API-1894: Ignore updates related to Scheduling Gates #128

Barakmor1 · 2023-12-25T15:15:44Z

Ignore updates related to Scheduling Gates to allow the installation of external operators that manage pod scheduling. Scheduling Gates don't affect pod privileges, so there's no need to block them through SCC admission.

@vladikr

openshift-ci · 2023-12-25T15:16:14Z

Hi @Barakmor1. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Barakmor1 · 2023-12-25T15:18:27Z

/cc @stlaz @soltysh

Barakmor1 · 2024-01-16T14:11:27Z

ping @stlaz @soltysh

stlaz · 2024-04-08T12:15:18Z

The admission should pass just as it did the first time the pod was created. Is this just a minor performance improvement, then?

Barakmor1 · 2024-04-17T07:14:44Z

The admission should pass just as it did the first time the pod was created. Is this just a minor performance improvement, then?

When the pod is created, it passes validation because it is created by an authorized Controller/Admin. The schedulingGates are typically added with a mutating webhook during admission, which doesn't perform an API call. This is why the validation passes on creation.

The schedulingGates are typically removed with an API call by a different Controller which is not associated with the same SCC as the creator and this is when the API call fails.

Barakmor1 · 2024-04-17T07:15:03Z

@stlaz

openshift-bot · 2024-07-16T09:00:35Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

openshift-bot · 2024-08-16T00:30:37Z

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

openshift-bot · 2024-09-16T00:01:14Z

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

openshift-ci · 2024-09-16T00:02:08Z

@openshift-bot: Closed this PR.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Barakmor1 · 2025-03-10T14:10:50Z

/reopen

@stlaz @deads2k can you please have a look

openshift-ci · 2025-03-10T14:11:03Z

@Barakmor1: Reopened this PR.

In response to this:

/reopen

@stlaz @deads2k can you please have a look

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Barakmor1 · 2025-03-10T14:11:17Z

/remove-lifecycle rotten

openshift-bot · 2025-06-09T01:00:39Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

pkg/securitycontextconstraints/sccadmission/admission.go

sjenning · 2025-07-02T13:37:51Z

/lgtm cancel

openshift-ci-robot · 2025-07-02T14:13:03Z

@Barakmor1: This pull request references API-1894 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.20.0" version, but no target version was set.

In response to this:

Ignore updates related to Scheduling Gates to allow the installation of external operators that manage pod scheduling. Scheduling Gates don't affect pod privileges, so there's no need to block them through SCC admission.

@vladikr

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

sjenning · 2025-07-08T19:28:08Z

/lgtm

pkg/securitycontextconstraints/sccadmission/admission.go

Barakmor1 · 2025-08-26T13:20:46Z

@kannon92 won't this cause problems with Kueue as well?

pkg/securitycontextconstraints/sccadmission/admission.go

liouk · 2025-09-04T08:59:01Z

pkg/securitycontextconstraints/sccadmission/admission.go

+// - update operations that only change fields like SchedulingGates or non-critical metadata.
+// If the request is malformed (e.g., object can't be cast to a Pod), it fails closed to avoid
+// bypassing security enforcement unintentionally.
+func shouldSkipSCCEvaluation(a admission.Attributes) (bool, error) {


Please also rename the respective unit test (TestShouldIgnore()) accordingly.

Also, how about adding a test in this unit that the original pod hasn't been mutated? (since we should only be mutating copies)

Thanks for reviewing.
Done

to allow the installation of external operators that manage pod scheduling. Scheduling Gates don't affect pod privileges, so there's no need to block them through SCC admission. Signed-off-by: bmordeha <[email protected]>

liouk · 2025-09-10T07:10:27Z

LGTM; will hold for @ibihim to have a look as well.

/lgtm
/hold

openshift-ci · 2025-09-10T07:14:15Z

@Barakmor1: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

ibihim · 2025-09-10T09:01:22Z

/lgtm
/approve

openshift-ci · 2025-09-10T09:01:41Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Barakmor1, ibihim, liouk, sjenning

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~pkg/securitycontextconstraints/OWNERS~~ [ibihim]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

liouk · 2025-09-16T14:05:03Z

/hold cancel

openshift-ci bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Dec 25, 2023

openshift-ci bot requested review from ibihim and stlaz December 25, 2023 15:16

openshift-ci bot requested a review from soltysh December 25, 2023 15:18

stlaz mentioned this pull request Jan 25, 2024

OCPBUGS-11933: Ignore informative annotations upon admission #117

Merged

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 8, 2024

Barakmor1 force-pushed the considerSchedulingGates branch from faed836 to 79d9a40 Compare April 17, 2024 07:31

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 17, 2024

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jul 16, 2024

openshift-ci bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Aug 16, 2024

openshift-ci bot closed this Sep 16, 2024

openshift-ci bot reopened this Mar 10, 2025

openshift-ci bot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Mar 10, 2025

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 9, 2025

sjenning reviewed Jun 16, 2025

View reviewed changes

pkg/securitycontextconstraints/sccadmission/admission.go Outdated Show resolved Hide resolved

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jul 2, 2025

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Jul 2, 2025

sjenning changed the title ~~Ignore updates related to Scheduling Gates~~ API-1894: Ignore updates related to Scheduling Gates Jul 2, 2025

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 2, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jul 8, 2025

ibihim reviewed Jul 17, 2025

View reviewed changes

pkg/securitycontextconstraints/sccadmission/admission.go Outdated Show resolved Hide resolved

Barakmor1 force-pushed the considerSchedulingGates branch from ebdbf84 to 8d3674c Compare July 17, 2025 09:08

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Jul 17, 2025

ibihim mentioned this pull request Jul 23, 2025

authorization: verify schedulingGates work openshift/origin#30011

Open

liouk suggested changes Sep 2, 2025

View reviewed changes

pkg/securitycontextconstraints/sccadmission/admission.go Outdated Show resolved Hide resolved

Barakmor1 force-pushed the considerSchedulingGates branch 2 times, most recently from e326fa1 to a9b901c Compare September 4, 2025 08:54

liouk suggested changes Sep 4, 2025

View reviewed changes

Ignore updates related to Scheduling Gates

07c3a15

to allow the installation of external operators that manage pod scheduling. Scheduling Gates don't affect pod privileges, so there's no need to block them through SCC admission. Signed-off-by: bmordeha <[email protected]>

Barakmor1 force-pushed the considerSchedulingGates branch from a9b901c to 07c3a15 Compare September 10, 2025 07:07

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 10, 2025

openshift-ci bot assigned liouk Sep 10, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 10, 2025

openshift-ci bot assigned ibihim Sep 10, 2025

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 10, 2025

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 16, 2025

API-1894: Ignore updates related to Scheduling Gates #128

Are you sure you want to change the base?

API-1894: Ignore updates related to Scheduling Gates #128

Uh oh!

Conversation

Barakmor1 commented Dec 25, 2023

Uh oh!

openshift-ci bot commented Dec 25, 2023

Uh oh!

Barakmor1 commented Dec 25, 2023

Uh oh!

Barakmor1 commented Jan 16, 2024

Uh oh!

stlaz commented Apr 8, 2024

Uh oh!

Barakmor1 commented Apr 17, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Barakmor1 commented Apr 17, 2024

Uh oh!

openshift-bot commented Jul 16, 2024

Uh oh!

openshift-bot commented Aug 16, 2024

Uh oh!

openshift-bot commented Sep 16, 2024

Uh oh!

openshift-ci bot commented Sep 16, 2024

Uh oh!

Barakmor1 commented Mar 10, 2025

Uh oh!

openshift-ci bot commented Mar 10, 2025

Uh oh!

Barakmor1 commented Mar 10, 2025

Uh oh!

openshift-bot commented Jun 9, 2025

Uh oh!

Uh oh!

sjenning commented Jul 2, 2025

Uh oh!

openshift-ci-robot commented Jul 2, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sjenning commented Jul 8, 2025

Uh oh!

Uh oh!

Barakmor1 commented Aug 26, 2025

Uh oh!

Uh oh!

liouk Sep 4, 2025

Choose a reason for hiding this comment

Uh oh!

liouk Sep 4, 2025

Choose a reason for hiding this comment

Uh oh!

Barakmor1 Sep 10, 2025

Choose a reason for hiding this comment

Uh oh!

liouk commented Sep 10, 2025

Uh oh!

openshift-ci bot commented Sep 10, 2025

Uh oh!

ibihim commented Sep 10, 2025

Uh oh!

openshift-ci bot commented Sep 10, 2025

Uh oh!

liouk commented Sep 16, 2025

Uh oh!

Uh oh!

Barakmor1 commented Apr 17, 2024 •

edited

Loading

openshift-ci-robot commented Jul 2, 2025 •

edited by openshift-ci bot

Loading