Enhancement: (Helm) truncate firewall label/description to match Linode API contract
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 45/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- go, helm
- Domain
- infrastructure
Research direction
Start at internal/controller/cloudfirewall_controller.go around line 240 and inspect the Helm values.yaml example and templates involved in creating CloudFirewall rules. Reproduce the problem with a label longer than the Linode API's 32-character limit, then trace whether validation occurs during template rendering or controller reconciliation. Done means oversized labels and descriptions receive an explicit, tested outcome rather than silently hanging or leaving the firewall unapplied.
Written by the indexing model from the issue text.
Description
Using the helm templates I added an additional firewall rule using the values.yaml file example:
# Additional Cloud Firewall rules can be added to the default set by adding them to the list below.
# These will be applied along with the default ruleset. Any rule added here will below
# applied to all nodes in the cluster.
firewall:
inbound:
- label: "allow-custom-port"
action: "ACCEPT"
description: "custom-rule"
protocol: "TCP"
ports: "9999"
addresses:
ipv4:
- "192.168.128.0/17"
My label however was too long (longer than the API allows, i.e. 32 characters). For some reason that I don't understand this caused the entire firewall controller to hang on this log line:
I got no errors in the logs of the cloud firewall controller pod at all, and the result was that I didn't have a firewall applied and thus 'Accept by default' rules essentially. 😐 I even deleted the pod to see if it would react any differently, but got the same results.
Interestingly enough when I edited the networking.linode.com/alpha1v1:CloudFirewall manifest directly and changed a few characters, I did get an message somewhere in the logs about exceeding the maximum length for the label. When I fixed that, it got applied correctly.
Unfortunately I don't have the logging anymore, they got lost clearing my shell output.
It seems to me that either way: it would be a good idea to either:
- truncate the label and/or description to the maximum amount of characters
- fail the template rendering if the length exceeds the maximum length for certain fields.
- Dominant language
- Go
- Stars
- 16
- Forks
- 9
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from linode/cloud-firewall-controller
-
Using to many rules Open
Difficulty 3/5 1-2 days Newbie friendliness 35/100
linode/cloud-firewall-controller#28 · 1 comment ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
linode/cloud-firewall-controller#18 · 1 comment · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 52/100
linode/cloud-firewall-controller#16 · 1 comment ·
-
enhancement
linode/cloud-firewall-controller#2 · 1 comment · 1 reaction · 1 assignee ·
-
enhancement
linode/cloud-firewall-controller#1 · 1 comment · 1 assignee ·
All issues in linode/cloud-firewall-controller
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 84/100
-
enhancement needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
kind/cleanup
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
kubernetes-sigs/kueue#15947 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
sympozium-ai/sympozium#627 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100