Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ensure 4xx+ response codes from webhook rejections #77022

Merged
merged 1 commit into from
May 4, 2019
Merged

Ensure 4xx+ response codes from webhook rejections #77022

merged 1 commit into from
May 4, 2019

Conversation

liggitt
Copy link
Member

@liggitt liggitt commented Apr 24, 2019

What type of PR is this?
/kind bug

What this PR does / why we need it:
Admission webhooks can unintentionally reject requests while still returning a 200 status to the user.

This causes things like kubectl create to return a 0 status when their request was actually rejected.

Webhook dispatch should force rejections to have >= 400 http status codes.

Special notes for your reviewer:
xref #76984

Does this PR introduce a user-facing change?:

API requests rejected by admission webhooks which specify an http status code < 400 are now assigned a 400 status code.

@k8s-ci-robot k8s-ci-robot added kind/bug Categorizes issue or PR as related to a bug. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Apr 24, 2019
@liggitt liggitt mentioned this pull request Apr 24, 2019
Closed
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 24, 2019
@k8s-ci-robot k8s-ci-robot added area/apiserver sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. and removed needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Apr 24, 2019
@liggitt
Copy link
Member Author

liggitt commented Apr 24, 2019

/cc @brendandburns

@liggitt liggitt added the priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. label Apr 24, 2019
@k8s-ci-robot k8s-ci-robot removed the needs-priority Indicates a PR lacks a `priority/foo` label and requires one. label Apr 24, 2019
@liggitt liggitt mentioned this pull request Apr 24, 2019
Closed
@liggitt
Copy link
Member Author

liggitt commented Apr 25, 2019

/cc @caesarxuchao

@liggitt liggitt force-pushed the webhook-error-success branch from 9978a34 to 5007643 Compare April 25, 2019 13:15
liggitt
liggitt commented Apr 26, 2019
View reviewed changes
staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/errors/statuserror.go
@@ -32,6 +33,15 @@ func ToStatusErr(webhookName string, result *metav1.Status) *apierrors.StatusErr
result = &metav1.Status{Status: metav1.StatusFailure}
}

// Make sure we don't return < 400 status codes along with a rejection
if result.Code < http.StatusBadRequest {
result.Code = http.StatusBadRequest
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We talked about switching this to a 500 in the api-machinery call today, but the more I consider this, I think that would be misleading to the end user. The reason their request was rejected was because their request was judged to be bad, not because the server had some error.

I see this as akin to what we do here:

kubernetes/staging/src/k8s.io/apiserver/pkg/endpoints/handlers/responsewriters/writers.go

Lines 119 to 126 in 7289c1e

_, serializer, err := negotiation.NegotiateOutputMediaType(req, s, restrictions)
if err != nil {
// if original statusCode was not successful we need to return the original error
// we cannot hide it behind negotiation problems
if statusCode < http.StatusOK || statusCode >= http.StatusBadRequest {
WriteRawJSON(int(statusCode), object, w)
return
}

if we encounter a negotiation error in the process of trying to write an error response, we don't switch to a 500, we preserve the original error code

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I personally find that argument compelling.

@caesarxuchao
Copy link
Member

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 3, 2019
@k8s-ci-robot k8s-ci-robot merged commit aefa6d4 into kubernetes:master May 4, 2019
@liggitt liggitt deleted the webhook-error-success branch May 6, 2019 18:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@logicalhan logicalhan logicalhan left review comments

@yue9944882 yue9944882 yue9944882 approved these changes

@jennybuckley jennybuckley Awaiting requested review from jennybuckley

@ncdc ncdc Awaiting requested review from ncdc

@brendandburns brendandburns Awaiting requested review from brendandburns

@caesarxuchao caesarxuchao Awaiting requested review from caesarxuchao

Assignees

@caesarxuchao caesarxuchao

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/admission-control area/apiserver cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@liggitt @k8s-ci-robot @caesarxuchao @logicalhan @yue9944882