OCPBUGS-58181: Fix nil pointer dereference in ensureRolesAssignedToManagedIdentity#987
OCPBUGS-58181: Fix nil pointer dereference in ensureRolesAssignedToManagedIdentity#987jstuever wants to merge 1 commit intoopenshift:masterfrom
Conversation
Add nil checks for Properties, RoleDefinitionID, and Scope fields before dereferencing role assignments. This prevents panics during retry scenarios when Azure API returns role assignments with nil properties. Assisted-by: Claude Sonnet 4.5
openshift-ci-robot
added
jira/severity-low
|
@jstuever: This pull request references Jira Issue OCPBUGS-58181, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughThis change adds defensive nil-safety checks to the role assignment validation function in the Azure managed identities provisioning module. The function now safely handles cases where role assignment data structures contain nil fields by skipping incomplete entries instead of attempting to dereference them. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@jstuever: This pull request references Jira Issue OCPBUGS-58181, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira backport release-4.21,release-4.22 |
|
@jstuever: Missing required branches for backport chain:
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@jstuever: This pull request references Jira Issue OCPBUGS-58181, which is valid. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jstuever The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pkg/cmd/provisioning/azure/create_managed_identities.go`:
- Around line 313-316: The cleanup loop may still nil-deref
existingRoleAssignment.Name; move the guard that checks
existingRoleAssignment.Properties, RoleDefinitionID, and Scope to execute before
any dereference of existingRoleAssignment.Name and extend it to also check
existingRoleAssignment.Name != nil; specifically, in the loop that iterates
existingRoleAssignment (the cleanup loop logic where the code compares
*existingRoleAssignment.Name and later logs it), add Name to the nil checks and
run that guard before the name comparison and before logging to avoid panics.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 5879ed38-c555-4581-8eb1-97770b5a6bfb
📒 Files selected for processing (1)
pkg/cmd/provisioning/azure/create_managed_identities.go
| if existingRoleAssignment.Properties == nil || existingRoleAssignment.Properties.RoleDefinitionID == nil || existingRoleAssignment.Properties.Scope == nil { | ||
| log.Printf("Skipping role assignment %s with nil Properties, RoleDefinitionID, or Scope", *existingRoleAssignment.Name) | ||
| continue | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n pkg/cmd/provisioning/azure/create_managed_identities.go | sed -n '300,330p'Repository: openshift/cloud-credential-operator
Length of output: 1604
🏁 Script executed:
head -50 pkg/cmd/provisioning/azure/create_managed_identities.go | grep -E "^import|armauthorization"Repository: openshift/cloud-credential-operator
Length of output: 178
🌐 Web query:
azure-sdk-for-go RoleAssignment armauthorization Name field type
💡 Result:
In github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization (v2 and v3), the RoleAssignment resource’s Name field is a read-only *string:
// READ-ONLY; The role assignment name.
Name *string[1], [2]
Sources:
[1] armauthorization v3 type RoleAssignment struct on pkg.go.dev
[2] armauthorization v2 type RoleAssignment struct on pkg.go.dev
🏁 Script executed:
cat -n pkg/cmd/provisioning/azure/create_managed_identities.go | sed -n '305,320p'Repository: openshift/cloud-credential-operator
Length of output: 1071
This still leaves a nil-deref path in the cleanup loop.
The new guard only covers Properties/RoleDefinitionID/Scope, but Line 308 dereferences *existingRoleAssignment.Name before this guard runs, and Line 314 dereferences *existingRoleAssignment.Name within the skip block. Since armauthorization.RoleAssignment.Name is a *string pointer, the malformed payloads this PR is handling can still panic. Move the guard ahead of the name comparison at Line 308 and include Name in the nil checks.
Suggested fix
for _, existingRoleAssignment := range existingRoleAssignments {
+ if existingRoleAssignment == nil || existingRoleAssignment.Name == nil ||
+ existingRoleAssignment.Properties == nil ||
+ existingRoleAssignment.Properties.RoleDefinitionID == nil ||
+ existingRoleAssignment.Properties.Scope == nil {
+ name := "<unknown>"
+ if existingRoleAssignment != nil && existingRoleAssignment.Name != nil {
+ name = *existingRoleAssignment.Name
+ }
+ log.Printf("Skipping role assignment %s with nil Name, Properties, RoleDefinitionID, or Scope", name)
+ continue
+ }
+
found := false
for _, shouldExistRoleAssignment := range shouldExistRoleAssignments {
- if shouldExistRoleAssignment != nil && *shouldExistRoleAssignment.Name == *existingRoleAssignment.Name {
+ if shouldExistRoleAssignment != nil &&
+ shouldExistRoleAssignment.Name != nil &&
+ *shouldExistRoleAssignment.Name == *existingRoleAssignment.Name {
found = true
}
}
if !found {
- if existingRoleAssignment.Properties == nil || existingRoleAssignment.Properties.RoleDefinitionID == nil || existingRoleAssignment.Properties.Scope == nil {
- log.Printf("Skipping role assignment %s with nil Properties, RoleDefinitionID, or Scope", *existingRoleAssignment.Name)
- continue
- }
roleDefinition, err := getRoleDefinitionByID(client, *existingRoleAssignment.Properties.RoleDefinitionID)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pkg/cmd/provisioning/azure/create_managed_identities.go` around lines 313 -
316, The cleanup loop may still nil-deref existingRoleAssignment.Name; move the
guard that checks existingRoleAssignment.Properties, RoleDefinitionID, and Scope
to execute before any dereference of existingRoleAssignment.Name and extend it
to also check existingRoleAssignment.Name != nil; specifically, in the loop that
iterates existingRoleAssignment (the cleanup loop logic where the code compares
*existingRoleAssignment.Name and later logs it), add Name to the nil checks and
run that guard before the name comparison and before logging to avoid panics.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #987 +/- ##
==========================================
- Coverage 46.20% 46.19% -0.02%
==========================================
Files 98 98
Lines 12253 12258 +5
==========================================
Hits 5662 5662
- Misses 5941 5944 +3
- Partials 650 652 +2
🚀 New features to boost your workflow:
|
|
/test e2e-azure-manual-oidc |
|
@jstuever e2e-azure-manual-oidc job is blocked by https://issues.redhat.com/browse/OCPBUGS-77845 |
|
@jstuever: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
Add nil checks for Properties, RoleDefinitionID, and Scope fields before dereferencing role assignments. This prevents panics during retry scenarios when Azure API returns role assignments with nil properties.
Assisted-by: Claude Sonnet 4.5
Summary by CodeRabbit