diff --git a/pkg/apis/apps/validation/validation.go b/pkg/apis/apps/validation/validation.go index 4699e85b98f..ab68809bf0f 100644 --- a/pkg/apis/apps/validation/validation.go +++ b/pkg/apis/apps/validation/validation.go @@ -146,21 +146,15 @@ func ValidateStatefulSet(statefulSet *apps.StatefulSet, opts apivalidation.PodVa func ValidateStatefulSetUpdate(statefulSet, oldStatefulSet *apps.StatefulSet) field.ErrorList { allErrs := apivalidation.ValidateObjectMetaUpdate(&statefulSet.ObjectMeta, &oldStatefulSet.ObjectMeta, field.NewPath("metadata")) - restoreReplicas := statefulSet.Spec.Replicas - statefulSet.Spec.Replicas = oldStatefulSet.Spec.Replicas - - restoreTemplate := statefulSet.Spec.Template - statefulSet.Spec.Template = oldStatefulSet.Spec.Template - - restoreStrategy := statefulSet.Spec.UpdateStrategy - statefulSet.Spec.UpdateStrategy = oldStatefulSet.Spec.UpdateStrategy - - if !apiequality.Semantic.DeepEqual(statefulSet.Spec, oldStatefulSet.Spec) { + // statefulset updates aren't super common and general updates are likely to be touching spec, so we'll do this + // deep copy right away. This avoids mutating our inputs + newStatefulSetClone := statefulSet.DeepCopy() + newStatefulSetClone.Spec.Replicas = oldStatefulSet.Spec.Replicas // +k8s:verify-mutation:reason=clone + newStatefulSetClone.Spec.Template = oldStatefulSet.Spec.Template // +k8s:verify-mutation:reason=clone + newStatefulSetClone.Spec.UpdateStrategy = oldStatefulSet.Spec.UpdateStrategy // +k8s:verify-mutation:reason=clone + if !apiequality.Semantic.DeepEqual(newStatefulSetClone.Spec, oldStatefulSet.Spec) { allErrs = append(allErrs, field.Forbidden(field.NewPath("spec"), "updates to statefulset spec for fields other than 'replicas', 'template', and 'updateStrategy' are forbidden")) } - statefulSet.Spec.Replicas = restoreReplicas - statefulSet.Spec.Template = restoreTemplate - statefulSet.Spec.UpdateStrategy = restoreStrategy allErrs = append(allErrs, apivalidation.ValidateNonnegativeField(int64(statefulSet.Spec.Replicas), field.NewPath("spec", "replicas"))...) return allErrs