registry: reject new labels on deployment status updates

pkg/registry/deployment/strategy.go

@@ -92,6 +92,7 @@ func (deploymentStatusStrategy) PrepareForUpdate(obj, old runtime.Object) {
 	newDeployment := obj.(*extensions.Deployment)
 	oldDeployment := old.(*extensions.Deployment)
 	newDeployment.Spec = oldDeployment.Spec
+	newDeployment.Labels = oldDeployment.Labels
 }
 
 // ValidateUpdate is the default update validation for an end user updating status

pkg/registry/deployment/strategy_test.go

@@ -17,13 +17,15 @@ limitations under the License.
 package deployment
 
 import (
+	"reflect"
 	"testing"
 
-	_ "k8s.io/kubernetes/pkg/api"
+	"k8s.io/kubernetes/pkg/api"
 	"k8s.io/kubernetes/pkg/api/testapi"
 	apitesting "k8s.io/kubernetes/pkg/api/testing"
 	"k8s.io/kubernetes/pkg/apis/extensions"
 	"k8s.io/kubernetes/pkg/labels"
+	"k8s.io/kubernetes/pkg/runtime"
 )
 
 func TestSelectableFieldLabelConversions(t *testing.T) {
@@ -34,3 +36,55 @@ func TestSelectableFieldLabelConversions(t *testing.T) {
 		nil,
 	)
 }
+
+func TestStatusUpdates(t *testing.T) {
+	tests := []struct {
+		old      runtime.Object
+		obj      runtime.Object
+		expected runtime.Object
+	}{
+		{
+			old:      newDeployment(map[string]string{"test": "label"}, map[string]string{"test": "annotation"}),
+			obj:      newDeployment(map[string]string{"test": "label", "sneaky": "label"}, map[string]string{"test": "annotation"}),
+			expected: newDeployment(map[string]string{"test": "label"}, map[string]string{"test": "annotation"}),
+		},
+		{
+			old:      newDeployment(map[string]string{"test": "label"}, map[string]string{"test": "annotation"}),
+			obj:      newDeployment(map[string]string{"test": "label"}, map[string]string{"test": "annotation", "sneaky": "annotation"}),
+			expected: newDeployment(map[string]string{"test": "label"}, map[string]string{"test": "annotation", "sneaky": "annotation"}),
+		},
+	}
+
+	for _, test := range tests {
+		deploymentStatusStrategy{}.PrepareForUpdate(test.obj, test.old)
+		if !reflect.DeepEqual(test.expected, test.obj) {
+			t.Errorf("Unexpected object mismatch! Expected:\n%#v\ngot:\n%#v", test.expected, test.obj)
+		}
+	}
+}
+
+func newDeployment(labels, annotations map[string]string) *extensions.Deployment {
+	return &extensions.Deployment{
+		ObjectMeta: api.ObjectMeta{
+			Name:        "test",
+			Labels:      labels,
+			Annotations: annotations,
+		},
+		Spec: extensions.DeploymentSpec{
+			Replicas: 1,
+			Strategy: extensions.DeploymentStrategy{
+				Type: extensions.RecreateDeploymentStrategyType,
+			},
+			Template: api.PodTemplateSpec{
+				Spec: api.PodSpec{
+					Containers: []api.Container{
+						{
+							Name:  "test",
+							Image: "test",
+						},
+					},
+				},
+			},
+		},
+	}
+}