kubevirt / hyperconverged-cluster-operator
82%
main: 76%

LAST BUILD BRANCH: cherry-pick-3954-to-release-1.16
DEFAULT BRANCH: main
Repo Added
Files 108
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH release-1.13
branch: release-1.13
CHANGE BRANCH
x

coverage: 82.44% (-0.5%) from 82.989%
20751599122

push

github

web-flow 
[release 1.13] Add ValidatingAdmissionPolicy to validate the HyperConverged namespace (#3950)

* Add the new admission policy controller

The current implementation of preventing the creation of the
HyperConverged CR in non-allowed namespace, is not working in Openshift,
where becasue of a race condition, the webhook's namespace selector is
removed by OLM.

This commit adds a new controller, to create and reconcile a
ValidatingAdmissionPolicy and the related
ValidatingAdmissionPolicyBinding, to perform the same validation.

The reason we're doing it in a new controller, is because we need the
ValidatingAdmissionPolicy to be set, even if the HyperConverged CR is
not deployed, while our main controller only reconciles resources if
the HyperConverged CR is deployed.



* Register the admission policy controller on boot



* Remove the current validation

Remove the existing validation of the HyperConverged CR namespace from
the validation webhook, as it is now done by the policy, created by the
admission policy controller.



* Don't remove the namespace selector from the validation wh

OLM adds a namespace selection on the validation webhook CR, causing the
namespace validation to be not relevant.

The webhook setup logic removes this selector, but actually this is
reconciled by OLM, and eventually, user can still create the
HyperConverged CR in any namespace.

The issue is now handled by a ValidationgAdmissionPolicy, and so we
don't need this logic anymore, and so this commit removes it.



---------

Signed-off-by: Nahshon Unna Tsameret <nahsh.ut@gmail.com>

138 of 209 new or added lines in 2 files covered. (66.03%)

3 existing lines in 1 file now uncovered.

5709 of 6925 relevant lines covered (82.44%)

0.92 hits per line

Relevant lines Covered
6925 RELEVANT LINES 5709 COVERED LINES
0.92 HITS PER LINE
Source Files on release-1.13

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
20751599122 release-1.13 [release 1.13] Add ValidatingAdmissionPolicy to validate the HyperConverged namespace (#3950) * Add the new admission policy controller The current implementation of preventing the creation of the HyperConverged CR in non-allowed namespace, is n... push web-flow github
82.44
19324433500 release-1.13 csv-merger: make Replaces field optional in the CSV (#3856) When using an FBC catalog, the upgrade graph is not determined by the replaces,skips and skipRange fields in the CSV itself, but in the file-based catalog. Make the replaces-csv-version ... push web-flow github
82.99
17593792408 release-1.13 [1.13] NodeNetworkInterfaceDown alert fires for disabled NICs (#3750) Signed-off-by: avlitman <alitman@redhat.com> push web-flow github
83.0
15292142857 release-1.13 [release-1.13] Add observability controller alerts (#3506) * Refactor hyperconverged monitoring into separate package Signed-off-by: João Vilaça <machadovilaca@gmail.com> * Add base for observability controller Prometheus rules Signed-off-by: ... push web-flow github
82.99
14601587375 release-1.13 CNV-59923: Fix Console Plugin access in case of single stack IPv6 (#3497) Signed-off-by: Oren Cohen <ocohen@redhat.com> Co-authored-by: Oren Cohen <ocohen@redhat.com> push web-flow github
84.44
14340433568 release-1.13 Fix a bug when setting a CPU quentity without a type (#3388) When setting, for example, the `spec.resourceRequirements.storageWorkloads.limit` field to `"1.5"`, the client set the value in CDI to `"1500m"`. Then HCO will always find this value as... push web-flow github
84.44
14190743993 release-1.13 Bump NETWORK_ADDONS to v0.95.1 (#3374) Signed-off-by: HCO Bump Bot <noreply@github.com> Co-authored-by: kubevirt-bot <25687724+kubevirt-bot@users.noreply.github.com> push web-flow github
84.44
14087220456 release-1.13 [Release 1.13] fix CVE-2025-30204 (#3357) What this PR does / why we need it: Bump github.com/golang-jwt/jwt/v5 to v5.2.2 in order to fix CVE-2025-30204. Signed-off-by: Nahshon Unna-Tsameret <nunnatsa@redhat.com> push web-flow github
84.44
13763479189 release-1.13 [release-1.13] Remove old api version from the SSP CRD on upgrade (#3332) Since version 1.10, SSP moved to a new api version - v1beta2. In latest release, SSP completely removed the old API v1beta1 from their CRD. This might result in an upgrade ... push web-flow github
84.43
13505783721 release-1.13 Fix inconsistent Alertmanager silence behavior for PodDisruptionBudgetAtLimit (#3311) With some versions of Alertamanager the silence creation through the API does not have a consistent behaviour to the "isTrue" field not being present. Therefore... push web-flow github
84.49
See All Builds (16410)