MON: rename remote write SafeAuthorization to Authorization#2901
MON: rename remote write SafeAuthorization to Authorization#2901marioferh wants to merge 6 commits into
Conversation
Align remote write auth with CMO by replacing SafeAuthorization and BearerToken with type Authorization and a credentials secret reference. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe remote-write authorization union now uses 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.12.2)Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented Comment |
|
Hello @marioferh! Some important instructions when contributing to openshift/api: |
openshift-ci
Bot
added
the
size/L
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@config/v1alpha1/types_cluster_monitoring.go`:
- Around line 1675-1677: The comment for RemoteWriteAuthorization states that
exactly one nested config must be set, but this does not accurately reflect the
CEL validation rule which shows that when type is ServiceAccount, credentials
are forbidden, and when type is Authorization, credentials are required. Update
the comment on line 1675-1677 to clarify the actual constraint: that credential
requirements are dependent on the type value, where type Authorization requires
credentials while type ServiceAccount forbids them, ensuring the generated API
documentation accurately describes the validation behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 696d9812-3db2-450a-9d64-9d3f278c1f8f
⛔ Files ignored due to path filters (6)
config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_clustermonitorings.crd.yamlis excluded by!**/zz_generated.crd-manifests/*config/v1alpha1/zz_generated.deepcopy.gois excluded by!**/zz_generated*config/v1alpha1/zz_generated.featuregated-crd-manifests/clustermonitorings.config.openshift.io/ClusterMonitoringConfig.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**config/v1alpha1/zz_generated.swagger_doc_generated.gois excluded by!**/zz_generated*openapi/generated_openapi/zz_generated.openapi.gois excluded by!openapi/**,!**/zz_generated*openapi/openapi.jsonis excluded by!openapi/**
📒 Files selected for processing (2)
config/v1alpha1/types_cluster_monitoring.gopayload-manifests/crds/0000_10_config-operator_01_clustermonitorings.crd.yaml
|
@everettraven do we need a tombstone here? |
simonpasquier
left a comment
simonpasquier
left a comment
There was a problem hiding this comment.
authorization is modeled after https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Authorization and has 2 properties:
- authz scheme, e.g.
Bearer. OnlyBasic-Authshould be forbidden. - authz parameters (or credentials), e.g. the bearer token value.
See also https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.SafeAuthorization
ty |
everettraven
left a comment
everettraven
left a comment
There was a problem hiding this comment.
A few comments. We need to align with DU patterns and tombstone removed fields/values.
| // +unionMember=Authorization | ||
| // +optional | ||
| BearerToken SecretKeySelector `json:"bearerToken,omitempty,omitzero"` | ||
| Credentials SecretKeySelector `json:"credentials,omitempty,omitzero"` |
There was a problem hiding this comment.
Following discriminated union patterns, this field name would need to be authorization.
| // safeAuthorization defines the secret reference containing the credentials for authentication (e.g. Bearer token). | ||
| // Required when type is "SafeAuthorization", and forbidden otherwise. Maps to Prometheus SafeAuthorization. The secret must exist in the openshift-monitoring namespace. | ||
| // +unionMember | ||
| // +optional | ||
| SafeAuthorization *v1.SecretKeySelector `json:"safeAuthorization,omitempty"` | ||
| // bearerToken defines the secret reference containing the bearer token. | ||
| // Required when type is "BearerToken", and forbidden otherwise. | ||
| // +unionMember | ||
| // credentials defines the secret reference containing the authorization credentials (e.g. Bearer token). | ||
| // Required when type is "Authorization", and forbidden otherwise. | ||
| // The secret must exist in the openshift-monitoring namespace. | ||
| // +unionMember=Authorization | ||
| // +optional | ||
| BearerToken SecretKeySelector `json:"bearerToken,omitempty,omitzero"` |
There was a problem hiding this comment.
The removed fields must be tombstoned so we never add them back in the future for this api version.
