Skip to content

MAO: Validate GCP disk license URLs at admission #1553

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
redhat-chai-bot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

MAO: Validate GCP disk license URLs at admission #1553

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ go 1.26.0
// an API yet we can leverage so that I do not have to copy what openshift/kubernetes/openshift-hack/cmd/k8s-tests-ext did to initialize.
replace (
github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20260424201627-4d4cc33d669d
github.com/openshift/api => github.com/redhat-chai-bot/api v0.0.0-20260912110502-b75db3fbbc59

k8s.io/apiserver => github.com/openshift/kubernetes/staging/src/k8s.io/apiserver v0.0.0-20260716191900-78acd4d422b2 // openshift kubernetes has very old copy of k8s.io/kubernetes/pkg/kubelet/server/server.go
k8s.io/cri-streaming => github.com/openshift/kubernetes/staging/src/k8s.io/cri-streaming v0.0.0-20260716191900-78acd4d422b2
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -498,8 +498,6 @@ github.com/opencontainers/selinux v1.13.1 h1:A8nNeceYngH9Ow++M+VVEwJVpdFmrlxsN22
github.com/opencontainers/selinux v1.13.1/go.mod h1:S10WXZ/osk2kWOYKy1x2f/eXF5ZHJoUs8UU/2caNRbg=
github.com/openshift-eng/openshift-tests-extension v0.0.0-20260707142426-572a3e9deb7a h1:ulT0JZ/x6S4hYhyjUJ9T49YAxDLl1i5idFOMm9RHBkY=
github.com/openshift-eng/openshift-tests-extension v0.0.0-20260707142426-572a3e9deb7a/go.mod h1:pHOS9c6BjZv91OkkHyIHAOWnYhxwcxWQkyYGEvPyUCE=
github.com/openshift/api v0.0.0-20260715165912-72066cc9718b h1:gN3SihCYEwoIksD+f24wHhwiEgvaV0RxNjgmkDvBBeg=
github.com/openshift/api v0.0.0-20260715165912-72066cc9718b/go.mod h1:k6qH5QOVa5GDln2VVm8Jz4NV3Z7R2SATHFLwGS6Wh3M=
github.com/openshift/apiserver-library-go v0.0.0-20260715200723-42e5e402ca43 h1:V9hWaBi9cnohNk1F0Ph6wpI0otMWqMHleJ3oj5603Bc=
github.com/openshift/apiserver-library-go v0.0.0-20260715200723-42e5e402ca43/go.mod h1:ZuzfEq1ccZpHNx05xEUKlm2TcMHt2iXVutb79kAuTfM=
github.com/openshift/client-go v0.0.0-20260715172546-dac61734e0ec h1:UDjX+mot5IVLpcChyBqLXG1oSB29s4UkqFmgNb0Xsqc=
Expand Down Expand Up @@ -576,6 +574,8 @@ github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 h1:M8mH9eK4OUR4l
github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567/go.mod h1:DWNGW8A4Y+GyBgPuaQJuWiy0XYftx4Xm/y5Jqk9I6VQ=
github.com/raeperd/recvcheck v0.2.0 h1:GnU+NsbiCqdC2XX5+vMZzP+jAJC5fht7rcVTAhX74UI=
github.com/raeperd/recvcheck v0.2.0/go.mod h1:n04eYkwIR0JbgD73wT8wL4JjPC3wm0nFtzBnWNocnYU=
github.com/redhat-chai-bot/api v0.0.0-20260912110502-b75db3fbbc59 h1:sPPzj+eG5hoZkHf2PgTDrC3VZObwiNoVUvjdyoEheR0=
github.com/redhat-chai-bot/api v0.0.0-20260912110502-b75db3fbbc59/go.mod h1:k6qH5QOVa5GDln2VVm8Jz4NV3Z7R2SATHFLwGS6Wh3M=
github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
Expand Down
8 changes: 8 additions & 0 deletions pkg/webhooks/machine_webhook.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,8 @@ var (
defaultGCPTags = func(clusterID string) []string {
return []string{fmt.Sprintf("%s-worker", clusterID)}
}
// gcpDiskLicensePattern matches the full URI and short self-link forms accepted by GCP.
gcpDiskLicensePattern = regexp.MustCompile(`^(https://www\.googleapis\.com/compute/v1/)?projects/[a-z][a-z0-9-]{4,28}[a-z0-9]/global/licenses/[a-z]([-a-z0-9]{0,61}[a-z0-9])?$`)

defaultGCPDiskImage = func() string {
if arch == ARM64 {
Expand Down Expand Up @@ -1612,6 +1614,12 @@ func validateGCPDisks(disks []*machinev1beta1.GCPDisk, parentPath *field.Path) f
errs = append(errs, field.NotSupported(fldPath.Child("type"), disk.Type, diskTypes.List()))
}
}

for j, license := range disk.Licenses {
if !gcpDiskLicensePattern.MatchString(license) {
errs = append(errs, field.Invalid(fldPath.Child("licenses").Index(j), license, "must be a valid GCP license URL"))
}
}
}

return errs
Expand Down
100 changes: 100 additions & 0 deletions pkg/webhooks/machine_webhook_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4611,6 +4611,106 @@ func TestValidateGCPProviderSpec(t *testing.T) {
},
expectedOk: true,
},
{
testCase: "with nil disk licenses",
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
p.Disks[0].Licenses = nil
},
expectedOk: true,
},
{
testCase: "with empty disk licenses",
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
p.Disks[0].Licenses = []string{}
},
expectedOk: true,
},
{
testCase: "with a valid short disk license self-link",
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
p.Disks[0].Licenses = []string{"projects/valid-project/global/licenses/valid-license"}
},
expectedOk: true,
},
{
testCase: "with a valid full disk license URI",
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
p.Disks[0].Licenses = []string{"https://www.googleapis.com/compute/v1/projects/valid-project/global/licenses/valid-license"}
},
expectedOk: true,
},
{
testCase: "with a disk license invalid host",
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
p.Disks[0].Licenses = []string{"https://compute.googleapis.com/compute/v1/projects/valid-project/global/licenses/valid-license"}
},
expectedOk: false,
expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"https://compute.googleapis.com/compute/v1/projects/valid-project/global/licenses/valid-license\": must be a valid GCP license URL",
},
{
testCase: "with a disk license invalid scheme",
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
p.Disks[0].Licenses = []string{"http://www.googleapis.com/compute/v1/projects/valid-project/global/licenses/valid-license"}
},
expectedOk: false,
expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"http://www.googleapis.com/compute/v1/projects/valid-project/global/licenses/valid-license\": must be a valid GCP license URL",
},
{
testCase: "with a disk license extra path component",
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
p.Disks[0].Licenses = []string{"projects/valid-project/global/licenses/valid-license/extra"}
},
expectedOk: false,
expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"projects/valid-project/global/licenses/valid-license/extra\": must be a valid GCP license URL",
},
{
testCase: "with a malformed disk license self-link",
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
p.Disks[0].Licenses = []string{"projects/valid-project/licenses/valid-license"}
},
expectedOk: false,
expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"projects/valid-project/licenses/valid-license\": must be a valid GCP license URL",
},
{
testCase: "with a disk license too-short project ID",
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
p.Disks[0].Licenses = []string{"projects/abc12/global/licenses/valid-license"}
},
expectedOk: false,
expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"projects/abc12/global/licenses/valid-license\": must be a valid GCP license URL",
},
{
testCase: "with a disk license uppercase project ID",
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
p.Disks[0].Licenses = []string{"projects/Valid-project/global/licenses/valid-license"}
},
expectedOk: false,
expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"projects/Valid-project/global/licenses/valid-license\": must be a valid GCP license URL",
},
{
testCase: "with a disk license uppercase name",
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
p.Disks[0].Licenses = []string{"projects/valid-project/global/licenses/Valid-license"}
},
expectedOk: false,
expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"projects/valid-project/global/licenses/Valid-license\": must be a valid GCP license URL",
},
{
testCase: "with a disk license hyphen-invalid name",
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
p.Disks[0].Licenses = []string{"projects/valid-project/global/licenses/-valid-license"}
},
expectedOk: false,
expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"projects/valid-project/global/licenses/-valid-license\": must be a valid GCP license URL",
},
{
testCase: "with an overlong disk license name",
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
p.Disks[0].Licenses = []string{"projects/valid-project/global/licenses/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}
},
expectedOk: false,
expectedError: "providerSpec.disks[0].licenses[0]: Invalid value: \"projects/valid-project/global/licenses/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\": must be a valid GCP license URL",
},
{
testCase: "with no service accounts",
modifySpec: func(p *machinev1beta1.GCPMachineProviderSpec) {
Expand Down
6 changes: 3 additions & 3 deletions vendor/github.com/openshift/api/config/v1/types_authentication.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

63 changes: 63 additions & 0 deletions vendor/github.com/openshift/api/config/v1/types_infrastructure.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 4 additions & 2 deletions vendor/github.com/openshift/api/config/v1/types_ingress.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading