Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ensure virt-export route has redirect policy #12195

Merged
merged 1 commit into from
Jun 26, 2024

Conversation

awels
Copy link
Member

@awels awels commented Jun 21, 2024

What this PR does

Before this PR:
The virt-export route did not have an EdgeTerminationPolicy set.

After this PR:
The virt-export route has an EdgeTerminationPolicy of redirect to ensure that insecure requests are automatically redirected to the secure route.

Fixes https://issues.redhat.com/browse/CNV-43248

Why we need it and why it was done in this way

The following tradeoffs were made:

The following alternatives were considered:

Links to places where the discussion took place:

Special notes for your reviewer

Checklist

This checklist is not enforcing, but it's a reminder of items that could be relevant to every PR.
Approvers are expected to review this list.

Release note

Virt export route has an edge termination of redirect

@kubevirt-bot kubevirt-bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. size/S labels Jun 21, 2024
@awels awels force-pushed the add_redirect_export_route branch from 9a3f24a to 6ee594f Compare June 21, 2024 19:11
@kubevirt-bot kubevirt-bot added the sig/buildsystem Denotes an issue or PR that relates to changes in the build system. label Jun 21, 2024
@awels
Copy link
Member Author

awels commented Jun 22, 2024

/retest

Copy link
Contributor

@fossedihelm fossedihelm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @awels!
General question: Should we redirect or block insecure connections?
Regarding the code: only two little things regarding the pkg.

I know that this is outside of the scope of this PR but I think that only one of GetAllRoutes and NewExportProxyRoute should be exported (maybe the first one).
Currently, NewExportProxyRoute is exported to allow the usage in the kubevirt_test file, which does not look so good to me :)

@@ -0,0 +1,21 @@
package components
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

missing header

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should it be components_test?

@awels
Copy link
Member Author

awels commented Jun 25, 2024

Either block or redirect are options. I am just following what other similar routes do, and they do redirect so I did the same. Let me add the header and change the package name.

The virt-export route should have a redirect
policy to ensure that insecure requests are
automatically redirected to the secure route.

Signed-off-by: Alexander Wels <awels@redhat.com>
@fossedihelm
Copy link
Contributor

Either block or redirect are options. I am just following what other similar routes do, and they do redirect so I did the same. Let me add the header and change the package name.

Fair enough! Thank you!
/lgtm

@kubevirt-bot kubevirt-bot added the lgtm Indicates that a PR is ready to be merged. label Jun 26, 2024
@alicefr
Copy link
Member

alicefr commented Jun 26, 2024

Looks good, thanks!
/approve

@kubevirt-bot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alicefr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubevirt-bot kubevirt-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 26, 2024
@kubevirt-commenter-bot
Copy link

Required labels detected, running phase 2 presubmits:
/test pull-kubevirt-e2e-windows2016
/test pull-kubevirt-e2e-kind-1.27-vgpu
/test pull-kubevirt-e2e-kind-sriov
/test pull-kubevirt-e2e-k8s-1.30-ipv6-sig-network
/test pull-kubevirt-e2e-k8s-1.28-sig-network
/test pull-kubevirt-e2e-k8s-1.28-sig-storage
/test pull-kubevirt-e2e-k8s-1.28-sig-compute
/test pull-kubevirt-e2e-k8s-1.28-sig-operator
/test pull-kubevirt-e2e-k8s-1.29-sig-network
/test pull-kubevirt-e2e-k8s-1.29-sig-storage
/test pull-kubevirt-e2e-k8s-1.29-sig-compute
/test pull-kubevirt-e2e-k8s-1.29-sig-operator

@kubevirt-bot kubevirt-bot merged commit ec4419f into kubevirt:main Jun 26, 2024
41 checks passed
@awels
Copy link
Member Author

awels commented Jun 26, 2024

/cherrypick release-1.3

@kubevirt-bot
Copy link
Contributor

@awels: new pull request created: #12226

In response to this:

/cherrypick release-1.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@awels
Copy link
Member Author

awels commented Jun 26, 2024

/cherrypick release-1.2

@kubevirt-bot
Copy link
Contributor

@awels: new pull request created: #12227

In response to this:

/cherrypick release-1.2

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@awels
Copy link
Member Author

awels commented Jun 26, 2024

/cherrypick release-1.1

@kubevirt-bot
Copy link
Contributor

@awels: #12195 failed to apply on top of branch "release-1.1":

Applying: Ensure virt-export route has redirect policy
Using index info to reconstruct a base tree...
M	pkg/virt-operator/resource/generate/components/BUILD.bazel
Falling back to patching base and 3-way merge...
Auto-merging pkg/virt-operator/resource/generate/components/BUILD.bazel
CONFLICT (content): Merge conflict in pkg/virt-operator/resource/generate/components/BUILD.bazel
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Ensure virt-export route has redirect policy
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherrypick release-1.1

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. lgtm Indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/buildsystem Denotes an issue or PR that relates to changes in the build system. size/M
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants