Add feature flag to secure cluster connections #621
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds a new SecureClusterTransports feature flag to enforce secure transport configurations across the YTsaurus cluster, validating that mTLS is used for native transport, HTTPS-only for HTTP proxies, and TLS-only for RPC proxies during spec validation.
- Adds
SecureClusterTransportsboolean field toClusterFeaturestype - Implements webhook validation to enforce TLS requirements when the feature is enabled
- Adds comprehensive test coverage for the new security validations
Reviewed changes
Copilot reviewed 15 out of 15 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| api/v1/ytsaurus_types.go | Adds SecureClusterTransports field to ClusterFeatures struct |
| api/v1/ytsaurus_webhook.go | Implements validation logic for secure transports including native transport, HTTP proxies, and RPC proxies |
| config/crd/bases/*.yaml | Updates CRD schemas to include the new secureClusterTransports field for all resource types |
| ytop-chart/templates/crds/*.yaml | Updates Helm chart CRD templates with the new field definition |
| test/webhooks/ytsaurus_webhooks_test.go | Adds comprehensive test cases covering successful and failure scenarios for the feature |
| pkg/testutil/spec_builders.go | Sets SecureClusterTransports to false in test builder to increase coverage |
| docs/api.md | Documents the new secureClusterTransports field in API documentation |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
koct9i
force-pushed
the
khlebnikov/flag-secure-cluster
branch
from
fa7b238 to
cac8548
Compare
koct9i
force-pushed
the
khlebnikov/flag-secure-cluster
branch
from
cac8548 to
4fd358c
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 15 out of 15 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
koct9i
force-pushed
the
khlebnikov/flag-secure-cluster
branch
from
4fd358c to
44c56f2
Compare
This feature allows to validate that only secure transports are allowed: - mTLS for native transport - HTTPS-only HTTP proxies - TLS-only RPC proxies One feature to rule them all. It has effect only during spec validation. Signed-off-by: Konstantin Khlebnikov <[email protected]>
koct9i
force-pushed
the
khlebnikov/flag-secure-cluster
branch
from
44c56f2 to
3d75cd6
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 20 out of 20 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This feature allows to validate that only secure transports are allowed:
One feature to rule them all. It has effect only during spec validation.
Signed-off-by: Konstantin Khlebnikov [email protected]