✨ Add classNamespace to topology #11352

Danil-Grigorev · 2024-10-30T09:46:21Z

What this PR does / why we need it:

Adding classNamespace variable to the cluster topology, which allows to point to a ClusterClass in a different namespace. This field is dormant, and is used for differentiation only.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Related to #5673

/area clusterclass

salasberryfin

Thanks @Danil-Grigorev! I added a small suggestion but I think this looks good.

docs/book/src/tasks/experimental-features/cluster-class/write-clusterclass.md

salasberryfin · 2024-10-31T10:04:51Z

Thanks @Danil-Grigorev

/lgtm

k8s-ci-robot · 2024-10-31T10:04:57Z

LGTM label has been added.

Git tree hash: c4b418743a4683ae623b3264aae7636c41ad5675

salasberryfin · 2024-10-31T10:05:46Z

/assign @chrischdi

k8s-ci-robot · 2024-10-31T18:34:35Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from chrischdi. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2024-11-11T09:43:48Z

LGTM label has been added.

Git tree hash: f7b15d982fdfb8730cff97c2900ccbd9c661e3d9

api/v1beta1/cluster_types.go

docs/book/src/tasks/experimental-features/cluster-class/write-clusterclass.md

api/v1beta1/cluster_types.go

fabriziopandini · 2024-11-25T13:51:42Z

internal/controllers/topology/cluster/cluster_controller.go

@@ -371,7 +370,9 @@ func (r *Reconciler) clusterClassToCluster(ctx context.Context, o client.Object)
 	// create a request for each of the clusters.
 	requests := []ctrl.Request{}
 	for i := range clusterList.Items {
-		requests = append(requests, ctrl.Request{NamespacedName: util.ObjectKey(&clusterList.Items[i])})
+		if clusterList.Items[i].GetInfrastructureNamespace() == clusterClass.Namespace {


Can we add a unit test ensuring that a change in a CC with a given name triggers reconcile only for clusters using it (and not for clusters using CC with the same name, but in another ns)
Possibly, this should cover both cluster with ClassNamespace set and not.

Note for self: this seems still open no matter if it reports outdated

fabriziopandini · 2024-11-25T13:55:42Z

internal/webhooks/clusterclass.go

@@ -380,12 +380,19 @@ func (webhook *ClusterClass) getClustersUsingClusterClass(ctx context.Context, c
 	clusters := &clusterv1.ClusterList{}
 	err := webhook.Client.List(ctx, clusters,
 		client.MatchingFields{index.ClusterClassNameField: clusterClass.Name},
-		client.InNamespace(clusterClass.Namespace),


Wondering if we should update the index, so it contains both namespace and name of the cluster class

Thinking a little bit more about this, I think we change this index so performance in the webhook are optimized and also the resulting code will be more readable (both here and in clusterClassToCluster)

It seems to me that in this method there is not enough information to know cluster namespace due to duality of the namespace reference.

If an index is added, there will be another Client.List call for client.MatchingFields{index.ClusterClassNamespaceField: clusterClass.Namespace}, and here I’m not sure how would an empty field be treated - matching an empty string or matching no selector at all?

If the first one the case, then the method will combine two list responses, and it will be more readable. If not, it will only increase the number of calls.

Ok, seems it is not an issue, as the index can use GetClass() method which resolves ambiguity. Should be added now.

fabriziopandini · 2024-11-25T13:56:28Z

internal/webhooks/clusterclass.go

+
+	referencedClusters := []clusterv1.Cluster{}
+	for _, cluster := range clusters.Items {
+		if cluster.GetInfrastructureNamespace() == clusterClass.Namespace {


Also, in this case, possibly add unit test coverage (similar to clusterClassToCluster above)

It should be added in other places now, and is tested indirectly by cleanup in integration tests which goes through ValidateDelete.

It should be added in other places now, and is tested indirectly by cleanup in integration tests which goes through ValidateDelete.

Edit: added unit test on top

api/v1beta1/cluster_types.go

JoelSpeed · 2024-11-27T10:43:24Z

api/v1beta1/cluster_types.go

+	// The namespace of the ClusterClass object to create the topology.
+	//
+	// +optional
+	ClassNamespace string `json:"classNamespace,omitempty"`


Please add a minimum and maximum length to all raw string types, since this is a namespace, it follows DNS1123Subdomain and should also be validated as such (there's a regex for this). The maximum length is 253 and the minimum is 1.

