Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validation around licenseKey field for extended kubernetes version support #9218

Merged
merged 3 commits into from
Feb 5, 2025

Conversation

panktishah26
Copy link
Member

@panktishah26 panktishah26 commented Feb 4, 2025

Issue #, if available:
#6793

Description of changes:

This PR adds below validations for eks-a controller,

  • Check whether the kubernetes version for the cluster is currently under extended support by comparing the endOfStandardSupport date from the bundle with the current date. If the current date is after the endOfStandardSupport date, it implies that the kubernetes version is still under standard support so skip performing any of the subsequent license validations. Otherwise, run the subsequent license validations.
    • Validate that the claims in the license token have not been modified by verifying the signature in the token.
    • Validate that the endValidity claim in the license token has a time value after the current time to verify that the license has not expired yet.

Testing (if applicable):

Documentation added/planned (if applicable):

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@eks-distro-bot
Copy link
Collaborator

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from panktishah26. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@eks-distro-bot eks-distro-bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Feb 4, 2025
@panktishah26 panktishah26 force-pushed the standardsupport-validation branch from a47baf1 to 987ef11 Compare February 4, 2025 07:33
Copy link

codecov bot commented Feb 4, 2025

Codecov Report

Attention: Patch coverage is 72.09302% with 24 lines in your changes missing coverage. Please review.

Project coverage is 72.38%. Comparing base (77c5f23) to head (78910a3).
Report is 2 commits behind head on main.

Files with missing lines Patch % Lines
pkg/validations/extendedversion.go 59.61% 21 Missing ⚠️
pkg/signature/manifest.go 90.90% 2 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #9218      +/-   ##
==========================================
- Coverage   72.38%   72.38%   -0.01%     
==========================================
  Files         587      587              
  Lines       45836    45910      +74     
==========================================
+ Hits        33178    33230      +52     
- Misses      10910    10932      +22     
  Partials     1748     1748              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@panktishah26 panktishah26 force-pushed the standardsupport-validation branch 4 times, most recently from d4d8b0c to c26ec97 Compare February 4, 2025 21:07
return dateToCompare.Before(today)
}

func parseDate(format string, date string) (time.Time, error) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this function really needed? it takes the exact same inputs and returns the exact same outputs as time.Parse?

@@ -31,3 +51,60 @@ func validateBundleSignature(bundle *v1alpha1.Bundles) error {
}
return nil
}

func isExtendedSupport(clusterSpec *anywherev1.Cluster, bundle *v1alpha1.Bundles) (bool, error) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this function only uses clusterSpec.Spec.KubernetesVersion from clusterSpec I recommend not taking in the whole anywherev1.Cluster object just for the kubernetes version field. I recommend just taking in what this function needs, so just the data type of clusterSpec.Spec.KubernetesVersion.

return isPastDateThanToday(endOfStandardSupport), nil
}

func getLicense(clusterSpec *anywherev1.Cluster) (*jwt.Token, error) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this function only uses clusterSpec.Spec.LicenseToken from clusterSpec I recommend not taking in the whole anywherev1.Cluster object just for the kubernetes version field. I recommend just taking in what this function needs, so just the data type of clusterSpec.Spec.LicenseToken.

"github.com/aws/eks-anywhere/pkg/constants"
"github.com/aws/eks-anywhere/pkg/signature"
"github.com/aws/eks-anywhere/release/api/v1alpha1"
)

// ValidateExtendedK8sVersionSupport validates all the validations needed for the support of extended kubernetes support.
func ValidateExtendedK8sVersionSupport(_ context.Context, _ *anywherev1.Cluster, bundle *v1alpha1.Bundles, _ kubernetes.Client) error {
func ValidateExtendedK8sVersionSupport(_ context.Context, clusterSpec *anywherev1.Cluster, bundle *v1alpha1.Bundles, _ kubernetes.Client) error {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks like the clusterSpec is needed but only for 2 fields within it. I don't recommend taking in the whole cluster spec as a dependency.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As discussed offline, I am not passing clusterSpec as a pointer.

@panktishah26 panktishah26 force-pushed the standardsupport-validation branch from c26ec97 to 78910a3 Compare February 5, 2025 03:18
@panktishah26 panktishah26 merged commit 17776e4 into aws:main Feb 5, 2025
11 of 13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
lgtm size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants