From 4a5fdad93bed55bcdde2fdb056f7a07d60c315f5 Mon Sep 17 00:00:00 2001 From: Kevin Wiesmueller Date: Thu, 14 Jan 2021 20:14:38 +0100 Subject: [PATCH 01/14] implement managedFields admission controller Kubernetes-commit: d5ae113e8dfba62709b1fccb8dbc26c6dde9b3e5 --- .../handlers/fieldmanager/admission.go | 105 ++++++++++++++++++ 1 file changed, 105 insertions(+) create mode 100644 pkg/endpoints/handlers/fieldmanager/admission.go diff --git a/pkg/endpoints/handlers/fieldmanager/admission.go b/pkg/endpoints/handlers/fieldmanager/admission.go new file mode 100644 index 000000000..8727f47bc --- /dev/null +++ b/pkg/endpoints/handlers/fieldmanager/admission.go @@ -0,0 +1,105 @@ +/* +Copyright 2021 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +package fieldmanager + +import ( + "context" + "fmt" + + "k8s.io/apimachinery/pkg/api/meta" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apiserver/pkg/admission" + "k8s.io/apiserver/pkg/warning" +) + +// InvalidManagedFieldsAfterMutatingAdmissionWarningFormat is the warning that a client receives +// when a create/update/patch request results in invalid managedFields after going through the admission chain. +const InvalidManagedFieldsAfterMutatingAdmissionWarningFormat = ".metadata.managedFields was in an invalid state after admission; this could be caused by an outdated mutating admission controller; please fix your requests: %v" + +// NewManagedFieldsValidatingAdmissionController validates the managedFields after calling +// the provided admission and resets them to their original state if they got changed to an invalid value +func NewManagedFieldsValidatingAdmissionController(wrap admission.Interface) admission.Interface { + return nil +} + +type managedFieldsValidatingAdmissionController struct { + wrap admission.Interface +} + +var _ admission.Interface = &managedFieldsValidatingAdmissionController{} +var _ admission.MutationInterface = &managedFieldsValidatingAdmissionController{} +var _ admission.ValidationInterface = &managedFieldsValidatingAdmissionController{} + +// Handles calls the wrapped admission.Interface if aplicable +func (admit *managedFieldsValidatingAdmissionController) Handles(operation admission.Operation) bool { + return admit.wrap.Handles(operation) +} + +// Admit calls the wrapped admission.Interface if aplicable and resets the managedFields to their state before admission if they +// got modified in an invalid way +func (admit *managedFieldsValidatingAdmissionController) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error) { + mutationInterface, isMutationInterface := admit.wrap.(admission.MutationInterface) + if !isMutationInterface { + return nil + } + objectMeta, err := meta.Accessor(a.GetObject()) + if err != nil { + return err + } + managedFieldsBeforeAdmission := objectMeta.GetManagedFields() + if err := mutationInterface.Admit(ctx, a, o); err != nil { + return err + } + objectMeta, err = meta.Accessor(a.GetObject()) + if err != nil { + return err + } + managedFieldsAfterAdmission := objectMeta.GetManagedFields() + if err := validateManagedFields(managedFieldsAfterAdmission); err != nil { + objectMeta.SetManagedFields(managedFieldsBeforeAdmission) + warning.AddWarning(ctx, "", + fmt.Sprintf(InvalidManagedFieldsAfterMutatingAdmissionWarningFormat, + err.Error()), + ) + } + return nil +} + +// Validate calls the wrapped admission.Interface if aplicable +func (admit *managedFieldsValidatingAdmissionController) Validate(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error) { + if validationInterface, isValidationInterface := admit.wrap.(admission.ValidationInterface); isValidationInterface { + return validationInterface.Validate(ctx, a, o) + } + return nil +} + +func validateManagedFields(managedFields []metav1.ManagedFieldsEntry) error { + for i, managed := range managedFields { + if len(managed.APIVersion) < 1 { + return fmt.Errorf(".metadata.managedFields[%d]: missing apiVersion", i) + } + if len(managed.FieldsType) < 1 { + return fmt.Errorf(".metadata.managedFields[%d]: missing fieldsType", i) + } + if len(managed.Manager) < 1 { + return fmt.Errorf(".metadata.managedFields[%d]: missing manager", i) + } + if managed.FieldsV1 == nil { + return fmt.Errorf(".metadata.managedFields[%d]: missing fieldsV1", i) + } + } + return nil +} From a29734176f07c42f9c5a96f0aa3e2e66eaf1173d Mon Sep 17 00:00:00 2001 From: Kevin Wiesmueller Date: Thu, 14 Jan 2021 20:15:11 +0100 Subject: [PATCH 02/14] use managedFields admission controller in create/patch/update Kubernetes-commit: 3d306e222de3b13a55030a53fef93622bb300646 --- pkg/endpoints/handlers/create.go | 3 +++ pkg/endpoints/handlers/patch.go | 2 +- pkg/endpoints/handlers/update.go | 2 ++ 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/pkg/endpoints/handlers/create.go b/pkg/endpoints/handlers/create.go index e914eaeea..743f28948 100644 --- a/pkg/endpoints/handlers/create.go +++ b/pkg/endpoints/handlers/create.go @@ -35,6 +35,7 @@ import ( "k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/apiserver/pkg/admission" "k8s.io/apiserver/pkg/audit" + "k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager" "k8s.io/apiserver/pkg/endpoints/handlers/negotiation" "k8s.io/apiserver/pkg/endpoints/request" "k8s.io/apiserver/pkg/features" @@ -163,6 +164,8 @@ func createHandler(r rest.NamedCreater, scope *RequestScope, admit admission.Int return nil, fmt.Errorf("failed to create new object (Create for %v): %v", scope.Kind, err) } obj = scope.FieldManager.UpdateNoErrors(liveObj, obj, managerOrUserAgent(options.FieldManager, req.UserAgent())) + + admit = fieldmanager.NewManagedFieldsValidatingAdmissionController(admit) } if mutatingAdmission, ok := admit.(admission.MutationInterface); ok && mutatingAdmission.Handles(admission.Create) { if err := mutatingAdmission.Admit(ctx, admissionAttributes, scope); err != nil { diff --git a/pkg/endpoints/handlers/patch.go b/pkg/endpoints/handlers/patch.go index 4c0d10230..b8e2991a9 100644 --- a/pkg/endpoints/handlers/patch.go +++ b/pkg/endpoints/handlers/patch.go @@ -171,7 +171,7 @@ func PatchResource(r rest.Patcher, scope *RequestScope, admit admission.Interfac userInfo, ) - mutatingAdmission, _ := admit.(admission.MutationInterface) + mutatingAdmission, _ := fieldmanager.NewManagedFieldsValidatingAdmissionController(admit).(admission.MutationInterface) createAuthorizerAttributes := authorizer.AttributesRecord{ User: userInfo, ResourceRequest: true, diff --git a/pkg/endpoints/handlers/update.go b/pkg/endpoints/handlers/update.go index fd215bb38..d6042aa10 100644 --- a/pkg/endpoints/handlers/update.go +++ b/pkg/endpoints/handlers/update.go @@ -33,6 +33,7 @@ import ( "k8s.io/apiserver/pkg/admission" "k8s.io/apiserver/pkg/audit" "k8s.io/apiserver/pkg/authorization/authorizer" + "k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager" "k8s.io/apiserver/pkg/endpoints/handlers/negotiation" "k8s.io/apiserver/pkg/endpoints/request" "k8s.io/apiserver/pkg/features" @@ -118,6 +119,7 @@ func UpdateResource(r rest.Updater, scope *RequestScope, admit admission.Interfa ae := request.AuditEventFrom(ctx) audit.LogRequestObject(ae, obj, scope.Resource, scope.Subresource, scope.Serializer) admit = admission.WithAudit(admit, ae) + admit = fieldmanager.NewManagedFieldsValidatingAdmissionController(admit) if err := checkName(obj, name, namespace, scope.Namer); err != nil { scope.err(err, w, req) From 08a5711ffbb80a5fa12098024fbb9449d4048d44 Mon Sep 17 00:00:00 2001 From: Kevin Wiesmueller Date: Thu, 14 Jan 2021 20:33:50 +0100 Subject: [PATCH 03/14] update bazel Kubernetes-commit: a06f981fb1388976cd6427d7a4284d36dd2f2448 --- pkg/endpoints/handlers/fieldmanager/admission.go | 1 + 1 file changed, 1 insertion(+) diff --git a/pkg/endpoints/handlers/fieldmanager/admission.go b/pkg/endpoints/handlers/fieldmanager/admission.go index 8727f47bc..10c172adf 100644 --- a/pkg/endpoints/handlers/fieldmanager/admission.go +++ b/pkg/endpoints/handlers/fieldmanager/admission.go @@ -13,6 +13,7 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ + package fieldmanager import ( From 7da058f6bbf07f5e397f95f2192c146ee5972872 Mon Sep 17 00:00:00 2001 From: Kevin Wiesmueller Date: Mon, 1 Feb 2021 17:56:49 +0100 Subject: [PATCH 04/14] disable webhook for testing Kubernetes-commit: ffbae9c5b4a3df9f7400d0047a5d7a957adf295d --- pkg/endpoints/handlers/create.go | 3 --- pkg/endpoints/handlers/patch.go | 2 +- pkg/endpoints/handlers/update.go | 2 -- 3 files changed, 1 insertion(+), 6 deletions(-) diff --git a/pkg/endpoints/handlers/create.go b/pkg/endpoints/handlers/create.go index 743f28948..e914eaeea 100644 --- a/pkg/endpoints/handlers/create.go +++ b/pkg/endpoints/handlers/create.go @@ -35,7 +35,6 @@ import ( "k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/apiserver/pkg/admission" "k8s.io/apiserver/pkg/audit" - "k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager" "k8s.io/apiserver/pkg/endpoints/handlers/negotiation" "k8s.io/apiserver/pkg/endpoints/request" "k8s.io/apiserver/pkg/features" @@ -164,8 +163,6 @@ func createHandler(r rest.NamedCreater, scope *RequestScope, admit admission.Int return nil, fmt.Errorf("failed to create new object (Create for %v): %v", scope.Kind, err) } obj = scope.FieldManager.UpdateNoErrors(liveObj, obj, managerOrUserAgent(options.FieldManager, req.UserAgent())) - - admit = fieldmanager.NewManagedFieldsValidatingAdmissionController(admit) } if mutatingAdmission, ok := admit.(admission.MutationInterface); ok && mutatingAdmission.Handles(admission.Create) { if err := mutatingAdmission.Admit(ctx, admissionAttributes, scope); err != nil { diff --git a/pkg/endpoints/handlers/patch.go b/pkg/endpoints/handlers/patch.go index b8e2991a9..4c0d10230 100644 --- a/pkg/endpoints/handlers/patch.go +++ b/pkg/endpoints/handlers/patch.go @@ -171,7 +171,7 @@ func PatchResource(r rest.Patcher, scope *RequestScope, admit admission.Interfac userInfo, ) - mutatingAdmission, _ := fieldmanager.NewManagedFieldsValidatingAdmissionController(admit).(admission.MutationInterface) + mutatingAdmission, _ := admit.(admission.MutationInterface) createAuthorizerAttributes := authorizer.AttributesRecord{ User: userInfo, ResourceRequest: true, diff --git a/pkg/endpoints/handlers/update.go b/pkg/endpoints/handlers/update.go index d6042aa10..fd215bb38 100644 --- a/pkg/endpoints/handlers/update.go +++ b/pkg/endpoints/handlers/update.go @@ -33,7 +33,6 @@ import ( "k8s.io/apiserver/pkg/admission" "k8s.io/apiserver/pkg/audit" "k8s.io/apiserver/pkg/authorization/authorizer" - "k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager" "k8s.io/apiserver/pkg/endpoints/handlers/negotiation" "k8s.io/apiserver/pkg/endpoints/request" "k8s.io/apiserver/pkg/features" @@ -119,7 +118,6 @@ func UpdateResource(r rest.Updater, scope *RequestScope, admit admission.Interfa ae := request.AuditEventFrom(ctx) audit.LogRequestObject(ae, obj, scope.Resource, scope.Subresource, scope.Serializer) admit = admission.WithAudit(admit, ae) - admit = fieldmanager.NewManagedFieldsValidatingAdmissionController(admit) if err := checkName(obj, name, namespace, scope.Namer); err != nil { scope.err(err, w, req) From 81cd3ef7b0a569265bdbfed2d0b37ac1cf6b0c34 Mon Sep 17 00:00:00 2001 From: Kevin Wiesmueller Date: Thu, 11 Feb 2021 16:11:43 +0100 Subject: [PATCH 05/14] fix admission controller Kubernetes-commit: 429a96da5e856c435b08b50791d462120724c475 --- pkg/endpoints/handlers/fieldmanager/admission.go | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/pkg/endpoints/handlers/fieldmanager/admission.go b/pkg/endpoints/handlers/fieldmanager/admission.go index 10c172adf..d489fda65 100644 --- a/pkg/endpoints/handlers/fieldmanager/admission.go +++ b/pkg/endpoints/handlers/fieldmanager/admission.go @@ -33,7 +33,7 @@ const InvalidManagedFieldsAfterMutatingAdmissionWarningFormat = ".metadata.manag // NewManagedFieldsValidatingAdmissionController validates the managedFields after calling // the provided admission and resets them to their original state if they got changed to an invalid value func NewManagedFieldsValidatingAdmissionController(wrap admission.Interface) admission.Interface { - return nil + return &managedFieldsValidatingAdmissionController{wrap: wrap} } type managedFieldsValidatingAdmissionController struct { @@ -64,10 +64,6 @@ func (admit *managedFieldsValidatingAdmissionController) Admit(ctx context.Conte if err := mutationInterface.Admit(ctx, a, o); err != nil { return err } - objectMeta, err = meta.Accessor(a.GetObject()) - if err != nil { - return err - } managedFieldsAfterAdmission := objectMeta.GetManagedFields() if err := validateManagedFields(managedFieldsAfterAdmission); err != nil { objectMeta.SetManagedFields(managedFieldsBeforeAdmission) From 82e671a5f890771fb88cd28581dcaf6e72a0b464 Mon Sep 17 00:00:00 2001 From: Kevin Wiesmueller Date: Thu, 11 Feb 2021 16:22:16 +0100 Subject: [PATCH 06/14] add managedFields admission Kubernetes-commit: f86b59ab79227929e7f283b859b4c59317399807 --- pkg/endpoints/handlers/create.go | 2 ++ pkg/endpoints/handlers/patch.go | 3 +++ pkg/endpoints/handlers/update.go | 2 ++ 3 files changed, 7 insertions(+) diff --git a/pkg/endpoints/handlers/create.go b/pkg/endpoints/handlers/create.go index e914eaeea..b2e167f26 100644 --- a/pkg/endpoints/handlers/create.go +++ b/pkg/endpoints/handlers/create.go @@ -35,6 +35,7 @@ import ( "k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/apiserver/pkg/admission" "k8s.io/apiserver/pkg/audit" + "k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager" "k8s.io/apiserver/pkg/endpoints/handlers/negotiation" "k8s.io/apiserver/pkg/endpoints/request" "k8s.io/apiserver/pkg/features" @@ -163,6 +164,7 @@ func createHandler(r rest.NamedCreater, scope *RequestScope, admit admission.Int return nil, fmt.Errorf("failed to create new object (Create for %v): %v", scope.Kind, err) } obj = scope.FieldManager.UpdateNoErrors(liveObj, obj, managerOrUserAgent(options.FieldManager, req.UserAgent())) + admit = fieldmanager.NewManagedFieldsValidatingAdmissionController(admit) } if mutatingAdmission, ok := admit.(admission.MutationInterface); ok && mutatingAdmission.Handles(admission.Create) { if err := mutatingAdmission.Admit(ctx, admissionAttributes, scope); err != nil { diff --git a/pkg/endpoints/handlers/patch.go b/pkg/endpoints/handlers/patch.go index 4c0d10230..903307fc2 100644 --- a/pkg/endpoints/handlers/patch.go +++ b/pkg/endpoints/handlers/patch.go @@ -171,6 +171,9 @@ func PatchResource(r rest.Patcher, scope *RequestScope, admit admission.Interfac userInfo, ) + if scope.FieldManager != nil { + admit = fieldmanager.NewManagedFieldsValidatingAdmissionController(admit) + } mutatingAdmission, _ := admit.(admission.MutationInterface) createAuthorizerAttributes := authorizer.AttributesRecord{ User: userInfo, diff --git a/pkg/endpoints/handlers/update.go b/pkg/endpoints/handlers/update.go index fd215bb38..57daefd9c 100644 --- a/pkg/endpoints/handlers/update.go +++ b/pkg/endpoints/handlers/update.go @@ -33,6 +33,7 @@ import ( "k8s.io/apiserver/pkg/admission" "k8s.io/apiserver/pkg/audit" "k8s.io/apiserver/pkg/authorization/authorizer" + "k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager" "k8s.io/apiserver/pkg/endpoints/handlers/negotiation" "k8s.io/apiserver/pkg/endpoints/request" "k8s.io/apiserver/pkg/features" @@ -130,6 +131,7 @@ func UpdateResource(r rest.Updater, scope *RequestScope, admit admission.Interfa // allows skipping managedFields update if the resulting object is too big shouldUpdateManagedFields := true if scope.FieldManager != nil { + admit = fieldmanager.NewManagedFieldsValidatingAdmissionController(admit) transformers = append(transformers, func(_ context.Context, newObj, liveObj runtime.Object) (runtime.Object, error) { if shouldUpdateManagedFields { return scope.FieldManager.UpdateNoErrors(liveObj, newObj, managerOrUserAgent(options.FieldManager, req.UserAgent())), nil From f9c68c0e80198bb175c4f835e63899479eae48e4 Mon Sep 17 00:00:00 2001 From: Kevin Wiesmueller Date: Fri, 26 Feb 2021 17:47:52 +0100 Subject: [PATCH 07/14] export and cleanup managedFields decoding Kubernetes-commit: 589ca1be1c9e75b1730feacd1af6e2c817f693ac --- .../handlers/fieldmanager/fieldmanager.go | 31 +++++++++++-------- .../fieldmanager/internal/managedfields.go | 24 +++++--------- .../internal/managedfields_test.go | 10 +++--- 3 files changed, 31 insertions(+), 34 deletions(-) diff --git a/pkg/endpoints/handlers/fieldmanager/fieldmanager.go b/pkg/endpoints/handlers/fieldmanager/fieldmanager.go index ec91d772f..71a4eff8e 100644 --- a/pkg/endpoints/handlers/fieldmanager/fieldmanager.go +++ b/pkg/endpoints/handlers/fieldmanager/fieldmanager.go @@ -110,23 +110,22 @@ func newDefaultFieldManager(f Manager, typeConverter TypeConverter, objectConver return NewFieldManager(f, ignoreManagedFieldsFromRequestObject) } -func decodeLiveManagedFields(liveObj runtime.Object) (Managed, error) { +// DecodeManagedFields converts ManagedFields from the wire format (api format) +// to the format used by sigs.k8s.io/structured-merge-diff +func DecodeManagedFields(encodedManagedFields []metav1.ManagedFieldsEntry) (Managed, error) { + return internal.DecodeManagedFields(encodedManagedFields) +} + +func decodeLiveOrNew(liveObj, newObj runtime.Object, ignoreManagedFieldsFromRequestObject bool) (Managed, error) { liveAccessor, err := meta.Accessor(liveObj) if err != nil { return nil, err } - managed, err := internal.DecodeObjectManagedFields(liveAccessor.GetManagedFields()) - if err != nil { - return internal.NewEmptyManaged(), nil - } - return managed, nil -} -func decodeManagedFields(liveObj, newObj runtime.Object, ignoreManagedFieldsFromRequestObject bool) (Managed, error) { // We take the managedFields of the live object in case the request tries to // manually set managedFields via a subresource. if ignoreManagedFieldsFromRequestObject { - return decodeLiveManagedFields(liveObj) + return emptyManagedFieldsOnErr(DecodeManagedFields(liveAccessor.GetManagedFields())) } // If the object