Since you have omitempty, you can safely add the MinLength, it will prevent anyone using an unstructured client from persisting classNamespace: "" which would then otherwise not round trip through a structured request

Signed-off-by: Danil-Grigorev <[email protected]>

k8s-ci-robot · 2024-11-27T21:03:11Z

New changes are detected. LGTM label has been removed.

Signed-off-by: Danil-Grigorev <[email protected]>

fabriziopandini · 2024-11-28T11:09:34Z

api/v1beta1/cluster_types.go

@@ -509,6 +509,14 @@ type Topology struct {
 	// The name of the ClusterClass object to create the topology.
 	Class string `json:"class"`

+	// The namespace of the ClusterClass object to create the topology.
+	// Empty namespace assumes the namespace of the cluster object.


Wondering if we should default to current namespace ...

Pros: it is explicit and consistent to what we do for other references
Cons: it add "noises" to the containing struct while we don't have a clean nesting yet

A compromise might be to keep it empty for now and start defaulting when we will introduce a nested struct
@JoelSpeed opinions?

The namespace of the object can never change, so, defaulting this value to the current namespace would make sense, and make the API explicit. I can't foresee us ever, in the future, wanting to default this to a specific namespace, as we have no concept of a core namespace.

That said, I could see a use case where a cluster admin wants to default this field themselves. In the future they could leverage MutatingAdmissionPolicy to set the namespace always to a certain namespace where they keep their classes. Could defaulting this (since it would have to be a webhook, or MAP) then cause interference with any logic the cluster admin has there? They'd have to make sure that their defaulting went before ours 🤔

I think I would err on the side here, or not defaulting it and just explaining that the empty namespace means that the namespace of the cluster is leveraged, as it is now.

api/v1beta1/cluster_types.go

fabriziopandini · 2024-11-28T11:13:25Z

api/v1beta1/cluster_types.go

-	return types.NamespacedName{Namespace: c.GetNamespace(), Name: c.Spec.Topology.Class}
+
+	namespace := c.Spec.Topology.ClassNamespace
+	if c.Spec.Topology == nil || c.Spec.Topology.ClassNamespace == "" {


Suggested change

if c.Spec.Topology == nil || c.Spec.Topology.ClassNamespace == "" {

if namespace == "" {

Above we are returning when c.Spec.Topology == nil

fabriziopandini · 2024-11-28T11:19:04Z

docs/book/src/tasks/experimental-features/cluster-class/write-clusterclass.md

+
+<h1>Cluster rebase across namespaces</h1>
+
+Changing `classNamespace` is not supported in rebase procedure, while chanding `class` reference to a different `ClusterClass` from the same namespace performs regular `Cluster` rebase procedure.


Might be I'm wrong, but I did not found a place where we are enforcing "Changing classNamespace is not supported".
Also, out of curiosity, why are we introducing this limitation?

That’s mainly due to tests performed on that operation locally. It seems when changing classNamespace, many referenced template components change namespace too, as they have to preserve ownership references, and instead of rebase performing minimal modifications of the resource, it has to switch resources entirely. This seemed as a larger scope change.

I’ll add a validation on the field modifications.

Thanks clarification
It would be great if we can add the same note as a godoc explanation for check above

I composed a clarification message on the field. It seems there is no need for additional tests as TestLocalObjectTemplatesAreCompatible is already covering template namespace changes.

fabriziopandini · 2024-11-28T11:31:07Z

internal/webhooks/clusterclass.go

@@ -380,12 +380,19 @@ func (webhook *ClusterClass) getClustersUsingClusterClass(ctx context.Context, c
 	clusters := &clusterv1.ClusterList{}
 	err := webhook.Client.List(ctx, clusters,
 		client.MatchingFields{index.ClusterClassNameField: clusterClass.Name},
-		client.InNamespace(clusterClass.Namespace),


Thinking a little bit more about this, I think we change this index so performance in the webhook are optimized and also the resulting code will be more readable (both here and in clusterClassToCluster)

fabriziopandini · 2024-11-28T11:32:02Z

internal/controllers/topology/cluster/cluster_controller.go

@@ -371,7 +370,9 @@ func (r *Reconciler) clusterClassToCluster(ctx context.Context, o client.Object)
 	// create a request for each of the clusters.
 	requests := []ctrl.Request{}
 	for i := range clusterList.Items {
-		requests = append(requests, ctrl.Request{NamespacedName: util.ObjectKey(&clusterList.Items[i])})
+		if clusterList.Items[i].GetInfrastructureNamespace() == clusterClass.Namespace {


Note for self: this seems still open no matter if it reports outdated

Signed-off-by: Danil-Grigorev <[email protected]>

docs/book/src/tasks/experimental-features/cluster-class/write-clusterclass.md

Co-authored-by: Christian Schlotter <[email protected]>

Danil-Grigorev · 2024-12-18T17:11:46Z

@chrischdi @fabriziopandini Can I get another review? All comments are addressed here.

k8s-ci-robot added area/clusterclass Issues or PRs related to clusterclass cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Oct 30, 2024

Danil-Grigorev changed the title ~~Add classNamespace to topology~~ ✨ Add classNamespace to topology Oct 30, 2024

k8s-ci-robot requested review from jackfrancis and sbueringer October 30, 2024 09:46

Danil-Grigorev force-pushed the class-namespace-addition branch 2 times, most recently from ae1cb19 to 43cb995 Compare October 30, 2024 11:59

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Oct 30, 2024

Danil-Grigorev force-pushed the class-namespace-addition branch 2 times, most recently from 2bddeeb to 352fd66 Compare October 30, 2024 15:20

salasberryfin reviewed Oct 31, 2024

View reviewed changes

docs/book/src/tasks/experimental-features/cluster-class/write-clusterclass.md Outdated Show resolved Hide resolved

Danil-Grigorev force-pushed the class-namespace-addition branch from 352fd66 to bd8a56f Compare October 31, 2024 09:51

k8s-ci-robot assigned salasberryfin Oct 31, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 31, 2024

k8s-ci-robot assigned chrischdi Oct 31, 2024

Danil-Grigorev changed the title ~~✨ Add classNamespace to topology~~ [WIP] ✨ Add classNamespace to topology Oct 31, 2024

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 31, 2024

Danil-Grigorev force-pushed the class-namespace-addition branch from bd8a56f to 4bbb218 Compare October 31, 2024 18:34

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 31, 2024

k8s-ci-robot requested review from chrischdi and salasberryfin October 31, 2024 18:34

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Oct 31, 2024

Danil-Grigorev force-pushed the class-namespace-addition branch from 4bbb218 to d450768 Compare October 31, 2024 18:44

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 11, 2024

Danil-Grigorev mentioned this pull request Nov 11, 2024

[WIP] ✨ Add clusterctl changes for cross-ns CC ref #11395

Open

fabriziopandini reviewed Nov 25, 2024

View reviewed changes

api/v1beta1/cluster_types.go Show resolved Hide resolved

JoelSpeed reviewed Nov 27, 2024

View reviewed changes

api/v1beta1/cluster_types.go Outdated Show resolved Hide resolved

JoelSpeed reviewed Nov 27, 2024

View reviewed changes

Danil-Grigorev added 4 commits November 27, 2024 21:38

Add classNamespace to topology

1dea02a

Signed-off-by: Danil-Grigorev <[email protected]>

Add documentation on securing cross-namespace access for CC

ccc32d1

Signed-off-by: Danil-Grigorev <[email protected]>

Lookup Clusters across namespaces

65db336

Signed-off-by: Danil-Grigorev <[email protected]>

Add a note on cross-ns rebase

5d9542b

Signed-off-by: Danil-Grigorev <[email protected]>

Danil-Grigorev force-pushed the class-namespace-addition branch from d6d8e33 to bbbddcf Compare November 27, 2024 21:03

