Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Drop support of LimitRange and NetworkPolicy resources from Tenant #740

Open
prometherion opened this issue Mar 24, 2023 · 4 comments
Open
Labels
breaking-change needs-discussion No outline on the feature, discussion is welcome
Milestone

Comments

@prometherion
Copy link
Member

With the implementation of {Global}TenantResource we started having a sort of overlap with the Tenant API: spec.limitRanges.items and spec.networkPolicies.items allow specifying a set of resources that must be replicated across the Tenant namespaces, and this can be easily achieved starting from v0.2.0 with the new APIs that replicate objects.

If we're going to accept this proposal the change must be considered a breaking change, and I'd vote to rename the current expected milestone (v0.4.0) to be considered a major one (v1.0.0), since end users would need to manually migrate the replicated resources to the new API kind.

@bsctl @MaxFedotov @oliverbaehler let's start the discussion!

@prometherion prometherion added this to the v0.4.0 milestone Mar 24, 2023
@prometherion prometherion added the needs-discussion No outline on the feature, discussion is welcome label Mar 24, 2023
@MaxFedotov
Copy link
Collaborator

@prometherion I love the idea, but I have the following concern - for networkPolicies defined in the tenant spec we have a webhook (https://github.com/clastix/capsule/blob/master/pkg/webhook/networkpolicy/validating.go#L67), which denies their deletion. But for the GlobalTenantResource user can delete the replicated resource, and it will be reconciled in spec.resyncPeriod. And while it is OK for non-critical resources, in the case of the networkPolicies it can be a potential security issue.

@bsctl
Copy link
Member

bsctl commented Apr 3, 2023

@MaxFedotov if well understanding #736 is blocking write operations on GlobalTenantResource by Tenant Owners

@prometherion
Copy link
Member Author

Exactly, replicated resources write operations are blocked to tenant owners, but obviously if the cluster administrator deletes those ones there's the resyncPeriod.

@oliverbaehler oliverbaehler modified the milestones: v0.4.0, v0.5.0 Nov 7, 2023
@prometherion
Copy link
Member Author

I think we should postpone this refactoring to v0.6.0 since the upcoming one is already busy with a new feature and we should proceed one by one since the documentation must be aligned properly.

@oliverbaehler oliverbaehler modified the milestones: v0.5.0, v0.6.0 Nov 29, 2023
@oliverbaehler oliverbaehler modified the milestones: v0.6.0, v1.0.0 Feb 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
breaking-change needs-discussion No outline on the feature, discussion is welcome
Projects
None yet
Development

No branches or pull requests

4 participants