Update Kube-OVN to v1.15.3 - #2022
Conversation
📝 WalkthroughWalkthroughUpdates KubeOVN Helm chart and packaging: dynamic chart tag retrieval, chart and image bumps to v1.15.3, expanded CRD schemas, RBAC adjustments, added ephemeral-storage resource limits, environment variable renames, controller/CNI argument and network-stack selection changes, and natgateway image/config changes. Changes
Sequence Diagram(s)mermaid Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Trivy (0.69.1)Trivy execution failed: Unknown error Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello Andrei Kvapil (@kvaps), I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request primarily focuses on upgrading the Kube-OVN component to version Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
There was a problem hiding this comment.
Code Review
This pull request successfully updates Kube-OVN to version v1.15.3, incorporating several new features, configuration options, and important security enhancements. The changes include updating version tags, refining OVN version compatibility logic, and introducing new arguments for DNS name resolution, conntrack skipping, and non-primary CNI mode. Resource management is improved by adding ephemeral-storage limits to various components. A notable security improvement is the transition from broad "*" permissions to explicit verb lists in RBAC definitions and the introduction of a dedicated Role for specific secret access, aligning with the principle of least privilege. The modularization of the vpc-nat-gateway image reference also enhances flexibility.
While the changes are generally positive, there are a couple of areas that warrant attention. The dynamic tag fetching logic in the Makefile could be brittle, and the removal of support_arm and thirdparty fields from the kubeovn image definition in values.yaml might require clarification if these properties are still relevant for supported architectures or features.
| - create | ||
| - get | ||
| - list | ||
| - update | ||
| - patch | ||
| - watch | ||
| - delete |
There was a problem hiding this comment.
While changing from "*" to explicit verbs is a good security practice, granting delete permissions on all kubeovn.io resources (vpcs, subnets, ips, etc.) to the system:ovn ClusterRole might be overly permissive. It's generally recommended to follow the principle of least privilege and only grant delete access where absolutely necessary, or to specific roles/users. Consider if delete is truly required for the core system:ovn role or if it can be restricted to more specific administrative roles.
| tag=$(KUBEOVN_TAG) && \ | ||
| curl -sSL https://github.com/cozystack/kubeovn/archive/refs/tags/$${tag}.tar.gz | \ | ||
| tar xzvf - --strip 2 kubeovn-$${tag#*v}/chart | ||
| tag=$$(git ls-remote --tags --sort="v:refname" https://github.com/cozystack/kubeovn-chart | awk -F'[/^]' 'END{print $$3}') && \ |
There was a problem hiding this comment.
The awk -F'[/^]' 'END{print $$3}' command used to extract the tag from git ls-remote output is quite specific to the current output format. If the output format of git ls-remote changes in a future Git version or for a different repository, this command could break, leading to unexpected tag resolution. Consider a more robust parsing method or adding a comment to explain this dependency.
| tag: v1.14.25 | ||
| support_arm: true | ||
| thirdparty: true | ||
| tag: v1.15.3 |
There was a problem hiding this comment.
The support_arm: true and thirdparty: true fields were removed from the kubeovn image definition. If these properties are still relevant for the kubeovn image's functionality, such as indicating multi-arch support or specific third-party dependencies, their removal might be an oversight. Please confirm if these properties are no longer needed or if their functionality is now handled implicitly elsewhere.
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Fix all issues with AI agents
In `@packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml`:
- Around line 3130-3134: Remove the duplicate description for the namespaces
property in the IPPool CRD: keep a single description entry for the property
named namespaces (under IPPool spec) and replace the incorrect "subnet" wording
with the correct text such as "Namespaces that can use this IP pool" so the
property has one accurate description.
- Around line 2314-2319: The YAML mapping for the "namespaces" property in the
VPC CRD has two duplicate "description" keys; remove one so there is only a
single description entry for the "namespaces" field (locate the "namespaces" key
in the kube-ovn-crd.yaml VPC spec and keep the preferred description text—e.g.,
"List of namespaces that can use this VPC"—and delete the other "description"
line) to avoid silent overwrites or parser errors.
- Around line 2348-2351: Replace all invalid OpenAPI v3 schema keywords
`min`/`max` with `minimum`/`maximum` in the CRD definitions: update
policyRoutes[].priority to use `minimum` and `maximum`, and likewise update
SecurityGroup ingressRules and egressRules fields (priority, portRangeMin,
portRangeMax) to use `minimum`/`maximum`; make the change in the upstream chart
sources (do not edit the vendored package) and open an upstream PR/issue so the
vendored copy can be updated from upstream.
🧹 Nitpick comments (1)
packages/system/kubeovn/charts/kube-ovn/templates/ic-controller-deploy.yaml (1)
96-103: Hardcoded resource limits differ from the pattern used by other components.Other templates (ovn-central, ovs-ovn, pinger, etc.) source their resource limits from
values.yamlvia{{ index .Values ... }}. This template hardcodes all limits including the newephemeral-storage: 1Gi. While consistent within this file (cpu/memory are also hardcoded), it means users can't tune ic-controller resources via values overrides.This appears to be inherited from upstream, so likely intentional — just flagging the inconsistency.
| type: integer | ||
| description: Priority of the policy route (0-32767) | ||
| min: 0 | ||
| max: 32767 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's locate and examine the CRD file
find . -path "*/packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml" -type fRepository: cozystack/cozystack
Length of output: 132
🏁 Script executed:
# If found, check the specific lines mentioned in the review
if [ -f "packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml" ]; then
echo "=== Lines 2348-2351 (VPC policyRoutes.priority) ==="
sed -n '2345,2355p' "packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml" | cat -n
echo ""
echo "=== Lines 3477-3478 (SecurityGroup - first location) ==="
sed -n '3475,3485p' "packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml" | cat -n
echo ""
echo "=== Lines 3491-3492 ==="
sed -n '3489,3499p' "packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml" | cat -n
echo ""
echo "=== Lines 3496-3497 ==="
sed -n '3494,3504p' "packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml" | cat -n
echo ""
echo "=== Lines 3516-3517 ==="
sed -n '3514,3524p' "packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml" | cat -n
echo ""
echo "=== Lines 3530-3531 ==="
sed -n '3528,3538p' "packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml" | cat -n
echo ""
echo "=== Lines 3535-3536 ==="
sed -n '3533,3543p' "packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml" | cat -n
fiRepository: cozystack/cozystack
Length of output: 4055
🌐 Web query:
OpenAPI 3.0 schema keywords for numeric validation minimum maximum
💡 Result:
In OpenAPI 3.0.x (Schema Object), the numeric range/constraint keywords are: minimum, maximum, exclusiveMinimum, exclusiveMaximum, and multipleOf. These follow JSON Schema semantics as adopted by OAS 3.0. (spec.openapis.org)
Keywords (OAS 3.0)
minimum(number): lower bound (inclusive unlessexclusiveMinimum: true). (spec.openapis.org)maximum(number): upper bound (inclusive unlessexclusiveMaximum: true). (spec.openapis.org)exclusiveMinimum(boolean): whentrue, the value must be strictly greater thanminimum. (swagger.io)exclusiveMaximum(boolean): whentrue, the value must be strictly less thanmaximum. (swagger.io)multipleOf(number): value must be a multiple of this number; in OAS 3.0’s schema, it must be > 0. (spec.openapis.org)
Example (OAS 3.0)
type: number
minimum: 0
exclusiveMinimum: true # > 0
maximum: 10 # <= 10
multipleOf: 0.5Note: In OpenAPI 3.1, exclusiveMinimum/exclusiveMaximum change to numeric values (JSON Schema style), e.g. exclusiveMinimum: 7 instead of minimum: 7 + exclusiveMinimum: true. (learn.openapis.org)
Citations:
- 1: https://spec.openapis.org/oas/v3.0.4.html?utm_source=openai
- 2: https://spec.openapis.org/oas/v3.0.4.html?utm_source=openai
- 3: https://spec.openapis.org/oas/v3.0.4.html?utm_source=openai
- 4: https://swagger.io/docs/specification/v3_0/data-models/keywords/?utm_source=openai
- 5: https://swagger.io/docs/specification/v3_0/data-models/keywords/?utm_source=openai
- 6: https://spec.openapis.org/oas/v3.0.4.html?utm_source=openai
- 7: https://learn.openapis.org/upgrading/v3.0-to-v3.1.html?utm_source=openai
🌐 Web query:
Kubernetes CRD OpenAPI v3 schema min max vs minimum maximum keywords
💡 Result:
In Kubernetes CRD validation (openAPIV3Schema), the schema language is essentially an OpenAPI v3.0 Schema Object / JSON Schema–like subset, so the correct constraint keywords are the standard ones like minimum / maximum, not min / max. Kubernetes’ CRD schema struct (JSONSchemaProps) also exposes fields named Minimum / Maximum (and many min*/max* variants like minItems, maxLength, etc.), but there is no generic min/max keyword. [1][2]
Use these keywords (CRD / OpenAPI v3.0)
Numbers (type: integer or type: number)
minimum,maximumexclusiveMinimum,exclusiveMaximum(booleans in OAS 3.0) [3]
Example:minimum: 0,maximum: 100(Kubernetes explicitly recommends this) [1]
Strings (type: string)
minLength,maxLength,pattern[1][2]
Arrays (type: array)
minItems,maxItems,uniqueItems[1][2]
Objects (type: object)
minProperties,maxProperties[2]
What happens if you write min / max?
They are not valid OpenAPI v3.0 / CRD schema keywords, so they won’t express the constraint you intend (typically they’ll be rejected by validation tooling or treated as unknown/ineffective). The correct forms are minimum / maximum for numeric bounds. [1][3]
Fix invalid OpenAPI v3 schema keywords: min/max should be minimum/maximum.
In the VPC policyRoutes[].priority field and throughout the SecurityGroup CRD (ingressRules and egressRules for priority, portRangeMin, and portRangeMax), min and max are used instead of minimum and maximum. The Kubernetes API server will silently ignore these unrecognized keywords, meaning no validation will be enforced on these fields.
Example fix for VPC policyRoutes.priority (lines 2350-2351)
priority:
type: integer
description: Priority of the policy route (0-32767)
- min: 0
- max: 32767
+ minimum: 0
+ maximum: 32767The same pattern appears in SecurityGroup ingressRules and egressRules. Since this is a vendored upstream chart, report this issue upstream rather than editing directly in the vendored directory.
🤖 Prompt for AI Agents
In `@packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml` around
lines 2348 - 2351, Replace all invalid OpenAPI v3 schema keywords `min`/`max`
with `minimum`/`maximum` in the CRD definitions: update policyRoutes[].priority
to use `minimum` and `maximum`, and likewise update SecurityGroup ingressRules
and egressRules fields (priority, portRangeMin, portRangeMax) to use
`minimum`/`maximum`; make the change in the upstream chart sources (do not edit
the vendored package) and open an upstream PR/issue so the vendored copy can be
updated from upstream.
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
c2ddd2d to
593a8b2
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/system/kubeovn/values.yaml (1)
27-33:⚠️ Potential issue | 🔴 CriticalAdd missing
ephemeral-storagelimits to prevent Helm template rendering failures.The vendored templates reference
ephemeral-storageunder limits for six components (ovsovn-ds.yaml:176, controller-deploy.yaml:221, central-deploy.yaml:125, ovncni-ds.yaml:231, pinger-ds.yaml:139, monitor-deploy.yaml:113), but values.yaml does not define this value for any of them. This causes Helm to render empty values and will fail the build.Add
ephemeral-storage: "1Gi"to thelimitssection for each component:Example fix for ovs-ovn (apply to all affected components)
ovs-ovn: requests: cpu: "10m" memory: "50Mi" limits: cpu: "2" memory: "1000Mi" + ephemeral-storage: "1Gi"Apply the same addition to
ovn-central,kube-ovn-controller,kube-ovn-cni,kube-ovn-pinger, andkube-ovn-monitor.
🤖 Fix all issues with AI agents
In `@packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml`:
- Around line 228-231: The VpcNatGateway CRD's toleration "operator" enum
includes "Lt" and "Gt" but lacks the feature-gate description present in
VpcEgressGateway; update both occurrences of the "operator" enum in the
VpcNatGateway CRD to add a description field (matching the style and wording
used in VpcEgressGateway) that states Lt and Gt require the
TaintTolerationComparisonOperators feature gate (alpha since v1.35, default
false) so clusters without that gate enabled will reject those values at
runtime.
In `@packages/system/kubeovn/charts/kube-ovn/templates/ovn-CR.yaml`:
- Around line 372-388: Revert the local edit that added the Role resource
(secret-reader-ovn-ipsec) in the vendored ovn-CR.yaml and remove any
corresponding changes so the vendored chart remains identical to upstream;
instead open a PR against the upstream kube-ovn-chart repository to add the
namespace-scoped Role (resourceNames: ["ovn-ipsec-ca"], verbs:
["get","list","watch"]) and its RoleBinding (as referenced in ovn-CRB.yaml).
After upstream merge, run the repository's update (Makefile update) to pull the
new upstream chart; if you must ship immediately, add a documented patch/overlay
mechanism in your repo (not a direct edit of the vendored file) that applies the
same Role/RoleBinding until upstream is accepted.
| - Equal | ||
| - Exists | ||
| - Lt | ||
| - Gt |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Kubernetes TaintTolerationComparisonOperators feature gate status 1.31 stable
💡 Result:
TaintTolerationComparisonOperators is not stable (GA) in Kubernetes v1.31—it did not exist in v1.31.
On the upstream Kubernetes feature-gates list, TaintTolerationComparisonOperators is shown as Alpha, default false, since v1.35 (not v1.31), and it enables numeric comparison operators (Lt, Gt) for tolerations. [1][2]
🏁 Script executed:
# First, let's examine the file to understand the context
fd kube-ovn-crd.yaml packages/system/kubeovn/ 2>/dev/null | head -5Repository: cozystack/cozystack
Length of output: 130
🏁 Script executed:
# Read the file to see the operators and CRD references
wc -l packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yamlRepository: cozystack/cozystack
Length of output: 135
🏁 Script executed:
# Check lines around 228-231 for the operators
sed -n '225,235p' packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yamlRepository: cozystack/cozystack
Length of output: 425
🏁 Script executed:
# Check lines around 610-614
sed -n '607,617p' packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yamlRepository: cozystack/cozystack
Length of output: 425
🏁 Script executed:
# Check VpcEgressGateway CRD around line 1331-1340
sed -n '1328,1345p' packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yamlRepository: cozystack/cozystack
Length of output: 1192
🏁 Script executed:
# Check if VpcNatGateway CRD exists and look for its documentation
rg -n "VpcNatGateway" packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml | head -20Repository: cozystack/cozystack
Length of output: 126
🏁 Script executed:
# Find the VpcNatGateway CRD spec and check for operator documentation
sed -n '175,220p' packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yamlRepository: cozystack/cozystack
Length of output: 1352
🏁 Script executed:
# Determine which CRD owns lines 228-231 by looking at the kind definition nearby
sed -n '200,235p' packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yamlRepository: cozystack/cozystack
Length of output: 1272
🏁 Script executed:
# Determine which CRD owns lines 610-614 by looking at context
sed -n '580,620p' packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yamlRepository: cozystack/cozystack
Length of output: 1540
🏁 Script executed:
# Determine which CRD owns lines 610-614 - look for kind definition above line 610
sed -n '1,615p' packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml | grep -n "kind:" | tail -3Repository: cozystack/cozystack
Length of output: 151
🏁 Script executed:
# Get broader context around line 610 to identify the CRD
sed -n '550,570p' packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yamlRepository: cozystack/cozystack
Length of output: 886
🏁 Script executed:
# Look specifically at the structure around line 600-620 to identify which property has the operators
sed -n '600,625p' packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yamlRepository: cozystack/cozystack
Length of output: 964
🏁 Script executed:
# Let's search for "spec:" definitions around line 600 to understand context better
sed -n '470,625p' packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml | grep -n "spec:" -A 5Repository: cozystack/cozystack
Length of output: 312
🏁 Script executed:
# Find all kind definitions with their line numbers to map them accurately
rg -n "^ kind:" packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yamlRepository: cozystack/cozystack
Length of output: 45
🏁 Script executed:
# Get the range from the last kind before line 610 to understand context
sed -n '400,625p' packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml | head -100Repository: cozystack/cozystack
Length of output: 4949
