Merge pull request #5258 from enxebre/relax-ibm-network-cel

NO-JIRA: Relax networking cel validation for IBMCloud
openshift · Dec 9, 2024 · ed84741 · ed84741
2 parents 3f21b14 + 0046f9d
commit ed84741
Show file tree

Hide file tree

Showing 22 changed files with 89 additions and 163 deletions.
diff --git a/api/hypershift/v1beta1/hostedcluster_types.go b/api/hypershift/v1beta1/hostedcluster_types.go
@@ -357,7 +357,9 @@ const (
 // +kubebuilder:validation:XValidation:rule=`self.platform.type == "Azure" ? self.services.exists(s, s.service == "Konnectivity" && s.servicePublishingStrategy.type == "Route" && s.servicePublishingStrategy.route.hostname != "") : true`,message="Azure platform requires Konnectivity Route service with a hostname to be defined"
 // +kubebuilder:validation:XValidation:rule=`self.platform.type == "Azure" ? self.services.exists(s, s.service == "Ignition" && s.servicePublishingStrategy.type == "Route" && s.servicePublishingStrategy.route.hostname != "") : true`,message="Azure platform requires Ignition Route service with a hostname to be defined"
 // +kubebuilder:validation:XValidation:rule=`has(self.issuerURL) || !has(self.serviceAccountSigningKey)`,message="If serviceAccountSigningKey is set, issuerURL must be set"
-
+// TODO(alberto): Use CEL cidr library for all these validation when all management clusters are >= 1.31.
+// TODO(alberto): Move this down to the networking section when IBMCloud has finished valid input migration.
+// +kubebuilder:validation:XValidation:rule=`(self.platform.type == "IBMCloud" || !has(self.networking.machineNetwork) && self.networking.clusterNetwork.all(c, self.networking.serviceNetwork.all(s, c.cidr != s.cidr)) || (has(self.networking.machineNetwork) && (self.networking.machineNetwork.all(m, self.networking.clusterNetwork.all(c, m.cidr != c.cidr)) && self.networking.machineNetwork.all(m, self.networking.serviceNetwork.all(s, m.cidr != s.cidr)) && self.networking.clusterNetwork.all(c, self.networking.serviceNetwork.all(s, c.cidr != s.cidr)))))`,message="CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork must be unique and non-overlapping"
 type HostedClusterSpec struct {
 	// release specifies the desired OCP release payload for all the hosted cluster components.
 	// This includes those components running management side like the Kube API Server and the CVO but also the operands which land in the hosted cluster data plane like the ingress controller, ovn agents, etc.
@@ -853,9 +855,6 @@ type DNSSpec struct {
 // clusterNetworking specifies network configuration for a cluster.
 // All CIDRs must be unique. Additional validation to check for CIDRs overlap and consistent network stack is performed by the controllers.
 // Failing that validation will result in the HostedCluster being degraded and the validConfiguration condition being false.
-// TODO this is available in vanilla kube from 1.31 API servers and in Openshift from 4.16.
-// TODO(alberto): Use CEL cidr library for all these validation when all management clusters are >= 1.31.
-// +kubebuilder:validation:XValidation:rule="(!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s, c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m, self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m, self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c, self.serviceNetwork.all(s, c.cidr != s.cidr)))))",message="CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork must be unique and non-overlapping"
 type ClusterNetworking struct {
 	// machineNetwork is the list of IP address pools for machines.
 	// This might be used among other things to generate appropriate networking security groups in some clouds providers.

