apiserver: Fail if dry-run query param is specified #63557

apelisse · 2018-05-08T22:14:25Z

Adds a dry-run query parameter now that does nothing but reject the request. The sooner we have this check in master, the safer it will be for clients to send dry-run requests that are not going to be applied nonetheless.

Create a new `dryRun` query parameter for mutating endpoints. If the parameter is set, then the query will be rejected, as the feature is not implemented yet. This will allow forward compatibility with future clients; otherwise, future clients talking with older apiservers might end up modifying a resource even if they include the `dryRun` query parameter.

lavalamp · 2018-05-08T22:23:08Z

staging/src/k8s.io/apiserver/pkg/endpoints/handlers/rest.go

@@ -318,3 +319,7 @@ func parseTimeout(str string) time.Duration {
 	}
 	return 30 * time.Second
 }
+
+func isDryRun(url *url.URL) bool {
+	return len(url.Query()["dry-run"]) != 0


The thing to debate is if this is the way we want to represent dry run. I'd open an issue & send an email to the api machinery list, since this is a bit late in the cycle. It's a very simple change so there shouldn't be a problem but let's be noisy about it.

It's probably OK for this sort of PR (maybe @deads2k won't think so), but you should be aware that this skips all of our ordinary URL parsing code.

It's probably OK for this sort of PR (maybe @deads2k won't think so), but you should be aware that this skips all of our ordinary URL parsing code.

I do think it's an example of the feature branch allowing flexibility we wouldn't allow into master. I think that flexibility is very useful when working something like this, but it does undermine the idea that the feature branch is as rigorous as master.

On a related note. If dry-run works well in this branch and the semantics are well described, it seems like a good target to bring into master separately.

This is targeting master :)

The goal is to get dry run as a concept established as early as possible so that it can be relied on to fail safe, since the consequences of submitting a dry run request the server doesn’t know is a dry run is really bad.

Before the parameter is actually used for anything other than a top-level short-circuiting fail like this, I’d expect the create/update/patch handlers to be updated to use the *Options approach and decode parameters just like the other handlers.

Yeah, this change is for master and wouldn't make sense for the feature branch.

I agree w/ @liggitt that it needs to go through the right stack before we do anything productive with it. I think this is fine as an easy & safe way to reserve it, though.

looking at all the other *Options structs, we'd add this as dryRun, not dry-run

apelisse · 2018-05-09T18:22:37Z

/retest

lavalamp · 2018-05-09T21:20:51Z

David & I talked earlier-- this is good to go if you can just add a test ;)

apelisse · 2018-05-09T22:31:44Z

Added tests, PTAL

lavalamp · 2018-05-09T23:22:56Z

staging/src/k8s.io/apiserver/pkg/endpoints/apiserver_test.go

+	}
+}
+
+func TestDryRunPatch(t *testing.T) {


also test update?

not sure how I missed it :-) Thanks

apelisse · 2018-05-10T16:35:16Z

I've added the missing test, and s/dry-run/dryRun.

liggitt · 2018-05-10T17:11:22Z

staging/src/k8s.io/apiserver/pkg/endpoints/apiserver_test.go

+	}
+}
+
+func TestDryRunDelete(t *testing.T) {


deletecollection as well? (with test)

liggitt · 2018-05-10T17:20:39Z

this covers subresources with standard rest crud handlers. what do we plan to do with subresources that implement "connect" (things like pods/exec, pods/attach, */proxy, pods/portforward, etc)?

lavalamp · 2018-05-10T17:41:04Z

That's a great point, I think those should *always* reject dryRun requests--there's no way to pass along the dryRun invariant.

…

On Thu, May 10, 2018 at 10:21 AM Jordan Liggitt ***@***.***> wrote: this covers subresources with standard rest crud handlers. what do we plan to do with subresources that implement "connect" (things like pods/exec, pods/attach, */proxy, pods/portforward, etc)? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#63557 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAnglp6NNrai-OzYV13QkOT9CEbIOLFsks5txHcfgaJpZM4T3a6Q> .

liggitt · 2018-05-10T18:06:05Z

I think those should always reject dryRun requests--there's no way to pass along the dryRun invariant.

wouldn't you expect them to exercise admission/validation the same way a normal request would, and stop short of execution? especially for exec/attach, I could see that being really handy.

lavalamp · 2018-05-10T18:10:10Z

That does sound super handy, actually. @apelisse is going to write up a design doc and this is a good thing to include.

…

On Thu, May 10, 2018 at 11:07 AM Jordan Liggitt ***@***.***> wrote: I think those should *always* reject dryRun requests--there's no way to pass along the dryRun invariant. wouldn't you expect them to exercise admission/validation the same way a normal request would, and stop short of execution? especially for exec/attach, I could see that being really handy. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#63557 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAnglvZN7OSmsHfptCBzwHs_Tyrzc4vpks5txIHJgaJpZM4T3a6Q> .

apelisse · 2018-05-11T23:05:20Z

I've had to change more test code than I wish I had to, but I think this is correct.

apelisse · 2018-05-12T03:04:32Z

staging/src/k8s.io/apiserver/pkg/endpoints/apiserver_test.go

+	return nil, nil
+}
+
+// TestUnimplementedRESTStorage ensures that if a rest.Storage does not implement a given


I should update that comment...

lavalamp · 2018-05-14T18:40:25Z

staging/src/k8s.io/apiserver/pkg/endpoints/handlers/rest.go

@@ -318,3 +319,7 @@ func parseTimeout(str string) time.Duration {
 	}
 	return 30 * time.Second
 }
+


It might be a good idea to add a TODO here explaining that this will be moved to our versioned structs like other parameters before being implemented for real.

lavalamp · 2018-05-14T18:42:49Z

Thanks for putting the test like we discussed IRL :)

I have one suggestion but I think it's optional.

