Skip to content

Commit ceacb94

Browse files
ngopalak-redhatngopalak-redhat
committed
kubebuilder validation and clarified API behavior for KubeletConfig API doc and adds tests
1 parent 13eaa95 commit ceacb94

6 files changed

Lines changed: 30 additions & 153 deletions

File tree

‎machineconfiguration/v1/tests/kubeletconfigs.machineconfiguration.openshift.io/KubeletConfigSpec.yaml‎

Lines changed: 11 additions & 117 deletions
Original file line numberDiff line numberDiff line change
@@ -41,136 +41,32 @@ tests:
4141
logLevel: 11
4242
expectedError: "Invalid value"
4343

44-
# TLSSecurityProfile CEL Validation tests
45-
- name: Should allow tlsSecurityProfile with Old type
46-
initial: |
47-
apiVersion: machineconfiguration.openshift.io/v1
48-
kind: KubeletConfig
49-
spec:
50-
tlsSecurityProfile:
51-
type: Old
52-
expected: |
53-
apiVersion: machineconfiguration.openshift.io/v1
54-
kind: KubeletConfig
55-
spec:
56-
tlsSecurityProfile:
57-
type: Old
58-
- name: Should allow tlsSecurityProfile with Intermediate type
59-
initial: |
60-
apiVersion: machineconfiguration.openshift.io/v1
61-
kind: KubeletConfig
62-
spec:
63-
tlsSecurityProfile:
64-
type: Intermediate
65-
expected: |
66-
apiVersion: machineconfiguration.openshift.io/v1
67-
kind: KubeletConfig
68-
spec:
69-
tlsSecurityProfile:
70-
type: Intermediate
71-
- name: Should reject tlsSecurityProfile with Modern type
72-
initial: |
73-
apiVersion: machineconfiguration.openshift.io/v1
74-
kind: KubeletConfig
75-
spec:
76-
tlsSecurityProfile:
77-
type: Modern
78-
expectedError: "only Old and Intermediate TLS profiles are supported for kubelet"
79-
- name: Should reject tlsSecurityProfile with Custom type
80-
initial: |
81-
apiVersion: machineconfiguration.openshift.io/v1
82-
kind: KubeletConfig
83-
spec:
84-
tlsSecurityProfile:
85-
type: Custom
86-
custom:
87-
ciphers:
88-
- ECDHE-ECDSA-AES128-GCM-SHA256
89-
minTLSVersion: VersionTLS12
90-
expectedError: "only Old and Intermediate TLS profiles are supported for kubelet"
91-
- name: Should allow tlsSecurityProfile without type field for backward compatibility
92-
initial: |
93-
apiVersion: machineconfiguration.openshift.io/v1
94-
kind: KubeletConfig
95-
spec:
96-
tlsSecurityProfile:
97-
custom:
98-
ciphers:
99-
- ECDHE-ECDSA-AES128-GCM-SHA256
100-
minTLSVersion: VersionTLS12
101-
expected: |
102-
apiVersion: machineconfiguration.openshift.io/v1
103-
kind: KubeletConfig
104-
spec:
105-
tlsSecurityProfile:
106-
custom:
107-
ciphers:
108-
- ECDHE-ECDSA-AES128-GCM-SHA256
109-
minTLSVersion: VersionTLS12
110-
11144
onUpdate:
11245
# Ratcheting tests - ensure existing objects with previously valid values can be updated
113-
- name: Should allow updating other fields with a previously valid Custom TLS profile persisted
46+
- name: Should allow updating other fields with a previously valid logLevel outside current range
11447
initialCRDPatches:
11548
- op: remove
116-
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/tlsSecurityProfile/x-kubernetes-validations
117-
initial: |
118-
apiVersion: machineconfiguration.openshift.io/v1
119-
kind: KubeletConfig
120-
spec:
121-
tlsSecurityProfile:
122-
type: Custom
123-
custom:
124-
ciphers:
125-
- ECDHE-ECDSA-AES128-GCM-SHA256
126-
minTLSVersion: VersionTLS12
127-
updated: |
128-
apiVersion: machineconfiguration.openshift.io/v1
129-
kind: KubeletConfig
130-
spec:
131-
logLevel: 5
132-
tlsSecurityProfile:
133-
type: Custom
134-
custom:
135-
ciphers:
136-
- ECDHE-ECDSA-AES128-GCM-SHA256
137-
minTLSVersion: VersionTLS12
138-
expected: |
139-
apiVersion: machineconfiguration.openshift.io/v1
140-
kind: KubeletConfig
141-
spec:
142-
logLevel: 5
143-
tlsSecurityProfile:
144-
type: Custom
145-
custom:
146-
ciphers:
147-
- ECDHE-ECDSA-AES128-GCM-SHA256
148-
minTLSVersion: VersionTLS12
149-
- name: Should allow updating other fields with a previously valid Modern TLS profile persisted
150-
initialCRDPatches:
49+
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/logLevel/maximum
15150
- op: remove
152-
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/tlsSecurityProfile/x-kubernetes-validations
51+
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/logLevel/minimum
15352
initial: |
15453
apiVersion: machineconfiguration.openshift.io/v1
15554
kind: KubeletConfig
15655
spec:
157-
tlsSecurityProfile:
158-
type: Modern
56+
logLevel: 15
15957
updated: |
16058
apiVersion: machineconfiguration.openshift.io/v1
16159
kind: KubeletConfig
16260
spec:
163-
logLevel: 3
164-
tlsSecurityProfile:
165-
type: Modern
61+
logLevel: 15
62+
autoSizingReserved: true
16663
expected: |
16764
apiVersion: machineconfiguration.openshift.io/v1
16865
kind: KubeletConfig
16966
spec:
170-
logLevel: 3
171-
tlsSecurityProfile:
172-
type: Modern
173-
- name: Should allow updating other fields with a previously valid logLevel outside current range
67+
logLevel: 15
68+
autoSizingReserved: true
69+
- name: Should allow migrating from invalid logLevel to valid value
17470
initialCRDPatches:
17571
- op: remove
17672
path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/logLevel/maximum
@@ -185,11 +81,9 @@ tests:
18581
apiVersion: machineconfiguration.openshift.io/v1
18682
kind: KubeletConfig
18783
spec:
188-
logLevel: 15
189-
autoSizingReserved: true
84+
logLevel: 5
19085
expected: |
19186
apiVersion: machineconfiguration.openshift.io/v1
19287
kind: KubeletConfig
19388
spec:
194-
logLevel: 15
195-
autoSizingReserved: true
89+
logLevel: 5

‎machineconfiguration/v1/types.go‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -740,7 +740,7 @@ type KubeletConfig struct {
740740
// KubeletConfigSpec configures the kubelet running on cluster nodes.
741741
type KubeletConfigSpec struct {
742742
// autoSizingReserved controls whether system-reserved CPU and memory are automatically
743-
// calculated based on each node's installed capacity. When enabled, prevents node failure
743+
// calculated based on each node's installed capacity. When set to true, this prevents node failure
744744
// from resource starvation of system components (kubelet, CRI-O) without manual configuration.
745745
// When omitted, this means the user has no opinion and the platform is left to choose a reasonable default,
746746
// which is subject to change over time. The current default is true for worker nodes and false for control plane nodes.
@@ -757,8 +757,8 @@ type KubeletConfigSpec struct {
757757
LogLevel *int32 `json:"logLevel,omitempty"`
758758

759759
// machineConfigPoolSelector selects which pools the KubeletConfig should apply to.
760-
// A nil selector results in no pools being selected, meaning this kubelet configuration
761-
// will not be applied to any nodes in the cluster.
760+
// When omitted or set to an empty selector {}, no pools are selected, which is equivalent
761+
// to not matching any MachineConfigPool.
762762
// +optional
763763
MachineConfigPoolSelector *metav1.LabelSelector `json:"machineConfigPoolSelector,omitempty"`
764764
// kubeletConfig contains upstream Kubernetes kubelet configuration fields.
@@ -770,9 +770,7 @@ type KubeletConfigSpec struct {
770770

