This is what happens when writing back a OIDC refresh token:
- plugin/pkg/client/auth/oidc/oidc.go:282
Calls `Persist` to save the new refresh token.
- tools/clientcmd/config.go:372
Calls `ModifyConfig` to save the config.
- tools/clientcmd/config.go:167
Calls `configAccess.GetLoadingPrecedence()` to get the files
listed from the `KUBECONFIG` environment variable.
- tools/clientcmd/loader.go:334
If the `ConfigAccess` was a `ClientConfigLoadingRules`, it
directly returns the `Precedence` slice from its `rules`
field.
THE PROBLEM:
The slice can be modified by the caller, unintentionally
changing the value of the `ClientConfigLoadingRules`'
`Precedence` field.
- tools/clientcmd/config.go:170
Then proceeds to in-place sort the slice returned by the
`ConfigAccess`. This is the same slice (by identity)
as the `ClientConfigLoadingRules`' `Precedence` field,
destroying its intended order.
- tools/clientcmd/config.go:179
Calls `configAccess.GetStartingConfig` to read the original
config so it can be compared with the new config.
- tools/clientcmd/loader.go:339
Calls `NewNonInteractiveDeferredLoadingClientConfig` with
itself as a parameter.
CONSEQUENCE:
At this point, its the `Precedence` has been
unintentionally sorted. When it loads the
config again, it gives precedence to whichever
file comes first in ascending alphabetical order.
- tools/clientcmd/config.go:192
If the file returned by `GetStartingConfig` has a
different `current-context` than the new config,
it calls `writeCurrentContext` to update the first
kubeconfig file in the `KUBECONFIG` environment
variable.
- tools/clientcmd/config.go:403
Calls `configAccess.GetDefaultFilename` to find the
destination kubeconfig file.
- tools/clientcmd/loader.go:358
Iterates through the kubeconfig files returned by
`GetLoadingPreferences` to find the first file
that exists.
CONSEQUENCE:
With the slice being sorted earlier, the files
returned by this call of `GetLoadingPreferences`
will be sorted alphabetically, rather than by
their intended order.
Kubernetes-commit: ffa084f81129ea685b176a282921c4d54906c539
* client-go: Replace depracted ErrWaitTimeout with recommended method
* Fix UT and Integration tests
* IT test
Kubernetes-commit: ffe306d67958297202e9492ea644b42c0e7e694d
* Add FileKeyRef field and struct to the Pod API
* Add the implementation code in the kubelet.
* Add validation code
* Add basic functionality e2e tests
* add codes for drop disabled pod fields
* update go.mod
Kubernetes-commit: 6f3b6b91f08585727784620285f990782901572f
This TestMain() is equivalent to not having any TestMain() at all.
This is the only such instance in whole repo.
Kubernetes-commit: 7e5aafcb164db5135a4d18ee4661c8813f2cc908
Calling os.Exit() skipped the
`defer os.RemoveAll(tmp)`
above and thus dangling files & dirs would appear in their $TMPDIR.
Since go1.15 we can safely remove os.Exit() from TestMain() function.
As this exact issue was common enough so that go1.15 changed[1] the API of
TestMain to no longer require os.Exit to be called.
Reproducer:
$ (cd staging/src/k8s.io/client-go; go test ./tools/clientcmd)
$ ls -d /tmp/testkubeconfig*
/tmp/testkubeconfig1015943687
[1]: https://go-review.googlesource.com/c/go/+/219639
Kubernetes-commit: 457df1cf9817e29381609fbf2d85854a6b6a52ac
Prevent the failure of releasing the lock by updating the resource version in case of the resource conflict
Kubernetes-commit: 793191529651ab5c9e49914f19e9bdf85d412218
