mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-23 11:50:44 +00:00
Merge pull request #107559 from liggitt/invalid-selectors
Handle invalid selectors properly
This commit is contained in:
commit
184daed0db
@ -900,7 +900,8 @@ func GetDeploymentsForReplicaSet(deploymentLister appslisters.DeploymentLister,
|
|||||||
for _, d := range dList {
|
for _, d := range dList {
|
||||||
selector, err := metav1.LabelSelectorAsSelector(d.Spec.Selector)
|
selector, err := metav1.LabelSelectorAsSelector(d.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("invalid label selector: %v", err)
|
// This object has an invalid selector, it does not match the replicaset
|
||||||
|
continue
|
||||||
}
|
}
|
||||||
// If a deployment with a nil or empty selector creeps in, it should match nothing, not everything.
|
// If a deployment with a nil or empty selector creeps in, it should match nothing, not everything.
|
||||||
if selector.Empty() || !selector.Matches(labels.Set(rs.Labels)) {
|
if selector.Empty() || !selector.Matches(labels.Set(rs.Labels)) {
|
||||||
|
@ -668,7 +668,7 @@ func (rsc *ReplicaSetController) syncReplicaSet(ctx context.Context, key string)
|
|||||||
rsNeedsSync := rsc.expectations.SatisfiedExpectations(key)
|
rsNeedsSync := rsc.expectations.SatisfiedExpectations(key)
|
||||||
selector, err := metav1.LabelSelectorAsSelector(rs.Spec.Selector)
|
selector, err := metav1.LabelSelectorAsSelector(rs.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
utilruntime.HandleError(fmt.Errorf("error converting pod selector to selector: %v", err))
|
utilruntime.HandleError(fmt.Errorf("error converting pod selector to selector for rs %v/%v: %v", namespace, name, err))
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -774,7 +774,8 @@ func (rsc *ReplicaSetController) getIndirectlyRelatedPods(rs *apps.ReplicaSet) (
|
|||||||
for _, relatedRS := range rsc.getReplicaSetsWithSameController(rs) {
|
for _, relatedRS := range rsc.getReplicaSetsWithSameController(rs) {
|
||||||
selector, err := metav1.LabelSelectorAsSelector(relatedRS.Spec.Selector)
|
selector, err := metav1.LabelSelectorAsSelector(relatedRS.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, err
|
// This object has an invalid selector, it does not match any pods
|
||||||
|
continue
|
||||||
}
|
}
|
||||||
pods, err := rsc.podLister.Pods(relatedRS.Namespace).List(selector)
|
pods, err := rsc.podLister.Pods(relatedRS.Namespace).List(selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
|
@ -197,7 +197,6 @@ func FindMatchingVolume(
|
|||||||
if claim.Spec.Selector != nil {
|
if claim.Spec.Selector != nil {
|
||||||
internalSelector, err := metav1.LabelSelectorAsSelector(claim.Spec.Selector)
|
internalSelector, err := metav1.LabelSelectorAsSelector(claim.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
// should be unreachable code due to validation
|
|
||||||
return nil, fmt.Errorf("error creating internal label selector for claim: %v: %v", claimToClaimKey(claim), err)
|
return nil, fmt.Errorf("error creating internal label selector for claim: %v: %v", claimToClaimKey(claim), err)
|
||||||
}
|
}
|
||||||
selector = internalSelector
|
selector = internalSelector
|
||||||
|
@ -1996,14 +1996,16 @@ func printDeployment(obj *apps.Deployment, options printers.GenerateOptions) ([]
|
|||||||
age := translateTimestampSince(obj.CreationTimestamp)
|
age := translateTimestampSince(obj.CreationTimestamp)
|
||||||
containers := obj.Spec.Template.Spec.Containers
|
containers := obj.Spec.Template.Spec.Containers
|
||||||
