Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make downwardMetric feature gate opt-in #2844

Merged
merged 1 commit into from
Apr 3, 2024

Conversation

jcanocan
Copy link
Contributor

What this PR does / why we need it:
The feature gate downwardMetric is an opt-out feature gate. This is due to backward compatibility reasons. Before this feature gate was introduced, it was hardcoded. It makes this feature gate to be disabled by default, leaving this decision to the final user.
Reviewer Checklist

Reviewers are supposed to review the PR for every aspect below one by one. To check an item means the PR is either "OK" or "Not Applicable" in terms of that item. All items are supposed to be checked before merging a PR.

  • PR Message
  • Commit Messages
  • How to test
  • Unit Tests
  • Functional Tests
  • User Documentation
  • Developer Documentation
  • Upgrade Scenario
  • Uninstallation Scenario
  • Backward Compatibility
  • Troubleshooting Friendly

Jira Ticket:


Release note:

Disable by default the `downwardMetric` feature gate

@kubevirt-bot kubevirt-bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. labels Mar 15, 2024
@jcanocan
Copy link
Contributor Author

/cc @nunnatsa

@kubevirt-bot kubevirt-bot requested a review from nunnatsa March 15, 2024 15:11
@jcanocan jcanocan force-pushed the default-downward-metrics branch from 79415f9 to 0d8096b Compare March 15, 2024 15:15
@coveralls
Copy link
Collaborator

coveralls commented Mar 15, 2024

Pull Request Test Coverage Report for Build 8508193253

Details

  • 1 of 1 (100.0%) changed or added relevant line in 1 file are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage decreased (-0.007%) to 86.061%

Totals Coverage Status
Change from base Build 8497598491: -0.007%
Covered Lines: 5279
Relevant Lines: 6134

💛 - Coveralls

@nunnatsa
Copy link
Collaborator

Looks good in general. Please also update the e2e defaults test to match this change. It currently fails in ci.

@hco-bot
Copy link
Collaborator

hco-bot commented Mar 15, 2024

hco-e2e-kv-smoke-azure lane succeeded.
/override ci/prow/hco-e2e-kv-smoke-gcp

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-kv-smoke-gcp

In response to this:

hco-e2e-kv-smoke-azure lane succeeded.
/override ci/prow/hco-e2e-kv-smoke-gcp

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@@ -395,6 +395,8 @@ type VirtualMachineOptions struct {
type HyperConvergedFeatureGates struct {
// Allow to expose a limited set of host metrics to guests.
// +optional
// +kubebuilder:default=false
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jcanocan please also add the default value for the FeatureGates field (line 69), and for the spec field (line 824).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

@kubevirt-bot kubevirt-bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 20, 2024
The feature gate `downwardMetric` is an opt-out feature gate. This is
due to backward compatibility reasons. Before this feature gate was
introduced, it was hardcoded. It makes this feature gate to be
disabled by default, leaving this decision to the final user.

Signed-off-by: Javier Cano Cano <[email protected]>
@jcanocan jcanocan force-pushed the default-downward-metrics branch from 0d8096b to 8399021 Compare April 1, 2024 12:43
@kubevirt-bot kubevirt-bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 1, 2024
Copy link

sonarqubecloud bot commented Apr 1, 2024

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

@jcanocan
Copy link
Contributor Author

jcanocan commented Apr 1, 2024

Looks good in general. Please also update the e2e defaults test to match this change. It currently fails in ci.

Thanks for the pointer. I wasn't aware of such tests. Done!

@hco-bot
Copy link
Collaborator

hco-bot commented Apr 1, 2024

hco-e2e-consecutive-operator-sdk-upgrades-aws lane succeeded.
/override ci/prow/hco-e2e-consecutive-operator-sdk-upgrades-azure
okd-hco-e2e-upgrade-operator-sdk-aws lane succeeded.
/override ci/prow/okd-hco-e2e-upgrade-operator-sdk-gcp
okd-hco-e2e-operator-sdk-aws lane succeeded.
/override ci/prow/okd-hco-e2e-operator-sdk-gcp
hco-e2e-upgrade-operator-sdk-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-sno-azure
hco-e2e-upgrade-prev-operator-sdk-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-operator-sdk-sno-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-consecutive-operator-sdk-upgrades-azure, ci/prow/hco-e2e-upgrade-operator-sdk-sno-azure, ci/prow/hco-e2e-upgrade-prev-operator-sdk-sno-azure, ci/prow/okd-hco-e2e-operator-sdk-gcp, ci/prow/okd-hco-e2e-upgrade-operator-sdk-gcp

In response to this:

hco-e2e-consecutive-operator-sdk-upgrades-aws lane succeeded.
/override ci/prow/hco-e2e-consecutive-operator-sdk-upgrades-azure
okd-hco-e2e-upgrade-operator-sdk-aws lane succeeded.
/override ci/prow/okd-hco-e2e-upgrade-operator-sdk-gcp
okd-hco-e2e-operator-sdk-aws lane succeeded.
/override ci/prow/okd-hco-e2e-operator-sdk-gcp
hco-e2e-upgrade-operator-sdk-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-sno-azure
hco-e2e-upgrade-prev-operator-sdk-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-operator-sdk-sno-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@nunnatsa
Copy link
Collaborator

nunnatsa commented Apr 1, 2024

/retest

@hco-bot
Copy link
Collaborator

hco-bot commented Apr 1, 2024

hco-e2e-operator-sdk-sno-aws lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-sno-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-operator-sdk-sno-azure

