Skip to content

fix: exemption race conditions - #407

Merged
mjnagel merged 44 commits into
mainfrom
fix-exemptions
Jun 5, 2024
Merged

fix: exemption race conditions#407
mjnagel merged 44 commits into
mainfrom
fix-exemptions

Conversation

@TristanHoladay

@TristanHoladay TristanHoladay commented May 14, 2024 •
edited by mjnagel
Loading

Copy link
Copy Markdown
Contributor

Description

Fixes race conditions with exemptions that result in overwrites of previous exemptions in the Pepr store or mutating then allowing pods that were meant to be exempted from mutation.

Issue

Fixes #409

Fixes #314

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Other (security config, docs update, etc)

Checklist before merging

cmwylie19
cmwylie19 reviewed May 15, 2024
View reviewed changes
Comment thread src/pepr/policies/index.ts Outdated
TristanHoladay
TristanHoladay commented May 15, 2024
View reviewed changes
Comment thread src/pepr/operator/controllers/exemptions/exemptions.ts
cmwylie19
cmwylie19 previously approved these changes May 15, 2024
View reviewed changes
@TristanHoladay @cmwylie19
Update src/pepr/policies/index.ts
dae141d 
Co-authored-by: Case Wylie <cmwylie19@gmail.com>
mjnagel
mjnagel reviewed May 15, 2024
View reviewed changes

@mjnagel mjnagel left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One other broad question/thing to validate - would want to make sure that this no longer being queue based doesn't lead to any weird behaviors with rapid create/edit/delete events (today those get processed in order on a queue with Reconcile, unsure exactly how that would behave with KFC watch here).

Comment thread src/pepr/operator/reconcilers/index.ts Outdated
@TristanHoladay

TristanHoladay commented May 16, 2024

Copy link
Copy Markdown
Contributor Author

I was thinking the same @mjnagel . so far i haven't seen any issues, but i'll see about creating a test for it.

@TristanHoladay TristanHoladay changed the title fix: exemption store overwrites fix: exemption race conditions May 16, 2024
mjnagel
mjnagel reviewed May 17, 2024
View reviewed changes
Comment thread src/pepr/operator/controllers/exemptions/exemptions.ts Outdated
mjnagel
mjnagel reviewed May 17, 2024
View reviewed changes
Comment thread src/pepr/operator/crd/validators/exempt-validator.ts
Comment thread src/test/tasks.yaml Outdated
mjnagel
mjnagel reviewed May 17, 2024
View reviewed changes
Comment thread src/test/tasks.yaml Outdated
mjnagel
mjnagel reviewed May 17, 2024
View reviewed changes
Comment thread src/test/tasks.yaml Outdated
@mjnagel
mjnagel marked this pull request as draft May 17, 2024 17:44
@mjnagel
mjnagel marked this pull request as draft June 3, 2024 22:23
@mjnagel
mjnagel marked this pull request as ready for review June 4, 2024 20:37
rjferguson21
rjferguson21 previously approved these changes Jun 5, 2024
View reviewed changes
@mjnagel
mjnagel merged commit d1b3b56 into main Jun 5, 2024
@mjnagel
mjnagel deleted the fix-exemptions branch June 5, 2024 20:42
@github-actions github-actions Bot mentioned this pull request Jun 5, 2024
Merged
mjnagel pushed a commit that referenced this pull request Jun 6, 2024
@github-actions
chore(main): release 0.22.1 (#432)
7cf9c4c 
🤖 I have created a release *beep* *boop*
---


##
[0.22.1](v0.22.0...v0.22.1)
(2024-06-06)


### Bug Fixes

* add saml configuration to k3d standard bundle
([#425](#425))
([15b41d7](15b41d7))
* de-duplicate renovate matches
([#435](#435))
([4f9dbbb](4f9dbbb))
* default keycloak realm envs
([#455](#455))
([3a2b48f](3a2b48f))
* exemption race conditions
([#407](#407))
([d1b3b56](d1b3b56))
* integrated docs
([#431](#431))
([72238fa](72238fa))
* keycloak schema for package cr
([#436](#436))
([e32ce9a](e32ce9a))
* networkpolicy for keycloak smtp egress
([4059954](4059954))
* nightly testing eks config architecture
([#452](#452))
([a0bbd1f](a0bbd1f))
* remove deprecated registry login and add env setup
([#443](#443))
([ca6b76f](ca6b76f))
* remove go mod
([#441](#441))
([0de9693](0de9693))
* remove no-tea and update uds version
([#446](#446))
([434844b](434844b))
* use updated k3s
([#426](#426))
([1da1c49](1da1c49))


### Miscellaneous

* add checks before killing pods when updating istio annotations
([#457](#457))
([a62f9a0](a62f9a0))
* add debug logs to save logs for easier searching
([#430](#430))
([319101b](319101b))
* add velero csi plugin
([#424](#424))
([c7e49e9](c7e49e9))
* **deps:** update githubactions
([#413](#413))
([ebd834e](ebd834e))
* **deps:** update istio to v1.22.1
([#405](#405))
([ad4b861](ad4b861))
* **deps:** update jest to v29.1.4
([#438](#438))
([c3ecc8b](c3ecc8b))
* **deps:** update keycloak to v0.4.4
([#460](#460))
([936f40b](936f40b))
* **deps:** update keycloak to v0.4.5
([#461](#461))
([3592012](3592012))
* **deps:** update keycloak to v24.0.5
([#453](#453))
([6b0c6fc](6b0c6fc))
* **deps:** update keycloak to v24.0.5
([#454](#454))
([89911f0](89911f0))
* **deps:** update pepr
([#419](#419))
([d8f0309](d8f0309))
* **deps:** update pepr to v0.4.5
([#447](#447))
([f1dba17](f1dba17))
* **deps:** update prometheus-stack
([#422](#422))
([a96193e](a96193e))
* **deps:** update uds-common to v0.4.4
([#442](#442))
([bf6debd](bf6debd))
* **deps:** update uds-k3d to v0.7.0
([#428](#428))
([23b59a2](23b59a2))
* **deps:** update velero
([#408](#408))
([ffbefda](ffbefda))
* **deps:** update velero
([#440](#440))
([4b1a3ea](4b1a3ea))
* **deps:** update velero to v6.6.0
([#456](#456))
([aff37c1](aff37c1))
* **deps:** update zarf to v0.34.0
([#434](#434))
([9badf9d](9badf9d))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@mjnagel mjnagel mentioned this pull request Jun 19, 2024
Closed
5 tasks
@mjnagel mjnagel mentioned this pull request Jun 26, 2024
Merged
5 tasks
rjferguson21 added a commit that referenced this pull request Jul 11, 2024
@TristanHoladay @cmwylie19
@mjnagel @rjferguson21
fix: exemption race conditions (#407)
9ea2185 
## Description
Fixes race conditions with exemptions that result in overwrites of
previous exemptions in the Pepr store or mutating then allowing pods
that were meant to be exempted from mutation.

## Issue

Fixes #409 

Fixes #314

## Type of change

- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Other (security config, docs update, etc)

## Checklist before merging

- [x] Test, docs, adr added or updated as needed
- [ ] [Contributor Guide
Steps](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md)(https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md#submitting-a-pull-request)
followed

---------

Co-authored-by: Case Wylie <cmwylie19@gmail.com>
Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
Co-authored-by: Rob Ferguson <rjferguson21@gmail.com>
rjferguson21 pushed a commit that referenced this pull request Jul 11, 2024
@github-actions
chore(main): release 0.22.1 (#432)
5ac4bd6 
🤖 I have created a release *beep* *boop*
---


##
[0.22.1](v0.22.0...v0.22.1)
(2024-06-06)


### Bug Fixes

* add saml configuration to k3d standard bundle
([#425](#425))
([15b41d7](15b41d7))
* de-duplicate renovate matches
([#435](#435))
([4f9dbbb](4f9dbbb))
* default keycloak realm envs
([#455](#455))
([3a2b48f](3a2b48f))
* exemption race conditions
([#407](#407))
([d1b3b56](d1b3b56))
* integrated docs
([#431](#431))
([72238fa](72238fa))
* keycloak schema for package cr
([#436](#436))
([e32ce9a](e32ce9a))
* networkpolicy for keycloak smtp egress
([4059954](4059954))
* nightly testing eks config architecture
([#452](#452))
([a0bbd1f](a0bbd1f))
* remove deprecated registry login and add env setup
([#443](#443))
([ca6b76f](ca6b76f))
* remove go mod
([#441](#441))
([0de9693](0de9693))
* remove no-tea and update uds version
([#446](#446))
([434844b](434844b))
* use updated k3s
([#426](#426))
([1da1c49](1da1c49))


