From c60fe4fb7623e7c20696d7093c11a09d5c86987a Mon Sep 17 00:00:00 2001 From: jennybuckley Date: Fri, 29 Jun 2018 11:28:19 -0700 Subject: [PATCH] Propagate forceAllowCreate as false to all subresources --- pkg/registry/apps/daemonset/storage/storage.go | 4 +++- pkg/registry/apps/deployment/storage/storage.go | 4 +++- pkg/registry/apps/replicaset/storage/storage.go | 4 +++- pkg/registry/apps/statefulset/storage/storage.go | 4 +++- .../horizontalpodautoscaler/storage/storage.go | 4 +++- pkg/registry/batch/cronjob/storage/storage.go | 4 +++- pkg/registry/batch/job/storage/storage.go | 4 +++- pkg/registry/certificates/certificates/storage/storage.go | 8 ++++++-- pkg/registry/core/namespace/storage/storage.go | 8 ++++++-- pkg/registry/core/node/storage/storage.go | 4 +++- pkg/registry/core/persistentvolume/storage/storage.go | 4 +++- .../core/persistentvolumeclaim/storage/storage.go | 4 +++- pkg/registry/core/pod/storage/storage.go | 4 +++- .../core/replicationcontroller/storage/storage.go | 4 +++- pkg/registry/core/resourcequota/storage/storage.go | 4 +++- pkg/registry/core/service/storage/storage.go | 4 +++- pkg/registry/extensions/ingress/storage/storage.go | 4 +++- .../policy/poddisruptionbudget/storage/storage.go | 4 +++- .../pkg/registry/customresource/etcd.go | 4 +++- .../pkg/registry/customresourcedefinition/etcd.go | 4 +++- .../kube-aggregator/pkg/registry/apiservice/etcd/etcd.go | 4 +++- 21 files changed, 69 insertions(+), 23 deletions(-) diff --git a/pkg/registry/apps/daemonset/storage/storage.go b/pkg/registry/apps/daemonset/storage/storage.go index 23134c317bd..2b02d9f80e3 100644 --- a/pkg/registry/apps/daemonset/storage/storage.go +++ b/pkg/registry/apps/daemonset/storage/storage.go @@ -97,5 +97,7 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } diff --git a/pkg/registry/apps/deployment/storage/storage.go b/pkg/registry/apps/deployment/storage/storage.go index e821bfa31a5..141ff758013 100644 --- a/pkg/registry/apps/deployment/storage/storage.go +++ b/pkg/registry/apps/deployment/storage/storage.go @@ -130,7 +130,9 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } // RollbackREST implements the REST endpoint for initiating the rollback of a deployment diff --git a/pkg/registry/apps/replicaset/storage/storage.go b/pkg/registry/apps/replicaset/storage/storage.go index 90b80f67cd7..4b4a755c2a1 100644 --- a/pkg/registry/apps/replicaset/storage/storage.go +++ b/pkg/registry/apps/replicaset/storage/storage.go @@ -127,7 +127,9 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } type ScaleREST struct { diff --git a/pkg/registry/apps/statefulset/storage/storage.go b/pkg/registry/apps/statefulset/storage/storage.go index dc8c0024d27..904509b3db0 100644 --- a/pkg/registry/apps/statefulset/storage/storage.go +++ b/pkg/registry/apps/statefulset/storage/storage.go @@ -110,7 +110,9 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } // Implement ShortNamesProvider diff --git a/pkg/registry/autoscaling/horizontalpodautoscaler/storage/storage.go b/pkg/registry/autoscaling/horizontalpodautoscaler/storage/storage.go index dcca5fda139..4692396a058 100644 --- a/pkg/registry/autoscaling/horizontalpodautoscaler/storage/storage.go +++ b/pkg/registry/autoscaling/horizontalpodautoscaler/storage/storage.go @@ -90,5 +90,7 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } diff --git a/pkg/registry/batch/cronjob/storage/storage.go b/pkg/registry/batch/cronjob/storage/storage.go index 52fb5693264..d1932cbf193 100644 --- a/pkg/registry/batch/cronjob/storage/storage.go +++ b/pkg/registry/batch/cronjob/storage/storage.go @@ -89,5 +89,7 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } diff --git a/pkg/registry/batch/job/storage/storage.go b/pkg/registry/batch/job/storage/storage.go index 23d7f093296..8f9da6e24ef 100644 --- a/pkg/registry/batch/job/storage/storage.go +++ b/pkg/registry/batch/job/storage/storage.go @@ -100,5 +100,7 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } diff --git a/pkg/registry/certificates/certificates/storage/storage.go b/pkg/registry/certificates/certificates/storage/storage.go index 604b2e2473d..deeeb4ac764 100644 --- a/pkg/registry/certificates/certificates/storage/storage.go +++ b/pkg/registry/certificates/certificates/storage/storage.go @@ -91,7 +91,9 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } var _ = rest.Patcher(&StatusREST{}) @@ -107,5 +109,7 @@ func (r *ApprovalREST) New() runtime.Object { // Update alters the approval subset of an object. func (r *ApprovalREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } diff --git a/pkg/registry/core/namespace/storage/storage.go b/pkg/registry/core/namespace/storage/storage.go index e7643ef65fc..bdf601bbc02 100644 --- a/pkg/registry/core/namespace/storage/storage.go +++ b/pkg/registry/core/namespace/storage/storage.go @@ -235,7 +235,9 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } func (r *FinalizeREST) New() runtime.Object { @@ -244,5 +246,7 @@ func (r *FinalizeREST) New() runtime.Object { // Update alters the status finalizers subset of an object. func (r *FinalizeREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } diff --git a/pkg/registry/core/node/storage/storage.go b/pkg/registry/core/node/storage/storage.go index 51c4079c6c1..0269ccb30cd 100644 --- a/pkg/registry/core/node/storage/storage.go +++ b/pkg/registry/core/node/storage/storage.go @@ -70,7 +70,9 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } // NewStorage returns a NodeStorage object that will work against nodes. diff --git a/pkg/registry/core/persistentvolume/storage/storage.go b/pkg/registry/core/persistentvolume/storage/storage.go index 686837f810f..17a133afc15 100644 --- a/pkg/registry/core/persistentvolume/storage/storage.go +++ b/pkg/registry/core/persistentvolume/storage/storage.go @@ -85,5 +85,7 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } diff --git a/pkg/registry/core/persistentvolumeclaim/storage/storage.go b/pkg/registry/core/persistentvolumeclaim/storage/storage.go index f62972aa885..d4c0b54e29f 100644 --- a/pkg/registry/core/persistentvolumeclaim/storage/storage.go +++ b/pkg/registry/core/persistentvolumeclaim/storage/storage.go @@ -85,5 +85,7 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } diff --git a/pkg/registry/core/pod/storage/storage.go b/pkg/registry/core/pod/storage/storage.go index 27ee6573c44..aecefb6cad2 100644 --- a/pkg/registry/core/pod/storage/storage.go +++ b/pkg/registry/core/pod/storage/storage.go @@ -218,5 +218,7 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } diff --git a/pkg/registry/core/replicationcontroller/storage/storage.go b/pkg/registry/core/replicationcontroller/storage/storage.go index 7ec2d82bfcc..016d93a7c96 100644 --- a/pkg/registry/core/replicationcontroller/storage/storage.go +++ b/pkg/registry/core/replicationcontroller/storage/storage.go @@ -120,7 +120,9 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } type ScaleREST struct { diff --git a/pkg/registry/core/resourcequota/storage/storage.go b/pkg/registry/core/resourcequota/storage/storage.go index 3200047b28b..39821022d8f 100644 --- a/pkg/registry/core/resourcequota/storage/storage.go +++ b/pkg/registry/core/resourcequota/storage/storage.go @@ -79,5 +79,7 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } diff --git a/pkg/registry/core/service/storage/storage.go b/pkg/registry/core/service/storage/storage.go index cc8e03c201c..2a2c8558fc9 100644 --- a/pkg/registry/core/service/storage/storage.go +++ b/pkg/registry/core/service/storage/storage.go @@ -91,5 +91,7 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } diff --git a/pkg/registry/extensions/ingress/storage/storage.go b/pkg/registry/extensions/ingress/storage/storage.go index 80dbf95d049..d64d2cd5889 100644 --- a/pkg/registry/extensions/ingress/storage/storage.go +++ b/pkg/registry/extensions/ingress/storage/storage.go @@ -83,5 +83,7 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } diff --git a/pkg/registry/policy/poddisruptionbudget/storage/storage.go b/pkg/registry/policy/poddisruptionbudget/storage/storage.go index c34cad8e5a1..19cb9b3d2fc 100644 --- a/pkg/registry/policy/poddisruptionbudget/storage/storage.go +++ b/pkg/registry/policy/poddisruptionbudget/storage/storage.go @@ -80,5 +80,7 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } diff --git a/staging/src/k8s.io/apiextensions-apiserver/pkg/registry/customresource/etcd.go b/staging/src/k8s.io/apiextensions-apiserver/pkg/registry/customresource/etcd.go index 5e7ae583a53..4c0dd4da570 100644 --- a/staging/src/k8s.io/apiextensions-apiserver/pkg/registry/customresource/etcd.go +++ b/staging/src/k8s.io/apiextensions-apiserver/pkg/registry/customresource/etcd.go @@ -183,7 +183,9 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } type ScaleREST struct { diff --git a/staging/src/k8s.io/apiextensions-apiserver/pkg/registry/customresourcedefinition/etcd.go b/staging/src/k8s.io/apiextensions-apiserver/pkg/registry/customresourcedefinition/etcd.go index e7de9defdd4..194647e23d3 100644 --- a/staging/src/k8s.io/apiextensions-apiserver/pkg/registry/customresourcedefinition/etcd.go +++ b/staging/src/k8s.io/apiextensions-apiserver/pkg/registry/customresourcedefinition/etcd.go @@ -173,5 +173,7 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) } diff --git a/staging/src/k8s.io/kube-aggregator/pkg/registry/apiservice/etcd/etcd.go b/staging/src/k8s.io/kube-aggregator/pkg/registry/apiservice/etcd/etcd.go index 2e10bd44d25..98afe4e1e68 100644 --- a/staging/src/k8s.io/kube-aggregator/pkg/registry/apiservice/etcd/etcd.go +++ b/staging/src/k8s.io/kube-aggregator/pkg/registry/apiservice/etcd/etcd.go @@ -80,5 +80,7 @@ func (r *StatusREST) Get(ctx context.Context, name string, options *metav1.GetOp // Update alters the status subset of an object. func (r *StatusREST) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool) (runtime.Object, bool, error) { - return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, forceAllowCreate) + // We are explicitly setting forceAllowCreate to false in the call to the underlying storage because + // subresources should never allow create on update. + return r.store.Update(ctx, name, objInfo, createValidation, updateValidation, false) }