From 9ab9ddeb19ca6db1cad11904894a41c87ce76a1b Mon Sep 17 00:00:00 2001 From: Seth Jennings Date: Mon, 12 Feb 2018 14:24:07 -0600 Subject: [PATCH] kubelet: check for illegal phase transition --- pkg/kubelet/kubelet_pods.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkg/kubelet/kubelet_pods.go b/pkg/kubelet/kubelet_pods.go index 5fa3dfd535a..506109ede07 100644 --- a/pkg/kubelet/kubelet_pods.go +++ b/pkg/kubelet/kubelet_pods.go @@ -1359,6 +1359,15 @@ func (kl *Kubelet) generateAPIPodStatus(pod *v1.Pod, podStatus *kubecontainer.Po spec := &pod.Spec allStatus := append(append([]v1.ContainerStatus{}, s.ContainerStatuses...), s.InitContainerStatuses...) s.Phase = getPhase(spec, allStatus) + // Check for illegal phase transition + if pod.Status.Phase == v1.PodFailed || pod.Status.Phase == v1.PodSucceeded { + // API server shows terminal phase; transitions are not allowed + if s.Phase != pod.Status.Phase { + glog.Errorf("Pod attempted illegal phase transition from %s to %s: %v", pod.Status.Phase, s.Phase, s) + // Force back to phase from the API server + s.Phase = pod.Status.Phase + } + } kl.probeManager.UpdatePodStatus(pod.UID, s) s.Conditions = append(s.Conditions, status.GeneratePodInitializedCondition(spec, s.InitContainerStatuses, s.Phase)) s.Conditions = append(s.Conditions, status.GeneratePodReadyCondition(spec, s.ContainerStatuses, s.Phase))