Validate labelSelector in topologySpreadConstraints by maaoBit · Pull Request #111802 · kubernetes/kubernetes

maaoBit · 2022-08-11T13:27:59Z

Signed-off-by: maao maao420691301@gmail.com

What type of PR is this?

/kind bug

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #111791

Special notes for your reviewer:

Does this PR introduce a user-facing change?

LabelSelectors specified in topologySpreadConstraints are now validated to ensure that pod is scheduled as expected. Existing pods with invalid LabelSelectors can be updated, but new pods are required to specify valid LabelSelectors.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

k8s-ci-robot · 2022-08-11T13:28:04Z

Please note that we're already in Test Freeze for the release-1.25 branch. This means every merged PR will be automatically fast-forwarded via the periodic ci-fast-forward job to the release branch of the upcoming v1.25.0 release.

Fast forwards are scheduled to happen every 6 hours, whereas the most recent run was: Thu Aug 11 07:32:13 UTC 2022.

k8s-ci-robot · 2022-08-11T13:28:08Z

@maaoBit: This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot · 2022-08-11T13:28:09Z

Hi @maaoBit. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

alaypatel07 · 2022-08-11T13:56:24Z

/cc

liggitt · 2022-08-16T13:25:22Z

We need to consider what happens to existing persisted data that doesn't pass this validation

This means we need to only apply this stricter validation when validating a create request or an update request of an object that already passes the strict validation.

The pattern we use for this is:

plumbing the PodValidationOptions struct down to this function

add an AllowInvalidTopologySpreadConstraintLabelSelector bool field to that struct

populate that field in GetValidationOptionsFromPodSpecAndMeta:

set it to false when creating a new pod

set it to true when updating a pod where the old pod has invalid topology spread constraint label selectors

set it to false otherwise

Make this new validation line conditional on that boolean field

Add unit tests:

validate a new pod (should not allow invalid selectors)

validate an updated pod where the old pod has invalid selectors (should allow the new pod to have an invalid selector)

validate an updated pod where the old pod has valid selectors (should not allow the new pod to have an invalid selector)

thanks for review. PR has been updated. PTAL

alaypatel07 · 2022-08-17T15:26:55Z

wonder if we need another test for invalid matchlables but with AllowInvalidTopologySpreadConstraintLabelSelector set to true to account for an update with invalid pod

maaoBit · 2022-08-18T09:02:58Z

@alaypatel07 Done

alculquicondor

It looks generally good, but there is something else that we need to make sure:

When tightening validation, a Pod that used to work should continue to work. For this PR, this means that if a Pod had an invalid labelSelector, it should have failed to schedule.

Can you verify that this is the case?

alculquicondor · 2022-08-18T16:23:42Z

rename to metavalidation

maaoBit · 2022-11-18T01:25:35Z

/test pull-kubernetes-verify

liggitt · 2022-11-23T19:28:11Z

this lgtm, just a couple comments

/milestone v1.27

alculquicondor

/approve
/lgtm
/hold for optional nit

Signed-off-by: maao <maao420691301@gmail.com>

alculquicondor · 2022-11-28T14:01:34Z

/lgtm
/hold cancel

This needs a release note btw.

alculquicondor · 2022-11-28T14:02:00Z

/hold
for release note

liggitt · 2022-11-28T14:02:34Z

/approve

k8s-ci-robot · 2022-11-28T14:02:42Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alculquicondor, liggitt, maaoBit

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~pkg/api/OWNERS~~ [liggitt]
~~pkg/apis/OWNERS~~ [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

dims · 2022-12-12T15:33:38Z

If you still need this PR then please rebase, if not, please close the PR

maaoBit · 2022-12-13T01:27:52Z

release note has been added, remove hold label
/hold cancel
@dims this PR has been rebased.

dims · 2022-12-13T02:30:11Z

i can see it in the merge queue - https://prow.k8s.io/tide

ameukam · 2022-12-13T09:51:49Z

/milestone v1.27

The milestone_applier plugin was not configured to add 1.27 milestone

k8s-ci-robot added kind/bug Categorizes issue or PR as related to a bug. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Aug 11, 2022

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Aug 11, 2022

k8s-ci-robot added needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Aug 11, 2022

k8s-ci-robot added the needs-priority Indicates a PR lacks a `priority/foo` label and requires one. label Aug 11, 2022

k8s-ci-robot requested review from dchen1107 and soltysh August 11, 2022 13:28

k8s-ci-robot requested a review from alaypatel07 August 11, 2022 13:56

liggitt reviewed Aug 16, 2022

View reviewed changes

liggitt added the api-review Categorizes an issue or PR as actively needing an API review. label Aug 16, 2022

liggitt self-assigned this Aug 16, 2022

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Aug 17, 2022

alaypatel07 reviewed Aug 17, 2022

View reviewed changes

Comment thread pkg/api/pod/util.go Outdated

alaypatel07 reviewed Aug 17, 2022

View reviewed changes

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Aug 18, 2022

alculquicondor reviewed Aug 18, 2022

View reviewed changes

liggitt reviewed Nov 23, 2022

View reviewed changes

Comment thread pkg/api/pod/util.go Outdated

Comment thread pkg/api/pod/util_test.go Outdated

k8s-ci-robot added this to the v1.27 milestone Nov 23, 2022

alculquicondor reviewed Nov 24, 2022

View reviewed changes

Comment thread pkg/api/pod/util_test.go Outdated

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 24, 2022

Validate labelSelector in topologySpreadConstraints

a796707

Signed-off-by: maao <maao420691301@gmail.com>

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 28, 2022

k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. and removed do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. labels Nov 28, 2022

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 28, 2022

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 13, 2022

k8s-ci-robot merged commit cb03415 into kubernetes:master Dec 13, 2022

k8s-ci-robot modified the milestones: v1.27, v1.26 Dec 13, 2022

k8s-ci-robot modified the milestones: v1.26, v1.27 Dec 13, 2022

kerthcet mentioned this pull request Jan 11, 2023

topologySpreadConstraints[*].labelSelector is not correctly validated #114932

Closed

Conversation

maaoBit commented Aug 11, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

Uh oh!

k8s-ci-robot commented Aug 11, 2022

Uh oh!

k8s-ci-robot commented Aug 11, 2022

Uh oh!

k8s-ci-robot commented Aug 11, 2022

Uh oh!

alaypatel07 commented Aug 11, 2022

Uh oh!

liggitt Aug 16, 2022

Choose a reason for hiding this comment

Uh oh!

maaoBit Aug 17, 2022

Choose a reason for hiding this comment

Uh oh!

Uh oh!

alaypatel07 Aug 17, 2022

Choose a reason for hiding this comment

Uh oh!

maaoBit commented Aug 18, 2022

Uh oh!

alculquicondor left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

alculquicondor Aug 18, 2022

Choose a reason for hiding this comment

Uh oh!

Uh oh!

maaoBit commented Nov 18, 2022

Uh oh!

Uh oh!

Uh oh!

liggitt commented Nov 23, 2022

Uh oh!

alculquicondor left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

alculquicondor commented Nov 28, 2022

Uh oh!

alculquicondor commented Nov 28, 2022

Uh oh!

liggitt commented Nov 28, 2022

Uh oh!

k8s-ci-robot commented Nov 28, 2022

Uh oh!

dims commented Dec 12, 2022

Uh oh!

maaoBit commented Dec 13, 2022

Uh oh!

dims commented Dec 13, 2022

Uh oh!

ameukam commented Dec 13, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

maaoBit commented Aug 11, 2022 •

edited

Loading