Enhancement: (Helm) truncate firewall label/description to match Linode API contract

Open
#17 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
45/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Stale
Tech stack
go, helm

Research direction

Start at internal/controller/cloudfirewall_controller.go around line 240 and inspect the Helm values.yaml example and templates involved in creating CloudFirewall rules. Reproduce the problem with a label longer than the Linode API's 32-character limit, then trace whether validation occurs during template rendering or controller reconciliation. Done means oversized labels and descriptions receive an explicit, tested outcome rather than silently hanging or leaving the firewall unapplied.

Written by the indexing model from the issue text.

Description

Using the helm templates I added an additional firewall rule using the values.yaml file example:

# Additional Cloud Firewall rules can be added to the default set by adding them to the list below.
# These will be applied along with the default ruleset. Any rule added here will below
# applied to all nodes in the cluster.
firewall:
  inbound: 
    - label:       "allow-custom-port"
      action:      "ACCEPT"
      description: "custom-rule"
      protocol:    "TCP"
      ports:       "9999"
      addresses:
        ipv4:
        - "192.168.128.0/17"

My label however was too long (longer than the API allows, i.e. 32 characters). For some reason that I don't understand this caused the entire firewall controller to hang on this log line:

https://github.com/linode/cloud-firewall-controller/blob/8eae0593716403589d4b070840967399b0b153d7/internal/controller/cloudfirewall_controller.go#L240-L240

I got no errors in the logs of the cloud firewall controller pod at all, and the result was that I didn't have a firewall applied and thus 'Accept by default' rules essentially. 😐 I even deleted the pod to see if it would react any differently, but got the same results.

Interestingly enough when I edited the networking.linode.com/alpha1v1:CloudFirewall manifest directly and changed a few characters, I did get an message somewhere in the logs about exceeding the maximum length for the label. When I fixed that, it got applied correctly.

Unfortunately I don't have the logging anymore, they got lost clearing my shell output.

It seems to me that either way: it would be a good idea to either:

  • truncate the label and/or description to the maximum amount of characters
  • fail the template rendering if the length exceeds the maximum length for certain fields.
Dominant language
Go
Stars
16
Forks
9
PR merge metrics
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from linode/cloud-firewall-controller

All issues in linode/cloud-firewall-controller

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.