-
Notifications
You must be signed in to change notification settings - Fork 210
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1596 from robpblake/ocm-4784-validate-max-pids-limit
OCM-4784 | fix: Ensure we validate maximum pids limit when creating/editing KubeletConfig
- Loading branch information
Showing
9 changed files
with
313 additions
and
78 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,98 @@ | ||
| package kubeletconfig | ||
|
|
||
| import ( | ||
| "fmt" | ||
| v1 "github.com/openshift-online/ocm-sdk-go/clustersmgmt/v1" | ||
| "github.com/openshift/rosa/pkg/rosa" | ||
|
|
||
| "github.com/openshift/rosa/pkg/interactive" | ||
| ) | ||
|
|
||
| //go:generate mockgen -source=config.go -package=kubeletconfig -destination=mock_capability_checker.go | ||
| type CapabilityChecker interface { | ||
| IsCapabilityEnabled(capability string) (bool, error) | ||
| } | ||
|
|
||
| // GetMaxPidsLimit - returns the maximum pids limit for the current organization | ||
| // the maximum is varied depending on whether the current organizaton has | ||
| // the capability.organization.bypass_pids_limit capability | ||
| func GetMaxPidsLimit(client CapabilityChecker) (int, error) { | ||
| enabled, err := client.IsCapabilityEnabled(ByPassPidsLimitCapability) | ||
| if err != nil { | ||
| return -1, err | ||
| } | ||
|
|
||
| if enabled { | ||
| return MaxUnsafePodPidsLimit, nil | ||
| } | ||
| return MaxPodPidsLimit, nil | ||
| } | ||
|
|
||
| func GetInteractiveMaxPidsLimitHelp(maxPidsLimit int) string { | ||
| return fmt.Sprintf(InteractivePodPidsLimitHelp, maxPidsLimit) | ||
| } | ||
|
|
||
| func GetInteractiveInput(maxPidsLimit int, kubeletConfig *v1.KubeletConfig) interactive.Input { | ||
|
|
||
| var defaultLimit = PodPidsLimitOptionDefaultValue | ||
| if kubeletConfig != nil { | ||
| defaultLimit = kubeletConfig.PodPidsLimit() | ||
| } | ||
|
|
||
| return interactive.Input{ | ||
| Question: InteractivePodPidsLimitPrompt, | ||
| Help: GetInteractiveMaxPidsLimitHelp(maxPidsLimit), | ||
| Options: nil, | ||
| Default: defaultLimit, | ||
| Required: true, | ||
| Validators: []interactive.Validator{ | ||
| interactive.MinValue(MinPodPidsLimit), | ||
| interactive.MaxValue(maxPidsLimit), | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| // ValidateOrPromptForRequestedPidsLimit validates user provided limits or prompts via interactive mode | ||
| // if the user hasn't specified any limit on the command line. | ||
| func ValidateOrPromptForRequestedPidsLimit( | ||
| requestedPids int, | ||
| clusterKey string, | ||
| kubeletConfig *v1.KubeletConfig, | ||
| r *rosa.Runtime) (int, error) { | ||
|
|
||
| if requestedPids == PodPidsLimitOptionDefaultValue && !interactive.Enabled() { | ||
| interactive.Enable() | ||
| r.Reporter.Infof("Enabling interactive mode") | ||
| } | ||
|
|
||
| maxPidsLimit, err := GetMaxPidsLimit(r.OCMClient) | ||
| if err != nil { | ||
| return PodPidsLimitOptionDefaultValue, | ||
| r.Reporter.Errorf("Failed to check maximum allowed Pids limit for cluster '%s'", | ||
| clusterKey) | ||
| } | ||
|
|
||
| if interactive.Enabled() { | ||
| requestedPids, err = interactive.GetInt(GetInteractiveInput(maxPidsLimit, kubeletConfig)) | ||
|
|
||
| if err != nil { | ||
| return PodPidsLimitOptionDefaultValue, | ||
| r.Reporter.Errorf("Failed reading requested Pids limit for cluster '%s': '%s'", | ||
| clusterKey, err) | ||
