Ignore changes to managed field in noderestriction

The validation is failing because the managedfields are changed when the object is updated. We don't have a good way to verify that the changes are only the ones that are supposed to happen, so we'll just ignore them for now.

Ignore changes to managed field in noderestriction
55f9eeed · Antoine Pelisse · 47063891 · 55f9eeed
Commit 55f9eeed authored Mar 06, 2019 by Antoine Pelisse
Hide whitespace changes
Inline Side-by-side

Showing with 6 additions and 0 deletions

admission.go plugin/pkg/admission/noderestriction/admission.go +6 -0

No files found.
--- a/plugin/pkg/admission/noderestriction/admission.go
+++ b/plugin/pkg/admission/noderestriction/admission.go
@@ -309,6 +309,12 @@ func (c *nodePlugin) admitPVCStatus(nodeName string, a admission.Attributes) err
 		oldPVC.Status.Conditions = nil
 		newPVC.Status.Conditions = nil

+		// TODO(apelisse): We don't have a good mechanism to
+		// verify that only the things that should have changed
+		// have changed. Ignore it for now.
+		oldPVC.ObjectMeta.ManagedFields = nil
+		newPVC.ObjectMeta.ManagedFields = nil
+
 		// ensure no metadata changed. nodes should not be able to relabel, add finalizers/owners, etc
 		if !apiequality.Semantic.DeepEqual(oldPVC, newPVC) {
 			return admission.NewForbidden(a, fmt.Errorf("node %q is not allowed to update fields other than status.capacity and status.conditions: %v", nodeName, diff.ObjectReflectDiff(oldPVC, newPVC)))