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 27, 2024

k8s-ci-robot requested a review from furkatgofurov7 November 27, 2024 21:03

Add validation on classNamespace, API review addressed

b4b6131

Signed-off-by: Danil-Grigorev <[email protected]>

Danil-Grigorev force-pushed the class-namespace-addition branch from bbbddcf to b4b6131 Compare November 27, 2024 21:25

fabriziopandini reviewed Nov 28, 2024

View reviewed changes

Danil-Grigorev mentioned this pull request Nov 28, 2024

v1beta2: Class Namespace API change #11500

Open

Danil-Grigorev force-pushed the class-namespace-addition branch from 5fef5d3 to 703597f Compare December 3, 2024 14:50

Add tests for clusterclassToCluster, godoc changes

e16aa76

Signed-off-by: Danil-Grigorev <[email protected]>

Danil-Grigorev force-pushed the class-namespace-addition branch 2 times, most recently from 9103f4d to c581444 Compare December 4, 2024 13:05

Add ClassNamespace index

3639364

Signed-off-by: Danil-Grigorev <[email protected]>

Danil-Grigorev force-pushed the class-namespace-addition branch from c581444 to 3639364 Compare December 4, 2024 13:28

Danil-Grigorev added 2 commits December 5, 2024 13:55

Clarify cross-namespace rebase support godoc

1a88697

Signed-off-by: Danil-Grigorev <[email protected]>

Use MatchingFields as And logic

f8e49a0

Signed-off-by: Danil-Grigorev <[email protected]>

chrischdi reviewed Dec 10, 2024

View reviewed changes

docs/book/src/tasks/experimental-features/cluster-class/write-clusterclass.md Outdated Show resolved Hide resolved

docs/book/src/tasks/experimental-features/cluster-class/write-clusterclass.md Outdated Show resolved Hide resolved

Fix spelling

902e582

Co-authored-by: Christian Schlotter <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ Add classNamespace to topology #11352

✨ Add classNamespace to topology #11352

Danil-Grigorev commented Oct 30, 2024 •

edited

Loading

salasberryfin left a comment

salasberryfin commented Oct 31, 2024

k8s-ci-robot commented Oct 31, 2024

salasberryfin commented Oct 31, 2024

k8s-ci-robot commented Oct 31, 2024

k8s-ci-robot commented Nov 11, 2024

fabriziopandini Nov 25, 2024 •

edited

Loading

fabriziopandini Nov 28, 2024

fabriziopandini Nov 25, 2024

fabriziopandini Nov 28, 2024

Danil-Grigorev Dec 4, 2024

Danil-Grigorev Dec 4, 2024

fabriziopandini Nov 25, 2024

Danil-Grigorev Dec 4, 2024

Danil-Grigorev Dec 4, 2024 •

edited

Loading

JoelSpeed Nov 27, 2024

k8s-ci-robot commented Nov 27, 2024

fabriziopandini Nov 28, 2024

JoelSpeed Nov 28, 2024

fabriziopandini Nov 28, 2024

fabriziopandini Nov 28, 2024

Danil-Grigorev Nov 28, 2024

fabriziopandini Dec 2, 2024

Danil-Grigorev Dec 5, 2024

fabriziopandini Nov 28, 2024

fabriziopandini Nov 28, 2024

Danil-Grigorev commented Dec 18, 2024

	if c.Spec.Topology == nil \|\| c.Spec.Topology.ClassNamespace == "" {
	if namespace == "" {


		<h1>Cluster rebase across namespaces</h1>

		Changing `classNamespace` is not supported in rebase procedure, while chanding `class` reference to a different `ClusterClass` from the same namespace performs regular `Cluster` rebase procedure.

✨ Add classNamespace to topology #11352

Are you sure you want to change the base?

✨ Add classNamespace to topology #11352

Conversation

Danil-Grigorev commented Oct 30, 2024 • edited Loading

salasberryfin left a comment

Choose a reason for hiding this comment

salasberryfin commented Oct 31, 2024

k8s-ci-robot commented Oct 31, 2024

salasberryfin commented Oct 31, 2024

k8s-ci-robot commented Oct 31, 2024

k8s-ci-robot commented Nov 11, 2024

fabriziopandini Nov 25, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Danil-Grigorev Dec 4, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented Nov 27, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Danil-Grigorev commented Dec 18, 2024

Danil-Grigorev commented Oct 30, 2024 •

edited

Loading

fabriziopandini Nov 25, 2024 •

edited

Loading

Danil-Grigorev Dec 4, 2024 •

edited

Loading