-
Notifications
You must be signed in to change notification settings - Fork 5.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(appset): Support more than two child generators for matrix generator #14189
base: master
Are you sure you want to change the base?
Conversation
I feel like we should have a controller-level configurable max for number of children in a matrix generator. We're close to having ApplicationSets manageable by non-admins, and it would be good to have a way for admins to mitigate denial of service via bonkers-level matrix generators. |
0621f87
to
fdd0e1c
Compare
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #14189 +/- ##
=========================================
Coverage ? 55.80%
=========================================
Files ? 320
Lines ? 44411
Branches ? 0
=========================================
Hits ? 24782
Misses ? 17066
Partials ? 2563 ☔ View full report in Codecov by Sentry. |
@crenshaw-dev Sounds reasonable. There is no precedent for generator configuration at the controller level. How about a controller flag called |
I'm wavering between default of 2 (no change of behavior for people upgrading) and default of 0. I think default 2 makes sense if we want people to be able to provide users create/update privileges on appsets as soon as we button down the remaining admin-only features. We could make it a controller flag/env var and let users set it via argocd-cmd-params-cm. |
Do we allow a value of 1? The code does handle this case but intuitively it doesn't really make sense. If not, any value less than 2 will be parsed as unlimited. Edit: There is already an error when using a matrix generator with only 1 child. Any value less than 2 will be unlimited then. |
@crenshaw-dev I have made the max matrix children configurable through |
Sounds reasonable! I'd say carry on with docs. |
Signed-off-by: Tung Huynh <[email protected]>
Signed-off-by: Tung Huynh <[email protected]>
Signed-off-by: Tung Huynh <[email protected]>
Signed-off-by: Tung Huynh <[email protected]>
Signed-off-by: Tung Huynh <[email protected]>
Signed-off-by: Tung Huynh <[email protected]>
e72dfab
to
5b77ec7
Compare
@crenshaw-dev I updated the manifest to allow setting the limit in the config map and updated the docs. |
Signed-off-by: Tung Huynh <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for your patience on the review! Small things. Targeting this for 2.9.
Signed-off-by: Tung Huynh <[email protected]>
I had to change those messages a bit to also reflect #14573 |
@crenshaw-dev Are there any updates on this PR? I can resolve the merge conflicts if it's ready to merge. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
One minor comment. Overall code LGTM!!
return nil, ErrLessThanTwoGenerators | ||
} | ||
|
||
if len(appSetGenerator.Matrix.Generators) > 2 { | ||
return nil, ErrMoreThanTwoGenerators | ||
if m.maxChildren > 1 && numGens > m.maxChildren { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It might be useful to log a separate configuration error if value of maxChildren is 1 or less.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
When maxChildren is 1 or less, it's considered no limit. The default value for maxChildren is 2.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not a showstopper but that sounds un-intuitive IMO - could we not say that no limit only applies if maxChildren < 0?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would prefer to have maxChildren < 1 to avoid using negative values. The param reposerver.git.lsremote.parallelism.limit
has the same logic where any values less than 1 mean unlimited.
plus we don't have to update the docs and tests this way
What's the ETA on this ? |
Hello, can we still expect that this support of >2 matrix steps will be reviewed and merged as stated in the roadmap. Since I am having a need for 3 steps and the parameter transfer between nested matrix steps has issues, I am still searching for any solution. |
Can this default be changed to a higher value? Maybe 100 or 10? |
So are we waiting another year here ? |
@sathieu I chose this default value of 2 to mirror the same limit of the current version of the matrix generator. I'm fine with having a higher value or even unlimited as a default. |
Would this not be easier solved using a Plugin Generator? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Minor comment, but otherwise LGTM
Signed-off-by: Tung Huynh <[email protected]>
Signed-off-by: Tung Huynh <[email protected]>
@crenshaw-dev do you still have concerns about this PR? |
Dismissing my review as stale, since I don't have time to re-review right now. At a glance, no major concerns. |
@crenshaw-dev any updates on merging and releasing this feature? |
Is there any chance of merging this PR? we are looking for this feature to be available asap. |
@it2008018 for that to happen, the merge conflicts need to be fixed from @huynhsontung. Once that happens, we can push for someone to review and merge it. Even if this gets merged tomorrow, this would not be "available asap" since this would come into 2.14, which is slated for next February. |
@blakepettersson will look forward for it to be merged :) @huynhsontung will it be possible for you to resolve conflicts? |
@huynhsontung if you do not have time to work on it, I can take on the mantle and get the necessary reviews for it to be merged. |
Signed-off-by: Tung Huynh <[email protected]>
Signed-off-by: Tung Huynh <[email protected]>
Signed-off-by: Tung Huynh <[email protected]>
appSetGenerators := generators.GetGenerators(ctx, s.client, s.k8sClient, namespace, argoCDService, s.dynamicClient, scmConfig) | ||
appSetGenerators := generators.GetGenerators(ctx, s.client, s.k8sClient, namespace, argoCDService, s.dynamicClient, scmConfig, matrixConfig) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't know how to get the config in this case. This method is used in argocd appset create --dry-run
and argocd appset generate
. I think not setting a limit here makes sense.
@blakepettersson I have resolved all the conflicts |
Closes #14182
Checklist:
Please see Contribution FAQs if you have questions about your pull-request.