In response to this:

hco-e2e-operator-sdk-sno-aws lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-sno-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hco-bot
Copy link
Collaborator

hco-bot commented Apr 1, 2024

hco-e2e-operator-sdk-gcp lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-aws
hco-e2e-operator-sdk-gcp lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-operator-sdk-aws, ci/prow/hco-e2e-operator-sdk-azure

In response to this:

hco-e2e-operator-sdk-gcp lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-aws
hco-e2e-operator-sdk-gcp lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hco-bot
Copy link
Collaborator

hco-bot commented Apr 1, 2024

hco-e2e-operator-sdk-sno-aws lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-sno-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-operator-sdk-sno-azure

In response to this:

hco-e2e-operator-sdk-sno-aws lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-sno-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hco-bot
Copy link
Collaborator

hco-bot commented Apr 1, 2024

hco-e2e-upgrade-operator-sdk-azure lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-aws

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-upgrade-operator-sdk-aws

In response to this:

hco-e2e-upgrade-operator-sdk-azure lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-aws

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@nunnatsa
Copy link
Collaborator

nunnatsa commented Apr 1, 2024

/test hco-e2e-upgrade-prev-operator-sdk-aws
/test hco-e2e-upgrade-prev-operator-sdk-azure

@kubevirt-bot
Copy link
Contributor

@nunnatsa: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

  • /test build-hco-test-utils-image
  • /test pull-hyperconverged-cluster-operator-e2e-k8s-1.27
  • /test pull-hyperconverged-cluster-operator-e2e-k8s-1.28

Use /test all to run the following jobs that were automatically triggered:

  • pull-hyperconverged-cluster-operator-e2e-k8s-1.27
  • pull-hyperconverged-cluster-operator-e2e-k8s-1.28

In response to this:

/test hco-e2e-upgrade-prev-operator-sdk-aws
/test hco-e2e-upgrade-prev-operator-sdk-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hco-bot
Copy link
Collaborator

hco-bot commented Apr 1, 2024

hco-e2e-kv-smoke-gcp lane succeeded.
/override ci/prow/hco-e2e-kv-smoke-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-kv-smoke-azure

In response to this:

hco-e2e-kv-smoke-gcp lane succeeded.
/override ci/prow/hco-e2e-kv-smoke-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Copy link
Collaborator

@nunnatsa nunnatsa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's OK. @tiraboschi - WDYT? will it work on update?

@kubevirt-bot kubevirt-bot added the lgtm Indicates that a PR is ready to be merged. label Apr 1, 2024
@hco-bot
Copy link
Collaborator

hco-bot commented Apr 1, 2024

hco-e2e-upgrade-prev-operator-sdk-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-operator-sdk-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-upgrade-prev-operator-sdk-azure

In response to this:

hco-e2e-upgrade-prev-operator-sdk-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-operator-sdk-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Copy link

openshift-ci bot commented Apr 1, 2024

@jcanocan: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/okd-hco-e2e-operator-sdk-gcp 8399021 link true /test okd-hco-e2e-operator-sdk-gcp
ci/prow/okd-hco-e2e-upgrade-operator-sdk-gcp 8399021 link true /test okd-hco-e2e-upgrade-operator-sdk-gcp
ci/prow/hco-e2e-upgrade-prev-operator-sdk-sno-azure 8399021 link false /test hco-e2e-upgrade-prev-operator-sdk-sno-azure
ci/prow/hco-e2e-upgrade-operator-sdk-sno-azure 8399021 link false /test hco-e2e-upgrade-operator-sdk-sno-azure
ci/prow/hco-e2e-consecutive-operator-sdk-upgrades-azure 8399021 link true /test hco-e2e-consecutive-operator-sdk-upgrades-azure
ci/prow/hco-e2e-operator-sdk-aws 8399021 link true /test hco-e2e-operator-sdk-aws
ci/prow/hco-e2e-upgrade-operator-sdk-aws 8399021 link true /test hco-e2e-upgrade-operator-sdk-aws
ci/prow/hco-e2e-operator-sdk-sno-azure 8399021 link false /test hco-e2e-operator-sdk-sno-azure
ci/prow/hco-e2e-kv-smoke-azure 8399021 link true /test hco-e2e-kv-smoke-azure
ci/prow/hco-e2e-upgrade-prev-operator-sdk-azure 8399021 link true /test hco-e2e-upgrade-prev-operator-sdk-azure

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@hco-bot
Copy link
Collaborator

hco-bot commented Apr 1, 2024

hco-e2e-upgrade-prev-operator-sdk-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-operator-sdk-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-upgrade-prev-operator-sdk-azure

