Validation admission policy#328
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: GunaKKIBM The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @GunaKKIBM. Thanks for your PR. I'm waiting for a etcd-io member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
GunaKKIBM
force-pushed
the
Validation-admission-policy
branch
3 times, most recently
from
7fde28a to
6dc6b74
Compare
There was a problem hiding this comment.
Pull request overview
This PR introduces a Kubernetes ValidatingAdmissionPolicy (VAP) and ValidatingAdmissionPolicyBinding to prevent end-users from updating or deleting operator-managed secondary resources (StatefulSets/Services/ConfigMaps) that are owned by an EtcdCluster, addressing issue #326.
Changes:
- Add a ValidatingAdmissionPolicy that matches UPDATE/DELETE on StatefulSets/Services/ConfigMaps and restricts those operations to the etcd-operator controller manager identity.
- Add a ValidatingAdmissionPolicyBinding to bind/enforce the policy (Deny).
- Wire the policy into the
config/defaultkustomize overlay via vars + a patch so the allowed service account username is derived from the deployed namespace/name.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| config/rbac/validating_admission_policy.yaml | Adds the core ValidatingAdmissionPolicy targeting operator-owned secondary resources. |
| config/rbac/validating_admission_policy_binding.yaml | Adds the binding intended to enforce the policy with Deny. |
| config/rbac/kustomization.yaml | Includes the new VAP/VAPBinding resources in the RBAC kustomization. |
| config/default/validating_admission_policy_patch.yaml | Patches the policy so the allowed username matches the installed service account identity. |
| config/default/kustomizeconfig.yaml | Adds kustomize varReference configuration for substitutions inside the policy expression. |
| config/default/kustomization.yaml | Adds vars/configurations/patch wiring to apply the policy patch in the default overlay. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| metadata: | ||
| name: secondary-resource-protection-binding | ||
| spec: | ||
| policyName: etcd-operator-resource-protection |
| - path: validating_admission_policy_patch.yaml | ||
| target: | ||
| kind: ValidatingAdmissionPolicy | ||
| name: secondary-resource-protection |
| spec: | ||
| validations: | ||
| - expression: | | ||
| request.userInfo.username == "system:serviceaccount:$(NAMESPACE):$(SERVICE_ACCOUNT_NAME)" |
GunaKKIBM
force-pushed
the
Validation-admission-policy
branch
from
6dc6b74 to
689c3b2
Compare
Signed-off-by: Guna K Kambalimath <Guna.Kambalimath@ibm.com>
GunaKKIBM
force-pushed
the
Validation-admission-policy
branch
from
689c3b2 to
dcf49a5
Compare
|
/ok-to-test |
|
@GunaKKIBM pls discuss with @hakman offline, thx |
|
I am reviewing this in the next few days, sorry for the delay. |
#326