Merge pull request #113206 from marseel/fix/fix_estimator_for_serviceaccount_tokens

Fix APF width estimate for creating service account's token

Kubernetes-commit: b7f5de17aeef93481f32a4cb804a72cd9ed9c8f3

go.mod

@@ -45,7 +45,7 @@ require (
 	k8s.io/api v0.0.0-20221028075226-689257039cfb
 	k8s.io/apimachinery v0.0.0-20221028155017-b03a432a2a6d
 	k8s.io/client-go v0.0.0-20221028155554-0d5739633518
-	k8s.io/component-base v0.0.0-20221028160413-57523092d0c2
+	k8s.io/component-base v0.0.0-20221031160353-c8872eefda04
 	k8s.io/klog/v2 v2.80.1
 	k8s.io/kms v0.0.0-20221028080743-a9ba1c11c0c6
 	k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280
@@ -125,6 +125,6 @@ replace (
 	k8s.io/api => k8s.io/api v0.0.0-20221028075226-689257039cfb
 	k8s.io/apimachinery => k8s.io/apimachinery v0.0.0-20221028155017-b03a432a2a6d
 	k8s.io/client-go => k8s.io/client-go v0.0.0-20221028155554-0d5739633518
-	k8s.io/component-base => k8s.io/component-base v0.0.0-20221028160413-57523092d0c2
+	k8s.io/component-base => k8s.io/component-base v0.0.0-20221031160353-c8872eefda04
 	k8s.io/kms => k8s.io/kms v0.0.0-20221028080743-a9ba1c11c0c6
 )

go.sum

@@ -991,8 +991,8 @@ k8s.io/apimachinery v0.0.0-20221028155017-b03a432a2a6d h1:fg/DbLqFKxFESf3AnU5iwC
 k8s.io/apimachinery v0.0.0-20221028155017-b03a432a2a6d/go.mod h1:zSkBXgO5G/dSQOe256tx5Yo2OJytojpY3bsXu/4/ZJE=
 k8s.io/client-go v0.0.0-20221028155554-0d5739633518 h1:KlSjZkXeVyocbVpEU157nadMdQIfWXchaItVtjmMVUE=
 k8s.io/client-go v0.0.0-20221028155554-0d5739633518/go.mod h1:9OZTm80DH1AI7P4cpx8yehVlTU1xZQCsMtAtlJYLWDw=
-k8s.io/component-base v0.0.0-20221028160413-57523092d0c2 h1:lHXBae/IFHPh8Lu9rDRTzt6KyTiBkKvRJWeLTYpXFDA=
+k8s.io/component-base v0.0.0-20221031160353-c8872eefda04 h1:tL8a+FAFKTda16A1vpPcIaR/9bfU0xkXZ9VixFrZIrE=
-k8s.io/component-base v0.0.0-20221028160413-57523092d0c2/go.mod h1:ng9M2gjWKyA3UKzYYImYBFvpk731uuzazqB7Ti2cKmA=
+k8s.io/component-base v0.0.0-20221031160353-c8872eefda04/go.mod h1:2u5b++Nak6uQthP6lk4Ntriz+N4l0cK1V4hlgW83H8I=
 k8s.io/klog/v2 v2.80.1 h1:atnLQ121W371wYYFawwYx1aEY2eUfs4l3J72wtgAwV4=
 k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/kms v0.0.0-20221028080743-a9ba1c11c0c6 h1:d/x+J+EPT4UkD2pH39Ms5xKo1IVDfYlzoxowFd99tFg=

pkg/util/flowcontrol/request/mutating_work_estimator.go

@@ -57,6 +57,15 @@ func (e *mutatingWorkEstimator) estimate(r *http.Request, flowSchemaName, priori
 			AdditionalLatency: e.config.eventAdditionalDuration(),
 		}
 	}
+
+	if isRequestExemptFromWatchEvents(requestInfo) {
+		return WorkEstimate{
+			InitialSeats:      e.config.MinimumSeats,
+			FinalSeats:        0,
+			AdditionalLatency: time.Duration(0),
+		}
+	}
+
 	watchCount := e.countFn(requestInfo)
 	metrics.ObserveWatchCount(r.Context(), priorityLevelName, flowSchemaName, watchCount)
 
@@ -129,3 +138,12 @@ func (e *mutatingWorkEstimator) estimate(r *http.Request, flowSchemaName, priori
 		AdditionalLatency: additionalLatency,
 	}
 }
+
+func isRequestExemptFromWatchEvents(requestInfo *apirequest.RequestInfo) bool {
+	// Creating token for service account does not produce any event,
+	// but still serviceaccounts can have multiple watchers.
+	if requestInfo.Resource == "serviceaccounts" && requestInfo.Subresource == "token" {
+		return true
+	}
+	return false
+}

pkg/util/flowcontrol/request/width_test.go

@@ -410,6 +410,33 @@ func TestWorkEstimator(t *testing.T) {
 			finalSeatsExpected:        3,
 			additionalLatencyExpected: 5 * time.Millisecond,
 		},
+		{
+			name:       "creating token for service account",
+			requestURI: "http://server/api/v1/namespaces/foo/serviceaccounts/default/token",
+			requestInfo: &apirequest.RequestInfo{
+				Verb:        "create",
+				APIGroup:    "v1",
+				Resource:    "serviceaccounts",
+				Subresource: "token",
+			},
+			watchCount:                5777,
+			initialSeatsExpected:      minimumSeats,
+			finalSeatsExpected:        0,
+			additionalLatencyExpected: 0,
+		},
+		{
+			name:       "creating service account",
+			requestURI: "http://server/api/v1/namespaces/foo/serviceaccounts",
+			requestInfo: &apirequest.RequestInfo{
+				Verb:     "create",
+				APIGroup: "v1",
+				Resource: "serviceaccounts",
+			},
+			watchCount:                1000,
+			initialSeatsExpected:      1,
+			finalSeatsExpected:        maximumSeats,
+			additionalLatencyExpected: 50 * time.Millisecond,
+		},
 	}
 
 	for _, test := range tests {