linode / linode/cloud-firewall-controller

Enhancement: (Helm) truncate firewall label/description to match Linode API contract

Open
#17 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
16
Forks
9
PR merge metrics
No merged PRs in 30d

Description

Using the helm templates I added an additional firewall rule using the `values.yaml` file example:

```yaml
# Additional Cloud Firewall rules can be added to the default set by adding them to the list below.
# These will be applied along with the default ruleset. Any rule added here will below
# applied to all nodes in the cluster.
firewall:
inbound:
- label: "allow-custom-port"
action: "ACCEPT"
description: "custom-rule"
protocol: "TCP"
ports: "9999"
addresses:
ipv4:
- "192.168.128.0/17"
```

My *`label`* however was too long (longer than the API allows, i.e. 32 characters). For some reason that I don't understand **this caused the entire firewall controller to hang** on this log line:

https://github.com/linode/cloud-firewall-controller/blob/8eae0593716403589d4b070840967399b0b153d7/internal/controller/cloudfirewall_controller.go#L240-L240

I got no errors in the logs of the cloud firewall controller pod at all, and the result was that I didn't have a firewall applied and thus 'Accept by default' rules essentially. 😐 I even deleted the pod to see if it would react any differently, but got the same results.

Interestingly enough when I edited the `networking.linode.com/alpha1v1:CloudFirewall` manifest directly and changed a few characters, I *did* get an message somewhere in the logs about exceeding the maximum length for the label. When I fixed that, it got applied correctly.

Unfortunately I don't have the logging anymore, they got lost clearing my shell output.

It seems to me that either way: it would be a good idea to either:
* truncate the label and/or description to the maximum amount of characters
* fail the template rendering if the length exceeds the maximum length for certain fields.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at internal/controller/cloudfirewall_controller.go around line 240 and inspect the Helm values.yaml example and templates involved in creating CloudFirewall rules. Reproduce the problem with a label longer than the Linode API's 32-character limit, then trace whether validation occurs during template rendering or controller reconciliation. Done means oversized labels and descriptions receive an explicit, tested outcome rather than silently hanging or leaving the firewall unapplied.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, helm
Domain
infrastructure
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.