Switch ACK to CEL-Based Immutability and Remove Runtime Checks #565
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rushmash91
force-pushed
the
main
branch
2 times, most recently
from
3ee1b27 to
c483a60
Compare
|
Controllers with immutable (reference to
|
|
/test s3-controller-test |
|
/test cloudfront-controller-test |
|
/hold |
ack-prow
bot
added
the
do-not-merge/hold
a-hilaly
reviewed
Jan 22, 2025
There was a problem hiding this comment.
Neat! Good job on this @rushmash91 🚀
As you stated, we'll wait until EKS 1.24 reaches end of support ship this to all controllers
This was referenced Feb 18, 2025
ack-prow bot
pushed a commit
to aws-controllers-k8s/iam-controller
that referenced
this pull request
Feb 19, 2025
fix aws-controllers-k8s/code-generator#565 Description of changes: Remove `getImmutableFieldChanges` from hooks to support cel immutability By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
ack-prow bot
pushed a commit
to aws-controllers-k8s/dynamodb-controller
that referenced
this pull request
Feb 19, 2025
fix aws-controllers-k8s/code-generator#565 Description of changes: Remove getImmutableFieldChanges from hooks to support cel immutability By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
ack-prow bot
pushed a commit
to aws-controllers-k8s/eventbridge-controller
that referenced
this pull request
Feb 19, 2025
fix aws-controllers-k8s/code-generator#565 Description of changes: Remove getImmutableFieldChanges from hooks to support cel immutability By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
ack-prow bot
pushed a commit
to aws-controllers-k8s/eks-controller
that referenced
this pull request
Feb 19, 2025
fix aws-controllers-k8s/code-generator#565 Description of changes: Remove getImmutableFieldChanges from hooks to support cel immutability By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
ack-prow bot
pushed a commit
to aws-controllers-k8s/kms-controller
that referenced
this pull request
Feb 19, 2025
fix aws-controllers-k8s/code-generator#565 Description of changes: Remove getImmutableFieldChanges from hooks to support cel immutability Remove immutability tests By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
ack-prow bot
pushed a commit
to aws-controllers-k8s/sns-controller
that referenced
this pull request
Feb 19, 2025
fix aws-controllers-k8s/code-generator#565 Description of changes: Remove getImmutableFieldChanges from hooks to support cel immutability field `Name` immutability test removed for resource `Topic` By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
ack-prow bot
pushed a commit
to aws-controllers-k8s/route53-controller
that referenced
this pull request
Feb 19, 2025
fix aws-controllers-k8s/code-generator#565 Description of changes: Remove getImmutableFieldChanges from hooks to support cel immutability By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
ack-prow bot
pushed a commit
to aws-controllers-k8s/ses-controller
that referenced
this pull request
Feb 19, 2025
fix aws-controllers-k8s/code-generator#565 Description of changes: Remove getImmutableFieldChanges from hooks to support cel immutability By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
a-hilaly
approved these changes
Feb 19, 2025
ack-prow
bot
removed
the
do-not-merge/hold
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: a-hilaly, rushmash91 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/test eks-controller-test |
|
/test efs-controller-test |
|
/test cloudfront-controller-test |
|
/test ec2-controller-test |
2 similar comments
|
/test ec2-controller-test |
|
/test ec2-controller-test |
|
@rushmash91: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issue #2202
Description of changes:
Updates the ACK code generation process to enforce immutability using CEL validation rules instead of runtime comparisons. By adding
+kubebuilder:validation:XValidationannotations to fields markedis_immutable: true, Kubernetes1.25+now blocks changes at admission time, eliminating the need for separate runtime checks or conditions.Why?
HasImmutableFieldChanges()and similar logic can be removed.Caveats
Clusters must be on Kubernetes 1.25+, which supports CEL.
Blog
Changes
•Add CEL rules for
is_immutable: truefields in the CRD template (+kubebuilder:validation:XValidation).•Remove runtime immutability checks (
HasImmutableFieldChanges, etc.) in the generatedsdk.gofiles.•Clean up references to "immutable fields” in
crd.goto avoid duplicating logic.•Update inline comments and docstrings to clarify that immutability is now admission-based.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.