doesn't have metadata, we should just return without trying to @@ -140,14 +139,20 @@ func decodeManagedFields(liveObj, newObj runtime.Object, ignoreManagedFieldsFrom return internal.NewEmptyManaged(), nil } - managed, err := internal.DecodeObjectManagedFields(newAccessor.GetManagedFields()) // If the managed field is empty or we failed to decode it, // let's try the live object. This is to prevent clients who // don't understand managedFields from deleting it accidentally. + managed, err := DecodeManagedFields(newAccessor.GetManagedFields()) if err != nil || len(managed.Fields()) == 0 { - return decodeLiveManagedFields(liveObj) + return emptyManagedFieldsOnErr(DecodeManagedFields(liveAccessor.GetManagedFields())) } + return managed, nil +} +func emptyManagedFieldsOnErr(managed Managed, err error) (Managed, error) { + if err != nil { + return internal.NewEmptyManaged(), nil + } return managed, nil } @@ -157,7 +162,7 @@ func decodeManagedFields(liveObj, newObj runtime.Object, ignoreManagedFieldsFrom func (f *FieldManager) Update(liveObj, newObj runtime.Object, manager string) (object runtime.Object, err error) { // First try to decode the managed fields provided in the update, // This is necessary to allow directly updating managed fields. - managed, err := decodeManagedFields(liveObj, newObj, f.ignoreManagedFieldsFromRequestObject) + managed, err := decodeLiveOrNew(liveObj, newObj, f.ignoreManagedFieldsFromRequestObject) if err != nil { return newObj, nil } @@ -219,7 +224,7 @@ func (f *FieldManager) Apply(liveObj, appliedObj runtime.Object, manager string, } // Decode the managed fields in the live object, since it isn't allowed in the patch. - managed, err := internal.DecodeObjectManagedFields(accessor.GetManagedFields()) + managed, err := DecodeManagedFields(accessor.GetManagedFields()) if err != nil { return nil, fmt.Errorf("failed to decode managed fields: %v", err) } diff --git a/pkg/endpoints/handlers/fieldmanager/internal/managedfields.go b/pkg/endpoints/handlers/fieldmanager/internal/managedfields.go index 9a625e2ac..652ba64a8 100644 --- a/pkg/endpoints/handlers/fieldmanager/internal/managedfields.go +++ b/pkg/endpoints/handlers/fieldmanager/internal/managedfields.go @@ -77,15 +77,6 @@ func RemoveObjectManagedFields(obj runtime.Object) { accessor.SetManagedFields(nil) } -// DecodeObjectManagedFields extracts and converts the objects ManagedFields into a fieldpath.ManagedFields. -func DecodeObjectManagedFields(from []metav1.ManagedFieldsEntry) (ManagedInterface, error) { - managed, err := decodeManagedFields(from) - if err != nil { - return nil, fmt.Errorf("failed to convert managed fields from API: %v", err) - } - return &managed, nil -} - // EncodeObjectManagedFields converts and stores the fieldpathManagedFields into the objects ManagedFields func EncodeObjectManagedFields(obj runtime.Object, managed ManagedInterface) error { accessor, err := meta.Accessor(obj) @@ -102,9 +93,10 @@ func EncodeObjectManagedFields(obj runtime.Object, managed ManagedInterface) err return nil } -// decodeManagedFields converts ManagedFields from the wire format (api format) +// DecodeManagedFields converts ManagedFields from the wire format (api format) // to the format used by sigs.k8s.io/structured-merge-diff -func decodeManagedFields(encodedManagedFields []metav1.ManagedFieldsEntry) (managed managedStruct, err error) { +func DecodeManagedFields(encodedManagedFields []metav1.ManagedFieldsEntry) (ManagedInterface, error) { + managed := managedStruct{} managed.fields = make(fieldpath.ManagedFields, len(encodedManagedFields)) managed.times = make(map[string]*metav1.Time, len(encodedManagedFields)) @@ -113,21 +105,21 @@ func decodeManagedFields(encodedManagedFields []metav1.ManagedFieldsEntry) (mana case "FieldsV1": // Valid case. case "": - return managedStruct{}, fmt.Errorf("missing fieldsType in managed fields entry %d", i) + return nil, fmt.Errorf("missing fieldsType in managed fields entry %d", i) default: - return managedStruct{}, fmt.Errorf("invalid fieldsType %q in managed fields entry %d", encodedVersionedSet.FieldsType, i) + return nil, fmt.Errorf("invalid fieldsType %q in managed fields entry %d", encodedVersionedSet.FieldsType, i) } manager, err := BuildManagerIdentifier(&encodedVersionedSet) if err != nil { - return managedStruct{}, fmt.Errorf("error decoding manager from %v: %v", encodedVersionedSet, err) + return nil, fmt.Errorf("error decoding manager from %v: %v", encodedVersionedSet, err) } managed.fields[manager], err = decodeVersionedSet(&encodedVersionedSet) if err != nil { - return managedStruct{}, fmt.Errorf("error decoding versioned set from %v: %v", encodedVersionedSet, err) + return nil, fmt.Errorf("error decoding versioned set from %v: %v", encodedVersionedSet, err) } managed.times[manager] = encodedVersionedSet.Time } - return managed, nil + return &managed, nil } // BuildManagerIdentifier creates a manager identifier string from a ManagedFieldsEntry diff --git a/pkg/endpoints/handlers/fieldmanager/internal/managedfields_test.go b/pkg/endpoints/handlers/fieldmanager/internal/managedfields_test.go index 68a6fa5a2..1ca4d4b0b 100644 --- a/pkg/endpoints/handlers/fieldmanager/internal/managedfields_test.go +++ b/pkg/endpoints/handlers/fieldmanager/internal/managedfields_test.go @@ -40,7 +40,7 @@ func TestHasFieldsType(t *testing.T) { `), &unmarshaled); err != nil { t.Fatalf("did not expect yaml unmarshalling error but got: %v", err) } - if _, err := decodeManagedFields(unmarshaled); err != nil { + if _, err := DecodeManagedFields(unmarshaled); err != nil { t.Fatalf("did not expect decoding error but got: %v", err) } @@ -54,7 +54,7 @@ func TestHasFieldsType(t *testing.T) { `), &unmarshaled); err != nil { t.Fatalf("did not expect yaml unmarshalling error but got: %v", err) } - if _, err := decodeManagedFields(unmarshaled); err == nil { + if _, err := DecodeManagedFields(unmarshaled); err == nil { t.Fatal("Expect decoding error but got none") } @@ -67,7 +67,7 @@ func TestHasFieldsType(t *testing.T) { `), &unmarshaled); err != nil { t.Fatalf("did not expect yaml unmarshalling error but got: %v", err) } - if _, err := decodeManagedFields(unmarshaled); err == nil { + if _, err := DecodeManagedFields(unmarshaled); err == nil { t.Fatal("Expect decoding error but got none") } } @@ -189,11 +189,11 @@ func TestRoundTripManagedFields(t *testing.T) { if err := yaml.Unmarshal([]byte(test), &unmarshaled); err != nil { t.Fatalf("did not expect yaml unmarshalling error but got: %v", err) } - decoded, err := decodeManagedFields(unmarshaled) + decoded, err := DecodeManagedFields(unmarshaled) if err != nil { t.Fatalf("did not expect decoding error but got: %v", err) } - encoded, err := encodeManagedFields(&decoded) + encoded, err := encodeManagedFields(decoded) if err != nil { t.Fatalf("did not expect encoding error but got: %v", err) } From a69b2cb302873223e38061152292d7a6a2ced6ba Mon Sep 17 00:00:00 2001 From: Kevin Wiesmueller Date: Fri, 26 Feb 2021 20:03:10 +0100 Subject: [PATCH 08/14] use existing validation code and decoding in fieldManager admission Kubernetes-commit: fc1841d72f7418dd2606fb796f2a1b664bb3a721 --- .../handlers/fieldmanager/admission.go | 21 +--- .../handlers/fieldmanager/admission_test.go | 115 ++++++++++++++++++ .../handlers/fieldmanager/validation.go | 22 ++++ 3 files changed, 138 insertions(+), 20 deletions(-) create mode 100644 pkg/endpoints/handlers/fieldmanager/admission_test.go create mode 100644 pkg/endpoints/handlers/fieldmanager/validation.go diff --git a/pkg/endpoints/handlers/fieldmanager/admission.go b/pkg/endpoints/handlers/fieldmanager/admission.go index d489fda65..a276be9a7 100644 --- a/pkg/endpoints/handlers/fieldmanager/admission.go +++ b/pkg/endpoints/handlers/fieldmanager/admission.go @@ -21,7 +21,6 @@ import ( "fmt" "k8s.io/apimachinery/pkg/api/meta" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apiserver/pkg/admission" "k8s.io/apiserver/pkg/warning" ) @@ -65,7 +64,7 @@ func (admit *managedFieldsValidatingAdmissionController) Admit(ctx context.Conte return err } managedFieldsAfterAdmission := objectMeta.GetManagedFields() - if err := validateManagedFields(managedFieldsAfterAdmission); err != nil { + if err := ValidateManagedFields(managedFieldsAfterAdmission); err != nil { objectMeta.SetManagedFields(managedFieldsBeforeAdmission) warning.AddWarning(ctx, "", fmt.Sprintf(InvalidManagedFieldsAfterMutatingAdmissionWarningFormat, @@ -82,21 +81,3 @@ func (admit *managedFieldsValidatingAdmissionController) Validate(ctx context.Co } return nil } - -func validateManagedFields(managedFields []metav1.ManagedFieldsEntry) error { - for i, managed := range managedFields { - if len(managed.APIVersion) < 1 { - return fmt.Errorf(".metadata.managedFields[%d]: missing apiVersion", i) - } - if len(managed.FieldsType) < 1 { - return fmt.Errorf(".metadata.managedFields[%d]: missing fieldsType", i) - } - if len(managed.Manager) < 1 { - return fmt.Errorf(".metadata.managedFields[%d]: missing manager", i) - } - if managed.FieldsV1 == nil { - return fmt.Errorf(".metadata.managedFields[%d]: missing fieldsV1", i) - } - } - return nil -} diff --git a/pkg/endpoints/handlers/fieldmanager/admission_test.go b/pkg/endpoints/handlers/fieldmanager/admission_test.go new file mode 100644 index 000000000..1f1c0ca12 --- /dev/null +++ b/pkg/endpoints/handlers/fieldmanager/admission_test.go @@ -0,0 +1,115 @@ +package fieldmanager_test + +import ( + "context" + "reflect" + "testing" + + "k8s.io/apimachinery/pkg/api/meta" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" + "k8s.io/apiserver/pkg/admission" + "k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager" + api "k8s.io/kubernetes/pkg/apis/core" +) + +func TestAdmission(t *testing.T) { + wrap := &mockAdmissionController{} + ac := fieldmanager.NewManagedFieldsValidatingAdmissionController(wrap) + + tests := []struct { + beforeAdmission []metav1.ManagedFieldsEntry + afterAdmission []metav1.ManagedFieldsEntry + expected []metav1.ManagedFieldsEntry + }{ + { + beforeAdmission: []metav1.ManagedFieldsEntry{ + { + Manager: "test", + }, + }, + afterAdmission: []metav1.ManagedFieldsEntry{ + { + Manager: "", + }, + }, + expected: []metav1.ManagedFieldsEntry{ + { + Manager: "test", + }, + }, + }, + { + beforeAdmission: []metav1.ManagedFieldsEntry{ + { + APIVersion: "test", + }, + }, + afterAdmission: []metav1.ManagedFieldsEntry{ + { + APIVersion: "", + }, + }, + expected: []metav1.ManagedFieldsEntry{ + { + APIVersion: "test", + }, + }, + }, + { + beforeAdmission: []metav1.ManagedFieldsEntry{ + { + FieldsType: "FieldsV1", + }, + }, + afterAdmission: []metav1.ManagedFieldsEntry{ + { + FieldsType: "test", + }, + }, + expected: []metav1.ManagedFieldsEntry{ + { + FieldsType: "FieldsV1", + }, + }, + }, + } + + for _, test := range tests { + obj := &unstructured.Unstructured{} + obj.SetManagedFields(test.beforeAdmission) + wrap.admit = replaceManagedFields(test.afterAdmission) + + attrs := admission.NewAttributesRecord(obj, obj, api.Kind("ConfigMap").WithVersion("version"), "default", "", api.Resource("configmaps").WithVersion("version"), "", admission.Update, nil, false, nil) + if err := ac.