ROSAENG-8224: refactor(ho): improve --hcp-egress-block-cidrs validation#8763
ROSAENG-8224: refactor(ho): improve --hcp-egress-block-cidrs validation#8763Ajpantuso wants to merge 1 commit into
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
|
@Ajpantuso: This pull request references ROSAENG-8224 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (4)
🚧 Files skipped from review as they are similar to previous changes (4)
📝 WalkthroughWalkthrough
Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 10 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (10 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Move CIDR validation from the cmd.Run closure (which used os.Exit) into validateStartOptions, where it returns errors consistently with other startup checks. Add IPv6 rejection since the CIDRs are used in IPv4-only NetworkPolicy IPBlock.Except rules, and log configured CIDRs at startup. Apply the same IPv6 rejection to the install command's validateHCPEgressBlockCIDRs. Update flag help text in both entry points to document the IPv4 constraint. Add unit tests for validateStartOptions (new file) and validateHCPEgressBlockCIDRs (appended to existing install_test.go). Jira: ROSAENG-8224 Signed-off-by: Andrew Pantuso <[email protected]> Commit-Message-Assisted-by: Claude (via Claude Code)
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: Ajpantuso The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Ajpantuso
force-pushed
the
apantuso/rosaeng-8224_pt2
branch
from
ba66b85 to
72d94c6
Compare
openshift-ci
Bot
added
area/cli
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hypershift-operator/main.go`:
- Around line 366-368: The log statement in the HCP egress block CIDRs check is
logging the full list of `opts.HCPEgressBlockCIDRs`, which exposes sensitive
customer network ranges in centralized logs. Instead of logging the actual CIDR
values, modify the log statement to only log the count of configured CIDRs
(using len(opts.HCPEgressBlockCIDRs)) to maintain visibility into the
configuration while protecting sensitive network information.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: cc17f3a9-1fb9-447d-80f4-679b4945903c
📒 Files selected for processing (4)
cmd/install/install.gocmd/install/install_test.gohypershift-operator/main.gohypershift-operator/main_validate_test.go
| if len(opts.HCPEgressBlockCIDRs) > 0 { | ||
| log.Info("Static HCP egress block CIDRs configured", "cidrs", opts.HCPEgressBlockCIDRs) | ||
| } |
There was a problem hiding this comment.
Avoid logging raw HCP egress CIDR values.
Line 367 logs the full HCPEgressBlockCIDRs list, which can leak internal/customer network ranges into centralized logs. Prefer logging only count (or redacted values).
Suggested change
if len(opts.HCPEgressBlockCIDRs) > 0 {
- log.Info("Static HCP egress block CIDRs configured", "cidrs", opts.HCPEgressBlockCIDRs)
+ log.Info("Static HCP egress block CIDRs configured", "count", len(opts.HCPEgressBlockCIDRs))
}As per coding guidelines, "Flag logging that may expose passwords, tokens, API keys, PII (email, SSN, credit card), session IDs, internal hostnames, or customer data".
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if len(opts.HCPEgressBlockCIDRs) > 0 { | |
| log.Info("Static HCP egress block CIDRs configured", "cidrs", opts.HCPEgressBlockCIDRs) | |
| } | |
| if len(opts.HCPEgressBlockCIDRs) > 0 { | |
| log.Info("Static HCP egress block CIDRs configured", "count", len(opts.HCPEgressBlockCIDRs)) | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@hypershift-operator/main.go` around lines 366 - 368, The log statement in the
HCP egress block CIDRs check is logging the full list of
`opts.HCPEgressBlockCIDRs`, which exposes sensitive customer network ranges in
centralized logs. Instead of logging the actual CIDR values, modify the log
statement to only log the count of configured CIDRs (using
len(opts.HCPEgressBlockCIDRs)) to maintain visibility into the configuration
while protecting sensitive network information.
Source: Coding guidelines
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #8763 +/- ##
==========================================
+ Coverage 41.80% 41.82% +0.02%
==========================================
Files 759 759
Lines 94067 94077 +10
==========================================
+ Hits 39323 39348 +25
+ Misses 51993 51977 -16
- Partials 2751 2752 +1
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
@Ajpantuso: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
What this PR does / why we need it:
Improves validation of the
--hcp-egress-block-cidrsflag introduced in #8689:cmd.Runclosure (which calledos.Exit) intovalidateStartOptions, where it returns errors consistently with other startup checks.NetworkPolicyIPBlock.Exceptrules.validateHCPEgressBlockCIDRs.Which issue(s) this PR fixes:
Fixes ROSAENG-8224
Special notes for your reviewer:
Follow-up to #8689. The validation logic is functionally equivalent for valid IPv4 inputs —
this PR moves it to a better location, adds the IPv6 guard, and adds test coverage that
did not previously exist for
validateStartOptions.Checklist:
Summary by CodeRabbit
--hcp-egress-block-cidrsby rejecting any non-IPv4 CIDR entries and returning clearer errors for invalid or IPv6 CIDRs.--hcp-egress-block-cidrsvalidation, including empty input, valid IPv4 CIDRs, invalid CIDR strings, and IPv6 (including mixed) cases.