selector, err := metav1.LabelSelectorAsSelector(obj.Spec.Selector)
|
selector, err := metav1.LabelSelectorAsSelector(obj.Spec.Selector)
|
||||||
|
selectorString := ""
|
||||||
if err != nil {
|
if err != nil {
|
||||||
// this shouldn't happen if LabelSelector passed validation
|
selectorString = "<invalid>"
|
||||||
return nil, err
|
} else {
|
||||||
|
selectorString = selector.String()
|
||||||
}
|
}
|
||||||
row.Cells = append(row.Cells, obj.Name, fmt.Sprintf("%d/%d", int64(readyReplicas), int64(desiredReplicas)), int64(updatedReplicas), int64(availableReplicas), age)
|
row.Cells = append(row.Cells, obj.Name, fmt.Sprintf("%d/%d", int64(readyReplicas), int64(desiredReplicas)), int64(updatedReplicas), int64(availableReplicas), age)
|
||||||
if options.Wide {
|
if options.Wide {
|
||||||
containers, images := layoutContainerCells(containers)
|
containers, images := layoutContainerCells(containers)
|
||||||
row.Cells = append(row.Cells, containers, images, selector.String())
|
row.Cells = append(row.Cells, containers, images, selectorString)
|
||||||
}
|
}
|
||||||
return []metav1.TableRow{row}, nil
|
return []metav1.TableRow{row}, nil
|
||||||
}
|
}
|
||||||
|
@ -385,6 +385,7 @@ func (r *EvictionREST) getPodDisruptionBudgets(ctx context.Context, pod *api.Pod
|
|||||||
}
|
}
|
||||||
selector, err := metav1.LabelSelectorAsSelector(pdb.Spec.Selector)
|
selector, err := metav1.LabelSelectorAsSelector(pdb.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
|
// This object has an invalid selector, it does not match the pod
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
// If a PDB with a nil or empty selector creeps in, it should match nothing, not everything.
|
// If a PDB with a nil or empty selector creeps in, it should match nothing, not everything.
|
||||||
|
@ -125,7 +125,8 @@ func (f ReplicaSetLister) GetPodReplicaSets(pod *v1.Pod) (rss []*appsv1.ReplicaS
|
|||||||
}
|
}
|
||||||
selector, err = metav1.LabelSelectorAsSelector(rs.Spec.Selector)
|
selector, err = metav1.LabelSelectorAsSelector(rs.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return
|
// This object has an invalid selector, it does not match the pod
|
||||||
|
continue
|
||||||
}
|
}
|
||||||
|
|
||||||
if selector.Matches(labels.Set(pod.Labels)) {
|
if selector.Matches(labels.Set(pod.Labels)) {
|
||||||
@ -164,7 +165,8 @@ func (f StatefulSetLister) GetPodStatefulSets(pod *v1.Pod) (sss []*appsv1.Statef
|
|||||||
}
|
}
|
||||||
selector, err = metav1.LabelSelectorAsSelector(ss.Spec.Selector)
|
selector, err = metav1.LabelSelectorAsSelector(ss.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return
|
// This object has an invalid selector, it does not match the pod
|
||||||
|
continue
|
||||||
}
|
}
|
||||||
if selector.Matches(labels.Set(pod.Labels)) {
|
if selector.Matches(labels.Set(pod.Labels)) {
|
||||||
sss = append(sss, ss)
|
sss = append(sss, ss)
|
||||||
|
@ -277,6 +277,7 @@ func filterPodsWithPDBViolation(podInfos []*framework.PodInfo, pdbs []*policy.Po
|
|||||||
}
|
}
|
||||||
selector, err := metav1.LabelSelectorAsSelector(pdb.Spec.Selector)
|
selector, err := metav1.LabelSelectorAsSelector(pdb.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
|
// This object has an invalid selector, it does not match the pod
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
// A PDB with a nil or empty selector matches nothing.
|
// A PDB with a nil or empty selector matches nothing.
|
||||||
|
@ -990,7 +990,6 @@ func (b *volumeBinder) nodeHasAccess(node *v1.Node, capacity *storagev1beta1.CSI
|
|||||||
// Only matching by label is supported.
