ROSAENG-8224: refactor(ho): improve --hcp-egress-block-cidrs validation - #8763
ROSAENG-8224: refactor(ho): improve --hcp-egress-block-cidrs validation#8763Ajpantuso wants to merge 1 commit into
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
|
@Ajpantuso: This pull request references ROSAENG-8224 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughA new exported helper Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: Ajpantuso The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
ba66b85 to
72d94c6
Compare
openshift-ci
Bot
added
area/cli
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hypershift-operator/main.go`:
- Around line 366-368: The log statement in the HCP egress block CIDRs check is
logging the full list of `opts.HCPEgressBlockCIDRs`, which exposes sensitive
customer network ranges in centralized logs. Instead of logging the actual CIDR
values, modify the log statement to only log the count of configured CIDRs
(using len(opts.HCPEgressBlockCIDRs)) to maintain visibility into the
configuration while protecting sensitive network information.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: cc17f3a9-1fb9-447d-80f4-679b4945903c
📒 Files selected for processing (4)
cmd/install/install.gocmd/install/install_test.gohypershift-operator/main.gohypershift-operator/main_validate_test.go
| if len(opts.HCPEgressBlockCIDRs) > 0 { | ||
| log.Info("Static HCP egress block CIDRs configured", "cidrs", opts.HCPEgressBlockCIDRs) | ||
| } |
There was a problem hiding this comment.
Avoid logging raw HCP egress CIDR values.
Line 367 logs the full HCPEgressBlockCIDRs list, which can leak internal/customer network ranges into centralized logs. Prefer logging only count (or redacted values).
Suggested change
if len(opts.HCPEgressBlockCIDRs) > 0 {
- log.Info("Static HCP egress block CIDRs configured", "cidrs", opts.HCPEgressBlockCIDRs)
+ log.Info("Static HCP egress block CIDRs configured", "count", len(opts.HCPEgressBlockCIDRs))
}As per coding guidelines, "Flag logging that may expose passwords, tokens, API keys, PII (email, SSN, credit card), session IDs, internal hostnames, or customer data".
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if len(opts.HCPEgressBlockCIDRs) > 0 { | |
| log.Info("Static HCP egress block CIDRs configured", "cidrs", opts.HCPEgressBlockCIDRs) | |
| } | |
| if len(opts.HCPEgressBlockCIDRs) > 0 { | |
| log.Info("Static HCP egress block CIDRs configured", "count", len(opts.HCPEgressBlockCIDRs)) | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@hypershift-operator/main.go` around lines 366 - 368, The log statement in the
HCP egress block CIDRs check is logging the full list of
`opts.HCPEgressBlockCIDRs`, which exposes sensitive customer network ranges in
centralized logs. Instead of logging the actual CIDR values, modify the log
statement to only log the count of configured CIDRs (using
len(opts.HCPEgressBlockCIDRs)) to maintain visibility into the configuration
while protecting sensitive network information.
Source: Coding guidelines
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #8763 +/- ##
==========================================
+ Coverage 43.78% 43.80% +0.01%
==========================================
Files 772 772
Lines 96000 96050 +50
==========================================
+ Hits 42033 42074 +41
- Misses 51055 51061 +6
- Partials 2912 2915 +3
... and 1 file with indirect coverage changes
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
72d94c6 to
f4da3ac
Compare
There was a problem hiding this comment.
♻️ Duplicate comments (1)
hypershift-operator/main.go (1)
360-362:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAvoid logging raw HCP egress CIDRs.
Line 361 logs full
HCPEgressBlockCIDRs, which can expose customer/internal network ranges in centralized logs. Log only count (or redact values).As per coding guidelines, "Flag logging that may expose passwords, tokens, API keys, PII (email, SSN, credit card), session IDs, internal hostnames, or customer data".
