From 991f2d727a0d9d6f1ffb8893550dc469c4b60cd7 Mon Sep 17 00:00:00 2001 From: ndixita Date: Thu, 19 Mar 2026 06:32:14 +0000 Subject: [PATCH] Use DeepCopy in GetLimits to avoid returning direct references to resource quantities, ensuring that changes to the returned ResourceList do not affect the original spec --- pkg/kubelet/util/util.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/kubelet/util/util.go b/pkg/kubelet/util/util.go index 8aa025abe31..9039797b18e 100644 --- a/pkg/kubelet/util/util.go +++ b/pkg/kubelet/util/util.go @@ -84,7 +84,7 @@ func GetLimits(res *ResourceOpts) v1.ResourceList { if containerResources == nil || containerResources.Limits == nil { return v1.ResourceList{} } - return containerResources.Limits + return containerResources.Limits.DeepCopy() } containerLimits := limitsOrEmpty(res.ContainerResources) @@ -99,13 +99,13 @@ func GetLimits(res *ResourceOpts) v1.ResourceList { // When container-level CPU limit is not set, the pod-level // limit CPU is applied at container-level if containerLimits.Cpu().IsZero() && !podLevelLimits.Cpu().IsZero() { - containerLimits[v1.ResourceCPU] = podLevelLimits[v1.ResourceCPU] + containerLimits[v1.ResourceCPU] = podLevelLimits[v1.ResourceCPU].DeepCopy() } // When container-level Memory limit is not set, the pod-level // limit Memory is applied at container-level if containerLimits.Memory().IsZero() && !podLevelLimits.Memory().IsZero() { - containerLimits[v1.ResourceMemory] = podLevelLimits[v1.ResourceMemory] + containerLimits[v1.ResourceMemory] = podLevelLimits[v1.ResourceMemory].DeepCopy() } return containerLimits }