### Miscellaneous

* add checks before killing pods when updating istio annotations
([#457](#457))
([a62f9a0](a62f9a0))
* add debug logs to save logs for easier searching
([#430](#430))
([319101b](319101b))
* add velero csi plugin
([#424](#424))
([c7e49e9](c7e49e9))
* **deps:** update githubactions
([#413](#413))
([ebd834e](ebd834e))
* **deps:** update istio to v1.22.1
([#405](#405))
([ad4b861](ad4b861))
* **deps:** update jest to v29.1.4
([#438](#438))
([c3ecc8b](c3ecc8b))
* **deps:** update keycloak to v0.4.4
([#460](#460))
([936f40b](936f40b))
* **deps:** update keycloak to v0.4.5
([#461](#461))
([3592012](3592012))
* **deps:** update keycloak to v24.0.5
([#453](#453))
([6b0c6fc](6b0c6fc))
* **deps:** update keycloak to v24.0.5
([#454](#454))
([89911f0](89911f0))
* **deps:** update pepr
([#419](#419))
([d8f0309](d8f0309))
* **deps:** update pepr to v0.4.5
([#447](#447))
([f1dba17](f1dba17))
* **deps:** update prometheus-stack
([#422](#422))
([a96193e](a96193e))
* **deps:** update uds-common to v0.4.4
([#442](#442))
([bf6debd](bf6debd))
* **deps:** update uds-k3d to v0.7.0
([#428](#428))
([23b59a2](23b59a2))
* **deps:** update velero
([#408](#408))
([ffbefda](ffbefda))
* **deps:** update velero
([#440](#440))
([4b1a3ea](4b1a3ea))
* **deps:** update velero to v6.6.0
([#456](#456))
([aff37c1](aff37c1))
* **deps:** update zarf to v0.34.0
([#434](#434))
([9badf9d](9badf9d))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
mjnagel added a commit to BagelLab/uds-core that referenced this pull request Nov 14, 2025
@TristanHoladay @cmwylie19
@mjnagel @rjferguson21
fix: exemption race conditions (defenseunicorns#407)
f59067a 
## Description
Fixes race conditions with exemptions that result in overwrites of
previous exemptions in the Pepr store or mutating then allowing pods
that were meant to be exempted from mutation.

## Issue

Fixes defenseunicorns#409 

Fixes defenseunicorns#314

## Type of change

- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Other (security config, docs update, etc)

## Checklist before merging

- [x] Test, docs, adr added or updated as needed
- [ ] [Contributor Guide
Steps](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md)(https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md#submitting-a-pull-request)
followed

---------

Co-authored-by: Case Wylie <cmwylie19@gmail.com>
Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
Co-authored-by: Rob Ferguson <rjferguson21@gmail.com>
mjnagel pushed a commit to BagelLab/uds-core that referenced this pull request Nov 14, 2025
@github-actions @mjnagel
chore(main): release 0.22.1 (defenseunicorns#432)
5821e1d 
🤖 I have created a release *beep* *boop*
---