diff --git a/...erated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml b/...erated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml
@@ -2514,14 +2514,6 @@ spec:
                         once set.
                       rule: self == oldSelf
                 type: object
-                x-kubernetes-validations:
-                - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
-                    must be unique and non-overlapping
-                  rule: (!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s,
-                    c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m,
-                    self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
-                    self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
-                    self.serviceNetwork.all(s, c.cidr != s.cidr)))))
               nodeSelector:
                 additionalProperties:
                   type: string
@@ -4088,6 +4080,14 @@ spec:
                 != "") : true'
             - message: If serviceAccountSigningKey is set, issuerURL must be set
               rule: has(self.issuerURL) || !has(self.serviceAccountSigningKey)
+            - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
+                must be unique and non-overlapping
+              rule: (self.platform.type == "IBMCloud" || !has(self.networking.machineNetwork)
+                && self.networking.clusterNetwork.all(c, self.networking.serviceNetwork.all(s,
+                c.cidr != s.cidr)) || (has(self.networking.machineNetwork) && (self.networking.machineNetwork.all(m,
+                self.networking.clusterNetwork.all(c, m.cidr != c.cidr)) && self.networking.machineNetwork.all(m,
+                self.networking.serviceNetwork.all(s, m.cidr != s.cidr)) && self.networking.clusterNetwork.all(c,
+                self.networking.serviceNetwork.all(s, c.cidr != s.cidr)))))
           status:
             description: Status is the latest observed status of the HostedCluster.
             properties:

diff --git a/...regated-crd-manifests/hostedclusters.hypershift.openshift.io/AROHCPManagedIdentities.yaml b/...regated-crd-manifests/hostedclusters.hypershift.openshift.io/AROHCPManagedIdentities.yaml
@@ -2510,14 +2510,6 @@ spec:
                         once set.
                       rule: self == oldSelf
                 type: object
-                x-kubernetes-validations:
-                - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
-                    must be unique and non-overlapping
-                  rule: (!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s,
-                    c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m,
-                    self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
-                    self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
-                    self.serviceNetwork.all(s, c.cidr != s.cidr)))))
               nodeSelector:
                 additionalProperties:
                   type: string
@@ -4333,6 +4325,14 @@ spec:
                 != "") : true'
             - message: If serviceAccountSigningKey is set, issuerURL must be set
               rule: has(self.issuerURL) || !has(self.serviceAccountSigningKey)
+            - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
+                must be unique and non-overlapping
+              rule: (self.platform.type == "IBMCloud" || !has(self.networking.machineNetwork)
+                && self.networking.clusterNetwork.all(c, self.networking.serviceNetwork.all(s,
+                c.cidr != s.cidr)) || (has(self.networking.machineNetwork) && (self.networking.machineNetwork.all(m,
+                self.networking.clusterNetwork.all(c, m.cidr != c.cidr)) && self.networking.machineNetwork.all(m,
+                self.networking.serviceNetwork.all(s, m.cidr != s.cidr)) && self.networking.clusterNetwork.all(c,
+                self.networking.serviceNetwork.all(s, c.cidr != s.cidr)))))
           status:
             description: Status is the latest observed status of the HostedCluster.
             properties:

diff --git a/...gated-crd-manifests/hostedclusters.hypershift.openshift.io/DynamicResourceAllocation.yaml b/...gated-crd-manifests/hostedclusters.hypershift.openshift.io/DynamicResourceAllocation.yaml
@@ -2531,14 +2531,6 @@ spec:
                         once set.
                       rule: self == oldSelf
                 type: object
-                x-kubernetes-validations:
-                - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
-                    must be unique and non-overlapping
-                  rule: (!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s,
-                    c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m,
-                    self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
-                    self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
-                    self.serviceNetwork.all(s, c.cidr != s.cidr)))))
               nodeSelector:
                 additionalProperties:
                   type: string
@@ -4097,6 +4089,14 @@ spec:
                 != "") : true'
             - message: If serviceAccountSigningKey is set, issuerURL must be set
               rule: has(self.issuerURL) || !has(self.serviceAccountSigningKey)
+            - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
+                must be unique and non-overlapping
+              rule: (self.platform.type == "IBMCloud" || !has(self.networking.machineNetwork)
+                && self.networking.clusterNetwork.all(c, self.networking.serviceNetwork.all(s,
+                c.cidr != s.cidr)) || (has(self.networking.machineNetwork) && (self.networking.machineNetwork.all(m,
+                self.networking.clusterNetwork.all(c, m.cidr != c.cidr)) && self.networking.machineNetwork.all(m,
+                self.networking.serviceNetwork.all(s, m.cidr != s.cidr)) && self.networking.clusterNetwork.all(c,
+                self.networking.serviceNetwork.all(s, c.cidr != s.cidr)))))
           status:
             description: Status is the latest observed status of the HostedCluster.
             properties:

diff --git a/...rated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml b/...rated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml
@@ -2752,14 +2752,6 @@ spec:
                         once set.
                       rule: self == oldSelf
                 type: object
-                x-kubernetes-validations:
-                - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
-                    must be unique and non-overlapping
-                  rule: (!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s,
-                    c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m,
-                    self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
-                    self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
-                    self.serviceNetwork.all(s, c.cidr != s.cidr)))))
               nodeSelector:
                 additionalProperties:
                   type: string
@@ -4318,6 +4310,14 @@ spec:
                 != "") : true'
             - message: If serviceAccountSigningKey is set, issuerURL must be set
               rule: has(self.issuerURL) || !has(self.serviceAccountSigningKey)
+            - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
+                must be unique and non-overlapping
+              rule: (self.platform.type == "IBMCloud" || !has(self.networking.machineNetwork)
+                && self.networking.clusterNetwork.all(c, self.networking.serviceNetwork.all(s,
+                c.cidr != s.cidr)) || (has(self.networking.machineNetwork) && (self.networking.machineNetwork.all(m,
+                self.networking.clusterNetwork.all(c, m.cidr != c.cidr)) && self.networking.machineNetwork.all(m,
+                self.networking.serviceNetwork.all(s, m.cidr != s.cidr)) && self.networking.clusterNetwork.all(c,
+                self.networking.serviceNetwork.all(s, c.cidr != s.cidr)))))
           status:
             description: Status is the latest observed status of the HostedCluster.
             properties:

diff --git a/...ated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPPodsLabels.yaml b/...ated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPPodsLabels.yaml
@@ -2523,14 +2523,6 @@ spec:
                         once set.
                       rule: self == oldSelf
                 type: object
-                x-kubernetes-validations:
-                - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
-                    must be unique and non-overlapping
-                  rule: (!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s,
-                    c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m,
-                    self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
-                    self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
-                    self.serviceNetwork.all(s, c.cidr != s.cidr)))))
               nodeSelector:
                 additionalProperties:
                   type: string
@@ -4089,6 +4081,14 @@ spec:
                 != "") : true'
             - message: If serviceAccountSigningKey is set, issuerURL must be set
               rule: has(self.issuerURL) || !has(self.serviceAccountSigningKey)
+            - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
+                must be unique and non-overlapping
+              rule: (self.platform.type == "IBMCloud" || !has(self.networking.machineNetwork)
+                && self.networking.clusterNetwork.all(c, self.networking.serviceNetwork.all(s,
+                c.cidr != s.cidr)) || (has(self.networking.machineNetwork) && (self.networking.machineNetwork.all(m,
+                self.networking.clusterNetwork.all(c, m.cidr != c.cidr)) && self.networking.machineNetwork.all(m,
+                self.networking.serviceNetwork.all(s, m.cidr != s.cidr)) && self.networking.clusterNetwork.all(c,
+                self.networking.serviceNetwork.all(s, c.cidr != s.cidr)))))
           status:
             description: Status is the latest observed status of the HostedCluster.
             properties:

diff --git a/...egated-crd-manifests/hostedclusters.hypershift.openshift.io/NetworkDiagnosticsConfig.yaml b/...egated-crd-manifests/hostedclusters.hypershift.openshift.io/NetworkDiagnosticsConfig.yaml
@@ -2662,14 +2662,6 @@ spec:
                         once set.
                       rule: self == oldSelf
                 type: object
-                x-kubernetes-validations:
-                - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
-                    must be unique and non-overlapping
-                  rule: (!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s,
-                    c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m,
-                    self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
-                    self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
-                    self.serviceNetwork.all(s, c.cidr != s.cidr)))))
               nodeSelector:
                 additionalProperties:
                   type: string
@@ -4228,6 +4220,14 @@ spec:
                 != "") : true'
             - message: If serviceAccountSigningKey is set, issuerURL must be set
               rule: has(self.issuerURL) || !has(self.serviceAccountSigningKey)
+            - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
+                must be unique and non-overlapping
+              rule: (self.platform.type == "IBMCloud" || !has(self.networking.machineNetwork)
+                && self.networking.clusterNetwork.all(c, self.networking.serviceNetwork.all(s,
+                c.cidr != s.cidr)) || (has(self.networking.machineNetwork) && (self.networking.machineNetwork.all(m,
+                self.networking.clusterNetwork.all(c, m.cidr != c.cidr)) && self.networking.machineNetwork.all(m,
+                self.networking.serviceNetwork.all(s, m.cidr != s.cidr)) && self.networking.clusterNetwork.all(c,
+                self.networking.serviceNetwork.all(s, c.cidr != s.cidr)))))
           status:
             description: Status is the latest observed status of the HostedCluster.
             properties:

