Merge pull request kubernetes#113206 from marseel/fix/fix_estimator_f…

…or_serviceaccount_tokens Fix APF width estimate for creating service account's token
yibozhuang · Nov 1, 2022 · b7f5de1 · b7f5de1
2 parents 303e7cb + 2f7b4ca
commit b7f5de1
Show file tree

Hide file tree

Showing 2 changed files with 45 additions and 0 deletions.
diff --git a/staging/src/k8s.io/apiserver/pkg/util/flowcontrol/request/mutating_work_estimator.go b/staging/src/k8s.io/apiserver/pkg/util/flowcontrol/request/mutating_work_estimator.go
@@ -57,6 +57,15 @@ func (e *mutatingWorkEstimator) estimate(r *http.Request, flowSchemaName, priori
 			AdditionalLatency: e.config.eventAdditionalDuration(),
 		}
 	}
+
+	if isRequestExemptFromWatchEvents(requestInfo) {
+		return WorkEstimate{
+			InitialSeats:      e.config.MinimumSeats,
+			FinalSeats:        0,
+			AdditionalLatency: time.Duration(0),
+		}
+	}
+
 	watchCount := e.countFn(requestInfo)
 	metrics.ObserveWatchCount(r.Context(), priorityLevelName, flowSchemaName, watchCount)
 
@@ -129,3 +138,12 @@ func (e *mutatingWorkEstimator) estimate(r *http.Request, flowSchemaName, priori
 		AdditionalLatency: additionalLatency,
 	}
 }
+
+func isRequestExemptFromWatchEvents(requestInfo *apirequest.RequestInfo) bool {
+	// Creating token for service account does not produce any event,
+	// but still serviceaccounts can have multiple watchers.
+	if requestInfo.Resource == "serviceaccounts" && requestInfo.Subresource == "token" {
+		return true
+	}
+	return false
+}
diff --git a/staging/src/k8s.io/apiserver/pkg/util/flowcontrol/request/width_test.go b/staging/src/k8s.io/apiserver/pkg/util/flowcontrol/request/width_test.go
@@ -410,6 +410,33 @@ func TestWorkEstimator(t *testing.T) {
 			finalSeatsExpected:        3,
 			additionalLatencyExpected: 5 * time.Millisecond,
 		},
+		{
+			name:       "creating token for service account",
+			requestURI: "http://server/api/v1/namespaces/foo/serviceaccounts/default/token",
+			requestInfo: &apirequest.RequestInfo{
+				Verb:        "create",
+				APIGroup:    "v1",
+				Resource:    "serviceaccounts",
+				Subresource: "token",
+			},
+			watchCount:                5777,
+			initialSeatsExpected:      minimumSeats,
+			finalSeatsExpected:        0,
+			additionalLatencyExpected: 0,
+		},
+		{
+			name:       "creating service account",
+			requestURI: "http://server/api/v1/namespaces/foo/serviceaccounts",
+			requestInfo: &apirequest.RequestInfo{
+				Verb:     "create",
+				APIGroup: "v1",
+				Resource: "serviceaccounts",
+			},
+			watchCount:                1000,
+			initialSeatsExpected:      1,
+			finalSeatsExpected:        maximumSeats,
+			additionalLatencyExpected: 50 * time.Millisecond,
+		},
 	}
 
 	for _, test := range tests {