Skip to content

K
k3s
Commit 55f9eeed authored by Antoine Pelisse's avatar Antoine Pelisse
Browse files
Options

Ignore changes to managed field in noderestriction

The validation is failing because the managedfields are changed when the object is updated. We don't have a good way to verify that the changes are only the ones that are supposed to happen, so we'll just ignore them for now.
parent 47063891
Hide whitespace changes
Inline Side-by-side
Showing with 6 additions and 0 deletions
plugin/pkg/admission/noderestriction/admission.go
View file @ 55f9eeed
...@@ -309,6 +309,12 @@ func (c *nodePlugin) admitPVCStatus(nodeName string, a admission.Attributes) err ...@@ -309,6 +309,12 @@ func (c *nodePlugin) admitPVCStatus(nodeName string, a admission.Attributes) err
oldPVC.Status.Conditions = nil oldPVC.Status.Conditions = nil
newPVC.Status.Conditions = nil newPVC.Status.Conditions = nil
// TODO(apelisse): We don't have a good mechanism to
// verify that only the things that should have changed
// have changed. Ignore it for now.
oldPVC.ObjectMeta.ManagedFields = nil
newPVC.ObjectMeta.ManagedFields = nil
// ensure no metadata changed. nodes should not be able to relabel, add finalizers/owners, etc // ensure no metadata changed. nodes should not be able to relabel, add finalizers/owners, etc
if !apiequality.Semantic.DeepEqual(oldPVC, newPVC) { if !apiequality.Semantic.DeepEqual(oldPVC, newPVC) {
return admission.NewForbidden(a, fmt.Errorf("node %q is not allowed to update fields other than status.capacity and status.conditions: %v", nodeName, diff.ObjectReflectDiff(oldPVC, newPVC))) return admission.NewForbidden(a, fmt.Errorf("node %q is not allowed to update fields other than status.capacity and status.conditions: %v", nodeName, diff.ObjectReflectDiff(oldPVC, newPVC)))
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment