Skip to content

Commit 996ca15

Browse files
rutvik23rutvik23
committed
fix(api): add missing has() guards to servingCerts CEL validation rule
 The CEL rule validating that APIServer loadBalancer hostname is not in servingCerts namedCertificates fails with "no such key" when servingCerts or namedCertificates are not set. This adds has() guards for servingCerts, namedCertificates, and cert.names fields to prevent the error. Fixes: OCPBUGS-77827 Signed-off-by: rutvik23 <rkshirsa@redhat.com>
1 parent 60802b1 commit 996ca15

19 files changed

Lines changed: 109 additions & 34 deletions

‎api/hypershift/v1beta1/hostedcluster_types.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -524,7 +524,7 @@ type Capabilities struct {
524524
// +kubebuilder:validation:XValidation:rule=`self.platform.type == "Azure" ? self.services.exists(s, s.service == "Konnectivity" && s.servicePublishingStrategy.type == "Route") : true`,message="Azure platform requires Konnectivity to use Route service publishing strategy"
525525
// +kubebuilder:validation:XValidation:rule=`self.platform.type == "Azure" ? self.services.exists(s, s.service == "Ignition" && s.servicePublishingStrategy.type == "Route") : true`,message="Azure platform requires Ignition to use Route service publishing strategy"
526526
// +kubebuilder:validation:XValidation:rule=`has(self.issuerURL) || !has(self.serviceAccountSigningKey)`,message="If serviceAccountSigningKey is set, issuerURL must be set"
527-
// +kubebuilder:validation:XValidation:rule=`!self.services.exists(s, s.service == 'APIServer' && has(s.servicePublishingStrategy.loadBalancer) && s.servicePublishingStrategy.loadBalancer.hostname != "" && has(self.configuration) && has(self.configuration.apiServer) && self.configuration.apiServer.servingCerts.namedCertificates.exists(cert, cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))`, message="APIServer loadBalancer hostname cannot be in ClusterConfiguration.apiserver.servingCerts.namedCertificates[]"
527+
// +kubebuilder:validation:XValidation:rule=`!self.services.exists(s, s.service == 'APIServer' && has(s.servicePublishingStrategy.loadBalancer) && s.servicePublishingStrategy.loadBalancer.hostname != "" && has(self.configuration) && has(self.configuration.apiServer) && has(self.configuration.apiServer.servingCerts) && has(self.configuration.apiServer.servingCerts.namedCertificates) && self.configuration.apiServer.servingCerts.namedCertificates.exists(cert, has(cert.names) && cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))`, message="APIServer loadBalancer hostname cannot be in ClusterConfiguration.apiserver.servingCerts.namedCertificates[]"
528528
// +kubebuilder:validation:XValidation:rule="!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork) || !self.operatorConfiguration.clusterNetworkOperator.disableMultiNetwork || self.networking.networkType == 'Other'",message="disableMultiNetwork can only be set to true when networkType is 'Other'"
529529
// +kubebuilder:validation:XValidation:rule="self.networking.networkType == 'OVNKubernetes' || !has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator) || !has(self.operatorConfiguration.clusterNetworkOperator.ovnKubernetesConfig)", message="ovnKubernetesConfig is forbidden when networkType is not OVNKubernetes"
530530
type HostedClusterSpec struct {

‎api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6348,8 +6348,10 @@ spec:
63486348
- message: APIServer loadBalancer hostname cannot be in ClusterConfiguration.apiserver.servingCerts.namedCertificates[]
63496349
rule: '!self.services.exists(s, s.service == ''APIServer'' && has(s.servicePublishingStrategy.loadBalancer)
63506350
&& s.servicePublishingStrategy.loadBalancer.hostname != "" && has(self.configuration)
6351-
&& has(self.configuration.apiServer) && self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6352-
cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
6351+
&& has(self.configuration.apiServer) && has(self.configuration.apiServer.servingCerts)
6352+
&& has(self.configuration.apiServer.servingCerts.namedCertificates)
6353+
&& self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6354+
has(cert.names) && cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
63536355
- message: disableMultiNetwork can only be set to true when networkType
63546356
is 'Other'
63556357
rule: '!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator)

‎api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AutoNodeKarpenter.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6467,8 +6467,10 @@ spec:
64676467
- message: APIServer loadBalancer hostname cannot be in ClusterConfiguration.apiserver.servingCerts.namedCertificates[]
64686468
rule: '!self.services.exists(s, s.service == ''APIServer'' && has(s.servicePublishingStrategy.loadBalancer)
64696469
&& s.servicePublishingStrategy.loadBalancer.hostname != "" && has(self.configuration)
6470-
&& has(self.configuration.apiServer) && self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6471-
cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
6470+
&& has(self.configuration.apiServer) && has(self.configuration.apiServer.servingCerts)
6471+
&& has(self.configuration.apiServer.servingCerts.namedCertificates)
6472+
&& self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6473+
has(cert.names) && cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
64726474
- message: disableMultiNetwork can only be set to true when networkType
64736475
is 'Other'
64746476
rule: '!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator)

‎api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6331,8 +6331,10 @@ spec:
63316331
- message: APIServer loadBalancer hostname cannot be in ClusterConfiguration.apiserver.servingCerts.namedCertificates[]
63326332
rule: '!self.services.exists(s, s.service == ''APIServer'' && has(s.servicePublishingStrategy.loadBalancer)
63336333
&& s.servicePublishingStrategy.loadBalancer.hostname != "" && has(self.configuration)
6334-
&& has(self.configuration.apiServer) && self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6335-
cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
6334+
&& has(self.configuration.apiServer) && has(self.configuration.apiServer.servingCerts)
6335+
&& has(self.configuration.apiServer.servingCerts.namedCertificates)
6336+
&& self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6337+
has(cert.names) && cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
63366338
- message: disableMultiNetwork can only be set to true when networkType
63376339
is 'Other'
63386340
rule: '!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator)

‎api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6351,8 +6351,10 @@ spec:
63516351
- message: APIServer loadBalancer hostname cannot be in ClusterConfiguration.apiserver.servingCerts.namedCertificates[]
63526352
rule: '!self.services.exists(s, s.service == ''APIServer'' && has(s.servicePublishingStrategy.loadBalancer)
63536353
&& s.servicePublishingStrategy.loadBalancer.hostname != "" && has(self.configuration)
6354-
&& has(self.configuration.apiServer) && self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6355-
cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
6354+
&& has(self.configuration.apiServer) && has(self.configuration.apiServer.servingCerts)
6355+
&& has(self.configuration.apiServer.servingCerts.namedCertificates)
6356+
&& self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6357+
has(cert.names) && cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
63566358
- message: disableMultiNetwork can only be set to true when networkType
63576359
is 'Other'
63586360
rule: '!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator)

‎api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6664,8 +6664,10 @@ spec:
66646664
- message: APIServer loadBalancer hostname cannot be in ClusterConfiguration.apiserver.servingCerts.namedCertificates[]
66656665
rule: '!self.services.exists(s, s.service == ''APIServer'' && has(s.servicePublishingStrategy.loadBalancer)
66666666
&& s.servicePublishingStrategy.loadBalancer.hostname != "" && has(self.configuration)
6667-
&& has(self.configuration.apiServer) && self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6668-
cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
6667+
&& has(self.configuration.apiServer) && has(self.configuration.apiServer.servingCerts)
6668+
&& has(self.configuration.apiServer.servingCerts.namedCertificates)
6669+
&& self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6670+
has(cert.names) && cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
66696671
- message: disableMultiNetwork can only be set to true when networkType
66706672
is 'Other'
66716673
rule: '!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator)

