github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-07-17 11:28:58 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #137053 from danwinship/kep-4858-beta

Browse Source 
KEP-4858: update StrictIPCIDRValidation to Beta
This commit is contained in:
Kubernetes Prow Robot
2026-02-28 00:49:30 +05:30
committed by GitHub
parent cf876463cd 08ee348b47
commit d63c9049c3
8 changed files with 30 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/api/pod/warnings_test.go
View File

@@ -1828,8 +1828,8 @@ func TestWarnings(t *testing.T) {
},
}},
expected: []string{
`spec.dnsConfig.nameservers[1]: non-standard IP address "05.06.07.08" will be considered invalid in a future Kubernetes release: use "5.6.7.8"`,
`spec.hostAliases[0].ip: non-standard IP address "::ffff:1.2.3.4" will be considered invalid in a future Kubernetes release: use "1.2.3.4"`,
`spec.dnsConfig.nameservers[1]: non-standard IP address "05.06.07.08" is invalid: use "5.6.7.8"`,
`spec.hostAliases[0].ip: non-standard IP address "::ffff:1.2.3.4" is invalid: use "1.2.3.4"`,
},
},
}

18
pkg/api/service/warnings_test.go
View File

@@ -166,21 +166,21 @@ func TestGetWarningsForServiceClusterIPs(t *testing.T) {
name: "IPv4 with leading zeros",
service: service([]string{"192.012.2.2"}),
want: []string{
`spec.clusterIPs[0]: non-standard IP address "192.012.2.2" will be considered invalid in a future Kubernetes release: use "192.12.2.2"`,
`spec.clusterIPs[0]: non-standard IP address "192.012.2.2" is invalid: use "192.12.2.2"`,
},
},
{
name: "Dual Stack IPv4-IPv6 and IPv4 with leading zeros",
service: service([]string{"192.012.2.2", "2001:db8::2"}),
want: []string{
`spec.clusterIPs[0]: non-standard IP address "192.012.2.2" will be considered invalid in a future Kubernetes release: use "192.12.2.2"`,
`spec.clusterIPs[0]: non-standard IP address "192.012.2.2" is invalid: use "192.12.2.2"`,
},
},
{
name: "Dual Stack IPv6-IPv4 and IPv4 with leading zeros",
service: service([]string{"2001:db8::2", "192.012.2.2"}),
want: []string{
`spec.clusterIPs[1]: non-standard IP address "192.012.2.2" will be considered invalid in a future Kubernetes release: use "192.12.2.2"`,
`spec.clusterIPs[1]: non-standard IP address "192.012.2.2" is invalid: use "192.12.2.2"`,
},
},
{
@@ -208,7 +208,7 @@ func TestGetWarningsForServiceClusterIPs(t *testing.T) {
name: "Dual Stack IPv4-IPv6 and IPv4 with leading zeros and IPv6 non-canonical format",
service: service([]string{"192.012.2.2", "2001:db8:0:0::2"}),
want: []string{
`spec.clusterIPs[0]: non-standard IP address "192.012.2.2" will be considered invalid in a future Kubernetes release: use "192.12.2.2"`,
`spec.clusterIPs[0]: non-standard IP address "192.012.2.2" is invalid: use "192.12.2.2"`,
`spec.clusterIPs[1]: IPv6 address "2001:db8:0:0::2" should be in RFC 5952 canonical format ("2001:db8::2")`,
},
},
@@ -217,7 +217,7 @@ func TestGetWarningsForServiceClusterIPs(t *testing.T) {
service: service([]string{"2001:db8:0:0::2", "192.012.2.2"}),
want: []string{
`spec.clusterIPs[0]: IPv6 address "2001:db8:0:0::2" should be in RFC 5952 canonical format ("2001:db8::2")`,
`spec.clusterIPs[1]: non-standard IP address "192.012.2.2" will be considered invalid in a future Kubernetes release: use "192.12.2.2"`,
`spec.clusterIPs[1]: non-standard IP address "192.012.2.2" is invalid: use "192.12.2.2"`,
},
},
{
@@ -238,12 +238,12 @@ func TestGetWarningsForServiceClusterIPs(t *testing.T) {
},
want: []string{
`spec.clusterIPs[0]: IPv6 address "2001:db8:0:0::2" should be in RFC 5952 canonical format ("2001:db8::2")`,
`spec.clusterIPs[1]: non-standard IP address "192.012.2.2" will be considered invalid in a future Kubernetes release: use "192.12.2.2"`,
`spec.clusterIPs[1]: non-standard IP address "192.012.2.2" is invalid: use "192.12.2.2"`,
`spec.externalIPs[0]: IPv6 address "2001:db8:1:0::2" should be in RFC 5952 canonical format ("2001:db8:1::2")`,
`spec.externalIPs[1]: non-standard IP address "10.012.2.2" will be considered invalid in a future Kubernetes release: use "10.12.2.2"`,
`spec.loadBalancerIP: non-standard IP address "10.001.1.1" will be considered invalid in a future Kubernetes release: use "10.1.1.1"`,
`spec.externalIPs[1]: non-standard IP address "10.012.2.2" is invalid: use "10.12.2.2"`,
`spec.loadBalancerIP: non-standard IP address "10.001.1.1" is invalid: use "10.1.1.1"`,
`spec.loadBalancerSourceRanges[0]: IPv6 CIDR value "2001:db8:1:0::/64" should be in RFC 5952 canonical format ("2001:db8:1::/64")`,
`spec.loadBalancerSourceRanges[1]: non-standard CIDR value "10.012.2.0/24" will be considered invalid in a future Kubernetes release: use "10.12.2.0/24"`,
`spec.loadBalancerSourceRanges[1]: non-standard CIDR value "10.012.2.0/24" is invalid: use "10.12.2.0/24"`,
},
},
}

1
pkg/features/kube_features.go
View File

@@ -1834,6 +1834,7 @@ var defaultVersionedKubernetesFeatureGates = map[featuregate.Feature]featuregate
StrictIPCIDRValidation: {
{Version: version.MustParse("1.33"), Default: false, PreRelease: featuregate.Alpha},
{Version: version.MustParse("1.36"), Default: true, PreRelease: featuregate.Beta},
},
SupplementalGroupsPolicy: {

4
staging/src/k8s.io/apimachinery/pkg/util/validation/ip.go
View File

@@ -115,7 +115,7 @@ func GetWarningsForIP(fldPath *field.Path, value string) []string {
// ParseAddr() doesn't) or IPv4-mapped IPv6 (.Is4In6()). Either way,
// re-stringifying the net.IP value will give the preferred form.
return []string{
fmt.Sprintf("%s: non-standard IP address %q will be considered invalid in a future Kubernetes release: use %q", fldPath, value, ip.String()),
fmt.Sprintf("%s: non-standard IP address %q is invalid: use %q", fldPath, value, ip.String()),
}
}
@@ -233,7 +233,7 @@ func GetWarningsForCIDR(fldPath *field.Path, value string) []string {
// ParsePrefix() doesn't) or IPv4-mapped IPv6 (.Is4In6()). Either way,
// re-stringifying the net.IPNet value will give the preferred form.
warnings = append(warnings,
fmt.Sprintf("%s: non-standard CIDR value %q will be considered invalid in a future Kubernetes release: use %q", fldPath, value, ipnet.String()),
fmt.Sprintf("%s: non-standard CIDR value %q is invalid: use %q", fldPath, value, ipnet.String()),
)
}

12
staging/src/k8s.io/apimachinery/pkg/util/validation/ip_test.go
View File

@@ -284,7 +284,7 @@ func TestGetWarningsForIP(t *testing.T) {
address: "192.012.2.2",
fieldPath: field.NewPath("spec").Child("clusterIPs").Index(0),
want: []string{
`spec.clusterIPs[0]: non-standard IP address "192.012.2.2" will be considered invalid in a future Kubernetes release: use "192.12.2.2"`,
`spec.clusterIPs[0]: non-standard IP address "192.012.2.2" is invalid: use "192.12.2.2"`,
},
},
{
@@ -292,7 +292,7 @@ func TestGetWarningsForIP(t *testing.T) {
address: "::ffff:192.12.2.2",
fieldPath: field.NewPath("spec").Child("clusterIPs").Index(0),
want: []string{
`spec.clusterIPs[0]: non-standard IP address "::ffff:192.12.2.2" will be considered invalid in a future Kubernetes release: use "192.12.2.2"`,
`spec.clusterIPs[0]: non-standard IP address "::ffff:192.12.2.2" is invalid: use "192.12.2.2"`,
},
},
{
@@ -551,7 +551,7 @@ func TestGetWarningsForCIDR(t *testing.T) {
cidr: "192.012.2.0/24",
fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
want: []string{
`spec.loadBalancerSourceRanges[0]: non-standard CIDR value "192.012.2.0/24" will be considered invalid in a future Kubernetes release: use "192.12.2.0/24"`,
`spec.loadBalancerSourceRanges[0]: non-standard CIDR value "192.012.2.0/24" is invalid: use "192.12.2.0/24"`,
},
},
{
@@ -559,7 +559,7 @@ func TestGetWarningsForCIDR(t *testing.T) {
cidr: "192.12.2.0/024",
fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
want: []string{
`spec.loadBalancerSourceRanges[0]: non-standard CIDR value "192.12.2.0/024" will be considered invalid in a future Kubernetes release: use "192.12.2.0/24"`,
`spec.loadBalancerSourceRanges[0]: non-standard CIDR value "192.12.2.0/024" is invalid: use "192.12.2.0/24"`,
},
},
{
@@ -567,7 +567,7 @@ func TestGetWarningsForCIDR(t *testing.T) {
cidr: "::ffff:192.12.2.0/120",
fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
want: []string{
`spec.loadBalancerSourceRanges[0]: non-standard CIDR value "::ffff:192.12.2.0/120" will be considered invalid in a future Kubernetes release: use "192.12.2.0/24"`,
`spec.loadBalancerSourceRanges[0]: non-standard CIDR value "::ffff:192.12.2.0/120" is invalid: use "192.12.2.0/24"`,
},
},
{
@@ -584,7 +584,7 @@ func TestGetWarningsForCIDR(t *testing.T) {
fieldPath: field.NewPath("spec").Child("loadBalancerSourceRanges").Index(0),
want: []string{
`spec.loadBalancerSourceRanges[0]: CIDR value "192.012.2.8/24" is ambiguous in this context (should be "192.12.2.0/24" or "192.12.2.8/32"?)`,
`spec.loadBalancerSourceRanges[0]: non-standard CIDR value "192.012.2.8/24" will be considered invalid in a future Kubernetes release: use "192.12.2.0/24"`,
`spec.loadBalancerSourceRanges[0]: non-standard CIDR value "192.012.2.8/24" is invalid: use "192.12.2.0/24"`,
},
},
{

2
test/compatibility_lifecycle/reference/feature_list.md
View File

@@ -189,7 +189,7 @@
| StorageVersionMigrator | | | 1.30–1.34 | 1.35– | | | | [code](https://cs.k8s.io/?q=%5CbStorageVersionMigrator%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbStorageVersionMigrator%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) |
| StreamingCollectionEncodingToJSON | :ballot_box_with_check: 1.33+ | :closed_lock_with_key: 1.34+ | | 1.33 | 1.34– | | | [code](https://cs.k8s.io/?q=%5CbStreamingCollectionEncodingToJSON%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbStreamingCollectionEncodingToJSON%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) |
| StreamingCollectionEncodingToProtobuf | :ballot_box_with_check: 1.33+ | :closed_lock_with_key: 1.34+ | | 1.33 | 1.34– | | | [code](https://cs.k8s.io/?q=%5CbStreamingCollectionEncodingToProtobuf%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbStreamingCollectionEncodingToProtobuf%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) |
| StrictIPCIDRValidation | | | 1.33– | | | | | [code](https://cs.k8s.io/?q=%5CbStrictIPCIDRValidation%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbStrictIPCIDRValidation%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) |
| StrictIPCIDRValidation | :ballot_box_with_check: 1.36+ | | 1.33–1.35 | 1.36– | | | | [code](https://cs.k8s.io/?q=%5CbStrictIPCIDRValidation%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbStrictIPCIDRValidation%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) |
| StructuredAuthenticationConfiguration | :ballot_box_with_check: 1.30+ | :closed_lock_with_key: 1.34+ | 1.29 | 1.30–1.33 | 1.34– | | | [code](https://cs.k8s.io/?q=%5CbStructuredAuthenticationConfiguration%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbStructuredAuthenticationConfiguration%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) |
| StructuredAuthenticationConfigurationEgressSelector | :ballot_box_with_check: 1.34+ | | | 1.34– | | | StructuredAuthenticationConfiguration | [code](https://cs.k8s.io/?q=%5CbStructuredAuthenticationConfigurationEgressSelector%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbStructuredAuthenticationConfigurationEgressSelector%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) |
| StructuredAuthenticationConfigurationJWKSMetrics | :ballot_box_with_check: 1.35+ | | | 1.35– | | | StructuredAuthenticationConfiguration | [code](https://cs.k8s.io/?q=%5CbStructuredAuthenticationConfigurationJWKSMetrics%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/kubernetes) [KEPs](https://cs.k8s.io/?q=%5CbStructuredAuthenticationConfigurationJWKSMetrics%5Cb&i=nope&files=&excludeFiles=CHANGELOG&repos=kubernetes/enhancements) |

4
test/compatibility_lifecycle/reference/versioned_feature_list.yaml
View File

@@ -1817,6 +1817,10 @@
lockToDefault: false
preRelease: Alpha
version: "1.33"
- default: true
lockToDefault: false
preRelease: Beta
version: "1.36"
- name: StructuredAuthenticationConfiguration
versionedSpecs:
- default: false

5
test/integration/apiserver/cve_2021_29923_test.go
View File

@@ -24,9 +24,12 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
"k8s.io/apimachinery/pkg/runtime/schema"
utilfeature "k8s.io/apiserver/pkg/util/feature"
"k8s.io/client-go/dynamic"
clientset "k8s.io/client-go/kubernetes"
featuregatetesting "k8s.io/component-base/featuregate/testing"
kubeapiservertesting "k8s.io/kubernetes/cmd/kube-apiserver/app/testing"
"k8s.io/kubernetes/pkg/features"
"k8s.io/kubernetes/test/integration/framework"
)
@@ -38,6 +41,8 @@ func gvr(g, v, r string) schema.GroupVersionResource {
// Is it possible that exist more fields that can contain IPs, the test consider the most significative.
// xref: https://issues.k8s.io/100895
func TestCanaryCVE_2021_29923(t *testing.T) {
featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.StrictIPCIDRValidation, false)
// Disable ServiceAccount admission plugin as we don't have serviceaccount controller running.
server := kubeapiservertesting.StartTestServerOrDie(t, nil, framework.DefaultTestServerFlags(), framework.SharedEtcd())
defer server.TearDownFn()