OCPBUGS-20161: Remove unncessary kas port exposure on service by enxebre · Pull Request #3139 · openshift/hypershift

enxebre · 2023-10-26T11:49:47Z

What this PR does / why we need it:
This was first introduced here https://github.com/openshift/hypershift/pull/1614/files#diff-62c16653415b8d89921cb26796abc479c31da1654095f7c46b551b470533d66dR368-R372 not sure with which purpose.

With the changes in https://github.com/openshift/hypershift/pull/2964/files#diff-39a001edaf01802e79e43b99b8ce38585ea7079c7253be01fe33a4902a9ca184 we stopped defaulting the kas container port to 443 resulting in this "if" to evaluate as true and exposing a new port https://github.com/openshift/hypershift/pull/2964/files#diff-62c16653415b8d89921cb26796abc479c31da1654095f7c46b551b470533d66dL277

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #

Checklist

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

openshift-ci-robot · 2023-10-26T11:49:52Z

@enxebre: This pull request references Jira Issue OCPBUGS-20161, which is invalid:

expected the bug to target the "4.15.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

enxebre · 2023-10-26T11:50:10Z

/hold
to make sure of the impact.

enxebre · 2023-10-26T11:53:01Z

/cherry-pick release-4.14

openshift-cherrypick-robot · 2023-10-26T11:53:03Z

@enxebre: once the present PR merges, I will cherry-pick it on top of release-4.14 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick release-4.14

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2023-10-26T12:12:25Z

@enxebre: This pull request references Jira Issue OCPBUGS-20161, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.15.0) matches configured target version for branch (4.15.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (jiezhao@redhat.com), skipping review request.

Details

In response to this:

What this PR does / why we need it:
This was first introduced here https://github.com/openshift/hypershift/pull/1614/files#diff-62c16653415b8d89921cb26796abc479c31da1654095f7c46b551b470533d66dR368-R372 not sure with which purpose.

With the changes in https://github.com/openshift/hypershift/pull/2964/files#diff-39a001edaf01802e79e43b99b8ce38585ea7079c7253be01fe33a4902a9ca184 we stopped defaulting the kas container port to 443 making this if to evaluate as true and exposing a new port https://github.com/openshift/hypershift/pull/2964/files#diff-62c16653415b8d89921cb26796abc479c31da1654095f7c46b551b470533d66dL277

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2023-10-26T12:13:05Z

@enxebre: This pull request references Jira Issue OCPBUGS-20161, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.15.0) matches configured target version for branch (4.15.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (jiezhao@redhat.com), skipping review request.

Details

In response to this:

What this PR does / why we need it:
This was first introduced here https://github.com/openshift/hypershift/pull/1614/files#diff-62c16653415b8d89921cb26796abc479c31da1654095f7c46b551b470533d66dR368-R372 not sure with which purpose.

With the changes in https://github.com/openshift/hypershift/pull/2964/files#diff-39a001edaf01802e79e43b99b8ce38585ea7079c7253be01fe33a4902a9ca184 we stopped defaulting the kas container port to 443 resulting in this "if" to evaluate as true and exposing a new port https://github.com/openshift/hypershift/pull/2964/files#diff-62c16653415b8d89921cb26796abc479c31da1654095f7c46b551b470533d66dL277

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

mjlshen

/lgtm

openshift-ci · 2023-10-26T12:19:19Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enxebre, mjlshen

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [enxebre]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2023-10-26T12:20:41Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enxebre, mjlshen

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [enxebre]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

mjlshen · 2023-10-26T12:25:09Z

-		case "kube-apiserver":
-			svc.Spec.Ports[i].Port = kasPort
-			svc.Spec.Ports[i].TargetPort = intstr.FromString("https")
-			svc.Spec.Ports[i].Protocol = corev1.ProtocolTCP
-			foundKAS = true


I think removing this is correct

mjlshen · 2023-10-26T12:26:35Z

-	foundKAS := false

-	// TODO (alberto): why this criteria?
-	// Introduced here https://github.com/openshift/hypershift/pull/1614/files#diff-62c16653415b8d89921cb26796abc479c31da1654095f7c46b551b470533d66dR368-R372.
-	if kasPort == 443 {
-		foundKAS = true
-	}


I'm not familiar with the use-case, but is this so that someone could separate router/KAS traffic onto different ports? If so, this would just be a guard for the ROSA HCP use-case where we use the same port for both. We would then need the if !foundKas block further down at line 279

I'm not familiar with the use-case, but is this so that someone could separate router/KAS traffic onto different ports? If so, this would just be a guard for the ROSA HCP use-case where we use the same port for both. We would then need the if !foundKas block further down at line 279

Might be the original reason, I'm not aware of this use atm.
But also the if kasPort == 443 {foundKAS = true} is not a valid criteria any more for that potential use case.

mjlshen · 2023-10-26T12:27:06Z

/hold

mjlshen · 2023-10-26T13:39:38Z

/unhold
/lgtm

enxebre · 2023-10-26T14:33:49Z

/test e2e-aws

openshift-ci · 2023-10-26T15:11:45Z

New changes are detected. LGTM label has been removed.

sjenning · 2023-10-27T02:11:54Z

/test e2e-aws

openshift-ci · 2023-10-27T14:52:43Z

@enxebre: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

sjenning · 2023-10-27T18:49:51Z

waiting to lgtm until after the weekend just in case 😅

jasonrhunter · 2023-10-30T16:08:36Z

@sjenning ok to lgtm now?

We want to remove the unncessary exposure of port 6443 externally, as this increases the used SG rules, which decreases our max number of HC per management aws account openshift#3139 We split the PR to roll out the HO first to all envs to make sure the haproxy in dataplane for newly created HCs don't point to a port 6443 that won't be exposed.

enxebre · 2023-10-30T16:24:41Z

@mjlshen @sjenning this need to be split in two different PRs and 3 steps:

HO change OCPBUGS-20161: Stop defaulting aws private haproxy external port to 6443 #3147 PTAL
Rollout HO
CPO change OCPBUGS-20161: Stop exposing kas on 6443 private route service load balancer #3149

Otherwise environments without this HO, but using the payload with the change might have a data plane haproxy pointing to 6443 which won't be exposed anymore.

We want to remove the unncessary exposure of port 6443 externally, as this increases the used SG rules, which decreases our max number of HC per management aws account openshift#3139 We split the PR to roll out the HO first to all envs to make sure the haproxy in dataplane for newly created HCs don't point to a port 6443 that won't be exposed.

openshift-ci-robot · 2023-10-31T10:59:40Z

@enxebre: This pull request references Jira Issue OCPBUGS-20161. The bug has been updated to no longer refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:
This was first introduced here https://github.com/openshift/hypershift/pull/1614/files#diff-62c16653415b8d89921cb26796abc479c31da1654095f7c46b551b470533d66dR368-R372 not sure with which purpose.

With the changes in https://github.com/openshift/hypershift/pull/2964/files#diff-39a001edaf01802e79e43b99b8ce38585ea7079c7253be01fe33a4902a9ca184 we stopped defaulting the kas container port to 443 resulting in this "if" to evaluate as true and exposing a new port https://github.com/openshift/hypershift/pull/2964/files#diff-62c16653415b8d89921cb26796abc479c31da1654095f7c46b551b470533d66dL277

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

We want to remove the unncessary exposure of port 6443 externally, as this increases the used SG rules, which decreases our max number of HC per management aws account openshift#3139 We split the PR to roll out the HO first to all envs to make sure the haproxy in dataplane for newly created HCs don't point to a port 6443 that won't be exposed.

parent a701ee3 author red-hat-trusted-app-pipeline <123456+red-hat-trusted-app-pipeline[bot]@users.noreply.github.com> 1698935322 +0000 committer Kyl-Bempah <24903083+Kyl-Bempah@users.noreply.github.com> 1699984168 -0500 # This is a combination of 2 commits. # This is the 1st commit message: chore(deps): update rhtap references # This is the commit message openshift#2: Enable multi-arch builds Signed-off-by: Kyl-Bempah <24903083+Kyl-Bempah@users.noreply.github.com> # This is the commit message openshift#3: OCPBUGS-16079: No error for overlapping service network and API IP Fixes: OCPBUGS-16079 Ensure that the nodeport IP for the API Server does not conflict with the Service Network CIDR. # This is the commit message openshift#4: Stop exposing kas on 6443 private route service load balancer We want to remove the unncessary exposure of port 6443 externally, as this increases the used SG rules, which decreases our max number of HC per management aws account openshift#3139 We split the PR to roll out the HO first to all envs to make sure the haproxy in dataplane for newly created HCs don't point to a port 6443 that won't be exposed. # This is the commit message openshift#5: OCPBUGS-10423: Update regex validation for nodepool.spec.taints.value # This is the commit message openshift#6: HOSTEDCP-1278: Adjustment cluster-cidr,service-cidr to support dual-stack # This is the commit message openshift#7: KubeVirt: create the etcd encryption key secret, if missing To allow creating of KubeVirt hosted cluster using the hosted cluster API (rather than using the cli). When creating the hosted cluster using the cli, the cli also creates the secret. But when creating the hosted cluster using the hosted cluster API, the secret is not created. This PR changes hypershift so it now creates the etcd encryption key secret, if it is not already exist. Signed-off-by: Nahshon Unna-Tsameret <nunnatsa@redhat.com>

author red-hat-trusted-app-pipeline <123456+red-hat-trusted-app-pipeline[bot]@users.noreply.github.com> 1698935322 +0000 committer Kyl-Bempah <24903083+Kyl-Bempah@users.noreply.github.com> 1699984168 -0500 chore(deps): update rhtap references Enable multi-arch builds Signed-off-by: Kyl-Bempah <24903083+Kyl-Bempah@users.noreply.github.com> OCPBUGS-16079: No error for overlapping service network and API IP Fixes: OCPBUGS-16079 Ensure that the nodeport IP for the API Server does not conflict with the Service Network CIDR. Stop exposing kas on 6443 private route service load balancer We want to remove the unncessary exposure of port 6443 externally, as this increases the used SG rules, which decreases our max number of HC per management aws account openshift#3139 We split the PR to roll out the HO first to all envs to make sure the haproxy in dataplane for newly created HCs don't point to a port 6443 that won't be exposed. OCPBUGS-10423: Update regex validation for nodepool.spec.taints.value HOSTEDCP-1278: Adjustment cluster-cidr,service-cidr to support dual-stack KubeVirt: create the etcd encryption key secret, if missing To allow creating of KubeVirt hosted cluster using the hosted cluster API (rather than using the cli). When creating the hosted cluster using the cli, the cli also creates the secret. But when creating the hosted cluster using the hosted cluster API, the secret is not created. This PR changes hypershift so it now creates the etcd encryption key secret, if it is not already exist. Signed-off-by: Nahshon Unna-Tsameret <nunnatsa@redhat.com> Update RHTAP references parent a701ee3 author red-hat-trusted-app-pipeline <123456+red-hat-trusted-app-pipeline[bot]@users.noreply.github.com> 1698935322 +0000 committer Kyl-Bempah <24903083+Kyl-Bempah@users.noreply.github.com> 1699984168 -0500 chore(deps): update rhtap references Enable multi-arch builds Signed-off-by: Kyl-Bempah <24903083+Kyl-Bempah@users.noreply.github.com> OCPBUGS-16079: No error for overlapping service network and API IP Fixes: OCPBUGS-16079 Ensure that the nodeport IP for the API Server does not conflict with the Service Network CIDR. Stop exposing kas on 6443 private route service load balancer We want to remove the unncessary exposure of port 6443 externally, as this increases the used SG rules, which decreases our max number of HC per management aws account openshift#3139 We split the PR to roll out the HO first to all envs to make sure the haproxy in dataplane for newly created HCs don't point to a port 6443 that won't be exposed. OCPBUGS-10423: Update regex validation for nodepool.spec.taints.value HOSTEDCP-1278: Adjustment cluster-cidr,service-cidr to support dual-stack KubeVirt: create the etcd encryption key secret, if missing To allow creating of KubeVirt hosted cluster using the hosted cluster API (rather than using the cli). When creating the hosted cluster using the cli, the cli also creates the secret. But when creating the hosted cluster using the hosted cluster API, the secret is not created. This PR changes hypershift so it now creates the etcd encryption key secret, if it is not already exist. Signed-off-by: Nahshon Unna-Tsameret <nunnatsa@redhat.com> Update RHTAP references

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Oct 26, 2023

openshift-ci Bot added do-not-merge/needs-area do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. labels Oct 26, 2023

openshift-ci Bot requested review from csrwng and sjenning October 26, 2023 11:53

openshift-ci Bot added area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release approved Indicates a PR has been approved by an approver from all required OWNERS files. and removed do-not-merge/needs-area labels Oct 26, 2023

enxebre force-pushed the port-fix branch 2 times, most recently from 6bdc992 to 9b91d79 Compare October 26, 2023 12:09

openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Oct 26, 2023

openshift-ci-robot removed the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Oct 26, 2023

mjlshen approved these changes Oct 26, 2023

View reviewed changes

openshift-ci Bot assigned mjlshen Oct 26, 2023

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Oct 26, 2023

mjlshen reviewed Oct 26, 2023

View reviewed changes

enxebre force-pushed the port-fix branch from 9b91d79 to 3bcc4bb Compare October 26, 2023 12:42

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 26, 2023

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 26, 2023

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 26, 2023

enxebre force-pushed the port-fix branch from 3bcc4bb to 49bf86b Compare October 26, 2023 15:11

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 26, 2023

sjenning requested changes Oct 26, 2023

View reviewed changes

Comment thread control-plane-operator/controllers/hostedcontrolplane/kas/params.go Outdated

openshift-ci Bot assigned sjenning Oct 26, 2023

enxebre force-pushed the port-fix branch from 49bf86b to 9243af6 Compare October 26, 2023 16:19

enxebre force-pushed the port-fix branch 2 times, most recently from 17e7190 to 2c8c633 Compare October 27, 2023 10:42

openshift-ci Bot added the area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release label Oct 27, 2023

enxebre force-pushed the port-fix branch from 2c8c633 to 092e83f Compare October 27, 2023 10:49

Remove unncessary kas port exposure on service

c342322

enxebre force-pushed the port-fix branch from 092e83f to c342322 Compare October 27, 2023 12:11

enxebre mentioned this pull request Oct 30, 2023

OCPBUGS-20161: Stop defaulting aws private haproxy external port to 6443 #3147

Merged

4 tasks

enxebre mentioned this pull request Oct 31, 2023

OCPBUGS-20161: Stop exposing kas on 6443 private route service load balancer #3149

Merged

4 tasks

enxebre closed this Oct 31, 2023

Uh oh!

Conversation

enxebre commented Oct 26, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Oct 26, 2023

Uh oh!

enxebre commented Oct 26, 2023

Uh oh!

enxebre commented Oct 26, 2023

Uh oh!

openshift-cherrypick-robot commented Oct 26, 2023

Uh oh!

openshift-ci-robot commented Oct 26, 2023

Uh oh!

openshift-ci-robot commented Oct 26, 2023

Uh oh!

mjlshen left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Oct 26, 2023

Uh oh!

openshift-ci Bot commented Oct 26, 2023

Uh oh!

mjlshen Oct 26, 2023

Choose a reason for hiding this comment

Uh oh!

mjlshen Oct 26, 2023

Choose a reason for hiding this comment

Uh oh!

enxebre Oct 26, 2023

Choose a reason for hiding this comment

Uh oh!

mjlshen commented Oct 26, 2023

Uh oh!

mjlshen commented Oct 26, 2023

Uh oh!

enxebre commented Oct 26, 2023

Uh oh!

openshift-ci Bot commented Oct 26, 2023

Uh oh!

Uh oh!

sjenning commented Oct 27, 2023

Uh oh!

openshift-ci Bot commented Oct 27, 2023

Uh oh!

sjenning commented Oct 27, 2023

Uh oh!

jasonrhunter commented Oct 30, 2023

Uh oh!

enxebre commented Oct 30, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Oct 31, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

enxebre commented Oct 26, 2023 •

edited

Loading

enxebre commented Oct 30, 2023 •

edited

Loading