-
Notifications
You must be signed in to change notification settings - Fork 40k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Validate deletion timestamp doesn't change on update #24839
Validate deletion timestamp doesn't change on update #24839
Conversation
ff650e0
to
4fd03b3
Compare
cbd4a84
to
751b2a0
Compare
@smarterclayton ptal regarding intended semantics on deletionTimestamp/deleteGracePeriodSeconds @derekwaynecarr ptal at the namespace deletion change... this is the only registry doing unusual things with deletionTimestamp during delete. A rework of graceful deletion is needed to allow a DeleteStrategy to do things like phase changes or finalizer changes, but this was the minimal change I could come up with to avoid allowing mutating deletionTimestamp via anything other than a delete API call. |
751b2a0
to
347390d
Compare
9bee4ec
to
87a7fe7
Compare
I would also like this to be cherry-picked. |
Removing label |
This was an oversight in the implementation. See the initial design that only discussed DELETE triggering a change to DeletionTimestamp: https://github.com/kubernetes/kubernetes/blob/master/docs/design/namespaces.md#phases
It was NOT intended that update to a Namespace could trigger cascading deletion. |
FYI, the |
87a7fe7
to
2993a38
Compare
} | ||
if options.Preconditions.UID == nil { | ||
options.Preconditions.UID = &namespace.UID | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Else, check that namespace.UID == options.Preconditions.UID? (i.e., bail early)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
sure, do we return conflict errors in those cases?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, I think that's what @caesarxuchao did in the place I'm thinking of.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
done
LGTM |
2993a38
to
1e58158
Compare
comments addressed |
tagging per comment |
@k8s-bot test this [submit-queue is verifying that this PR is safe to merge] |
GCE e2e build/test passed for commit 1e58158. |
Automatic merge from submit-queue |
Commit found in the "release-1.2" branch appears to be this PR. Removing the "cherrypick-candidate" label. If this is an error find help to get your PR picked. |
…k-of-#24839-upstream-release-1.2 Automatic merge from submit-queue Automated cherry pick of kubernetes#24839 Cherry pick of kubernetes#24839 on release-1.2.
…k-of-#24839-upstream-release-1.2 Automatic merge from submit-queue Automated cherry pick of kubernetes#24839 Cherry pick of kubernetes#24839 on release-1.2.
Fixes #24828
Updates validation to ensure that deletionTimestamp and deletionGracePeriodSeconds are not set during update operations to ensure those fields are only set during delete operations.