github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-21 19:01:49 +00:00
Code Issues Projects Releases Wiki Activity

only use managedFields decoding for admission check

Browse Source
This commit is contained in:
Kevin Wiesmueller 2021-03-01 20:29:15 +01:00
parent 470ad03d07
commit 98d498117b
3 changed files with 15 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
staging/src/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/admission.go
View File

@ -67,7 +67,7 @@ func (admit *managedFieldsValidatingAdmissionController) Admit(ctx context.Conte
return err
}
managedFieldsAfterAdmission := objectMeta.GetManagedFields()
if err := ValidateManagedFields(managedFieldsAfterAdmission); err != nil {
if _, err := DecodeManagedFields(managedFieldsAfterAdmission); err != nil {
objectMeta.SetManagedFields(managedFieldsBeforeAdmission)
warning.AddWarning(ctx, "",
fmt.Sprintf(InvalidManagedFieldsAfterMutatingAdmissionWarningFormat,

38
staging/src/k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/validation.go
View File

@ -1,38 +0,0 @@
/*
Copyright 2021 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package fieldmanager
import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
v1validation "k8s.io/apimachinery/pkg/apis/meta/v1/validation"
"k8s.io/apimachinery/pkg/util/validation/field"
)
// ValidateManagedFields by checking the integrity of every entry and trying to decode
// them to the internal format
func ValidateManagedFields(managedFields []metav1.ManagedFieldsEntry) error {
validationErrs := v1validation.ValidateManagedFields(managedFields, field.NewPath("metadata").Child("managedFields"))
if len(validationErrs) > 0 {
return validationErrs.ToAggregate()
}
if _, err := DecodeManagedFields(managedFields); err != nil {
return err
}
return nil
}

16
test/integration/apiserver/admissionwebhook/invalid_managedFields_test.go
View File

@ -34,7 +34,9 @@ import (
admissionv1 "k8s.io/api/admissionregistration/v1"
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
v1validation "k8s.io/apimachinery/pkg/apis/meta/v1/validation"
"k8s.io/apimachinery/pkg/types"
"k8s.io/apimachinery/pkg/util/validation/field"
"k8s.io/apimachinery/pkg/util/wait"
"k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager"
clientset "k8s.io/client-go/kubernetes"
@ -127,7 +129,7 @@ func TestMutatingWebhookResetsInvalidManagedFields(t *testing.T) {
if err != nil {
return false, err
}
if err := fieldmanager.ValidateManagedFields(pod.ManagedFields); err != nil {
if err := validateManagedFieldsAndDecode(pod.ManagedFields); err != nil {
lastErr = err
return false, nil
}
@ -152,7 +154,7 @@ func TestMutatingWebhookResetsInvalidManagedFields(t *testing.T) {
if err != nil {
t.Fatal(err)
}
if err := fieldmanager.ValidateManagedFields(pod.ManagedFields); err != nil {
if err := validateManagedFieldsAndDecode(pod.ManagedFields); err != nil {
t.Error(err)
}
if warningWriter.WarningCount() != 2 {
@ -164,6 +166,16 @@ func TestMutatingWebhookResetsInvalidManagedFields(t *testing.T) {
}
}
// validate against both decoding and validation to make sure we use the hardest rule between the both to reset
// with decoding being as strict as it gets, only using it should be enough in admission
func validateManagedFieldsAndDecode(managedFields []metav1.ManagedFieldsEntry) error {
if _, err := fieldmanager.DecodeManagedFields(managedFields); err != nil {
return err
}
validationErrs := v1validation.ValidateManagedFields(managedFields, field.NewPath("metadata").Child("managedFields"))
return validationErrs.ToAggregate()
}
func newInvalidManagedFieldsWebhookHandler(t *testing.T) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
defer r.Body.Close()