771771
// tlsSecurityProfile configures TLS settings for the kubelet.
772772
// When omitted, the TLS configuration defaults to the value from apiservers.config.openshift.io/cluster.
773-
// When specified, the type field can be set to either "Old" or "Intermediate", or omitted for backward compatibility.
774-
// Modern and Custom TLS profiles are not supported for kubelet; maximum minTLSVersion is VersionTLS12.
775-
// +kubebuilder:validation:XValidation:rule="!has(self.type) || self.type == 'Old' || self.type == 'Intermediate'",message="only Old and Intermediate TLS profiles are supported for kubelet"
773+
// When specified, the type field can be set to either "Old", "Intermediate", "Modern", "Custom" or omitted for backward compatibility.
776774
// +optional
777775
TLSSecurityProfile *configv1.TLSSecurityProfile `json:"tlsSecurityProfile,omitempty"`
778776
}

‎machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs.crd.yaml‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ spec:
4949
autoSizingReserved:
5050
description: |-
5151
autoSizingReserved controls whether system-reserved CPU and memory are automatically
52-
calculated based on each node's installed capacity. When enabled, prevents node failure
52+
calculated based on each node's installed capacity. When set to true, this prevents node failure
5353
from resource starvation of system components (kubelet, CRI-O) without manual configuration.
5454
When omitted, this means the user has no opinion and the platform is left to choose a reasonable default,
5555
which is subject to change over time. The current default is true for worker nodes and false for control plane nodes.
@@ -76,8 +76,8 @@ spec:
7676
machineConfigPoolSelector:
7777
description: |-
7878
machineConfigPoolSelector selects which pools the KubeletConfig should apply to.
79-
A nil selector results in no pools being selected, meaning this kubelet configuration
80-
will not be applied to any nodes in the cluster.
79+
When omitted or set to an empty selector {}, no pools are selected, which is equivalent
80+
to not matching any MachineConfigPool.
8181
properties:
8282
matchExpressions:
8383
description: matchExpressions is a list of label selector requirements.
@@ -126,8 +126,7 @@ spec:
126126
description: |-
127127
tlsSecurityProfile configures TLS settings for the kubelet.
128128
When omitted, the TLS configuration defaults to the value from apiservers.config.openshift.io/cluster.
129-
When specified, the type field can be set to either "Old" or "Intermediate", or omitted for backward compatibility.
130-
Modern and Custom TLS profiles are not supported for kubelet; maximum minTLSVersion is VersionTLS12.
129+
When specified, the type field can be set to either "Old", "Intermediate", "Modern", "Custom" or omitted for backward compatibility.
131130
properties:
132131
custom:
133132
description: |-
@@ -256,10 +255,6 @@ spec:
256255
- Custom
257256
type: string
258257
type: object
259-
x-kubernetes-validations:
260-
- message: only Old and Intermediate TLS profiles are supported for
261-
kubelet
262-
rule: '!has(self.type) || self.type == ''Old'' || self.type == ''Intermediate'''
263258
type: object
264259
status:
265260
description: status contains observed information about the kubelet configuration.

