The validation code generator was failing to propagate the
StabilityLevel from the parent context when evaluating composite tags
like `+k8s:item`, `+k8s:each`, and `+k8s:subfield`. As a result, inner
validations like `+k8s:zeroOrOneOfMember` combined with `+k8s:alpha`
were not emitting `.MarkAlpha()` in the generated code.
This fix ensures the `StabilityLevel` is copied to the `subContext`
during evaluation, and adds a test case for list items using
`+k8s:alpha=+k8s:item(...)=+k8s:zeroOrOneOfMember`.
Generated code is updated accordingly.
- Register v1 MutatingAdmissionPolicy and Binding in apiserver storage.
- Add defaults and validation for v1 types.
- Update storage version hash data.
- Add API testdata.
Mark Workload v1alpha1 validations as +k8s:alpha(since:"1.35") and
configure the registry strategy to use WithDeclarativeEnforcement().
This transitions the resource to the stability-based validation lifecycle,
where enforcement is determined by tag stability and feature gates.
Includes generated code updates.
Replace all imports of k8s.io/apimachinery/pkg/util/dump with
k8s.io/utils/dump across the repo. The apimachinery dump package
now contains deprecated wrapper functions that delegate to
k8s.io/utils/dump for backwards compatibility.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
The verbs parameter slice might be shared between different rule instances and
gets sorted (= written), so we have to make a copy or (even better) also
de-duplicate as in pkg/apis/rbac/helpers.go.
More specifically, plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
shares the Read and ReadWrite slices, causing:
WARNING: DATA RACE
Read at 0x000008e5e5b0 by goroutine 124:
slices.insertionSortOrdered[go.shape.string]()
/home/prow/go/src/k8s.io/kubernetes/_output/local/go/cache/mod/golang.org/toolchain@v0.0.1-go1.25.6.linux-amd64/src/slices/zsortordered.go:14 +0x126
slices.pdqsortOrdered[go.shape.string]()
/home/prow/go/src/k8s.io/kubernetes/_output/local/go/cache/mod/golang.org/toolchain@v0.0.1-go1.25.6.linux-amd64/src/slices/zsortordered.go:75 +0x6c4
slices.Sort[go.shape.[]string,go.shape.string]()
/home/prow/go/src/k8s.io/kubernetes/_output/local/go/cache/mod/golang.org/toolchain@v0.0.1-go1.25.6.linux-amd64/src/slices/sort.go:18 +0x64
sort.Strings()
/home/prow/go/src/k8s.io/kubernetes/_output/local/go/cache/mod/golang.org/toolchain@v0.0.1-go1.25.6.linux-amd64/src/sort/sort.go:181 +0xe
k8s.io/kubernetes/pkg/apis/rbac/v1.(*PolicyRuleBuilder).Rule()
/home/prow/go/src/k8s.io/kubernetes/pkg/apis/rbac/v1/helpers.go:98 +0x2c9
k8s.io/kubernetes/pkg/apis/rbac/v1.(*PolicyRuleBuilder).RuleOrDie()
/home/prow/go/src/k8s.io/kubernetes/pkg/apis/rbac/v1/helpers.go:65 +0x2f44
k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy.ClusterRoles()
/home/prow/go/src/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go:404 +0x2c13
...
Previous write at 0x000008e5e5b0 by goroutine 123:
slices.insertionSortOrdered[go.shape.string]()
/home/prow/go/src/k8s.io/kubernetes/_output/local/go/cache/mod/golang.org/toolchain@v0.0.1-go1.25.6.linux-amd64/src/slices/zsortordered.go:15 +0x2f9
slices.pdqsortOrdered[go.shape.string]()
/home/prow/go/src/k8s.io/kubernetes/_output/local/go/cache/mod/golang.org/toolchain@v0.0.1-go1.25.6.linux-amd64/src/slices/zsortordered.go:75 +0x6c4
slices.Sort[go.shape.[]string,go.shape.string]()
/home/prow/go/src/k8s.io/kubernetes/_output/local/go/cache/mod/golang.org/toolchain@v0.0.1-go1.25.6.linux-amd64/src/slices/sort.go:18 +0x64
sort.Strings()
/home/prow/go/src/k8s.io/kubernetes/_output/local/go/cache/mod/golang.org/toolchain@v0.0.1-go1.25.6.linux-amd64/src/sort/sort.go:181 +0xe
k8s.io/kubernetes/pkg/apis/rbac/v1.(*PolicyRuleBuilder).Rule()
/home/prow/go/src/k8s.io/kubernetes/pkg/apis/rbac/v1/helpers.go:98 +0x2c9
k8s.io/kubernetes/pkg/apis/rbac/v1.(*PolicyRuleBuilder).RuleOrDie()
/home/prow/go/src/k8s.io/kubernetes/pkg/apis/rbac/v1/helpers.go:65 +0x2f44
k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy.ClusterRoles()
/home/prow/go/src/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go:404 +0x2c13
Seen in test/integration/apiserver/oidc.
This is where all the scrubbed validation helpers are going.
Note: This does NOT check for or too-long inputs, and changing it now
would be a breaking change.
Co-authored-by: Tim Hockin <thockin@google.com>
Signed-off-by: Heba Elayoty <heelayot@microsoft.com>
