🐛 IPAM Webhook allows empty gateway for IPv6 Address #8525
Conversation
k8s-ci-robot
added
the
cncf-cla: yes
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
needs-ok-to-test
|
Hi @christianang. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Continue to require gateway for IPv4. IPv6 default routes can be acquired through Router Advertisements, therefore empty gateway should be permitted. Signed-off-by: Christian Ang <[email protected]> Co-authored-by: Tyler Schultz <[email protected]> Co-authored-by: Christian Ang <[email protected]>
christianang
force-pushed
the
ipam-ipaddress-gateway
branch
from
8b8c944 to
792e566
Compare
|
/hold While we discuss which one of the solution to go on |
k8s-ci-robot
added
the
do-not-merge/hold
|
|
||
| _, err = netip.ParseAddr(ip.Spec.Gateway) | ||
| if err != nil { | ||
| if addr.Is4() && ip.Spec.Gateway == "" { |
There was a problem hiding this comment.
Just reading through this, are we not specifying a mode of operation? Wouldn't it be possible in this way to mix ipv4 and ipv6 settings under the same specs?
There was a problem hiding this comment.
There isn't anything explicit that specifies the mode of operation on the IPAddress, but as part of this PR we did add validation to ensure address and gateway fields are not mixed, which I think would be sufficient to prevent mixing ipv4 and ipv6 on the same IPAddress.
|
/close |
|
@schrej: Closed this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
What this PR does / why we need it:
IPv6 default routes can be acquired through Router Advertisements, therefore empty gateway should be permitted. This PR continues to require gateway for IPv4. We also added validation to ensure the gateway family matches the address family.
Which issue(s) this PR fixes (optional, in
fixes #<issue number>(, fixes #<issue_number>, ...)format, will close the issue(s) when PR gets merged):