In response to this:

hco-e2e-upgrade-prev-operator-sdk-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-operator-sdk-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@nunnatsa
Copy link
Collaborator

nunnatsa commented Apr 3, 2024

/approve

@kubevirt-bot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: nunnatsa

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubevirt-bot kubevirt-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 3, 2024
@kubevirt-bot kubevirt-bot merged commit 18d028f into kubevirt:main Apr 3, 2024
36 checks passed
@jcanocan
Copy link
Contributor Author

jcanocan commented Apr 4, 2024

/cherry-pick release-1.11

@kubevirt-bot
Copy link
Contributor

@jcanocan: #2844 failed to apply on top of branch "release-1.11":

Applying: Make `downwardMetric` feature gate opt-in
.git/rebase-apply/patch:401: trailing whitespace.
**Note**: Updates from previous versions require to enable this feature gate if the metrics was used in any 
warning: 1 line adds whitespace errors.
Using index info to reconstruct a base tree...
M	api/v1beta1/hyperconverged_types.go
M	api/v1beta1/zz_generated.defaults.go
M	api/v1beta1/zz_generated.openapi.go
M	config/crd/bases/hco.kubevirt.io_hyperconvergeds.yaml
M	controllers/hyperconverged/hyperconverged_controller_test.go
M	controllers/operands/kubevirt.go
M	controllers/operands/kubevirt_test.go
M	deploy/crds/hco00.crd.yaml
M	deploy/hco.cr.yaml
A	deploy/index-image/community-kubevirt-hyperconverged/1.12.0/manifests/hco00.crd.yaml
A	deploy/olm-catalog/community-kubevirt-hyperconverged/1.12.0/manifests/hco00.crd.yaml
M	docs/api.md
M	docs/cluster-configuration.md
M	tests/func-tests/defaults_test.go
M	tests/vendor/github.com/kubevirt/hyperconverged-cluster-operator/api/v1beta1/hyperconverged_types.go
M	tests/vendor/github.com/kubevirt/hyperconverged-cluster-operator/api/v1beta1/zz_generated.defaults.go
M	tests/vendor/github.com/kubevirt/hyperconverged-cluster-operator/api/v1beta1/zz_generated.openapi.go
Falling back to patching base and 3-way merge...
Auto-merging tests/vendor/github.com/kubevirt/hyperconverged-cluster-operator/api/v1beta1/zz_generated.openapi.go
Auto-merging tests/vendor/github.com/kubevirt/hyperconverged-cluster-operator/api/v1beta1/zz_generated.defaults.go
Auto-merging tests/vendor/github.com/kubevirt/hyperconverged-cluster-operator/api/v1beta1/hyperconverged_types.go
Auto-merging tests/func-tests/defaults_test.go
Auto-merging docs/cluster-configuration.md
Auto-merging docs/api.md
Auto-merging deploy/olm-catalog/community-kubevirt-hyperconverged/1.11.1/manifests/hco00.crd.yaml
Auto-merging deploy/index-image/community-kubevirt-hyperconverged/1.11.1/manifests/hco00.crd.yaml
Auto-merging deploy/hco.cr.yaml
Auto-merging deploy/crds/hco00.crd.yaml
Auto-merging controllers/operands/kubevirt_test.go
CONFLICT (content): Merge conflict in controllers/operands/kubevirt_test.go
Auto-merging controllers/operands/kubevirt.go
Auto-merging controllers/hyperconverged/hyperconverged_controller_test.go
Auto-merging config/crd/bases/hco.kubevirt.io_hyperconvergeds.yaml
Auto-merging api/v1beta1/zz_generated.openapi.go
Auto-merging api/v1beta1/zz_generated.defaults.go
Auto-merging api/v1beta1/hyperconverged_types.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Make `downwardMetric` feature gate opt-in
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-1.11

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hco-bot
Copy link
Collaborator

hco-bot commented Apr 4, 2024

Rebase Bot action has failed.
Action URL: https://github.com/kubevirt/hyperconverged-cluster-operator/actions/runs/8556193742

@nunnatsa
Copy link
Collaborator

nunnatsa commented Apr 4, 2024

@jcanocan - I think we should not take it to 1.11

@tiraboschi WDYT?

@sarahbx
Copy link

sarahbx commented Apr 4, 2024

Hi @nunnatsa , @tiraboschi,
This is recommended to mitigate https://access.redhat.com/security/cve/CVE-2024-31419 upstream for earlier v1 branches.
A more comprehensive solution to this access would be ideal, and I hope we see something in a future release, but currently any existing consumers of this feature on earlier v1 branches would have to disable this cluster-wide feature manually. While this is classified as 'low' impact, it is still a CVE originating from the kubevirt org without explicit admin approval.

@tiraboschi
Copy link
Member

This is compatibility breaking change so we need at least an intermediate release (1.11 here) to avoid silently breaking upstream users that are currently relying on that.
By the way this is just a partial mitigation since it could only be enabled or disabled at cluster scope with no more fine grained control: so, if at least one VM in the cluster needs it for a good reason, all the other VMs are still going to have it.
So this is still not the right solution.
I'd suggest to properly fix it instead it with a more fine grained API to limit it only to VMs/namespaces that really need it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. lgtm Indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/M
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants