triffer
commented
5 months ago The root cause for the failing UI tests is that the rules fields are not rendered. The UI renders the fields based on the Kubernetes OpenAPI response from /openapi/v2. The OpenAPI response is influenced by setting x-kubernetes-preserve-unknown-fields: true in the CRD. We can find more information about that in the Kubernetes CRD docs:
A structural schema is an OpenAPI v3.0 validation schema which:
specifies a non-empty type (via type in OpenAPI) for the root, for each specified field of an object node (via properties or >additionalProperties in OpenAPI) and for each item in an array node (via items in OpenAPI), with the exception of: a node with x-kubernetes-int-or-string: true a node with x-kubernetes-preserve-unknown-fields: true
For the old CRD the API response for rules looks like this:
"rules": {
"description": "Represents the array of Oathkeeper access rules to be applied.",
"type": "array",
"minItems": 1,
"items": {
"description": "Rule .",
"type": "object",
"required": [
"accessStrategies",
"methods",
"path"
],
"properties": {
"accessStrategies": {
"description": "Specifies the list of access strategies. All strategies listed in [Oathkeeper documentation](https://www.ory.sh/docs/oathkeeper/pipeline/authn) are supported.",
"type": "array",
"minItems": 1,
"items": {
"description": "Represents a handler that authenticates provided credentials. See the corresponding type in the oathkeeper-maester project.",
"type": "object",
"required": [
"handler"
],
"properties": {
"config": {
"description": "Configures the handler. Configuration keys vary per handler.",
"x-kubernetes-preserve-unknown-fields": true
},
"handler": {
"description": "Specifies the name of the handler.",
"type": "string"
}
}
}
},
"methods": {
"description": "Represents the list of allowed HTTP request methods available for the **spec.rules.path**.",
"type": "array",
"minItems": 1,
"items": {
"description": "HttpMethod specifies the HTTP request method. The list of supported methods is defined in RFC 9910: HTTP Semantics and RFC 5789: PATCH Method for HTTP.",
"type": "string",
"enum": [
"GET",
"HEAD",
"POST",
"PUT",
"DELETE",
"CONNECT",
"OPTIONS",
"TRACE",
"PATCH"
]
}
},
"mutators": {
"description": "Specifies the list of [Ory Oathkeeper](https://www.ory.sh/docs/oathkeeper/pipeline/mutator) mutators.",
"type": "array",
"items": {
"description": "Mutator represents a handler that transforms the HTTP request before forwarding it. See the corresponding in the oathkeeper-maester project.",
"type": "object",
"required": [
"handler"
],
"properties": {
"config": {
"description": "Configures the handler. Configuration keys vary per handler.",
"x-kubernetes-preserve-unknown-fields": true
},
"handler": {
"description": "Specifies the name of the handler.",
"type": "string"
}
}
}
},
"path": {
"description": "Specifies the path of the exposed service.",
"type": "string",
"pattern": "^([0-9a-zA-Z./*()?!\\\\_-]+)"
},
"service": {
"description": "Describes the service to expose. Overwrites the **spec** level service if defined.",
"type": "object",
"required": [
"name",
"port"
],
"properties": {
"external": {
"description": "Specifies if the service is internal (in cluster) or external.",
"type": "boolean"
},
"name": {
"description": "Specifies the name of the exposed service.",
"type": "string"
},
"namespace": {
"description": "Specifies the Namespace of the exposed service. If not defined, it defaults to the APIRule Namespace.",
"type": "string",
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$"
},
"port": {
"description": "Specifies the communication port of the exposed service.",
"type": "integer",
"format": "int32",
"maximum": 65535,
"minimum": 1
}
}
},
"timeout": {
"description": "Timeout for HTTP requests in seconds. The timeout can be configured up to 3900 seconds (65 minutes).",
"type": "integer",
"maximum": 3900,
"minimum": 1
}
}
}
},For the new CRD with x-kubernetes-preserve-unknown-fields: true the response looks like this:
"rules": {
"description": "Represents the array of Oathkeeper access rules to be applied.",
"type": "array",
"minItems": 1,
"items": {
"description": "Rule .",
"required": [
"accessStrategies",
"methods",
"path"
],
"x-kubernetes-preserve-unknown-fields": true
}
},As far as I know Busola uses /openapi/v2 endpoint to load the schema and parse it.
You can reproduce this by checking the response of the request to this endpoint on initial rendering of Busola or directly query the Kubernetes API server using
kubectl proxy --port=8080 & and curl http://localhost:8080/openapi/v2
videlov
barchw
werdes72
Description
Changes proposed in this pull request:
Related issues
986