Rename the Authorization union member to authorization, tombstone removed BearerToken/SafeAuthorization values and fields, and clarify ServiceAccount validation so the API follows discriminated union conventions. Co-authored-by: Cursor <cursoragent@cursor.com>
Retain BearerToken and SafeAuthorization in the CRD schema while rejecting them via validation, so verify-crdify passes and callers migrate to the Authorization union member. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@payload-manifests/crds/0000_10_config-operator_01_clustermonitorings.crd.yaml`:
- Around line 3501-3503: Update the generated CRD field descriptions for the
legacy bearerToken-related fields so they no longer describe them as normal
SecretKeySelectors; mark them as deprecated and rejected to match the validation
behavior in the ClusterMonitoring CRD. Make the change in the source that
generates the CRD docs (not by hand-editing the manifest), then regenerate the
manifest so the descriptions for the affected fields reflect the tombstone
status consistently.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: a1fa1f7e-16e4-4948-9b2d-53d7e2768d36
⛔ Files ignored due to path filters (6)
config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_clustermonitorings.crd.yamlis excluded by!**/zz_generated.crd-manifests/*config/v1alpha1/zz_generated.deepcopy.gois excluded by!**/zz_generated*config/v1alpha1/zz_generated.featuregated-crd-manifests/clustermonitorings.config.openshift.io/ClusterMonitoringConfig.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**config/v1alpha1/zz_generated.swagger_doc_generated.gois excluded by!**/zz_generated*openapi/generated_openapi/zz_generated.openapi.gois excluded by!openapi/**,!**/zz_generated*openapi/openapi.jsonis excluded by!openapi/**
📒 Files selected for processing (2)
config/v1alpha1/types_cluster_monitoring.gopayload-manifests/crds/0000_10_config-operator_01_clustermonitorings.crd.yaml
Start bearerToken and safeAuthorization comments with the field name so kubeapilinter commentstart checks pass. Co-authored-by: Cursor <cursoragent@cursor.com>
Update CRD manifests, swagger docs, and openapi to match the revised bearerToken and safeAuthorization field comments. Co-authored-by: Cursor <cursoragent@cursor.com>
everettraven
left a comment
everettraven
left a comment
There was a problem hiding this comment.
Aside from some tombstoning corrections, this change seems fine to me.
Are there any integration test changes that need to happen since we are removing some fields?
| RemoteWriteAuthorizationTypeBearerToken RemoteWriteAuthorizationType = "BearerToken" | ||
|
|
||
| // --- TOMBSTONE --- | ||
| // RemoteWriteAuthorizationTypeSafeAuthorization is deprecated. Use RemoteWriteAuthorizationTypeAuthorization instead. | ||
| // The value remains in the API schema but is rejected by validation. | ||
| RemoteWriteAuthorizationTypeSafeAuthorization RemoteWriteAuthorizationType = "SafeAuthorization" |
There was a problem hiding this comment.
Comment the actual constants out so they can't be used by clients.
| // bearerToken is a tombstoned field that is deprecated. Use authorization with type Authorization instead. | ||
| // This field remains in the API schema but is rejected by validation. | ||
| // +unionMember | ||
| // +optional | ||
| BearerToken SecretKeySelector `json:"bearerToken,omitempty,omitzero"` | ||
| // safeAuthorization is a tombstoned field that is deprecated. Use authorization with type Authorization instead. | ||
| // This field remains in the API schema but is rejected by validation. | ||
| // +unionMember | ||
| // +optional | ||
| SafeAuthorization *v1.SecretKeySelector `json:"safeAuthorization,omitempty"` |
There was a problem hiding this comment.
These fields need to be commented out to be tombstoned so that they no longer appear in the API surface and are not included in the generated CRD schema.
Comment out removed BearerToken and SafeAuthorization constants and fields per API tombstone conventions, and add integration tests for Authorization and ServiceAccount remote write auth. Co-authored-by: Cursor <cursoragent@cursor.com>
|
There were no existing integration tests for the removed fields. I added some test for new fields |
openshift-ci
Bot
added
size/XL
There was a problem hiding this comment.
