Skip to content

Added set and map structural validation for AllowedTopologies#66843

Merged
k8s-github-robot merged 1 commit intokubernetes:masterfrom
verult:validate-allowedtopologies
Aug 27, 2018
Merged

Added set and map structural validation for AllowedTopologies#66843
k8s-github-robot merged 1 commit intokubernetes:masterfrom
verult:validate-allowedtopologies

Conversation

@verult
Copy link
Copy Markdown
Contributor

@verult verult commented Aug 1, 2018

What this PR does / why we need it: Adding structural validation to AllowedTopologies field in StorageClass.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #66184

Release note:

AllowedTopologies field inside StorageClass is now validated against set and map semantics. Specifically, there cannot be duplicate TopologySelectorTerms, MatchLabelExpressions keys, and TopologySelectorLabelRequirement Values.

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Aug 1, 2018
@verult
Copy link
Copy Markdown
Contributor Author

verult commented Aug 1, 2018

/sig storage
/assign @msau42 @lichuqiang

@k8s-ci-robot k8s-ci-robot requested review from eparis and mbohlool August 1, 2018 02:05
@k8s-ci-robot k8s-ci-robot added the sig/storage Categorizes an issue or PR as relevant to SIG Storage. label Aug 1, 2018
@verult
Copy link
Copy Markdown
Contributor Author

verult commented Aug 1, 2018

/cc ddebroy

@k8s-ci-robot
Copy link
Copy Markdown
Contributor

@verult: GitHub didn't allow me to request PR reviews from the following users: ddebroy.

Note that only kubernetes members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

/cc ddebroy

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@verult verult force-pushed the validate-allowedtopologies branch from 8963cbb to 5374495 Compare August 1, 2018 02:07
@verult
Copy link
Copy Markdown
Contributor Author

verult commented Aug 1, 2018

/assign @liggitt

Copy link
Copy Markdown
Contributor

@lichuqiang lichuqiang left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for help improving this!
A few minor comments, otherwise lgtm

Copy link
Copy Markdown
Contributor

@lichuqiang lichuqiang Aug 1, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@msau42 , I remembered that I had this check in the initial commit,
but you'd suggest that the things of TopologySelectorTerm should be same to that of NodeSelector as much as possible, so we removed it.

Now since it has already been kind of different from NodeSelector, let's add the check here?
An empty expression won't bring users anything I guess.

@verult verult force-pushed the validate-allowedtopologies branch from 5374495 to 532c86e Compare August 1, 2018 05:09
@liggitt
Copy link
Copy Markdown
Member

liggitt commented Aug 1, 2018

/hold

tightening validation is a potentially breaking change that cannot be done without consideration of existing persisted data in etcd. This PR would invalidate persisted data, which we cannot do compatibly.

see discussion in #64841 (comment)

@k8s-ci-robot k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 1, 2018
@msau42
Copy link
Copy Markdown
Member

msau42 commented Aug 1, 2018

@liggitt is tightening validation not allowed even for alpha types?

@ddebroy
Copy link
Copy Markdown
Contributor

ddebroy commented Aug 2, 2018

logic lgtm

@liggitt
Copy link
Copy Markdown
Member

liggitt commented Aug 7, 2018

@liggitt is tightening validation not allowed even for alpha types?

ah, I didn't realize it was a gated alpha field. if it is gated as alpha, that means we have no persisted data for that field in an upgradeable cluster. as long as the schema isn't changing, tightening validation seems acceptable prior to promotion of the field to beta.

@liggitt
Copy link
Copy Markdown
Member

liggitt commented Aug 7, 2018

/hold cancel

@k8s-ci-robot k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 7, 2018
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

think carefully about whether we'd need to extend these with other types of matchers in the future (e.g. a field matcher like this:

// A list of node selector requirements by node's labels.
// +optional
MatchExpressions []NodeSelectorRequirement `json:"matchExpressions,omitempty" protobuf:"bytes,1,rep,name=matchExpressions"`
// A list of node selector requirements by node's fields.
// +optional
MatchFields []NodeSelectorRequirement `json:"matchFields,omitempty" protobuf:"bytes,2,rep,name=matchFields"`

if so, we'd need to tolerate len(term.MatchLabelExpressions) == 0 in validation now to make such a future addition safe for old skewed apiservers

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What does the version skew issue look like? If a client makes a call to create a new object against an old apiserver, wouldn't it fail anyway because MatchFields doesn't exist?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did explicitly call it MatchLabelExpressions to leave room for other types of matchers in the future (although no concrete use cases yet)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@liggitt can you describe more in detail the skew issue?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@liggitt can you describe more in detail the skew issue?

What is the behavior of a TopologySelectorTerm with no MatchLabelExpressions? I'd expect it to match nothing.

Making MatchLabelExpressions required makes it very hard to make it optional in the future without breaking clients that expect a required field to stay required.

Making it optional allows adding something like MatchFieldExpressions to TopologySelectorTerm in the future without breaking clients that assume that all TopologySelectorTerm objects will contain non-zero-length MatchLabelExpressions.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reflect.DeepEqual or semantic.DeepEqual? (reflect differentiates between nil and [], semantic does not)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Neat, in this case reflect.DeepEqual is OK but semantic.DeepEqual is safer. Will update

@verult verult force-pushed the validate-allowedtopologies branch 3 times, most recently from fd01282 to 04c6236 Compare August 11, 2018 01:08
@verult verult force-pushed the validate-allowedtopologies branch from 04c6236 to a805515 Compare August 15, 2018 23:03
@verult
Copy link
Copy Markdown
Contributor Author

verult commented Aug 15, 2018

Removed empty validation on MatchLabelExpressions

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you also add some positive test cases similar to these negative ones? For example, specifying the same key but across different TopologySelectorTerms

@verult verult force-pushed the validate-allowedtopologies branch from a805515 to e5cf6f5 Compare August 16, 2018 23:27
@verult
Copy link
Copy Markdown
Contributor Author

verult commented Aug 16, 2018

addressed comments

@verult
Copy link
Copy Markdown
Contributor Author

verult commented Aug 17, 2018

/retest

@msau42
Copy link
Copy Markdown
Member

msau42 commented Aug 17, 2018

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 17, 2018
@verult
Copy link
Copy Markdown
Contributor Author

verult commented Aug 23, 2018

/retest

@verult
Copy link
Copy Markdown
Contributor Author

verult commented Aug 25, 2018

/retest

Bazel test failure is due to a flake currently being addressed: #67852

@liggitt
Copy link
Copy Markdown
Member

liggitt commented Aug 27, 2018

api-wise, this LGTM. the changes to validation are only to fields that are currently behind alpha gates

/lgtm

@k8s-ci-robot
Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, msau42, verult

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 27, 2018
@k8s-github-robot
Copy link
Copy Markdown

/test all [submit-queue is verifying that this PR is safe to merge]

@k8s-github-robot
Copy link
Copy Markdown

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here.

@k8s-github-robot k8s-github-robot merged commit 344b915 into kubernetes:master Aug 27, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/storage Categorizes an issue or PR as relevant to SIG Storage. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Structural validation of AllowedTopologies field in StorageClass

7 participants