‎machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/AAA_ungated.yaml‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ spec:
5050
autoSizingReserved:
5151
description: |-
5252
autoSizingReserved controls whether system-reserved CPU and memory are automatically
53-
calculated based on each node's installed capacity. When enabled, prevents node failure
53+
calculated based on each node's installed capacity. When set to true, this prevents node failure
5454
from resource starvation of system components (kubelet, CRI-O) without manual configuration.
5555
When omitted, this means the user has no opinion and the platform is left to choose a reasonable default,
5656
which is subject to change over time. The current default is true for worker nodes and false for control plane nodes.
@@ -77,8 +77,8 @@ spec:
7777
machineConfigPoolSelector:
7878
description: |-
7979
machineConfigPoolSelector selects which pools the KubeletConfig should apply to.
80-
A nil selector results in no pools being selected, meaning this kubelet configuration
81-
will not be applied to any nodes in the cluster.
80+
When omitted or set to an empty selector {}, no pools are selected, which is equivalent
81+
to not matching any MachineConfigPool.
8282
properties:
8383
matchExpressions:
8484
description: matchExpressions is a list of label selector requirements.
@@ -127,8 +127,7 @@ spec:
127127
description: |-
128128
tlsSecurityProfile configures TLS settings for the kubelet.
129129
When omitted, the TLS configuration defaults to the value from apiservers.config.openshift.io/cluster.
130-
When specified, the type field can be set to either "Old" or "Intermediate", or omitted for backward compatibility.
131-
Modern and Custom TLS profiles are not supported for kubelet; maximum minTLSVersion is VersionTLS12.
130+
When specified, the type field can be set to either "Old", "Intermediate", "Modern", "Custom" or omitted for backward compatibility.
132131
properties:
133132
custom:
134133
description: |-
@@ -257,10 +256,6 @@ spec:
257256
- Custom
258257
type: string
259258
type: object
260-
x-kubernetes-validations:
261-
- message: only Old and Intermediate TLS profiles are supported for
262-
kubelet
263-
rule: '!has(self.type) || self.type == ''Old'' || self.type == ''Intermediate'''
264259
type: object
265260
status:
266261
description: status contains observed information about the kubelet configuration.

‎machineconfiguration/v1/zz_generated.swagger_doc_generated.go‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs.crd.yaml‎

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ spec:
4949
autoSizingReserved:
5050
description: |-
5151
autoSizingReserved controls whether system-reserved CPU and memory are automatically
52-
calculated based on each node's installed capacity. When enabled, prevents node failure
52+
calculated based on each node's installed capacity. When set to true, this prevents node failure
5353
from resource starvation of system components (kubelet, CRI-O) without manual configuration.
5454
When omitted, this means the user has no opinion and the platform is left to choose a reasonable default,
5555
which is subject to change over time. The current default is true for worker nodes and false for control plane nodes.
@@ -76,8 +76,8 @@ spec:
7676
machineConfigPoolSelector:
7777
description: |-
7878
machineConfigPoolSelector selects which pools the KubeletConfig should apply to.
79-
A nil selector results in no pools being selected, meaning this kubelet configuration
80-
will not be applied to any nodes in the cluster.
79+
When omitted or set to an empty selector {}, no pools are selected, which is equivalent
80+
to not matching any MachineConfigPool.
8181
properties:
8282
matchExpressions:
8383
description: matchExpressions is a list of label selector requirements.
@@ -126,8 +126,7 @@ spec:
126126
description: |-
127127
tlsSecurityProfile configures TLS settings for the kubelet.
128128
When omitted, the TLS configuration defaults to the value from apiservers.config.openshift.io/cluster.
129-
When specified, the type field can be set to either "Old" or "Intermediate", or omitted for backward compatibility.
130-
Modern and Custom TLS profiles are not supported for kubelet; maximum minTLSVersion is VersionTLS12.
129+
When specified, the type field can be set to either "Old", "Intermediate", "Modern", "Custom" or omitted for backward compatibility.
131130
properties:
132131
custom:
133132
description: |-
@@ -256,10 +255,6 @@ spec:
256255
- Custom
257256
type: string
258257
type: object
259-
x-kubernetes-validations:
260-
- message: only Old and Intermediate TLS profiles are supported for
261-
kubelet
262-
rule: '!has(self.type) || self.type == ''Old'' || self.type == ''Intermediate'''
263258
type: object
264259
status:
265260
description: status contains observed information about the kubelet configuration.

0 commit comments

Comments
 (0)