I think, given where you put the check, it's not possible to screw it up by doing start-up plumbing wrong, so there's no need to do an integration check.

I'm not sure how to make this work for aggregated apiservers--we can't force people to upgrade. I will discuss in the issue.

/lgtm
/approve

apelisse · 2018-05-14T22:31:42Z

/retest

apelisse · 2018-05-14T22:32:02Z

/release-note-none

lavalamp · 2018-05-14T22:34:40Z

Are you sure this shouldn't say anything for a release note?

…

On Mon, May 14, 2018 at 3:33 PM Antoine Pelisse ***@***.***> wrote: /release-note-none — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#63557 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAnglpk6pRihZrTdGNC0I2U9KH9miTVhks5tygYhgaJpZM4T3a6Q> .

liggitt · 2018-05-14T22:45:08Z

Yeah, definitely needs a release note

apelisse · 2018-05-14T23:41:13Z

Tentatively added a release note.

lavalamp · 2018-05-14T23:45:56Z

Edited the release note a bit :)

/lgtm

k8s-ci-robot · 2018-05-14T23:46:04Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: apelisse, lavalamp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~staging/src/k8s.io/apiserver/OWNERS~~ [lavalamp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-github-robot · 2018-05-15T09:07:39Z

Automatic merge from submit-queue (batch tested with PRs 63603, 63557, 62015). If you want to cherry-pick this change to another branch, please follow the instructions here.

k8s-ci-robot requested review from enj and smarterclayton May 8, 2018 22:15

apelisse force-pushed the dry-run-path branch from c69107e to 1af56dd Compare May 8, 2018 22:16

lavalamp reviewed May 8, 2018

View reviewed changes

apelisse mentioned this pull request May 8, 2018

Create dry-run query parameter on CREATE/UPDATE/PATCH/DELETE handlers #63559

Closed

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels May 9, 2018

lavalamp reviewed May 9, 2018

View reviewed changes

apelisse force-pushed the dry-run-path branch from 3314338 to 4a5f43c Compare May 10, 2018 16:34

liggitt reviewed May 10, 2018

View reviewed changes

apelisse force-pushed the dry-run-path branch 2 times, most recently from d52d7b5 to 143a068 Compare May 11, 2018 23:04

apelisse commented May 12, 2018

View reviewed changes

apelisse force-pushed the dry-run-path branch from 143a068 to 2d980fa Compare May 14, 2018 17:51

apiserver: Fail if dry-run query param is specified

9861392

apelisse force-pushed the dry-run-path branch from 2d980fa to 9861392 Compare May 14, 2018 18:21

lavalamp reviewed May 14, 2018

View reviewed changes

k8s-ci-robot assigned lavalamp May 14, 2018

k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels May 14, 2018

k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels May 14, 2018

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesn't merit a release note. labels May 14, 2018

k8s-github-robot merged commit 6aa6051 into kubernetes:master May 15, 2018

deads2k mentioned this pull request Jul 25, 2022

Add support for API streaming to the watch-cache #110960

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

apiserver: Fail if dry-run query param is specified #63557

apiserver: Fail if dry-run query param is specified #63557

apelisse commented May 8, 2018 •

edited by lavalamp

Loading

lavalamp May 8, 2018

lavalamp May 8, 2018

deads2k May 9, 2018

liggitt May 9, 2018

liggitt May 9, 2018

lavalamp May 9, 2018

liggitt May 10, 2018

apelisse commented May 9, 2018

lavalamp commented May 9, 2018

apelisse commented May 9, 2018

lavalamp May 9, 2018

apelisse May 10, 2018

apelisse commented May 10, 2018

liggitt May 10, 2018 •

edited

Loading

liggitt commented May 10, 2018

lavalamp commented May 10, 2018 via email

liggitt commented May 10, 2018

lavalamp commented May 10, 2018 via email •

edited by apelisse

Loading

apelisse commented May 11, 2018

apelisse May 12, 2018

lavalamp May 14, 2018

lavalamp commented May 14, 2018

apelisse commented May 14, 2018

apelisse commented May 14, 2018

lavalamp commented May 14, 2018 via email

liggitt commented May 14, 2018

apelisse commented May 14, 2018

lavalamp commented May 14, 2018

k8s-ci-robot commented May 14, 2018

k8s-github-robot commented May 15, 2018

apiserver: Fail if dry-run query param is specified #63557

apiserver: Fail if dry-run query param is specified #63557

Conversation

apelisse commented May 8, 2018 • edited by lavalamp Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

apelisse commented May 9, 2018

lavalamp commented May 9, 2018

apelisse commented May 9, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

apelisse commented May 10, 2018

liggitt May 10, 2018 • edited Loading

Choose a reason for hiding this comment

liggitt commented May 10, 2018

lavalamp commented May 10, 2018 via email

liggitt commented May 10, 2018

lavalamp commented May 10, 2018 via email • edited by apelisse Loading

apelisse commented May 11, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lavalamp commented May 14, 2018

apelisse commented May 14, 2018

apelisse commented May 14, 2018

lavalamp commented May 14, 2018 via email

liggitt commented May 14, 2018

apelisse commented May 14, 2018

lavalamp commented May 14, 2018

k8s-ci-robot commented May 14, 2018

k8s-github-robot commented May 15, 2018

apelisse commented May 8, 2018 •

edited by lavalamp

Loading

liggitt May 10, 2018 •

edited

Loading

lavalamp commented May 10, 2018 via email •

edited by apelisse

Loading