From 98276e88eabb6d9bc6b330599280a1bc932b77b3 Mon Sep 17 00:00:00 2001 From: Ricardo Maraschini Date: Tue, 18 Nov 2025 15:21:36 +0100 Subject: [PATCH] cbor: bump limits with the current established limits we can see the following error: ``` failed to list : unable to determine group/version/kind: cbor: exceeded max number of elements 1024 for CBOR array. ``` --- .../serializer/cbor/internal/modes/decode.go | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/staging/src/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode.go b/staging/src/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode.go index 0210132ffaf..4a7055c10fd 100644 --- a/staging/src/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode.go +++ b/staging/src/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/decode.go @@ -58,12 +58,18 @@ var decode cbor.DecMode = func() cbor.DecMode { // with or without tagging. If a tag number is present, it must be valid. TimeTag: cbor.DecTagOptional, - // Observed depth up to 16 in fuzzed batch/v1 CronJobList. JSON implementation limit - // is 10000. - MaxNestedLevels: 64, + // MaxNestedLevels is set to the same value used in the JSON implementation. + MaxNestedLevels: 10000, - MaxArrayElements: 1024, - MaxMapPairs: 1024, + // MaxArrayElements is set to the maximum allowed by the cbor library. We rely on + // the library initial wellformedness scan and on the api max request limit to + // prevent preallocating very large slices during decoding. + MaxArrayElements: 2147483647, + + // MaxMapPairs specifies the maximum number of key-value pairs allowed in a map. + // We selected this value as it is large enough so that in practice the API server + // decoder will always hit the request body limit before the limit here is reached. + MaxMapPairs: 2097152, // Indefinite-length sequences aren't produced by this serializer, but other // implementations can.