| } | ||
| } | ||
|
|
||
| if requestedPids < MinPodPidsLimit { | ||
| return PodPidsLimitOptionDefaultValue, | ||
| r.Reporter.Errorf("The minimum value for --pod-pids-limit is '%d'. You have supplied '%d'", | ||
| MinPodPidsLimit, requestedPids) | ||
| } | ||
|
|
||
| if requestedPids > maxPidsLimit { | ||
| return PodPidsLimitOptionDefaultValue, | ||
| r.Reporter.Errorf("The maximum value for --pod-pids-limit is '%d'. You have supplied '%d'", | ||
| maxPidsLimit, requestedPids) | ||
| } | ||
|
|
||
| return requestedPids, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| package kubeletconfig | ||
|
|
||
| import ( | ||
| "github.com/golang/mock/gomock" | ||
| . "github.com/onsi/ginkgo/v2/dsl/core" | ||
| . "github.com/onsi/gomega" | ||
| v1 "github.com/openshift-online/ocm-sdk-go/clustersmgmt/v1" | ||
| ) | ||
|
|
||
| var _ = Describe("KubeletConfig Config", func() { | ||
|
|
||
| Context("GetMaxPidsLimit", func() { | ||
|
|
||
| var ctrl *gomock.Controller | ||
| var capabilityChecker *MockCapabilityChecker | ||
|
|
||
| BeforeEach(func() { | ||
| ctrl = gomock.NewController(GinkgoT()) | ||
| capabilityChecker = NewMockCapabilityChecker(ctrl) | ||
| }) | ||
|
|
||
| It("Returns Correct Max Pids Limit When Org Has Capability", func() { | ||
| capabilityChecker.EXPECT().IsCapabilityEnabled(ByPassPidsLimitCapability).Return(true, nil) | ||
|
|
||
| max, err := GetMaxPidsLimit(capabilityChecker) | ||
| Expect(err).NotTo(HaveOccurred()) | ||
| Expect(max).To(Equal(MaxUnsafePodPidsLimit)) | ||
| }) | ||
|
|
||
| It("Returns Correct Max Pids Limit When Org Does Not Have Capability", func() { | ||
| capabilityChecker.EXPECT().IsCapabilityEnabled(ByPassPidsLimitCapability).Return(false, nil) | ||
|
|
||
| max, err := GetMaxPidsLimit(capabilityChecker) | ||
| Expect(err).NotTo(HaveOccurred()) | ||
| Expect(max).To(Equal(MaxPodPidsLimit)) | ||
| }) | ||
| }) | ||
|
|
||
| Context("GetInteractiveMaxPidsLimitHelp", func() { | ||
| It("Correctly generates the Max Pids Limit Interactive Help", func() { | ||
| help := GetInteractiveMaxPidsLimitHelp(5000) | ||
| Expect(help).To(Equal("Set the Pod Pids Limit field to a value between 4096 and 5000")) | ||
| }) | ||
| }) | ||
|
|
||
| Context("GetInteractiveInput", func() { | ||
| It("Correctly generates Interactive Input for pre-existing KubeletConfig", func() { | ||
|
|
||
| builder := v1.KubeletConfigBuilder{} | ||
| kubeletConfig, err := builder.PodPidsLimit(10000).Build() | ||
|
|
||
| Expect(err).NotTo(HaveOccurred()) | ||
|
|
||
| input := GetInteractiveInput(5000, kubeletConfig) | ||
| Expect(input.Required).To(BeTrue()) | ||
| Expect(input.Question).To(Equal(InteractivePodPidsLimitPrompt)) | ||
| Expect(input.Help).To(Equal(GetInteractiveMaxPidsLimitHelp(5000))) | ||
| Expect(len(input.Validators)).To(Equal(2)) | ||
| Expect(input.Default).To(Equal(kubeletConfig.PodPidsLimit())) | ||
| }) | ||
|
|
||
| It("Correctly generates Interactive Input for new KubeletConfig", func() { | ||
| input := GetInteractiveInput(5000, nil) | ||
| Expect(input.Required).To(BeTrue()) | ||
| Expect(input.Question).To(Equal(InteractivePodPidsLimitPrompt)) | ||
| Expect(input.Help).To(Equal(GetInteractiveMaxPidsLimitHelp(5000))) | ||
| Expect(len(input.Validators)).To(Equal(2)) | ||
| Expect(input.Default).To(Equal(PodPidsLimitOptionDefaultValue)) | ||
| }) | ||
| }) | ||
| }) |
Oops, something went wrong.