‎api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUIDAndExtraClaimMappings.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6804,8 +6804,10 @@ spec:
68046804
- message: APIServer loadBalancer hostname cannot be in ClusterConfiguration.apiserver.servingCerts.namedCertificates[]
68056805
rule: '!self.services.exists(s, s.service == ''APIServer'' && has(s.servicePublishingStrategy.loadBalancer)
68066806
&& s.servicePublishingStrategy.loadBalancer.hostname != "" && has(self.configuration)
6807-
&& has(self.configuration.apiServer) && self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6808-
cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
6807+
&& has(self.configuration.apiServer) && has(self.configuration.apiServer.servingCerts)
6808+
&& has(self.configuration.apiServer.servingCerts.namedCertificates)
6809+
&& self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6810+
has(cert.names) && cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
68096811
- message: disableMultiNetwork can only be set to true when networkType
68106812
is 'Other'
68116813
rule: '!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator)

‎api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCWithUpstreamParity.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6785,8 +6785,10 @@ spec:
67856785
- message: APIServer loadBalancer hostname cannot be in ClusterConfiguration.apiserver.servingCerts.namedCertificates[]
67866786
rule: '!self.services.exists(s, s.service == ''APIServer'' && has(s.servicePublishingStrategy.loadBalancer)
67876787
&& s.servicePublishingStrategy.loadBalancer.hostname != "" && has(self.configuration)
6788-
&& has(self.configuration.apiServer) && self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6789-
cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
6788+
&& has(self.configuration.apiServer) && has(self.configuration.apiServer.servingCerts)
6789+
&& has(self.configuration.apiServer.servingCerts.namedCertificates)
6790+
&& self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6791+
has(cert.names) && cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
67906792
- message: disableMultiNetwork can only be set to true when networkType
67916793
is 'Other'
67926794
rule: '!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator)

‎api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/GCPPlatform.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6777,8 +6777,10 @@ spec:
67776777
- message: APIServer loadBalancer hostname cannot be in ClusterConfiguration.apiserver.servingCerts.namedCertificates[]
67786778
rule: '!self.services.exists(s, s.service == ''APIServer'' && has(s.servicePublishingStrategy.loadBalancer)
67796779
&& s.servicePublishingStrategy.loadBalancer.hostname != "" && has(self.configuration)
6780-
&& has(self.configuration.apiServer) && self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6781-
cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
6780+
&& has(self.configuration.apiServer) && has(self.configuration.apiServer.servingCerts)
6781+
&& has(self.configuration.apiServer.servingCerts.namedCertificates)
6782+
&& self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6783+
has(cert.names) && cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
67826784
- message: disableMultiNetwork can only be set to true when networkType
67836785
is 'Other'
67846786
rule: '!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator)

‎api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/HCPEtcdBackup.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6396,8 +6396,10 @@ spec:
63966396
- message: APIServer loadBalancer hostname cannot be in ClusterConfiguration.apiserver.servingCerts.namedCertificates[]
63976397
rule: '!self.services.exists(s, s.service == ''APIServer'' && has(s.servicePublishingStrategy.loadBalancer)
63986398
&& s.servicePublishingStrategy.loadBalancer.hostname != "" && has(self.configuration)
6399-
&& has(self.configuration.apiServer) && self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6400-
cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
6399+
&& has(self.configuration.apiServer) && has(self.configuration.apiServer.servingCerts)
6400+
&& has(self.configuration.apiServer.servingCerts.namedCertificates)
6401+
&& self.configuration.apiServer.servingCerts.namedCertificates.exists(cert,
6402+
has(cert.names) && cert.names.exists(n, n == s.servicePublishingStrategy.loadBalancer.hostname)))'
64016403
- message: disableMultiNetwork can only be set to true when networkType
64026404
is 'Other'
64036405
rule: '!has(self.operatorConfiguration) || !has(self.operatorConfiguration.clusterNetworkOperator)

0 commit comments

Comments
 (0)