github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Do not allow manual changes to manageFields via subresources

Browse Source 
If a request tries to change managedFields, the response returns the
managedField of the live object.
This commit is contained in:
Andrea Nodari
2020-07-14 17:42:54 +02:00
parent c46c1c043e
commit c522ee08a3
10 changed files with 312 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

72
test/integration/apiserver/apply/apply_crd_test.go
View File

@@ -27,6 +27,7 @@ import (
"k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
"k8s.io/apiextensions-apiserver/test/integration/fixtures"
apierrors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
"k8s.io/apimachinery/pkg/types"
genericfeatures "k8s.io/apiserver/pkg/features"
@@ -129,6 +130,69 @@ spec:
t.Fatalf("failed to apply object with force after updating replicas: %v:\n%v", err, string(result))
}
verifyReplicas(t, result, 1)
// Try to set managed fields using a subresource and verify that it has no effect
existingManagedFields, err := getManagedFields(result)
if err != nil {
t.Fatalf("failed to get managedFields from response: %v", err)
}
updateBytes := []byte(`{
"metadata": {
"managedFields": [{
"manager":"testing",
"operation":"Update",
"apiVersion":"v1",
"fieldsType":"FieldsV1",
"fieldsV1":{
"f:spec":{
"f:containers":{
"k:{\"name\":\"testing\"}":{
".":{},
"f:image":{},
"f:name":{}
}
}
}
}
}]
}
}`)
result, err = rest.Patch(types.MergePatchType).
AbsPath("/apis", noxuDefinition.Spec.Group, noxuDefinition.Spec.Version, noxuDefinition.Spec.Names.Plural).
SubResource("status").
Name(name).
Param("fieldManager", "subresource_test").
Body(updateBytes).
DoRaw(context.TODO())
if err != nil {
t.Fatalf("Error updating subresource: %v ", err)
}
newManagedFields, err := getManagedFields(result)
if err != nil {
t.Fatalf("failed to get managedFields from response: %v", err)
}
if !reflect.DeepEqual(existingManagedFields, newManagedFields) {
t.Fatalf("Expected managed fields to not have changed when trying manually settting them via subresoures.\n\nExpected: %#v\n\nGot: %#v", existingManagedFields, newManagedFields)
}
// However, it is possible to modify managed fields using the main resource
result, err = rest.Patch(types.MergePatchType).
AbsPath("/apis", noxuDefinition.Spec.Group, noxuDefinition.Spec.Version, noxuDefinition.Spec.Names.Plural).
Name(name).
Param("fieldManager", "subresource_test").
Body([]byte(`{"metadata":{"managedFields":[{}]}}`)).
DoRaw(context.TODO())
if err != nil {
t.Fatalf("Error updating managed fields of the main resource: %v ", err)
}
newManagedFields, err = getManagedFields(result)
if err != nil {
t.Fatalf("failed to get managedFields from response: %v", err)
}
if len(newManagedFields) != 0 {
t.Fatalf("Expected managed fields to have been reset, but got: %v", newManagedFields)
}
}
// TestApplyCRDStructuralSchema tests that when a CRD has a structural schema in its validation field,
@@ -753,3 +817,11 @@ spec:
}
verifyReplicas(t, result, 1)
}
func getManagedFields(rawResponse []byte) ([]metav1.ManagedFieldsEntry, error) {
obj := unstructured.Unstructured{}
if err := obj.UnmarshalJSON(rawResponse); err != nil {
return nil, err
}
return obj.GetManagedFields(), nil
}