Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix replicalimits ConstraintTemplate to handle scaling to zero #420

Closed

Conversation

skaven81
Copy link

@skaven81 skaven81 commented Oct 20, 2023

What this PR does / why we need it:
The replicalimits ConstraintTemplate in the library had no unit tests for validating scaling to zero.

It turns out that when scaling to zero, Kubernetes generates a Scale resource with an empty spec, instead of spec.replicas=0.

The unit tests were also missing tests using the Scale resource.

This PR fixes both issues.

Which issue(s) does this PR fix
Fixes #419

@skaven81
Copy link
Author

skaven81 commented Oct 20, 2023

Additional unit tests confirm that the updated template works as expected.

=== RUN   replica-limit
    === RUN   example-allowed
    --- PASS: example-allowed	(0.005s)
    === RUN   example-scale-allowed
    --- PASS: example-scale-allowed	(0.006s)
    === RUN   example-disallowed
    --- PASS: example-disallowed	(0.004s)
    === RUN   example-scale-disallowed
    --- PASS: example-scale-disallowed	(0.005s)
--- PASS: replica-limit	(0.027s)
=== RUN   replica-limit-zero
    === RUN   example-allowed
    --- PASS: example-allowed	(0.008s)
    === RUN   example-scale-allowed
    --- PASS: example-scale-allowed	(0.006s)
    === RUN   example-disallowed
    --- PASS: example-disallowed	(0.006s)
    === RUN   example-scale-disallowed
    --- PASS: example-scale-disallowed	(0.005s)
--- PASS: replica-limit-zero	(0.031s)
ok	suite.yaml	0.058s
PASS

@skaven81 skaven81 changed the title Fix replicalimits zero Fix replicalimits ConstraintTemplate to handle scaling to zero Oct 20, 2023
@skaven81 skaven81 force-pushed the fix-replicalimits-zero branch 2 times, most recently from efa1621 to d84cf76 Compare October 25, 2023 17:19
@skaven81 skaven81 requested a review from a team as a code owner October 25, 2023 17:19
Copy link
Contributor

@apeabody apeabody left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the contribution @skaven81!

You will also need to make your template changes to https://github.com/open-policy-agent/gatekeeper-library/blob/master/src/general/replicalimits/constraint.tmpl and https://github.com/open-policy-agent/gatekeeper-library/blob/master/src/general/replicalimits/src.rego. The artifacts (e.g. template.yaml can then be built with make generate-all.

dependabot bot and others added 13 commits October 25, 2023 20:06
Bumps the all group with 3 updates: [step-security/harden-runner](https://github.com/step-security/harden-runner), [github/codeql-action](https://github.com/github/codeql-action) and [ossf/scorecard-action](https://github.com/ossf/scorecard-action).

Updates `step-security/harden-runner` from 2.5.1 to 2.6.0
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@8ca2b8b...1b05615)

Updates `github/codeql-action` from 2.21.9 to 2.22.1
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@ddccb87...fdcae64)

Updates `ossf/scorecard-action` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@08b4669...483ef80)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: ossf/scorecard-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Paul Krizak <paul.krizak@gmail.com>
…agent#404)

Signed-off-by: Shinebayar Gansukh <3091558+shinebayar-g@users.noreply.github.com>
Co-authored-by: Andrew Peabody <andrewpeabody@google.com>
Signed-off-by: Paul Krizak <paul.krizak@gmail.com>
Bumps the all group with 1 update: [github/codeql-action](https://github.com/github/codeql-action).

- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@fdcae64...0116bc2)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Paul Krizak <paul.krizak@gmail.com>
* fix api groups in constraint 1.22

Signed-off-by: Albert Zhong <albert.zhong@databricks.com>

* run make generate generate-website-docs generate-artifacthub-artifacts

Signed-off-by: Albert Zhong <albert.zhong@databricks.com>

---------

Signed-off-by: Albert Zhong <albert.zhong@databricks.com>
Signed-off-by: Paul Krizak <paul.krizak@gmail.com>
…lude check for scaling to zero

Signed-off-by: Paul Krizak <paul.krizak@gmail.com>
…s allowed

Signed-off-by: Paul Krizak <paul.krizak@gmail.com>
Signed-off-by: Paul Krizak <paul.krizak@gmail.com>
Signed-off-by: Paul Krizak <paul.krizak@gmail.com>
Bumps the all group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [github/codeql-action](https://github.com/github/codeql-action) and [actions/setup-node](https://github.com/actions/setup-node).

Updates `actions/checkout` from 4.1.0 to 4.1.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@8ade135...b4ffde6)

Updates `github/codeql-action` from 2.22.3 to 2.22.4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@0116bc2...49abf0b)

Updates `actions/setup-node` from 3.8.1 to 4.0.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@5e21ff4...8f152de)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: actions/setup-node
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Paul Krizak <paul.krizak@gmail.com>
…ta.0.0.20230831155303-366ba791d009 to 3.14.0-rc.2 in /scripts/require-sync (open-policy-agent#423)

Bumps [github.com/open-policy-agent/gatekeeper/v3](https://github.com/open-policy-agent/gatekeeper) from 3.14.0-beta.0.0.20230831155303-366ba791d009 to 3.14.0-rc.2.
- [Release notes](https://github.com/open-policy-agent/gatekeeper/releases)
- [Changelog](https://github.com/open-policy-agent/gatekeeper/blob/master/docs/RELEASE.md)
- [Commits](https://github.com/open-policy-agent/gatekeeper/commits/v3.14.0-rc.2)

---
updated-dependencies:
- dependency-name: github.com/open-policy-agent/gatekeeper/v3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Paul Krizak <paul.krizak@gmail.com>
Signed-off-by: Sertac Ozercan <sozercan@gmail.com>
Signed-off-by: Paul Krizak <paul.krizak@gmail.com>
…-agent#422)

Bumps [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) from 0.27.6 to 0.27.7.
- [Commits](kubernetes/apimachinery@v0.27.6...v0.27.7)

---
updated-dependencies:
- dependency-name: k8s.io/apimachinery
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Paul Krizak <paul.krizak@gmail.com>
Signed-off-by: Paul Krizak <paul.krizak@gmail.com>
@skaven81
Copy link
Author

I'm not sure what I borked here, but I'll close this and try again with a fresh branch

@skaven81 skaven81 closed this Oct 27, 2023
@skaven81 skaven81 deleted the fix-replicalimits-zero branch October 27, 2023 00:33
@skaven81
Copy link
Author

Opened #427 with corrected branch contents

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

replicalimits unit tests do not include checks for Scale resources
5 participants