MON: rename remote write SafeAuthorization to Authorization#2901
MON: rename remote write SafeAuthorization to Authorization#2901marioferh wants to merge 1 commit into
Conversation
Align remote write auth with CMO by replacing SafeAuthorization and BearerToken with type Authorization and a credentials secret reference. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
📝 WalkthroughWalkthroughThe 🚥 Pre-merge checks | ✅ 5 | ❌ 10❌ Failed checks (10 inconclusive)
✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.12.2)Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented Comment |
|
Hello @marioferh! Some important instructions when contributing to openshift/api: |
openshift-ci
Bot
added
the
size/L
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@config/v1alpha1/types_cluster_monitoring.go`:
- Around line 1675-1677: The comment for RemoteWriteAuthorization states that
exactly one nested config must be set, but this does not accurately reflect the
CEL validation rule which shows that when type is ServiceAccount, credentials
are forbidden, and when type is Authorization, credentials are required. Update
the comment on line 1675-1677 to clarify the actual constraint: that credential
requirements are dependent on the type value, where type Authorization requires
credentials while type ServiceAccount forbids them, ensuring the generated API
documentation accurately describes the validation behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 696d9812-3db2-450a-9d64-9d3f278c1f8f
⛔ Files ignored due to path filters (6)
config/v1alpha1/zz_generated.crd-manifests/0000_10_config-operator_01_clustermonitorings.crd.yamlis excluded by!**/zz_generated.crd-manifests/*config/v1alpha1/zz_generated.deepcopy.gois excluded by!**/zz_generated*config/v1alpha1/zz_generated.featuregated-crd-manifests/clustermonitorings.config.openshift.io/ClusterMonitoringConfig.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**config/v1alpha1/zz_generated.swagger_doc_generated.gois excluded by!**/zz_generated*openapi/generated_openapi/zz_generated.openapi.gois excluded by!openapi/**,!**/zz_generated*openapi/openapi.jsonis excluded by!openapi/**
📒 Files selected for processing (2)
config/v1alpha1/types_cluster_monitoring.gopayload-manifests/crds/0000_10_config-operator_01_clustermonitorings.crd.yaml
|
@everettraven do we need a tombstone here? |
simonpasquier
left a comment
simonpasquier
left a comment
There was a problem hiding this comment.
authorization is modeled after https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Authorization and has 2 properties:
- authz scheme, e.g.
Bearer. OnlyBasic-Authshould be forbidden. - authz parameters (or credentials), e.g. the bearer token value.
See also https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.SafeAuthorization
|
@marioferh: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
ty |
everettraven
left a comment
everettraven
left a comment
There was a problem hiding this comment.
A few comments. We need to align with DU patterns and tombstone removed fields/values.
| // +unionMember=Authorization | ||
| // +optional | ||
| BearerToken SecretKeySelector `json:"bearerToken,omitempty,omitzero"` | ||
| Credentials SecretKeySelector `json:"credentials,omitempty,omitzero"` |
There was a problem hiding this comment.
Following discriminated union patterns, this field name would need to be authorization.
| // RemoteWriteAuthorizationTypeBearerToken indicates bearer token from a secret. | ||
| RemoteWriteAuthorizationTypeBearerToken RemoteWriteAuthorizationType = "BearerToken" | ||
| // RemoteWriteAuthorizationTypeAuthorization indicates authorization credentials from a secret. | ||
| // The secret key contains the credentials (e.g. a Bearer token). Use the credentials field. | ||
| RemoteWriteAuthorizationTypeAuthorization RemoteWriteAuthorizationType = "Authorization" | ||
| // RemoteWriteAuthorizationTypeBasicAuth indicates HTTP basic authentication. | ||
| RemoteWriteAuthorizationTypeBasicAuth RemoteWriteAuthorizationType = "BasicAuth" | ||
| // RemoteWriteAuthorizationTypeOAuth2 indicates OAuth2 client credentials. | ||
| RemoteWriteAuthorizationTypeOAuth2 RemoteWriteAuthorizationType = "OAuth2" | ||
| // RemoteWriteAuthorizationTypeSigV4 indicates AWS Signature Version 4. | ||
| RemoteWriteAuthorizationTypeSigV4 RemoteWriteAuthorizationType = "SigV4" | ||
| // RemoteWriteAuthorizationTypeSafeAuthorization indicates authorization from a secret (Prometheus SafeAuthorization pattern). | ||
| // The secret key contains the credentials (e.g. a Bearer token). Use the safeAuthorization field. | ||
| RemoteWriteAuthorizationTypeSafeAuthorization RemoteWriteAuthorizationType = "SafeAuthorization" |
There was a problem hiding this comment.
The removed constants need to be tombstoned so we do not add these options back as valid options in the future.
| // safeAuthorization defines the secret reference containing the credentials for authentication (e.g. Bearer token). | ||
| // Required when type is "SafeAuthorization", and forbidden otherwise. Maps to Prometheus SafeAuthorization. The secret must exist in the openshift-monitoring namespace. | ||
| // +unionMember | ||
| // +optional | ||
| SafeAuthorization *v1.SecretKeySelector `json:"safeAuthorization,omitempty"` | ||
| // bearerToken defines the secret reference containing the bearer token. | ||
| // Required when type is "BearerToken", and forbidden otherwise. | ||
| // +unionMember | ||
| // credentials defines the secret reference containing the authorization credentials (e.g. Bearer token). | ||
| // Required when type is "Authorization", and forbidden otherwise. | ||
| // The secret must exist in the openshift-monitoring namespace. | ||
| // +unionMember=Authorization | ||
| // +optional | ||
| BearerToken SecretKeySelector `json:"bearerToken,omitempty,omitzero"` |
There was a problem hiding this comment.
The removed fields must be tombstoned so we never add them back in the future for this api version.
4 participants
Align remote write auth with CMO by replacing SafeAuthorization and BearerToken with type Authorization and a credentials secret reference.