Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

adjust log level for userspace authz #959

Merged
merged 1 commit into from
Oct 17, 2024

Conversation

hzxuzhonghu
Copy link
Member

What type of PR is this?

/kind enhancement

What this PR does / why we need it:

Which issue(s) this PR fixes:
Fixes #955

Special notes for your reviewer:

Does this PR introduce a user-facing change?:


Signed-off-by: Zhonghu Xu <xuzhonghu@huawei.com>
@kmesh-bot kmesh-bot added the kind/enhancement New feature or request label Oct 15, 2024
@kmesh-bot kmesh-bot requested review from nlgwcy and tacslon October 15, 2024 03:03
@@ -179,7 +180,7 @@ func (r *Rbac) doRbac(conn *rbacConnection) bool {
dstWorkload := r.workloadCache.GetWorkloadByAddr(networkAddress)
// If no workload found, deny
if dstWorkload == nil {
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@LiZhenCheng9527 I thought about this again, we cannot deny if src workload is not found. And also cannot simply allow if src not found,

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So we need to discuss different scenarios of source workload not found.
But how should we distinguish between these scenarios?

Copy link
Member Author

@hzxuzhonghu hzxuzhonghu Oct 15, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not needed from here, auth should not care whether src workload exist or not if the auth policy is based on ip or port

#961 is the way to ignore kubelet probe traffic

Copy link

codecov bot commented Oct 15, 2024

Codecov Report

Attention: Patch coverage is 33.33333% with 6 lines in your changes missing coverage. Please review.

Project coverage is 54.45%. Comparing base (739fde5) to head (3036a15).
Report is 28 commits behind head on main.

Files with missing lines Patch % Lines
pkg/auth/rbac.go 33.33% 4 Missing and 2 partials ⚠️
Files with missing lines Coverage Δ
pkg/auth/rbac.go 79.92% <33.33%> (+0.15%) ⬆️

... and 6 files with indirect coverage changes


Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b85ca41...3036a15. Read the comment docs.

@LiZhenCheng9527
Copy link
Collaborator

/lgtm
/approved

@nlgwcy
Copy link
Contributor

nlgwcy commented Oct 17, 2024

/lgtm
/approve

@kmesh-bot
Copy link
Collaborator

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: nlgwcy

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kmesh-bot kmesh-bot merged commit 5559603 into kmesh-net:main Oct 17, 2024
9 checks passed
@hzxuzhonghu hzxuzhonghu deleted the userspace-authz branch October 18, 2024 01:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Test_restart with authz error log
4 participants