linode / linode/cloud-firewall-controller
Enhancement: (Helm) truncate firewall label/description to match Linode API contract
Nessuno ha ancora preso questa issue.
- Lingua principale
- Go
- Stelle
- 16
- Fork
- 9
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
Using the helm templates I added an additional firewall rule using the `values.yaml` file example:
```yaml
# Additional Cloud Firewall rules can be added to the default set by adding them to the list below.
# These will be applied along with the default ruleset. Any rule added here will below
# applied to all nodes in the cluster.
firewall:
inbound:
- label: "allow-custom-port"
action: "ACCEPT"
description: "custom-rule"
protocol: "TCP"
ports: "9999"
addresses:
ipv4:
- "192.168.128.0/17"
```
My *`label`* however was too long (longer than the API allows, i.e. 32 characters). For some reason that I don't understand **this caused the entire firewall controller to hang** on this log line:
https://github.com/linode/cloud-firewall-controller/blob/8eae0593716403589d4b070840967399b0b153d7/internal/controller/cloudfirewall_controller.go#L240-L240
I got no errors in the logs of the cloud firewall controller pod at all, and the result was that I didn't have a firewall applied and thus 'Accept by default' rules essentially. 😐 I even deleted the pod to see if it would react any differently, but got the same results.
Interestingly enough when I edited the `networking.linode.com/alpha1v1:CloudFirewall` manifest directly and changed a few characters, I *did* get an message somewhere in the logs about exceeding the maximum length for the label. When I fixed that, it got applied correctly.
Unfortunately I don't have the logging anymore, they got lost clearing my shell output.
It seems to me that either way: it would be a good idea to either:
* truncate the label and/or description to the maximum amount of characters
* fail the template rendering if the length exceeds the maximum length for certain fields.
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Come iniziare
- Leggi tutta la issue e poi la guida ai contributi del progetto.
- Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
- Fai un fork del repository e lavora su un branch.
- Apri una pull request che faccia riferimento al numero della issue.
Direzione di ricerca
Start at internal/controller/cloudfirewall_controller.go around line 240 and inspect the Helm values.yaml example and templates involved in creating CloudFirewall rules. Reproduce the problem with a label longer than the Linode API's 32-character limit, then trace whether validation occurs during template rendering or controller reconciliation. Done means oversized labels and descriptions receive an explicit, tested outcome rather than silently hanging or leaving the firewall unapplied.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- go, helm
- Ambito
- infrastructure
- Tipo di issue
- Funzionalità
- Difficoltà
- 3/5
- Tempo stimato
- 1-2 giorni
- Stato di attività
- Ferma
- Chiarezza
- Abbastanza chiara
- Idoneità per principianti
- 45/100