Skip to content

ROX-8758: Parameterize ALL scanner-related resource names.#558

Merged
porridge merged 2 commits intomasterfrom
porridge/ROX-8758-resource-un-colliding
Feb 8, 2022
Merged

ROX-8758: Parameterize ALL scanner-related resource names.#558
porridge merged 2 commits intomasterfrom
porridge/ROX-8758-resource-un-colliding

Conversation

@porridge
Copy link
Contributor

@porridge porridge commented Feb 4, 2022

Description

Use the word scanner when in full mode, and scanner-slim while in slim mode.

This parameterisation applies the following:

  • names (i.e. metadata.name) of ALL scanner-related resources, both namespaced and cluster-scoped - to prevent clashes
  • label values (e.g. selectors), necessary to effectively isolate scanner deployment and service from scanner-slim
  • any identifiers which directly refer to the above, including:
    • host in db connection string in scanner config file
    • istio destination rule host name
    • use of the word scanner in the override section of chart values. This is debatable, but I chose to be consistent with the actual resource names since this is what users likely expect when they tweak at such level of detail.

Note that any uses of the above in application code will need parameterisation as well.
cc @RTann @juanrh

For the avoidance of doubt, there are NO CHANGES to:

  • volume names inside pods
  • scanner pod container name
  • service port names
  • readiness probe path
  • identifiers expected in the chart values file EXCEPT for the word scanner in the customize section of chart values. See rationale above.
  • words scanner and scanner-db in TLS certSpecs passed to configureCrypto calls. This might also be debatable, if we want these to match the Service names.
  • comments
  • internal helm chart variable and function names
  • chart file/directory path names

Checklist

  • Investigated and inspected CI test results
  • Unit test and regression tests added
  • Evaluated and added CHANGELOG entry if required
  • Determined and documented upgrade steps

If any of these don't apply, please comment below.

Testing Performed

@ghost
Copy link

ghost commented Feb 4, 2022

Tag for build #177144 is 3.68.x-130-g963a1bde3a.

💻 For deploying this image using the dev scripts, run the following first:

export MAIN_IMAGE_TAG='3.68.x-130-g963a1bde3a'

📦 You can also generate an installation bundle with:

docker run -i --rm stackrox/main:3.68.x-130-g963a1bde3a central generate interactive > bundle.zip

🕹️ A roxctl binary artifact can be downloaded from CircleCI.

@porridge porridge requested a review from SimonBaeumer February 4, 2022 10:35
@porridge porridge marked this pull request as ready for review February 4, 2022 10:35
@SimonBaeumer SimonBaeumer requested review from RTann and juanrh February 7, 2022 14:08
@SimonBaeumer
Copy link
Contributor

any identifiers which directly refer to the above, including:

  • host in db connection string in scanner config file

The changes look good but I want to reiterate on adding different names to all resources after seeing it in code.
My main concern is that all identifiers are changed but the operations of scanner are the same so we shift complexity to tests, operator and everything else which worked with scanner before.

Take the operator for example, if we start adding custom reconciliation to scanner (i.e. scaling) we need to support scanner and scanner-slim identifiers.

Given the advantage of deploying it into the same namespace (or cluster) for better (developer) UX.
Having in mind that we'll support this the efforts supporting two different sets of identifiers seem not be worth it.
(I.e. for managed services we would need to support both)

Instead we could do a lookup on an existing scanner deployment and disable scanner-slim automatically.
Global resources still need prefixes so that different namespace installation are supported.

Lastly installing the same application two times in the same namespace is often not supported and a reasonable argument to not support it.

What do you think @porridge?

@porridge
Copy link
Contributor Author

porridge commented Feb 8, 2022

After watching @RTann 's scanner brown bag and chatting to him, I had the impression that talking to local scanner would be a different code path from talking to the global one. So it is not necessarily a problem that the scanner connection hostname would differ. But I might have gotten that wrong, so I'll let him comment on that.

Regarding the cost/benefit trade-off: it seems to me that this change will actually make (e2e) testing simpler, since in a single-cluster scenarios we will be able to continue using a single namespace (it's particularly cumbersome to use more than one with kuttl). It's also the general ease of distinguishing both types of scanner deployments (without the need for special labels or annotations) that is my primary motivation here. Given the different image and functionality, the two scanners will likely have different resource usage patterns, etc, so distinguishing them explicitly could really help in the long term.

[< end >]

{{ if or (eq $scannerCfg.mode "") (eq $scannerCfg.mode "full") }}
{{ $_ := set $scannerCfg "name" "scanner" }}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@SimonBaeumer one thing I wanted to ask is if this should instead be:

Suggested change
{{ $_ := set $scannerCfg "name" "scanner" }}
{{ $_ := set $scannerCfg "_name" "scanner" }}

since whether an identifier starts with an underscore seems random to me :-/

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To me this looks fine 👍

Comment on lines +22 to +23
.secrets["scanner-slim-tls"] | assertThat(. == null)
.secrets["scanner-slim-db-tls"] | assertThat(. == null)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@juanrh Does this affect your pull-requests? I think you need to create scanner-slim-db-tls and scanner-slim-tls secrets instead of scanner-tls

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the heads up, I'll take that into account for #565

@porridge porridge merged commit aaf02a1 into master Feb 8, 2022
@porridge porridge deleted the porridge/ROX-8758-resource-un-colliding branch February 8, 2022 08:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants