kubernetes-sigs/cluster-api

Add strict validation for CIDR ranges in the Cluster webhook

Open

#7,538 opened on Nov 14, 2022

View on GitHub
 (11 comments) (0 reactions) (1 assignee)Go (1,532 forks)auto 404
area/apihelp wantedkind/api-changekind/featurepriority/backlogtriage/accepted

Repository metrics

Stars
 (4,267 stars)
PR merge metrics
 (PR metrics pending)

Description

Add a check in the Cluster webhook to ensure each CIDR block only contains valid CIDR blocks with the following rules:

  1. No more than two CIDR blocks are specified under Pods or Services
  2. If two are specified the blocks need to be from different IP families i.e. one IPv4 and one IPv6
  3. The IPFamily for pods and services must be compatible
  4. The CIDR ranges are valid CIDR ranges

This change ensures Clusters can not be created or updated with invalid CIDR blocks. This is the value that the Kubernetes control plane components take - e.g. the kube-apiserver flag --service-cluster-ip-range is documented:

A CIDR notation IP range from which to assign service cluster IPs. This must not overlap with any IP ranges assigned to nodes or pods. Max of two dual-stack CIDRs is allowed.

Related to: https://github.com/kubernetes-sigs/cluster-api/pull/7420

/kind feature /area api /kind api-change

Contributor guide

Research direction
Examine the existing Cluster webhook code in the repository (likely in internal/webhook/ or similar). Add validation logic that checks the number of CIDR blocks per Pods/Services (max 2), ensures dual stack compatibility, and validates CIDR format. Refer to the linked PR for context.
Tech stack
go
Domain
backendapi
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GoKubernetes webhooksCIDR notation
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
65