Suggested change
if len(opts.HCPEgressBlockCIDRs) > 0 { - log.Info("Static HCP egress block CIDRs configured", "cidrs", opts.HCPEgressBlockCIDRs) + log.Info("Static HCP egress block CIDRs configured", "count", len(opts.HCPEgressBlockCIDRs)) }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hypershift-operator/main.go` around lines 360 - 362, The log statement in the block that checks `if len(opts.HCPEgressBlockCIDRs) > 0` is logging the full CIDR values from `opts.HCPEgressBlockCIDRs`, which can expose internal network ranges in centralized logs. Instead of logging the raw CIDR values, modify the log.Info call to log only the count of configured CIDRs by using `len(opts.HCPEgressBlockCIDRs)` as the value, removing the direct reference to the CIDR slice itself.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@hypershift-operator/main.go`:
- Around line 360-362: The log statement in the block that checks `if
len(opts.HCPEgressBlockCIDRs) > 0` is logging the full CIDR values from
`opts.HCPEgressBlockCIDRs`, which can expose internal network ranges in
centralized logs. Instead of logging the raw CIDR values, modify the log.Info
call to log only the count of configured CIDRs by using
`len(opts.HCPEgressBlockCIDRs)` as the value, removing the direct reference to
the CIDR slice itself.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 6d3277d6-f447-4723-8417-40697b1ec0e0
📒 Files selected for processing (6)
cmd/install/install.gocmd/install/install_test.gocmd/util/util.gocmd/util/util_test.gohypershift-operator/main.gohypershift-operator/main_validate_test.go
🚧 Files skipped from review as they are similar to previous changes (2)
- hypershift-operator/main_validate_test.go
- cmd/install/install_test.go
e5fd053 to
daa328e
Compare
|
/lgtm |
|
Scheduling tests matching the |
|
/retest-required |
openshift-ci
Bot
added
the
needs-rebase
daa328e to
82ebe51
Compare
openshift-ci
Bot
removed
lgtm
openshift-ci
Bot
added
the
needs-rebase
82ebe51 to
8571cce
Compare
openshift-ci
Bot
removed
the
needs-rebase
Move CIDR validation from the cmd.Run closure (which used os.Exit) into validateStartOptions, where it returns errors consistently with other startup checks. Add IPv6 rejection since the CIDRs are used in IPv4-only NetworkPolicy IPBlock.Except rules, and log configured CIDRs at startup. Apply the same IPv6 rejection to the install command's validateHCPEgressBlockCIDRs. Update flag help text in both entry points to document the IPv4 constraint. Add unit tests for validateStartOptions (new file) and validateHCPEgressBlockCIDRs (appended to existing install_test.go). Jira: ROSAENG-8224 Signed-off-by: Andrew Pantuso <apantuso@redhat.com> Commit-Message-Assisted-by: Claude (via Claude Code)
8571cce to
e8bca61
Compare
|
Now I have all the evidence. The Test Failure Analysis CompleteJob Information
Test Failure AnalysisErrorSummaryThe codecov/patch check failed because all 7 new executable lines added to Root CauseThe PR introduces two code changes:
Since all 7 diff-touched executable lines are in a file with no test coverage, the patch coverage is 0%, which fails the default Codecov patch gate (target: 43.78%, the project average). The Recommendations
Evidence
|
|
/lgtm |
|
Scheduling tests matching the |
|
/retest-required |
1 similar comment
|
/retest-required |
|
Stale PRs are closed after 21d of inactivity. If this PR is still relevant, comment to refresh it or remove the stale label. If this PR is safe to close now please do so with /lifecycle stale |
openshift-ci
Bot
added
the
lifecycle/stale
|
@Ajpantuso: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
openshift-ci
Bot
added
the
needs-rebase
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
3 participants
What this PR does / why we need it:
Improves validation of the
--hcp-egress-block-cidrsflag introduced in #8689:cmd.Runclosure (which calledos.Exit) intovalidateStartOptions, where it returns errors consistently with other startup checks.NetworkPolicyIPBlock.Exceptrules.validateHCPEgressBlockCIDRs.Which issue(s) this PR fixes:
Fixes ROSAENG-8224
Special notes for your reviewer:
Follow-up to #8689. The validation logic is functionally equivalent for valid IPv4 inputs —
this PR moves it to a better location, adds the IPv6 guard, and adds test coverage that
did not previously exist for
validateStartOptions.Checklist:
Summary by CodeRabbit
Bug Fixes
Documentation
--hcp-egress-block-cidrsflag only accepts IPv4 CIDRs.