Skip to content

k8s/client/fake: let update operations respect resource versioning#44264

Merged
giorio94 merged 7 commits intocilium:mainfrom
giorio94:mio/fake-client-conflict
Feb 14, 2026
Merged

k8s/client/fake: let update operations respect resource versioning#44264
giorio94 merged 7 commits intocilium:mainfrom
giorio94:mio/fake-client-conflict

Conversation

@giorio94
Copy link
Copy Markdown
Member

@giorio94 giorio94 commented Feb 9, 2026

Currently, the statedb object tracker backing the fake kubernetes client used for testing purposes does not respect resource versioning, and allows update operations to succeed regardless of the provided resource version. While convenient for the k8s/update command itself, this approach is problematic in case of controllers acting on the same resources, as it can lead to objects being unexpectedly reverted to incorrect versions, due to the missing optimistic concurrency control.

Let's get this fixed by extending the update implementation to additionally compare the resource version of the stored and provided objects, and reject the update in case they do not match, as the real Kubernetes API Server would do. By default, the k8s/update command still ignores the provided resource version, letting the update succeed regardless: this matches the desired behavior in the vast majority of the tests, and avoids the need for complex operations to set the expected resource version. Still, if necessary, the stricter behavior can be enabled via the dedicated flag.

@giorio94 giorio94 requested a review from joamaki February 9, 2026 08:42
@giorio94 giorio94 requested a review from a team as a code owner February 9, 2026 08:42
@giorio94 giorio94 added release-note/misc This PR makes changes that have no direct user impact. needs-backport/1.19 This PR / issue needs backporting to the v1.19 branch labels Feb 9, 2026
@giorio94
Copy link
Copy Markdown
Member Author

giorio94 commented Feb 9, 2026

/ci-integration

@giorio94
Copy link
Copy Markdown
Member Author

giorio94 commented Feb 9, 2026

Back to draft, as a few tests need to be fixed.

@giorio94 giorio94 marked this pull request as draft February 9, 2026 14:15
Update the TestResource_WithFakeClient test to correctly specify the
expected resource version during updates, in preparation for extending
the fake client to actually enforce optimistic concurrency control.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
Update the TestUpdatePodLabels test to correctly specify the expected
resource version during updates, in preparation for extending the fake
client to actually enforce optimistic concurrency control.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
@giorio94 giorio94 force-pushed the mio/fake-client-conflict branch from 83c73c6 to 0d98ebe Compare February 10, 2026 08:59
@giorio94
Copy link
Copy Markdown
Member Author

/ci-integration

@giorio94
Copy link
Copy Markdown
Member Author

/ci-runtime

Update the Test_LocalNodeCIDRsSyncer test to correctly specify the
expected resource version during updates, in preparation for extending
the fake client to actually enforce optimistic concurrency control.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
Update the bgp tests to correctly specify the expected resource version
during updates, in preparation for extending the fake client to actually
enforce optimistic concurrency control.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
Update the UpdateObjects helper to use the [ObjectTracker.Patch],
instead of [ObjectTracker.Update], in preparation for the subsequent
commit that will make the latter implement optimistic concurrency
control, and validate resource version mismatches, which is not
required in this context.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
Currently, the object tracker is affected by a bug that causes the
resource version to not be set on creation or update if the object
does not have the [metav1.TypeMeta] set. Indeed, in that case, the
function updating the TypeMeta creates a deep copy of the object,
causing operations performed via [meta.Accessor] to act on the old
copy, and not have effect. Let's get this fixed by changing the
[fillTypeMetaIfNeeded] function to not create a deep copy, given
that it already operates on a copy of the original object.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
Currently, the statedb object tracker backing the fake kubernetes client
used for testing purposes does not respect resource versioning, and allows
update operations to succeed regardless of the provided resource version.
While convenient for the `k8s/update` command itself, this approach is
problematic in case of controllers acting on the same resources, as it
can lead to objects being unexpectedly reverted to incorrect versions,
due to the missing optimistic concurrency control.

Let's get this fixed by extending the update implementation to additionally
compare the resource version of the stored and provided objects, and reject
the update in case they do not match, as the real Kubernetes API Server
would do. By default, the k8s/update command still ignores the provided
resource version, letting the update succeed regardless: this matches the
desired behavior in the vast majority of the tests, and avoids the need
for complex operations to set the expected resource version. Still, if
necessary, the stricter behavior can be enabled via the dedicated flag.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
@giorio94 giorio94 force-pushed the mio/fake-client-conflict branch from 0d98ebe to f09bfad Compare February 10, 2026 10:09
@giorio94
Copy link
Copy Markdown
Member Author

/test

@giorio94
Copy link
Copy Markdown
Member Author

Back to draft, as a few tests need to be fixed.

Fixed, reviewable again.

@giorio94 giorio94 marked this pull request as ready for review February 10, 2026 11:02
@giorio94 giorio94 requested review from a team as code owners February 10, 2026 11:02
@giorio94 giorio94 enabled auto-merge February 13, 2026 08:05
@giorio94 giorio94 added this pull request to the merge queue Feb 14, 2026
@maintainer-s-little-helper maintainer-s-little-helper bot added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Feb 14, 2026
Merged via the queue into cilium:main with commit 8f41218 Feb 14, 2026
87 of 88 checks passed
@giorio94 giorio94 deleted the mio/fake-client-conflict branch February 14, 2026 00:36
@glrf glrf mentioned this pull request Feb 17, 2026
12 tasks
@glrf glrf added backport-pending/1.19 The backport for Cilium 1.19.x for this PR is in progress. and removed needs-backport/1.19 This PR / issue needs backporting to the v1.19 branch labels Feb 17, 2026
@github-actions github-actions bot added backport-done/1.19 The backport for Cilium 1.19.x for this PR is done. and removed backport-pending/1.19 The backport for Cilium 1.19.x for this PR is in progress. labels Feb 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport-done/1.19 The backport for Cilium 1.19.x for this PR is done. ready-to-merge This PR has passed all tests and received consensus from code owners to merge. release-note/misc This PR makes changes that have no direct user impact.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants