HNC: Handle object propagation conflict

[yiqigao217]

This issue is raised on Slack. See http://bit.ly/hnc-propagation-conflict for detailed design.

Consider an example tree structure with one source object demo role in namespace tenant1:

org1
├── tenant1 (with a demo role)
│   └── space1 (with a propagated demo role from tenant1) 
└── tenant2
   └── space2

Now let’s create a demo role in org1 namespace: currently, HNC propagates demo from org1 to space1, tenant2 and space2, but it skips propagation to namespace tenant1 since a conflicting source object already exists.

For now, we will fix this issue by adding new webhook rules to prevent it (creating conflicting source). If the webhook is bypassed, HNC will overwrite any conflicts in the descendants, e.g. overwriting demo in tenant1 with the one in org1.

[adrianludwin]

@yiqigao217 I think this is finished now, correct?

[yiqigao217]

@yiqigao217 I think this is finished now, correct?

I would say yes, since #1120 is a rare corner case that we thought it was not a rush and could be done later, so we may close this for now.

[adrianludwin]

/close

…

On Mon, Oct 19, 2020 at 12:29 PM Yiqi Gao ***@***.***> wrote: @yiqigao217 <https://github.com/yiqigao217> I think this is finished now, correct? I would say yes, since #1120 <#1120> is a rare corner case that we thought it was not a rush and could be done later, so we may close this for now. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1076 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AE43PZAHPA2P5YE46YXPD4DSLRSM5ANCNFSM4QTPCCTQ> .

[k8s-ci-robot]

@adrianludwin: Closing this issue.

In response to this:

/close

On Mon, Oct 19, 2020 at 12:29 PM Yiqi Gao notifications@github.com wrote:

@yiqigao217 https://github.com/yiqigao217 I think this is finished now,
correct?

I would say yes, since #1120
#1120 is a rare
corner case that we thought it was not a rush and could be done later, so
we may close this for now.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
#1076 (comment),
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AE43PZAHPA2P5YE46YXPD4DSLRSM5ANCNFSM4QTPCCTQ
.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.