[bug-654]: Zero quota should allow infinite usage #211
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
atye
requested review from
gallacher,
tdawe,
alikdell,
hoppea2,
coulof,
shaynafinocchiaro,
sharmilarama,
EvgenyUglov,
bjiang27,
IsaiasA1,
aqu-dell and
xuluna
as code owners
atye
force-pushed
the
bug-654-zero-quota
branch
2 times, most recently
from
05a240c to
869f3aa
Compare
alikdell
previously approved these changes
Feb 21, 2023
shaynafinocchiaro
previously approved these changes
Feb 21, 2023
atye
dismissed stale reviews from shaynafinocchiaro and alikdell
via
214d9a0
atye
force-pushed
the
bug-654-zero-quota
branch
from
869f3aa to
214d9a0
Compare
shaynafinocchiaro
previously approved these changes
Feb 21, 2023
alikdell
previously approved these changes
Feb 21, 2023
| @@ -46,6 +46,3 @@ $K3S kubectl create configmap volumes-create -n karavi --from-file=./volumes_cre | |||
| $K3S kubectl create configmap volumes-delete -n karavi --from-file=./volumes_delete.rego --save-config --dry-run=client -o yaml | $K3S kubectl apply -f - | |||
| $K3S kubectl create configmap volumes-unmap -n karavi --from-file=./volumes_unmap.rego --save-config --dry-run=client -o yaml | $K3S kubectl apply -f - | |||
| $K3S kubectl create configmap volumes-map -n karavi --from-file=./volumes_map.rego --save-config --dry-run=client -o yaml | $K3S kubectl apply -f - | |||
| $K3S kubectl create configmap powerflex-urls -n karavi --from-file=./url.rego --save-config --dry-run=client -o yaml | $K3S kubectl apply -f - | |||
There was a problem hiding this comment.
should you also remove $K3S kubectl create configmap powerscale-volumes-create -n karavi --from-file=./volumes_powerscale_create.rego --save-config --dry-run=client -o yaml | $K3S kubectl apply -f - since that rego file is being removed
atye
dismissed stale reviews from alikdell and shaynafinocchiaro
via
f88e952
shaynafinocchiaro
approved these changes
Feb 21, 2023
alikdell
approved these changes
Feb 21, 2023
|
run e2e test |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR implements infinite capacity usage for PowerFlex and PowreMax if the quota is zero.
This also fixes a data race and cleans up unnecessary code around URL request paths and PowerScale handlers.
Infinite Quota
The volume create policy files are updated to permit roles with zero quota along with roles that have a non-zero allowable quota.
The Redis enforcer is also updated to not check the approved capacity and request capacity for the tenant if the quota is zero. We just approve the request, but still keep track of the approved capacity.
Data Race
The unit tests reported a data race regarding the storage pool cache and the token getter for PowerFlex. This occurs because these entities are using the same goscaleio client and getting/setting the client's login concurrently. The fix is to use different goscaleio clients.
Another solution would be to wrap the goscaleio client with a mutex but the above solution is simpler.
Code Removal
For URL path policy decisions, we want to allow all paths by default so querying OPA for a URL policy decision is unnecessary since we will always allow the request anyway. The URL policy files are removed and the proxy-server code for querying OPA for those policies is removed.
The PowerScale handler should only be a credential shield since PowerScale has its own RBAC. But, we have
volumeCreateandvolumeDeletehandlers which intercept the requests and essentially do nothing except query OPA that the claims exist in the token. There is other middleware in the proxy-server which validates the access token. These handlers are removed so now the proxy-server only handles session authentication with the array and proxies everything else.GitHub Issues
List the GitHub issues impacted by this PR:
Checklist:
How Has This Been Tested?
Please describe the tests that you ran to verify your changes. Please also list any relevant details for your test configuration
New unit tests in the proxy-server handlers and in the redis enforcer, manual testing, and e2e tests.