🧹 Nitpick comments (1)
config/v1alpha1/tests/clustermonitorings.config.openshift.io/ClusterMonitoringConfig.yaml (1)
2970-2983: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd the matching
SafeAuthorizationrejection case.This test covers the removed
BearerTokendiscriminator, but the API contract also tombstonesSafeAuthorization. Add the same unsupported-value coverage fortype: SafeAuthorizationso both removed values are protected by tests.Suggested additional test
- name: Should reject prometheusConfig remoteWrite deprecated BearerToken type initial: | apiVersion: config.openshift.io/v1alpha1 kind: ClusterMonitoring @@ authorization: type: BearerToken expectedError: 'spec.prometheusConfig.remoteWrite[0].authorization.type: Unsupported value: "BearerToken": supported values: "Authorization", "BasicAuth", "OAuth2", "SigV4", "ServiceAccount"' + - name: Should reject prometheusConfig remoteWrite deprecated SafeAuthorization type + initial: | + apiVersion: config.openshift.io/v1alpha1 + kind: ClusterMonitoring + spec: + userDefined: + mode: "Disabled" + prometheusConfig: + remoteWrite: + - name: primary + url: https://example.com/api/v1/write + authorization: + type: SafeAuthorization + expectedError: 'spec.prometheusConfig.remoteWrite[0].authorization.type: Unsupported value: "SafeAuthorization": supported values: "Authorization", "BasicAuth", "OAuth2", "SigV4", "ServiceAccount"'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@config/v1alpha1/tests/clustermonitorings.config.openshift.io/ClusterMonitoringConfig.yaml` around lines 2970 - 2983, The remoteWrite validation tests only cover the removed BearerToken discriminator; add a matching rejection case for the removed SafeAuthorization discriminator in the same ClusterMonitoringConfig test group. Update the test data near the existing remoteWrite authorization cases so the spec.prometheusConfig.remoteWrite[].authorization.type path also asserts Unsupported value for SafeAuthorization, using the same style as the current deprecated BearerToken coverage.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In
`@config/v1alpha1/tests/clustermonitorings.config.openshift.io/ClusterMonitoringConfig.yaml`:
- Around line 2970-2983: The remoteWrite validation tests only cover the removed
BearerToken discriminator; add a matching rejection case for the removed
SafeAuthorization discriminator in the same ClusterMonitoringConfig test group.
Update the test data near the existing remoteWrite authorization cases so the
spec.prometheusConfig.remoteWrite[].authorization.type path also asserts
Unsupported value for SafeAuthorization, using the same style as the current
deprecated BearerToken coverage.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: f752a38c-370c-4334-9a3a-cfdd0a38eb04
⛔ Files ignored due to path filters (6)
config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_clustermonitorings.crd.yamlis excluded by!**/zz_generated.crd-manifests/*config/v1alpha1/zz_generated.deepcopy.gois excluded by!**/zz_generated*config/v1alpha1/zz_generated.featuregated-crd-manifests/clustermonitorings.config.openshift.io/ClusterMonitoringConfig.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**config/v1alpha1/zz_generated.swagger_doc_generated.gois excluded by!**/zz_generated*openapi/generated_openapi/zz_generated.openapi.gois excluded by!openapi/**,!**/zz_generated*openapi/openapi.jsonis excluded by!openapi/**
📒 Files selected for processing (3)
config/v1alpha1/tests/clustermonitorings.config.openshift.io/ClusterMonitoringConfig.yamlconfig/v1alpha1/types_cluster_monitoring.gopayload-manifests/crds/0000_10_config-operator_01_clustermonitorings.crd.yaml
💤 Files with no reviewable changes (1)
- payload-manifests/crds/0000_10_config-operator_01_clustermonitorings.crd.yaml
|
Scheduling tests matching the |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: everettraven The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
TPNU only v1alpha1 API and properly tombstones. Overriding failures because of field removal. /override ci/prow/verify-crd-schema |
|
@everettraven: Overrode contexts on behalf of everettraven: ci/prow/verify-crd-schema, ci/prow/verify-crdify DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@marioferh: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
4 participants
Align remote write auth with CMO by replacing SafeAuthorization and BearerToken with type Authorization and a credentials secret reference.