|
// Only matching by label is supported.
|
||||||
selector, err := metav1.LabelSelectorAsSelector(capacity.NodeTopology)
|
selector, err := metav1.LabelSelectorAsSelector(capacity.NodeTopology)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
// This should never happen because NodeTopology must be valid.
|
|
||||||
klog.ErrorS(err, "Unexpected error converting to a label selector", "nodeTopology", capacity.NodeTopology)
|
klog.ErrorS(err, "Unexpected error converting to a label selector", "nodeTopology", capacity.NodeTopology)
|
||||||
return false
|
return false
|
||||||
}
|
}
|
||||||
|
@ -60,8 +60,8 @@ func (s *daemonSetLister) GetPodDaemonSets(pod *v1.Pod) ([]*apps.DaemonSet, erro
|
|||||||
}
|
}
|
||||||
selector, err = metav1.LabelSelectorAsSelector(daemonSet.Spec.Selector)
|
selector, err = metav1.LabelSelectorAsSelector(daemonSet.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
// this should not happen if the DaemonSet passed validation
|
// This object has an invalid selector, it does not match the pod
|
||||||
return nil, err
|
continue
|
||||||
}
|
}
|
||||||
|
|
||||||
// If a daemonSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
// If a daemonSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
||||||
@ -96,7 +96,8 @@ func (s *daemonSetLister) GetHistoryDaemonSets(history *apps.ControllerRevision)
|
|||||||
for _, ds := range list {
|
for _, ds := range list {
|
||||||
selector, err := metav1.LabelSelectorAsSelector(ds.Spec.Selector)
|
selector, err := metav1.LabelSelectorAsSelector(ds.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("invalid label selector: %v", err)
|
// This object has an invalid selector, it does not match the history
|
||||||
|
continue
|
||||||
}
|
}
|
||||||
// If a DaemonSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
// If a DaemonSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
||||||
if selector.Empty() || !selector.Matches(labels.Set(history.Labels)) {
|
if selector.Empty() || !selector.Matches(labels.Set(history.Labels)) {
|
||||||
|
@ -55,7 +55,8 @@ func (s *replicaSetLister) GetPodReplicaSets(pod *v1.Pod) ([]*apps.ReplicaSet, e
|
|||||||
}
|
}
|
||||||
selector, err := metav1.LabelSelectorAsSelector(rs.Spec.Selector)
|
selector, err := metav1.LabelSelectorAsSelector(rs.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("invalid selector: %v", err)
|
// This object has an invalid selector, it does not match the pod
|
||||||
|
continue
|
||||||
}
|
}
|
||||||
|
|
||||||
// If a ReplicaSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
// If a ReplicaSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
||||||
|
@ -59,7 +59,8 @@ func (s *statefulSetLister) GetPodStatefulSets(pod *v1.Pod) ([]*apps.StatefulSet
|
|||||||
}
|
}
|
||||||
selector, err = metav1.LabelSelectorAsSelector(ps.Spec.Selector)
|
selector, err = metav1.LabelSelectorAsSelector(ps.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("invalid selector: %v", err)
|
// This object has an invalid selector, it does not match the pod
|
||||||
|
continue
|
||||||
}
|
}
|
||||||
|
|
||||||
// If a StatefulSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
// If a StatefulSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
||||||
|
@ -59,7 +59,8 @@ func (s *statefulSetLister) GetPodStatefulSets(pod *v1.Pod) ([]*apps.StatefulSet
|
|||||||
}
|
}
|
||||||
selector, err = metav1.LabelSelectorAsSelector(ps.Spec.Selector)
|
selector, err = metav1.LabelSelectorAsSelector(ps.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("invalid selector: %v", err)
|
// This object has an invalid selector, it does not match the pod
|
||||||
|
continue
|
||||||
}
|
}
|
||||||
|
|
||||||