(admission.MutationInterface).Admit(context.TODO(), attrs, nil); err != nil { + t.Fatal(err) + } + + if !reflect.DeepEqual(obj.GetManagedFields(), test.expected) { + t.Fatalf("expected: \n%v\ngot:\n%v", test.expected, obj.GetManagedFields()) + } + } +} + +func replaceManagedFields(with []metav1.ManagedFieldsEntry) func(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error { + return func(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error { + objectMeta, err := meta.Accessor(a.GetObject()) + if err != nil { + return err + } + objectMeta.SetManagedFields(with) + return nil + } +} + +type mockAdmissionController struct { + admit func(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error +} + +func (c *mockAdmissionController) Handles(operation admission.Operation) bool { + return true +} + +func (c *mockAdmissionController) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error { + return c.admit(ctx, a, o) +} diff --git a/pkg/endpoints/handlers/fieldmanager/validation.go b/pkg/endpoints/handlers/fieldmanager/validation.go new file mode 100644 index 000000000..c862a7745 --- /dev/null +++ b/pkg/endpoints/handlers/fieldmanager/validation.go @@ -0,0 +1,22 @@ +package fieldmanager + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + v1validation "k8s.io/apimachinery/pkg/apis/meta/v1/validation" + "k8s.io/apimachinery/pkg/util/validation/field" +) + +// ValidateManagedFields by checking the integrity of every entry and trying to decode +// them to the internal format +func ValidateManagedFields(managedFields []metav1.ManagedFieldsEntry) error { + validationErrs := v1validation.ValidateManagedFields(managedFields, field.NewPath("metadata").Child("managedFields")) + if len(validationErrs) > 0 { + return validationErrs.ToAggregate() + } + + if _, err := DecodeManagedFields(managedFields); err != nil { + return err + } + + return nil +} From 04593d2277858b4a2a8489e99e9dc4c15bb8dcf2 Mon Sep 17 00:00:00 2001 From: Kevin Wiesmueller Date: Fri, 26 Feb 2021 20:14:11 +0100 Subject: [PATCH 09/14] prevent fieldManager admission from wrapping nil Kubernetes-commit: 22dfa6ae1b431cb8e8afe72ce7d60360bf766337 --- pkg/endpoints/handlers/fieldmanager/admission.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkg/endpoints/handlers/fieldmanager/admission.go b/pkg/endpoints/handlers/fieldmanager/admission.go index a276be9a7..751c4753d 100644 --- a/pkg/endpoints/handlers/fieldmanager/admission.go +++ b/pkg/endpoints/handlers/fieldmanager/admission.go @@ -32,6 +32,9 @@ const InvalidManagedFieldsAfterMutatingAdmissionWarningFormat = ".metadata.manag // NewManagedFieldsValidatingAdmissionController validates the managedFields after calling // the provided admission and resets them to their original state if they got changed to an invalid value func NewManagedFieldsValidatingAdmissionController(wrap admission.Interface) admission.Interface { + if wrap == nil { + return nil + } return &managedFieldsValidatingAdmissionController{wrap: wrap} } From e4b883c5c7d5aa9e049d7f5b2eda6cec332f6645 Mon Sep 17 00:00:00 2001 From: Kevin Wiesmueller Date: Fri, 26 Feb 2021 20:14:22 +0100 Subject: [PATCH 10/14] update licenses and bazel Kubernetes-commit: 1a8e2bf0358651151a6440717b4de1f662c4571b --- .../handlers/fieldmanager/admission_test.go | 16 ++++++++++++++++ .../handlers/fieldmanager/validation.go | 16 ++++++++++++++++ 2 files changed, 32 insertions(+) diff --git a/pkg/endpoints/handlers/fieldmanager/admission_test.go b/pkg/endpoints/handlers/fieldmanager/admission_test.go index 1f1c0ca12..ae51b9d1e 100644 --- a/pkg/endpoints/handlers/fieldmanager/admission_test.go +++ b/pkg/endpoints/handlers/fieldmanager/admission_test.go @@ -1,3 +1,19 @@ +/* +Copyright 2021 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + package fieldmanager_test import ( diff --git a/pkg/endpoints/handlers/fieldmanager/validation.go b/pkg/endpoints/handlers/fieldmanager/validation.go index c862a7745..324c23b55 100644 --- a/pkg/endpoints/handlers/fieldmanager/validation.go +++ b/pkg/endpoints/handlers/fieldmanager/validation.go @@ -1,3 +1,19 @@ +/* +Copyright 2021 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + package fieldmanager import ( From 543879f479c6ee16cb5ef52ee0afe90ecca74350 Mon Sep 17 00:00:00 2001 From: Kevin Wiesmueller Date: Fri, 26 Feb 2021 20:33:36 +0100 Subject: [PATCH 11/14] fix test dependencies Kubernetes-commit: 295e47f60b64332ef4e3268db282184357440675 --- pkg/endpoints/handlers/fieldmanager/admission_test.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/endpoints/handlers/fieldmanager/admission_test.go b/pkg/endpoints/handlers/fieldmanager/admission_test.go index ae51b9d1e..a6aac4448 100644 --- a/pkg/endpoints/handlers/fieldmanager/admission_test.go +++ b/pkg/endpoints/handlers/fieldmanager/admission_test.go @@ -24,9 +24,9 @@ import ( "k8s.io/apimachinery/pkg/api/meta" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" + "k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/apiserver/pkg/admission" "k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager" - api "k8s.io/kubernetes/pkg/apis/core" ) func TestAdmission(t *testing.T) { @@ -96,7 +96,7 @@ func TestAdmission(t *testing.T) { obj.SetManagedFields(test.beforeAdmission) wrap.admit = replaceManagedFields(test.afterAdmission) - attrs := admission.NewAttributesRecord(obj, obj, api.Kind("ConfigMap").WithVersion("version"), "default", "", api.Resource("configmaps").WithVersion("version"), "", admission.Update, nil, false, nil) + attrs := admission.NewAttributesRecord(obj, obj, schema.GroupVersionKind{}, "default", "", schema.GroupVersionResource{}, "", admission.Update, nil, false, nil) if err := ac.(admission.MutationInterface).Admit(context.TODO(), attrs, nil); err != nil { t.Fatal(err) } From 7c5bd1b084a2288b023d6d88aff6067704bbf879 Mon Sep 17 00:00:00 2001 From: Kevin Wiesmueller Date: Mon, 1 Mar 2021 19:58:56 +0100 Subject: [PATCH 12/14] harden managedFields decoding Kubernetes-commit: 470ad03d076cae44bc98c64a08eea32e65f1bb9f --- .../fieldmanager/internal/managedfields.go | 8 ++ .../internal/managedfields_test.go | 78 +++++++++++++++++++ 2 files changed, 86 insertions(+) diff --git a/pkg/endpoints/handlers/fieldmanager/internal/managedfields.go b/pkg/endpoints/handlers/fieldmanager/internal/managedfields.go index 652ba64a8..40237cdc6 100644 --- a/pkg/endpoints/handlers/fieldmanager/internal/managedfields.go +++ b/pkg/endpoints/handlers/fieldmanager/internal/managedfields.go @@ -101,6 +101,14 @@ func DecodeManagedFields(encodedManagedFields []metav1.ManagedFieldsEntry) (Mana managed.times = make(map[string]*metav1.Time, len(encodedManagedFields)) for i, encodedVersionedSet := range encodedManagedFields { + switch encodedVersionedSet.Operation { + case metav1.ManagedFieldsOperationApply, metav1.ManagedFieldsOperationUpdate: + default: + return nil, fmt.Errorf("operation must be `Apply` or `Update`") + } + if len(encodedVersionedSet.APIVersion) < 1 { + return nil, fmt.Errorf("apiVersion must not be empty") + } switch encodedVersionedSet.FieldsType { case "FieldsV1": // Valid case. diff --git a/pkg/endpoints/handlers/fieldmanager/internal/managedfields_test.go b/pkg/endpoints/handlers/fieldmanager/internal/managedfields_test.go index 1ca4d4b0b..f6df7228c 100644 --- a/pkg/endpoints/handlers/fieldmanager/internal/managedfields_test.go +++ b/pkg/endpoints/handlers/fieldmanager/internal/managedfields_test.go @@ -72,6 +72,84 @@ func TestHasFieldsType(t *testing.T) { } } +// TestHasAPIVersion makes sure that we fail if we don't have an +// APIVersion set. +func TestHasAPIVersion(t *testing.T) { + var unmarshaled []metav1.ManagedFieldsEntry + if err := yaml.Unmarshal([]byte(`- apiVersion: v1 + fieldsType: FieldsV1 + fieldsV1: + f:field: {} + manager: foo + operation: Apply +`), &unmarshaled); err != nil { + t.Fatalf("did not expect yaml unmarshalling error but got: %v", err) + } + if _, err := DecodeManagedFields(unmarshaled); err != nil { + t.Fatalf("did not expect decoding error but got: %v", err) + } + + // Missing apiVersion. + unmarshaled = nil + if err := yaml.Unmarshal([]byte(`- fieldsType: FieldsV1 + fieldsV1: + f:field: {} + manager: foo + operation: Apply +`), &unmarshaled); err != nil { + t.Fatalf("did not expect yaml unmarshalling error but got: %v", err) + } + if _, err := DecodeManagedFields(unmarshaled); err == nil { + t.Fatal("Expect decoding error but got none") + } +} + +// TestHasOperation makes sure that we fail if we don't have an +// Operation set properly. +func TestHasOperation(t *testing.T) { + var unmarshaled []metav1.ManagedFieldsEntry + if err := yaml.Unmarshal([]byte(`- apiVersion: v1 + fieldsType: FieldsV1 + fieldsV1: + f:field: {} + manager: foo + operation: Apply +`), &unmarshaled); err != nil { + t.Fatalf("did not expect yaml unmarshalling error but got: %v", err) + } + if _, err := DecodeManagedFields(unmarshaled); err != nil { + t.Fatalf("did not expect decoding error but got: %v", err) + } + + // Invalid operation. + if err := yaml.Unmarshal([]byte(`- apiVersion: v1 + fieldsType: FieldsV1 + fieldsV1: + f:field: {} + manager: foo + operation: Invalid +`), &unmarshaled); err != nil { + t.Fatalf("did not expect yaml unmarshalling error but got: %v", err) + } + if _, err := DecodeManagedFields(unmarshaled); err == nil { + t.Fatal("Expect decoding error but got none") + } + + // Missing operation. + unmarshaled = nil + if err := yaml.Unmarshal([]byte(`- apiVersion: v1 + fieldsType: FieldsV1 + fieldsV1: + f:field: {} + manager: foo +`), &unmarshaled); err != nil { + t.Fatalf("did not expect yaml unmarshalling error but got: %v", err) + } + if _, err := DecodeManagedFields(unmarshaled); err == nil { + t.Fatal("Expect decoding error but got none") + } +} + // TestRoundTripManagedFields will roundtrip ManagedFields from the wire format // (api format) to the format used by sigs.k8s.io/structured-merge-diff and back func TestRoundTripManagedFields(t *testing.T) { From 8ef7c0686d832f3175857bf546e0821008a0d978 Mon Sep 17 00:00:00 2001 From: Kevin Wiesmueller Date: Mon, 1 Mar 2021 20:29:15 +0100 Subject: [PATCH 13/14] only use managedFields decoding for admission check Kubernetes-commit: 98d498117b5566c1229d754d97923f61600660d8 --- .../handlers/fieldmanager/admission.go | 2 +- .../handlers/fieldmanager/validation.go | 38 ------------------- 2 files changed, 1 insertion(+), 39 deletions(-) delete mode 100644 pkg/endpoints/handlers/fieldmanager/validation.go diff --git a/pkg/endpoints/handlers/fieldmanager/admission.go b/pkg/endpoints/handlers/fieldmanager/admission.go index 751c4753d..fdc95aa93 100644 --- a/pkg/endpoints/handlers/fieldmanager/admission.go +++ b/pkg/endpoints/handlers/fieldmanager/admission.go @@ -67,7 +67,7 @@ func (admit *managedFieldsValidatingAdmissionController) Admit(ctx context.Conte return err } managedFieldsAfterAdmission := objectMeta.GetManagedFields() - if err := ValidateManagedFields(managedFieldsAfterAdmission); err != nil { + if _, err := DecodeManagedFields(managedFieldsAfterAdmission); err != nil { objectMeta.SetManagedFields(managedFieldsBeforeAdmission) warning.AddWarning(ctx, "", fmt.Sprintf(InvalidManagedFieldsAfterMutatingAdmissionWarningFormat, diff --git a/pkg/endpoints/handlers/fieldmanager/validation.go b/pkg/endpoints/handlers/fieldmanager/validation.go deleted file mode 100644 index 324c23b55..000000000 --- a/pkg/endpoints/handlers/fieldmanager/validation.go +++ /dev/null @@ -1,38 +0,0 @@ -/* -Copyright 2021 The Kubernetes Authors. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ - -package fieldmanager - -import ( - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - v1validation "k8s.io/apimachinery/pkg/apis/meta/v1/validation" - "k8s.io/apimachinery/pkg/util/validation/field" -) - -// ValidateManagedFields by checking the integrity of every entry and trying to decode -// them to the internal format -func ValidateManagedFields(managedFields []metav1.ManagedFieldsEntry) error { - validationErrs := v1validation.ValidateManagedFields(managedFields, field.NewPath("metadata").Child("managedFields")) - if len(validationErrs) > 0 { - return validationErrs.ToAggregate() - } - - if _, err := DecodeManagedFields(managedFields); err != nil { - return err - } - - return nil -} From b101f44b7692bfd447ed03d880c384860b6f3ec5 Mon Sep 17 00:00:00 2001 From: Kevin Wiesmueller Date: Thu, 4 Mar 2021 23:20:51 +0100 Subject: [PATCH 14/14] cleanup managedFields admission and test Kubernetes-commit: 2d1ba0c35829a2f146a712d49cb21f382c9894cb --- .../handlers/fieldmanager/admission.go | 4 +- .../handlers/fieldmanager/admission_test.go | 121 ++++++++---------- 2 files changed, 58 insertions(+), 67 deletions(-) diff --git a/pkg/endpoints/handlers/fieldmanager/admission.go b/pkg/endpoints/handlers/fieldmanager/admission.go index fdc95aa93..20bbab065 