🏁 Script executed:
# Search for "kind:" with proper grep
grep -n "^ kind:" packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yamlRepository: cozystack/cozystack
Length of output: 45
🏁 Script executed:
# Get context around line 610 to see what spec this belongs to - check for VPC/gateway patterns
sed -n '1,610p' packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml | tail -50Repository: cozystack/cozystack
Length of output: 1963
🏁 Script executed:
# Try a different approach to find all kinds
rg "kind:\s" packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml -n | grep -v "listKind"Repository: cozystack/cozystack
Length of output: 1341
🏁 Script executed:
# Check what section lines 610-614 belong to by looking at the actual context
awk 'NR >= 1 && NR <= 650 {if (/kind:/ && !/listKind/) print NR": "$0}' packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yamlRepository: cozystack/cozystack
Length of output: 244
🏁 Script executed:
# Now determine which section of VpcNatGateway each range belongs to
# Lines 228-231 - check if it's spec or status
sed -n '200,235p' packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml | grep -n "spec:\|status:"Repository: cozystack/cozystack
Length of output: 84
🏁 Script executed:
# Lines 610-614 - check if it's spec or status
sed -n '580,625p' packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml | grep -n "spec:\|status:"Repository: cozystack/cozystack
Length of output: 45
🏁 Script executed:
# Now let's check if VpcNatGateway has documentation about the feature gate requirement
# Look for description field near the operator enum in both locations
sed -n '225,235p' packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yamlRepository: cozystack/cozystack
Length of output: 425
🏁 Script executed:
# Check around line 610-614
sed -n '605,620p' packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yamlRepository: cozystack/cozystack
Length of output: 589
🏁 Script executed:
# Check if this is a vendored upstream chart or part of cozystack
head -20 packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yamlRepository: cozystack/cozystack
Length of output: 494
🏁 Script executed:
# Check the directory structure to understand if this is vendored
ls -la packages/system/kubeovn/Repository: cozystack/cozystack
Length of output: 421
🏁 Script executed:
# Check if there's a Chart.yaml file indicating this is the kube-ovn chart
find packages/system/kubeovn -name "Chart.yaml" -o -name "values.yaml" | head -5Repository: cozystack/cozystack
Length of output: 236
🏁 Script executed:
# Check the Chart.yaml to understand if this is truly a vendored upstream chart
cat packages/system/kubeovn/charts/kube-ovn/Chart.yamlRepository: cozystack/cozystack
Length of output: 1232
🏁 Script executed:
# Check if there's a source or reference to the upstream kube-ovn chart
head -30 packages/system/kubeovn/charts/kube-ovn/Chart.yamlRepository: cozystack/cozystack
Length of output: 1232
🏁 Script executed:
# Check git history to see if this chart was vendored or is custom
git log --oneline packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml | head -5Repository: cozystack/cozystack
Length of output: 98
🏁 Script executed:
# Check if there are any upstream references or documentation
find packages/system/kubeovn -type f -name "*.md" -o -name "README*" | head -5Repository: cozystack/cozystack
Length of output: 112
Add feature gate documentation to VpcNatGateway CRD operator enum.
The toleration operator enum includes Lt and Gt (lines 228–231, 610–614), which require the Kubernetes TaintTolerationComparisonOperators feature gate (Alpha since v1.35, default false). The VpcEgressGateway CRD documents this dependency explicitly with a description field, but the VpcNatGateway CRD does not. If target clusters don't have this feature gate enabled, these operators will be rejected at runtime. Add a description field to both occurrences of the operator enum in VpcNatGateway matching the documentation style used in VpcEgressGateway.
🤖 Prompt for AI Agents
In `@packages/system/kubeovn/charts/kube-ovn/templates/kube-ovn-crd.yaml` around
lines 228 - 231, The VpcNatGateway CRD's toleration "operator" enum includes
"Lt" and "Gt" but lacks the feature-gate description present in
VpcEgressGateway; update both occurrences of the "operator" enum in the
VpcNatGateway CRD to add a description field (matching the style and wording
used in VpcEgressGateway) that states Lt and Gt require the
TaintTolerationComparisonOperators feature gate (alpha since v1.35, default
false) so clusters without that gate enabled will reject those values at
runtime.
| --- | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: Role | ||
| metadata: | ||
| name: secret-reader-ovn-ipsec | ||
| namespace: {{ .Values.namespace }} | ||
| rules: | ||
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - "secrets" | ||
| resourceNames: | ||
| - "ovn-ipsec-ca" | ||
| verbs: | ||
| - "get" | ||
| - "list" | ||
| - "watch" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Check for RoleBinding for secret-reader-ovn-ipsec
rg -n 'secret-reader-ovn-ipsec' packages/system/kubeovn/ --type yaml -A 5Repository: cozystack/cozystack
Length of output: 1120
🏁 Script executed:
# Check the structure to see if this is a vendored upstream chart
ls -la packages/system/kubeovn/charts/Repository: cozystack/cozystack
Length of output: 228
🏁 Script executed:
# Look for evidence of chart vendoring (e.g., Chart.yaml, .gitignore patterns)
cat packages/system/kubeovn/charts/kube-ovn/Chart.yaml 2>/dev/null || echo "File not found"Repository: cozystack/cozystack
Length of output: 1232
🏁 Script executed:
# Check if there's documentation about chart vendoring in the repo
find packages/system -name "README*" -o -name "*vendor*" -o -name "*chart*" | head -20Repository: cozystack/cozystack
Length of output: 1050
🏁 Script executed:
# Check for git submodules that might indicate vendoring
git config --file .gitmodules --get-regexp path | grep -i kube-ovn || echo "No submodule found"Repository: cozystack/cozystack
Length of output: 81
🏁 Script executed:
# Check for .gitignore patterns that might indicate how charts are managed
find packages/system/kubeovn -name ".gitignore" -exec cat {} \;Repository: cozystack/cozystack
Length of output: 45
🏁 Script executed:
# Check if there's any documentation or script about chart vendoring
ls -la packages/system/kubeovn/ | grep -E "README|Makefile|script"Repository: cozystack/cozystack
Length of output: 122
🏁 Script executed:
# Check the git history/origin of this chart directory
cd packages/system/kubeovn/charts/kube-ovn && git log --oneline --follow Chart.yaml 2>/dev/null | head -5 || echo "No git history available"Repository: cozystack/cozystack
Length of output: 98
🏁 Script executed:
# Check the Makefile to understand chart vendoring mechanism
cat packages/system/kubeovn/MakefileRepository: cozystack/cozystack
Length of output: 503
Do not directly edit vendored upstream chart; submit changes to upstream repository instead.
The new secret-reader-ovn-ipsec Role is a sound security improvement (namespace-scoped with resourceNames restriction replacing broad cluster-wide secrets access), and the corresponding RoleBinding exists in ovn-CRB.yaml. However, this file is a vendored upstream chart from https://github.com/cozystack/kubeovn-chart (pulled via the Makefile update target). Per the coding guidelines, do not directly edit vendored upstream charts. These changes will be lost on the next make update execution. Submit this security improvement as a PR to the upstream kube-ovn-chart repository instead.
🤖 Prompt for AI Agents
In `@packages/system/kubeovn/charts/kube-ovn/templates/ovn-CR.yaml` around lines
372 - 388, Revert the local edit that added the Role resource
(secret-reader-ovn-ipsec) in the vendored ovn-CR.yaml and remove any
corresponding changes so the vendored chart remains identical to upstream;
instead open a PR against the upstream kube-ovn-chart repository to add the
namespace-scoped Role (resourceNames: ["ovn-ipsec-ca"], verbs:
["get","list","watch"]) and its RoleBinding (as referenced in ovn-CRB.yaml).
After upstream merge, run the repository's update (Makefile update) to pull the
new upstream chart; if you must ship immediately, add a documented patch/overlay
mechanism in your repo (not a direct edit of the vendored file) that applies the
same Role/RoleBinding until upstream is accepted.
|
Backport failed for Please cherry-pick the changes locally and resolve any conflicts. git fetch origin release-0.41
git worktree add -d .worktree/backport-2022-to-release-0.41 origin/release-0.41
cd .worktree/backport-2022-to-release-0.41
git switch --create backport-2022-to-release-0.41
git cherry-pick -x 593a8b2baa9ccb43521b95312f94094f3e3f14d7 |
Signed-off-by: Andrei Kvapil kvapss@gmail.com
What this PR does
Release note
Summary by CodeRabbit
New Features
Improvements
Updates