// If a StatefulSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
// If a StatefulSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
||||||
|
@ -60,8 +60,8 @@ func (s *daemonSetLister) GetPodDaemonSets(pod *v1.Pod) ([]*apps.DaemonSet, erro
|
|||||||
}
|
}
|
||||||
selector, err = metav1.LabelSelectorAsSelector(daemonSet.Spec.Selector)
|
selector, err = metav1.LabelSelectorAsSelector(daemonSet.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
// this should not happen if the DaemonSet passed validation
|
// This object has an invalid selector, it does not match the pod
|
||||||
return nil, err
|
continue
|
||||||
}
|
}
|
||||||
|
|
||||||
// If a daemonSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
// If a daemonSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
||||||
@ -96,7 +96,8 @@ func (s *daemonSetLister) GetHistoryDaemonSets(history *apps.ControllerRevision)
|
|||||||
for _, ds := range list {
|
for _, ds := range list {
|
||||||
selector, err := metav1.LabelSelectorAsSelector(ds.Spec.Selector)
|
selector, err := metav1.LabelSelectorAsSelector(ds.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("invalid label selector: %v", err)
|
// This object has an invalid selector, it does not match the history object
|
||||||
|
continue
|
||||||
}
|
}
|
||||||
// If a DaemonSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
// If a DaemonSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
||||||
if selector.Empty() || !selector.Matches(labels.Set(history.Labels)) {
|
if selector.Empty() || !selector.Matches(labels.Set(history.Labels)) {
|
||||||
|
@ -55,7 +55,8 @@ func (s *replicaSetLister) GetPodReplicaSets(pod *v1.Pod) ([]*apps.ReplicaSet, e
|
|||||||
}
|
}
|
||||||
selector, err := metav1.LabelSelectorAsSelector(rs.Spec.Selector)
|
selector, err := metav1.LabelSelectorAsSelector(rs.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("invalid selector: %v", err)
|
// This object has an invalid selector, it does not match the pod
|
||||||
|
continue
|
||||||
}
|
}
|
||||||
|
|
||||||
// If a ReplicaSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
// If a ReplicaSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
||||||
|
@ -59,7 +59,8 @@ func (s *statefulSetLister) GetPodStatefulSets(pod *v1.Pod) ([]*apps.StatefulSet
|
|||||||
}
|
}
|
||||||
selector, err = metav1.LabelSelectorAsSelector(ps.Spec.Selector)
|
selector, err = metav1.LabelSelectorAsSelector(ps.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("invalid selector: %v", err)
|
// This object has an invalid selector, it does not match the pod
|
||||||
|
continue
|
||||||
}
|
}
|
||||||
|
|
||||||
// If a StatefulSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
// If a StatefulSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
||||||
|
@ -51,7 +51,11 @@ func (l *jobLister) GetPodJobs(pod *v1.Pod) (jobs []batch.Job, err error) {
|
|||||||
return
|
return
|
||||||
}
|
}
|
||||||
for _, job := range list {
|
for _, job := range list {
|
||||||
selector, _ := metav1.LabelSelectorAsSelector(job.Spec.Selector)
|
selector, err := metav1.LabelSelectorAsSelector(job.Spec.Selector)
|
||||||
|
if err != nil {
|
||||||
|
// This object has an invalid selector, it does not match the pod
|
||||||
|
continue
|
||||||
|
}
|
||||||
if !selector.Matches(labels.Set(pod.Labels)) {
|
if !selector.Matches(labels.Set(pod.Labels)) {
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
|
@ -61,8 +61,8 @@ func (s *daemonSetLister) GetPodDaemonSets(pod *v1.Pod) ([]*v1beta1.DaemonSet, e
|
|||||||
}
|
}
|
||||||
selector, err = metav1.LabelSelectorAsSelector(daemonSet.Spec.Selector)
|
selector, err = metav1.LabelSelectorAsSelector(daemonSet.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
// this should not happen if the DaemonSet passed validation
|
// This object has an invalid selector, it does not match the pod
|
||||||
return nil, err
|
continue
|
||||||
}
|
}
|
||||||
|
|
||||||
// If a daemonSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
// If a daemonSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
||||||
@ -97,7 +97,8 @@ func (s *daemonSetLister) GetHistoryDaemonSets(history *apps.ControllerRevision)
|
|||||||
for _, ds := range list {
|
for _, ds := range list {
|
||||||
selector, err := metav1.LabelSelectorAsSelector(ds.Spec.Selector)
|
selector, err := metav1.LabelSelectorAsSelector(ds.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("invalid label selector: %v", err)
|
// This object has an invalid selector, it does not match the history object
|
||||||
|
continue
|
||||||
}
|
}
|
||||||
// If a DaemonSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
// If a DaemonSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
||||||
if selector.Empty() || !selector.Matches(labels.Set(history.Labels)) {
|
if selector.Empty() || !selector.Matches(labels.Set(history.Labels)) {
|
||||||
|
@ -55,7 +55,8 @@ func (s *replicaSetLister) GetPodReplicaSets(pod *v1.Pod) ([]*extensions.Replica
|
|||||||
}
|
}
|
||||||
selector, err := metav1.LabelSelectorAsSelector(rs.Spec.Selector)
|
selector, err := metav1.LabelSelectorAsSelector(rs.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("invalid selector: %v", err)
|
// This object has an invalid selector, it does not match the pod
|
||||||
|
continue
|
||||||
}
|
}
|
||||||
|
|
||||||
// If a ReplicaSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
// If a ReplicaSet with a nil or empty selector creeps in, it should match nothing, not everything.
|
||||||
|
@ -23,7 +23,6 @@ import (
|
|||||||
policy "k8s.io/api/policy/v1"
|
policy "k8s.io/api/policy/v1"
|
||||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
"k8s.io/apimachinery/pkg/labels"
|
"k8s.io/apimachinery/pkg/labels"
|
||||||
"k8s.io/klog/v2"
|
|
||||||
)
|
)
|
||||||
|
|
||||||
// PodDisruptionBudgetListerExpansion allows custom methods to be added to
|
// PodDisruptionBudgetListerExpansion allows custom methods to be added to
|
||||||
@ -50,7 +49,7 @@ func (s *podDisruptionBudgetLister) GetPodPodDisruptionBudgets(pod *v1.Pod) ([]*
|
|||||||
pdb := list[i]
|
pdb := list[i]
|
||||||
selector, err = metav1.LabelSelectorAsSelector(pdb.Spec.Selector)
|
selector, err = metav1.LabelSelectorAsSelector(pdb.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
klog.Warningf("invalid selector: %v", err)
|
// This object has an invalid selector, it does not match the pod
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -23,7 +23,6 @@ import (
|
|||||||
policy "k8s.io/api/policy/v1beta1"
|
policy "k8s.io/api/policy/v1beta1"
|
||||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
"k8s.io/apimachinery/pkg/labels"
|
"k8s.io/apimachinery/pkg/labels"
|
||||||
"k8s.io/klog/v2"
|
|
||||||
)
|
)
|
||||||
|
|
||||||
// PodDisruptionBudgetListerExpansion allows custom methods to be added to
|
// PodDisruptionBudgetListerExpansion allows custom methods to be added to
|
||||||
@ -50,8 +49,7 @@ func (s *podDisruptionBudgetLister) GetPodPodDisruptionBudgets(pod *v1.Pod) ([]*
|
|||||||
pdb := list[i]
|
pdb := list[i]
|
||||||
selector, err = metav1.LabelSelectorAsSelector(pdb.Spec.Selector)
|
selector, err = metav1.LabelSelectorAsSelector(pdb.Spec.Selector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
klog.Warningf("invalid selector: %v", err)
|
// This object has an invalid selector, it does not match the pod
|
||||||
// TODO(mml): add an event to the PDB
|
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user