##
[0.22.1](defenseunicorns/uds-core@v0.22.0...v0.22.1)
(2024-06-06)


### Bug Fixes

* add saml configuration to k3d standard bundle
([defenseunicorns#425](defenseunicorns#425))
([15b41d7](defenseunicorns@15b41d7))
* de-duplicate renovate matches
([defenseunicorns#435](defenseunicorns#435))
([4f9dbbb](defenseunicorns@4f9dbbb))
* default keycloak realm envs
([defenseunicorns#455](defenseunicorns#455))
([3a2b48f](defenseunicorns@3a2b48f))
* exemption race conditions
([defenseunicorns#407](defenseunicorns#407))
([d1b3b56](defenseunicorns@d1b3b56))
* integrated docs
([defenseunicorns#431](defenseunicorns#431))
([72238fa](defenseunicorns@72238fa))
* keycloak schema for package cr
([defenseunicorns#436](defenseunicorns#436))
([e32ce9a](defenseunicorns@e32ce9a))
* networkpolicy for keycloak smtp egress
([4059954](defenseunicorns@4059954))
* nightly testing eks config architecture
([defenseunicorns#452](defenseunicorns#452))
([a0bbd1f](defenseunicorns@a0bbd1f))
* remove deprecated registry login and add env setup
([defenseunicorns#443](defenseunicorns#443))
([ca6b76f](defenseunicorns@ca6b76f))
* remove go mod
([defenseunicorns#441](defenseunicorns#441))
([0de9693](defenseunicorns@0de9693))
* remove no-tea and update uds version
([defenseunicorns#446](defenseunicorns#446))
([434844b](defenseunicorns@434844b))
* use updated k3s
([defenseunicorns#426](defenseunicorns#426))
([1da1c49](defenseunicorns@1da1c49))


### Miscellaneous

* add checks before killing pods when updating istio annotations
([defenseunicorns#457](defenseunicorns#457))
([a62f9a0](defenseunicorns@a62f9a0))
* add debug logs to save logs for easier searching
([defenseunicorns#430](defenseunicorns#430))
([319101b](defenseunicorns@319101b))
* add velero csi plugin
([defenseunicorns#424](defenseunicorns#424))
([c7e49e9](defenseunicorns@c7e49e9))
* **deps:** update githubactions
([defenseunicorns#413](defenseunicorns#413))
([ebd834e](defenseunicorns@ebd834e))
* **deps:** update istio to v1.22.1
([defenseunicorns#405](defenseunicorns#405))
([ad4b861](defenseunicorns@ad4b861))
* **deps:** update jest to v29.1.4
([defenseunicorns#438](defenseunicorns#438))
([c3ecc8b](defenseunicorns@c3ecc8b))
* **deps:** update keycloak to v0.4.4
([defenseunicorns#460](defenseunicorns#460))
([936f40b](defenseunicorns@936f40b))
* **deps:** update keycloak to v0.4.5
([defenseunicorns#461](defenseunicorns#461))
([3592012](defenseunicorns@3592012))
* **deps:** update keycloak to v24.0.5
([defenseunicorns#453](defenseunicorns#453))
([6b0c6fc](defenseunicorns@6b0c6fc))
* **deps:** update keycloak to v24.0.5
([defenseunicorns#454](defenseunicorns#454))
([89911f0](defenseunicorns@89911f0))
* **deps:** update pepr
([defenseunicorns#419](defenseunicorns#419))
([d8f0309](defenseunicorns@d8f0309))
* **deps:** update pepr to v0.4.5
([defenseunicorns#447](defenseunicorns#447))
([f1dba17](defenseunicorns@f1dba17))
* **deps:** update prometheus-stack
([defenseunicorns#422](defenseunicorns#422))
([a96193e](defenseunicorns@a96193e))
* **deps:** update uds-common to v0.4.4
([defenseunicorns#442](defenseunicorns#442))
([bf6debd](defenseunicorns@bf6debd))
* **deps:** update uds-k3d to v0.7.0
([defenseunicorns#428](defenseunicorns#428))
([23b59a2](defenseunicorns@23b59a2))
* **deps:** update velero
([defenseunicorns#408](defenseunicorns#408))
([ffbefda](defenseunicorns@ffbefda))
* **deps:** update velero
([defenseunicorns#440](defenseunicorns#440))
([4b1a3ea](defenseunicorns@4b1a3ea))
* **deps:** update velero to v6.6.0
([defenseunicorns#456](defenseunicorns#456))
([aff37c1](defenseunicorns@aff37c1))
* **deps:** update zarf to v0.34.0
([defenseunicorns#434](defenseunicorns#434))
([9badf9d](defenseunicorns@9badf9d))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cmwylie19 cmwylie19 cmwylie19 approved these changes
@MxNxPx MxNxPx MxNxPx approved these changes
@mjnagel mjnagel mjnagel left review comments
+1 more reviewer
@rjferguson21 rjferguson21 rjferguson21 approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@mjnagel mjnagel

@TristanHoladay TristanHoladay

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Exemption Race Conditions Exemptions with same matcher twice cause erroneous deletes

5 participants

@TristanHoladay @cmwylie19 @rjferguson21 @mjnagel @MxNxPx