diff --git a/...enerated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml b/...enerated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/OpenStack.yaml
@@ -2510,14 +2510,6 @@ spec:
                         once set.
                       rule: self == oldSelf
                 type: object
-                x-kubernetes-validations:
-                - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
-                    must be unique and non-overlapping
-                  rule: (!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s,
-                    c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m,
-                    self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
-                    self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
-                    self.serviceNetwork.all(s, c.cidr != s.cidr)))))
               nodeSelector:
                 additionalProperties:
                   type: string
@@ -4564,6 +4556,14 @@ spec:
                 != "") : true'
             - message: If serviceAccountSigningKey is set, issuerURL must be set
               rule: has(self.issuerURL) || !has(self.serviceAccountSigningKey)
+            - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
+                must be unique and non-overlapping
+              rule: (self.platform.type == "IBMCloud" || !has(self.networking.machineNetwork)
+                && self.networking.clusterNetwork.all(c, self.networking.serviceNetwork.all(s,
+                c.cidr != s.cidr)) || (has(self.networking.machineNetwork) && (self.networking.machineNetwork.all(m,
+                self.networking.clusterNetwork.all(c, m.cidr != c.cidr)) && self.networking.machineNetwork.all(m,
+                self.networking.serviceNetwork.all(s, m.cidr != s.cidr)) && self.networking.clusterNetwork.all(c,
+                self.networking.serviceNetwork.all(s, c.cidr != s.cidr)))))
           status:
             description: Status is the latest observed status of the HostedCluster.
             properties:

diff --git a/...d.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml b/...d.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AAA_ungated.yaml
@@ -2431,14 +2431,6 @@ spec:
                         once set.
                       rule: self == oldSelf
                 type: object
-                x-kubernetes-validations:
-                - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
-                    must be unique and non-overlapping
-                  rule: (!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s,
-                    c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m,
-                    self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
-                    self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
-                    self.serviceNetwork.all(s, c.cidr != s.cidr)))))
               nodeSelector:
                 additionalProperties:
                   type: string

diff --git a/...ed-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AROHCPManagedIdentities.yaml b/...ed-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/AROHCPManagedIdentities.yaml
@@ -2427,14 +2427,6 @@ spec:
                         once set.
                       rule: self == oldSelf
                 type: object
-                x-kubernetes-validations:
-                - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
-                    must be unique and non-overlapping
-                  rule: (!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s,
-                    c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m,
-                    self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
-                    self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
-                    self.serviceNetwork.all(s, c.cidr != s.cidr)))))
               nodeSelector:
                 additionalProperties:
                   type: string

diff --git a/...-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/DynamicResourceAllocation.yaml b/...-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/DynamicResourceAllocation.yaml
@@ -2448,14 +2448,6 @@ spec:
                         once set.
                       rule: self == oldSelf
                 type: object
-                x-kubernetes-validations:
-                - message: CIDR ranges in machineNetwork, clusterNetwork, and serviceNetwork
-                    must be unique and non-overlapping
-                  rule: (!has(self.machineNetwork) && self.clusterNetwork.all(c, self.serviceNetwork.all(s,
-                    c.cidr != s.cidr)) || (has(self.machineNetwork) && (self.machineNetwork.all(m,
-                    self.clusterNetwork.all(c, m.cidr != c.cidr)) && self.machineNetwork.all(m,
-                    self.serviceNetwork.all(s, m.cidr != s.cidr)) && self.clusterNetwork.all(c,
-                    self.serviceNetwork.all(s, c.cidr != s.cidr)))))
               nodeSelector:
                 additionalProperties:
                   type: string