100644 --- a/pkg/endpoints/handlers/fieldmanager/admission.go +++ b/pkg/endpoints/handlers/fieldmanager/admission.go @@ -46,12 +46,12 @@ var _ admission.Interface = &managedFieldsValidatingAdmissionController{} var _ admission.MutationInterface = &managedFieldsValidatingAdmissionController{} var _ admission.ValidationInterface = &managedFieldsValidatingAdmissionController{} -// Handles calls the wrapped admission.Interface if aplicable +// Handles calls the wrapped admission.Interface if applicable func (admit *managedFieldsValidatingAdmissionController) Handles(operation admission.Operation) bool { return admit.wrap.Handles(operation) } -// Admit calls the wrapped admission.Interface if aplicable and resets the managedFields to their state before admission if they +// Admit calls the wrapped admission.Interface if applicable and resets the managedFields to their state before admission if they // got modified in an invalid way func (admit *managedFieldsValidatingAdmissionController) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error) { mutationInterface, isMutationInterface := admit.wrap.(admission.MutationInterface) diff --git a/pkg/endpoints/handlers/fieldmanager/admission_test.go b/pkg/endpoints/handlers/fieldmanager/admission_test.go index a6aac4448..09df1f476 100644 --- a/pkg/endpoints/handlers/fieldmanager/admission_test.go +++ b/pkg/endpoints/handlers/fieldmanager/admission_test.go @@ -21,89 +21,80 @@ import ( "reflect" "testing" + v1 "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/api/meta" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" - "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" "k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/apiserver/pkg/admission" "k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager" + "k8s.io/apiserver/pkg/endpoints/handlers/fieldmanager/internal" + "sigs.k8s.io/structured-merge-diff/v4/fieldpath" ) func TestAdmission(t *testing.T) { wrap := &mockAdmissionController{} ac := fieldmanager.NewManagedFieldsValidatingAdmissionController(wrap) + now := metav1.Now() - tests := []struct { - beforeAdmission []metav1.ManagedFieldsEntry - afterAdmission []metav1.ManagedFieldsEntry - expected []metav1.ManagedFieldsEntry - }{ - { - beforeAdmission: []metav1.ManagedFieldsEntry{ - { - Manager: "test", - }, - }, - afterAdmission: []metav1.ManagedFieldsEntry{ - { - Manager: "", - }, - }, - expected: []metav1.ManagedFieldsEntry{ - { - Manager: "test", - }, - }, + validFieldsV1, err := internal.SetToFields(*fieldpath.NewSet(fieldpath.MakePathOrDie("metadata", "labels", "test-label"))) + if err != nil { + t.Fatal(err) + } + validManagedFieldsEntry := metav1.ManagedFieldsEntry{ + APIVersion: "v1", + Operation: metav1.ManagedFieldsOperationApply, + Time: &now, + Manager: "test", + FieldsType: "FieldsV1", + FieldsV1: &validFieldsV1, + } + + managedFieldsMutators := map[string]func(in metav1.ManagedFieldsEntry) (out metav1.ManagedFieldsEntry, shouldReset bool){ + "invalid APIVersion": func(managedFields metav1.ManagedFieldsEntry) (metav1.ManagedFieldsEntry, bool) { + managedFields.APIVersion = "" + return managedFields, true }, - { - beforeAdmission: []metav1.ManagedFieldsEntry{ - { - APIVersion: "test", - }, - }, - afterAdmission: []metav1.ManagedFieldsEntry{ - { - APIVersion: "", - }, - }, - expected: []metav1.ManagedFieldsEntry{ - { - APIVersion: "test", - }, - }, + "invalid Operation": func(managedFields metav1.ManagedFieldsEntry) (metav1.ManagedFieldsEntry, bool) { + managedFields.Operation = "invalid operation" + return managedFields, true }, - { - beforeAdmission: []metav1.ManagedFieldsEntry{ - { - FieldsType: "FieldsV1", - }, - }, - afterAdmission: []metav1.ManagedFieldsEntry{ - { - FieldsType: "test", - }, - }, - expected: []metav1.ManagedFieldsEntry{ - { - FieldsType: "FieldsV1", - }, - }, + "invalid fieldsType": func(managedFields metav1.ManagedFieldsEntry) (metav1.ManagedFieldsEntry, bool) { + managedFields.FieldsType = "invalid fieldsType" + return managedFields, true + }, + "invalid fieldsV1": func(managedFields metav1.ManagedFieldsEntry) (metav1.ManagedFieldsEntry, bool) { + managedFields.FieldsV1 = &metav1.FieldsV1{Raw: []byte("{invalid}")} + return managedFields, true + }, + "invalid manager": func(managedFields metav1.ManagedFieldsEntry) (metav1.ManagedFieldsEntry, bool) { + managedFields.Manager = "" + return managedFields, false }, } - for _, test := range tests { - obj := &unstructured.Unstructured{} - obj.SetManagedFields(test.beforeAdmission) - wrap.admit = replaceManagedFields(test.afterAdmission) + for name, mutate := range managedFieldsMutators { + t.Run(name, func(t *testing.T) { + mutated, shouldReset := mutate(validManagedFieldsEntry) + validEntries := []metav1.ManagedFieldsEntry{validManagedFieldsEntry} + mutatedEntries := []metav1.ManagedFieldsEntry{mutated} - attrs := admission.NewAttributesRecord(obj, obj, schema.GroupVersionKind{}, "default", "", schema.GroupVersionResource{}, "", admission.Update, nil, false, nil) - if err := ac.(admission.MutationInterface).Admit(context.TODO(), attrs, nil); err != nil { - t.Fatal(err) - } + obj := &v1.ConfigMap{} + obj.SetManagedFields(validEntries) - if !reflect.DeepEqual(obj.GetManagedFields(), test.expected) { - t.Fatalf("expected: \n%v\ngot:\n%v", test.expected, obj.GetManagedFields()) - } + wrap.admit = replaceManagedFields(mutatedEntries) + + attrs := admission.NewAttributesRecord(obj, obj, schema.GroupVersionKind{}, "default", "", schema.GroupVersionResource{}, "", admission.Update, nil, false, nil) + if err := ac.(admission.MutationInterface).Admit(context.TODO(), attrs, nil); err != nil { + t.Fatal(err) + } + + if shouldReset && !reflect.DeepEqual(obj.GetManagedFields(), validEntries) { + t.Fatalf("expected: \n%v\ngot:\n%v", validEntries, obj.GetManagedFields()) + } + if !shouldReset && reflect.DeepEqual(obj.GetManagedFields(), validEntries) { + t.Fatalf("expected: \n%v\ngot:\n%v", mutatedEntries, obj.GetManagedFields()) + } + }) } }