Skip to content

Commit 9d9dc5b

Browse files
committed
Fix code formatting and linting issues in PvCSI validation
Address CI/CD pipeline failures by fixing: - Remove trailing whitespace from lines 257, 261, 270, 310, 449, 461 - Break long lines exceeding 120 character limit: * Split long GitHub URL reference across multiple lines * Break long log message with colon injection warning - Maintain code functionality while ensuring compliance with: * gofmt formatting standards * golangci-lint lll (line length) rules These changes resolve make fmt and golangci-lint failures in the fix_pvcsi_service_account_regex_vulnerability branch without affecting the PvCSI service account validation logic. Signed-off-by: ab002488 <anuj.bansal@broadcom.com>
1 parent c5ce575 commit 9d9dc5b

1 file changed

Lines changed: 12 additions & 10 deletions

File tree

pkg/syncer/admissionhandler/validate_cnsfileaccessconfig.go

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -254,9 +254,9 @@ func isUserAllowedForDeletion(username string) (bool, error) {
254254
func validatePvCSIServiceAccount(username string) (bool, error) {
255255
ctx := context.TODO()
256256
log := logger.GetLogger(ctx)
257-
257+
258258
log.Infof("Validating PvCSI service account: username=%s", username)
259-
259+
260260
// Expected format: "system:serviceaccount:namespace:service-account-name"
261261
// Parse the username to extract namespace and service account name
262262
const prefix = "system:serviceaccount:"
@@ -268,7 +268,7 @@ func validatePvCSIServiceAccount(username string) (bool, error) {
268268
remaining := strings.TrimPrefix(username, prefix)
269269
parts := strings.Split(remaining, ":")
270270
log.Infof("Parsed service account parts: %v (count: %d)", parts, len(parts))
271-
271+
272272
if len(parts) != 2 {
273273
log.Infof("Invalid service account format - expected 2 parts, got %d, returning false", len(parts))
274274
return false, nil
@@ -306,9 +306,9 @@ func validatePvCSIServiceAccount(username string) (bool, error) {
306306
func isExplicitPvCSIServiceAccount(namespace, serviceAccountName string) bool {
307307
ctx := context.TODO()
308308
log := logger.GetLogger(ctx)
309-
309+
310310
log.Infof("Checking explicit PvCSI service account: namespace=%s, serviceAccount=%s", namespace, serviceAccountName)
311-
311+
312312
switch namespace {
313313
case "vmware-system-csi":
314314
isExplicit := serviceAccountName == "vsphere-csi-controller" || serviceAccountName == "vsphere-csi-node"
@@ -336,7 +336,8 @@ func isExplicitPvCSIServiceAccount(namespace, serviceAccountName string) bool {
336336
// },
337337
// }
338338
//
339-
// https://github-vcf.devops.broadcom.net/vcf/kubernetes-service/blob/0319c5f7c9a4300b0a97296e2b3ad6283fc6bae0/addons/controllers/csi/vspherecsiconfig_controller.go#L322-L331
339+
// Reference: https://github-vcf.devops.broadcom.net/vcf/kubernetes-service/blob/
340+
// 0319c5f7c9a4300b0a97296e2b3ad6283fc6bae0/addons/controllers/csi/vspherecsiconfig_controller.go#L322-L331
340341
func validateProviderServiceAccount(serviceAccountName string) (bool, error) {
341342
ctx := context.TODO()
342343

@@ -446,25 +447,26 @@ func validateGuestClusterPvCSIServiceAccount(namespace, serviceAccountName strin
446447
// Extract cluster name from service account name
447448
// Expected format: {cluster-name}-pvcsi
448449
clusterNameFromSA := strings.TrimSuffix(serviceAccountName, "-pvcsi")
449-
450+
450451
// Validate cluster name doesn't contain colon (prevents colon injection)
451452
if strings.Contains(clusterNameFromSA, ":") {
452-
log.Warnf("Security: Rejected service account %s with colon injection attempt in namespace %s", serviceAccountName, namespace)
453+
log.Warnf("Security: Rejected service account %s with colon injection attempt in namespace %s",
454+
serviceAccountName, namespace)
453455
return false, nil
454456
}
455457

456458
// For guest cluster service accounts, we validate by checking if the service account
457459
// follows the expected naming pattern and the namespace seems legitimate
458460
// This is a more permissive validation than supervisor cluster validation
459-
461+
460462
// Basic validation: cluster name should be reasonable length and not empty
461463
if len(clusterNameFromSA) == 0 || len(clusterNameFromSA) > 253 {
462464
log.Debugf("Guest cluster service account has invalid cluster name length: %s", clusterNameFromSA)
463465
return false, nil
464466
}
465467

466468
// Log for audit purposes
467-
log.Infof("Validated guest cluster PvCSI service account: %s in namespace %s (cluster: %s)",
469+
log.Infof("Validated guest cluster PvCSI service account: %s in namespace %s (cluster: %s)",
468470
serviceAccountName, namespace, clusterNameFromSA)
469471

470472
return true, nil

0 commit comments

Comments
 (0)