tolerate duplicate ACLs #5552
tolerate duplicate ACLs #5552
Conversation
Signed-off-by: Mengxin Liu <[email protected]>
dosubot
bot
added
the
size:M
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary of Changes
Hello @oilbeater, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
I've implemented changes to improve the handling of Access Control Lists (ACLs) within the system, specifically addressing scenarios where duplicate ACL entries might exist. My primary goal was to prevent errors caused by these duplicates and ensure the system can gracefully manage them. This involved introducing more specific error types for ACL operations and modifying existing functions to properly interpret and tolerate duplicate ACLs, particularly when checking for their existence. This change aims to enhance the robustness and reliability of ACL management.
Highlights
- Enhanced Error Handling: I've introduced a new structured error type,
ACLError, along with an enumACLErrorType(ACLErrorNotFound, ACLErrorDuplicated, ACLErrorDatabase). This allows for more granular error handling when dealing with ACL operations. - Refined ACL Retrieval Error Reporting: I've updated the
GetACLfunction to return these specificACLErrortypes, providing clearer context for different failure scenarios such as database issues, ACLs not being found, or the unexpected presence of duplicate ACLs. - Tolerating Duplicate ACLs in Existence Checks: I've modified the
ACLExistsfunction to specifically check for and tolerateACLErrorDuplicated. IfGetACLreturns a duplicate ACL error,ACLExistswill now correctly report that the ACL exists (returningtrue) without propagating an error, aligning with the goal of tolerating duplicate ACLs.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments or fill out our survey to provide feedback.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
The pull request introduces a custom error type ACLError to handle duplicate ACLs more gracefully, which is a good approach. My main feedback is to improve the implementation of ACLError to support Go's standard error wrapping. This will prevent losing valuable context from underlying errors, particularly from database operations, making the code more robust and easier to debug. I've also suggested updating the calls to NewACLError to align with this change.
| type ACLError struct { | ||
| Type ACLErrorType | ||
| Msg string | ||
| } | ||
|
|
||
| func (e *ACLError) Error() string { | ||
| return e.Msg | ||
| } | ||
|
|
||
| func NewACLError(errType ACLErrorType, msg string) *ACLError { | ||
| return &ACLError{Type: errType, Msg: msg} | ||
| } |
There was a problem hiding this comment.
The new ACLError type is a good addition for typed errors. However, it should support error wrapping to avoid losing the underlying error context, especially for database errors. I suggest adding an Err field to the struct and an Unwrap() method to conform to Go's error wrapping conventions. The Error() method and NewACLError constructor should also be updated accordingly. This will make your custom error type more robust and easier to debug.
| type ACLError struct { | |
| Type ACLErrorType | |
| Msg string | |
| } | |
| func (e *ACLError) Error() string { | |
| return e.Msg | |
| } | |
| func NewACLError(errType ACLErrorType, msg string) *ACLError { | |
| return &ACLError{Type: errType, Msg: msg} | |
| } | |
| type ACLError struct { | |
| Type ACLErrorType | |
| Msg string | |
| Err error | |
| } | |
| func (e *ACLError) Error() string { | |
| if e.Err != nil { | |
| return fmt.Sprintf("%s: %v", e.Msg, e.Err) | |
| } | |
| return e.Msg | |
| } | |
| func (e *ACLError) Unwrap() error { | |
| return e.Err | |
| } | |
| func NewACLError(errType ACLErrorType, msg string, err error) *ACLError { | |
| return &ACLError{Type: errType, Msg: msg, Err: err} | |
| } |
| }).List(ctx, &aclList); err != nil { | ||
| klog.Error(err) | ||
| return nil, fmt.Errorf("get acl with 'parent %s direction %s priority %s match %s': %w", parent, direction, priority, match, err) | ||
| return nil, NewACLError(ACLErrorDatabase, fmt.Sprintf("get acl with 'parent %s direction %s priority %s match %s': %v", parent, direction, priority, match, err)) | ||
| } | ||
|
|
||
| // not found | ||
| if len(aclList) == 0 { | ||
| if ignoreNotFound { | ||
| return nil, nil | ||
| } | ||
| return nil, fmt.Errorf("not found acl with 'parent %s direction %s priority %s match %s'", parent, direction, priority, match) | ||
| return nil, NewACLError(ACLErrorNotFound, fmt.Sprintf("not found acl with 'parent %s direction %s priority %s match %s'", parent, direction, priority, match)) | ||
| } | ||
|
|
||
| if len(aclList) > 1 { | ||
| return nil, fmt.Errorf("more than one acl with same 'parent %s direction %s priority %s match %s'", parent, direction, priority, match) | ||
| return nil, NewACLError(ACLErrorDuplicated, fmt.Sprintf("more than one acl with same 'parent %s direction %s priority %s match %s'", parent, direction, priority, match)) | ||
| } |
There was a problem hiding this comment.
To align with the proposed changes for ACLError to support error wrapping, the calls to NewACLError should be updated to pass the underlying error where applicable. This ensures that no error information is lost from the original database error. For cases where there is no underlying error, nil should be passed.
| }).List(ctx, &aclList); err != nil { | |
| klog.Error(err) | |
| return nil, fmt.Errorf("get acl with 'parent %s direction %s priority %s match %s': %w", parent, direction, priority, match, err) | |
| return nil, NewACLError(ACLErrorDatabase, fmt.Sprintf("get acl with 'parent %s direction %s priority %s match %s': %v", parent, direction, priority, match, err)) | |
| } | |
| // not found | |
| if len(aclList) == 0 { | |
| if ignoreNotFound { | |
| return nil, nil | |
| } | |
| return nil, fmt.Errorf("not found acl with 'parent %s direction %s priority %s match %s'", parent, direction, priority, match) | |
| return nil, NewACLError(ACLErrorNotFound, fmt.Sprintf("not found acl with 'parent %s direction %s priority %s match %s'", parent, direction, priority, match)) | |
| } | |
| if len(aclList) > 1 { | |
| return nil, fmt.Errorf("more than one acl with same 'parent %s direction %s priority %s match %s'", parent, direction, priority, match) | |
| return nil, NewACLError(ACLErrorDuplicated, fmt.Sprintf("more than one acl with same 'parent %s direction %s priority %s match %s'", parent, direction, priority, match)) | |
| } | |
| }).List(ctx, &aclList); err != nil { | |
| klog.Error(err) | |
| return nil, NewACLError(ACLErrorDatabase, fmt.Sprintf("get acl with 'parent %s direction %s priority %s match %s'", parent, direction, priority, match), err) | |
| } | |
| // not found | |
| if len(aclList) == 0 { | |
| if ignoreNotFound { | |
| return nil, nil | |
| } | |
| return nil, NewACLError(ACLErrorNotFound, fmt.Sprintf("not found acl with 'parent %s direction %s priority %s match %s'", parent, direction, priority, match), nil) | |
| } | |
| if len(aclList) > 1 { | |
| return nil, NewACLError(ACLErrorDuplicated, fmt.Sprintf("more than one acl with same 'parent %s direction %s priority %s match %s'", parent, direction, priority, match), nil) | |
| } |
Signed-off-by: Mengxin Liu <[email protected]> (cherry picked from commit 788694f)
Signed-off-by: Mengxin Liu <[email protected]> (cherry picked from commit 788694f)
Pull Request
What type of this PR
Examples of user facing changes:
Which issue(s) this PR fixes
Fixes #5538