Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug 1820255: Fix race for localhost-recovery-client-token snapshotting #815

Merged
merged 2 commits into from Apr 7, 2020

Conversation

tnozicka
Copy link
Contributor

@tnozicka tnozicka commented Apr 2, 2020

When localhost-recovery-client-token secret got created there is a race between kube-controller-manager to inject a token into it and revision controller that snapshots it. If it snapshots it before the token is injected we deploy without a token.

/cc @deads2k @soltysh @sttts

@openshift-ci-robot openshift-ci-robot added the bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. label Apr 2, 2020
@openshift-ci-robot
Copy link

@tnozicka: This pull request references Bugzilla bug 1819256, which is valid. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.5.0) matches configured target release for branch (4.5.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1819256: Fix race for localhost-recovery-client-token snapshotting

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@@ -348,6 +348,24 @@ func SyncSecret(client coreclientv1.SecretsGetter, recorder events.Recorder, sou
case err != nil:
return nil, false, err
default:
if source.Type == corev1.SecretTypeServiceAccountToken {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fix is here

@openshift-ci-robot openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 2, 2020
@tnozicka tnozicka changed the title Bug 1819256: Fix race for localhost-recovery-client-token snapshotting Bug 1820255: Fix race for localhost-recovery-client-token snapshotting Apr 2, 2020
@openshift-ci-robot
Copy link

@tnozicka: This pull request references Bugzilla bug 1820255, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.5.0) matches configured target release for branch (4.5.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1820255: Fix race for localhost-recovery-client-token snapshotting

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tnozicka
Copy link
Contributor Author

tnozicka commented Apr 6, 2020

/retest

@openshift-ci-robot
Copy link

openshift-ci-robot commented Apr 6, 2020

@tnozicka: The following test failed, say /retest to rerun all failed tests:

Test name Commit Details Rerun command
ci/prow/verify e83b830 link /test verify

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@@ -41,6 +42,18 @@ import (
"k8s.io/client-go/kubernetes"
)

type encryptionProvider []schema.GroupResource
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@p0lyn0mial I suppose this could have been in library-go next to the interface as SimpleProvider

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, thx :)

Copy link
Member

@soltysh soltysh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Apr 7, 2020
@openshift-ci-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: soltysh, tnozicka

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-robot openshift-merge-robot merged commit 321793d into openshift:master Apr 7, 2020
@openshift-ci-robot
Copy link

@tnozicka: All pull requests linked via external trackers have merged: openshift/cluster-kube-apiserver-operator#815. Bugzilla bug 1820255 has been moved to the MODIFIED state.

In response to this:

Bug 1820255: Fix race for localhost-recovery-client-token snapshotting

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.


var _ controllers.Provider = encryptionProvider{}

func (p encryptionProvider) EncryptedGRs() []schema.GroupResource {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@p0lyn0mial I missed this in library-go, but I think we should try to keep interfaces more verbose rather than cryptic, iow. this should've been EncryptedGroupResources just to follow the API patterns we have everywhere. It's ok to name local variables this way but interfaces not necessarily, if in doubt look at k8s always 😉

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, thx :)

@tnozicka tnozicka deleted the fix-sa-token-race branch April 7, 2020 07:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants