshift-ci-robot
added
jira/valid-reference
|
@ankimaha-sys: This pull request references Jira Issue OCPBUGS-97953, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
- Reduce nameservers MaxItems from 10 to 3 to match existing Go validation that enforces a maximum of 3 nameservers. - Add unit tests for IPv6 nameserver, invalid nameserver, empty gateway, and IPv6 CIDR ipAddrs to cover the XValidation CEL rules. - Update generated CRD YAML to reflect the MaxItems change. Signed-off-by: Ankit Mahajan <ankimaha@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Ankit Mahajan <ankimaha@redhat.com>
ankimaha-sys
force-pushed
the
fix-vsphere-networkdevice-ipv6-format
branch
from
666d7a0 to
fcadbcd
Compare
|
/jira refresh |
|
@ankimaha-sys: This pull request references Jira Issue OCPBUGS-97953, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@ankimaha-sys: This pull request references Jira Issue OCPBUGS-97953, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
3 participants
Summary
The
NetworkDeviceSpecfields (gateway,ipAddrs,nameservers) inpkg/types/vsphere/platform.gohad both+kubebuilder:validation:Format=ipv4and+kubebuilder:validation:Format=ipv6markers. Sincecontroller-genonly keeps the last marker, the generated CRD schema ended up withformat: ipv6, causing valid IPv4 addresses (e.g.,192.168.1.1,8.8.8.8) to be rejected.This PR removes the
Formatmarkers from these three fields so both IPv4 and IPv6 addresses are accepted. The field descriptions already document the expected input formats.A
Format=ipmarker was considered but is not suitable becauseipAddrsaccepts CIDR notation (e.g.,192.168.1.100/24), which is not a valid IP address format.Fixes #10377
Discovered via: openshift/hive#2851 (comment)
Changes
pkg/types/vsphere/platform.go: Remove+kubebuilder:validation:Format=ipv4and+kubebuilder:validation:Format=ipv6fromgateway,ipAddrs, andnameserversfields inNetworkDeviceSpecdata/data/install.openshift.io_installconfigs.yaml: Remove generatedformat: ipv6from the corresponding CRD schema fieldsVerification
The generated CRD YAML was updated to match the marker changes. The
pkg/asset/store/data/copy is a hardlink todata/data/and is updated automatically.Summary by CodeRabbit
Gatewaycan be empty, or must be a valid IP address.ipAddrsnow requires every entry to be a valid CIDR.nameserversnow requires every entry to be a valid IP address.