telekom/cluster-api-ipam-provider-infoblox v0.3.0-rc.2

on GitHub

What's Changed

🚨 Highlights

This release fixes several ways in which IP addresses could leak in Infoblox or be reported wrongly. Claims no longer try to replace an address that was removed in Infoblox. Releases go to the Infoblox instance recorded on the IPAddress. A 404 from a proxy no longer counts as "not found".

Errors from Infoblox now name the endpoint, the operation and the parameters, and are classified into clear condition reasons. Some reasons are renamed or new — see Upgrade notes.

Upgrade notes

• Drifted addresses are reported, not replaced. Claims whose IPAddress no longer agrees with Infoblox now show Ready=False with the reason AddressDrifted (before: Ready=True plus permanent "IPAddress spec is immutable" errors, and possibly a second address reserved in Infoblox). Repair such claims manually: set the host record back to the address of the IPAddress and remove the extra address, or replace the machine.
• Condition reasons changed. Monitoring and alerts must be adapted:
  • InfobloxCheckFailed is renamed to InfobloxRequestFailed and only used when Infoblox rejected a request with a WAPI error.
  • Errors without a WAPI response (transport errors, HTTP errors of a proxy, unreadable responses) give the new reason InfobloxConnectionFailed.
  • If no Infoblox client can be created, instances, pools and claims show ConfigurationInvalid instead of AuthenticationFailed.
  • Claims whose subnets are all full show NoAddressAvailable instead of AllocationFailed.
• Invalid TLS configuration is an error. An unreadable or invalid custom CA file no longer silently disables TLS verification, and an invalid client certificate no longer stops the operator. The InfobloxInstance gets ConfigurationInvalid instead.
• Instances are always checked. InfobloxInstances without default views were Ready=True without any request. They are now checked against Infoblox and can become Ready=False, e.g. with wrong credentials.
• Releases can now fail where they silently leaked before. A release that gets a 404 without a WAPI error body, or of a claim without the hostname annotation whose pool is gone, now fails with ReleaseFailed and keeps the finalizer. Restore the pool or set the annotation ipam.cluster.x-k8s.io/hostname to let the deletion proceed.

✨ Features

• feat: add context and classification to Infoblox errors by @Arakos in #180 (0687211)
  • Each failed request is a RequestError with endpoint, operation and parameters. HTTP error responses become HTTPError, or WapiError if they have a WAPI error body. HTML bodies (e.g. a proxy error page) are not shown.
  • New classifiers IsTransportError, IsHTTPError, IsWapiError, IsAuthError. IsNotFoundError no longer matches by message text, and only a 404 with a WAPI error body counts as "not found" — a 404 of a proxy made a release report success while the address stayed in Infoblox.
  • An empty host record lookup means "no record" instead of "multiple records".
• feat: report a full network as NoAddressAvailable on the claim by @Arakos in #180 (dbe4c19)
• feat: always check the connection of an InfobloxInstance (WAPI schema request) before the view checks by @Arakos in #180 (f65a94b)
• feat: extend the printcolumns of InfobloxInstance and InfobloxIPPool (Ready status and reason, message with -o wide, instance of a pool) by @Arakos in #180 (e644b69)

🐛 Fixes

• fix: address leaks and drift by @Arakos in #180
  • The Infoblox request timeout was int(time.Second) seconds, about 31 years — a request without a response could block a worker forever. It is now 30 seconds (972e111)
  • NewClient validates the TLS configuration first: a missing or invalid custom CA file, an invalid client certificate/key pair, or a transport without TLS verification is an error (48d7bb4)
  • Releases use a client for the Infoblox instance recorded on the IPAddress, not the client of the pool's current instance (31c41ad)
  • An existing IPAddress is only verified in Infoblox, never replaced: AddressDrifted, AddressInvalid and VerificationFailed report the problems. Before a new allocation, the IPAddress is read from the API server, so a stale cache cannot cause a second reservation (0436b61)
  • A claim without the hostname annotation whose pool is gone no longer guesses its hostname from the claim name; the release fails instead of leaking the address (01a3702)
  • A missing InfobloxInstance or credentials Secret is no longer mistaken for a missing pool: live claims get ConfigurationInvalid, deleted claims ReleaseFailed (6e76a06)
  • Errors without a WAPI response are reported as InfobloxConnectionFailed, and InfobloxCheckFailed is renamed to InfobloxRequestFailed (89b5082)
  • Pools only check the DNS view if they have a dnsZone — only then do their host records use DNS (503c701)

🧪 Testing & Chores

• test: add unit tests for pkg/infoblox and move the integration tests by @Arakos in #180 (6317ffb)
  • Unit tests with generated mocks of the Infoblox API (ibclientmock); make generate also generates the mocks, using the mockgen version from go.mod
  • Tests against a live Infoblox instance moved to test/integration/infoblox behind the build tag integration; run them with make test-integration (renamed from make test-infoblox) or make test-all
  • The linter and make vet also examine the integration tests
  • The README documents the test targets and rules for good tests

Full Changelog: v0.3.0-rc.1...v0.3.0-rc.2

Contributors

@Arakos