Merge pull request #47864 from droot/podpreset-conflict-fix

hack/local-up-cluster.sh

@@ -406,7 +406,6 @@ function start_apiserver {
 
     # Admission Controllers to invoke prior to persisting objects in cluster
     ADMISSION_CONTROL=Initializers,NamespaceLifecycle,LimitRanger,ServiceAccount${security_admission},ResourceQuota,DefaultStorageClass,DefaultTolerationSeconds
-
     # This is the default dir and filename where the apiserver will generate a self-signed cert
     # which should be able to be used as the CA to verify itself
 

plugin/pkg/admission/podpreset/BUILD

@@ -43,6 +43,7 @@ go_library(
         "//vendor/k8s.io/apimachinery/pkg/api/errors:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/labels:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/util/errors:go_default_library",
         "//vendor/k8s.io/apiserver/pkg/admission:go_default_library",
     ],
 )

plugin/pkg/admission/podpreset/admission_test.go

@@ -66,8 +66,8 @@ func TestMergeEnv(t *testing.T) {
 
 	for name, test := range tests {
 		result, err := mergeEnv(
-			&settings.PodPreset{Spec: settings.PodPresetSpec{Env: test.mod}},
 			test.orig,
+			[]*settings.PodPreset{{Spec: settings.PodPresetSpec{Env: test.mod}}},
 		)
 		if test.shouldFail && err == nil {
 			t.Fatalf("expected test %q to fail but got nil", name)
@@ -162,8 +162,8 @@ func TestMergeEnvFrom(t *testing.T) {
 
 	for name, test := range tests {
 		result, err := mergeEnvFrom(
-			&settings.PodPreset{Spec: settings.PodPresetSpec{EnvFrom: test.mod}},
 			test.orig,
+			[]*settings.PodPreset{{Spec: settings.PodPresetSpec{EnvFrom: test.mod}}},
 		)
 		if test.shouldFail && err == nil {
 			t.Fatalf("expected test %q to fail but got nil", name)
@@ -295,8 +295,8 @@ func TestMergeVolumeMounts(t *testing.T) {
 
 	for name, test := range tests {
 		result, err := mergeVolumeMounts(
-			&settings.PodPreset{Spec: settings.PodPresetSpec{VolumeMounts: test.mod}},
 			test.orig,
+			[]*settings.PodPreset{{Spec: settings.PodPresetSpec{VolumeMounts: test.mod}}},
 		)
 		if test.shouldFail && err == nil {
 			t.Fatalf("expected test %q to fail but got nil", name)
@@ -376,8 +376,8 @@ func TestMergeVolumes(t *testing.T) {
 
 	for name, test := range tests {
 		result, err := mergeVolumes(
-			&settings.PodPreset{Spec: settings.PodPresetSpec{Volumes: test.mod}},
 			test.orig,
+			[]*settings.PodPreset{{Spec: settings.PodPresetSpec{Volumes: test.mod}}},
 		)
 		if test.shouldFail && err == nil {
 			t.Fatalf("expected test %q to fail but got nil", name)
@@ -496,6 +496,56 @@ func TestAdmitConflictWithNonMatchingLabelsShouldNotError(t *testing.T) {
 	}
 }
 
+func TestAdmitConflictShouldNotModifyPod(t *testing.T) {
+	containerName := "container"
+
+	pod := &api.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "mypod",
+			Namespace: "namespace",
+			Labels: map[string]string{
+				"security": "S2",
+			},
+		},
+		Spec: api.PodSpec{
+			Containers: []api.Container{
+				{
+					Name: containerName,
+					Env:  []api.EnvVar{{Name: "abc", Value: "value2"}, {Name: "ABC", Value: "value3"}},
+				},
+			},
+		},
+	}
+	origPod := *pod
+
+	pip := &settings.PodPreset{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "hello",
+			Namespace: "namespace",
+		},
+		Spec: settings.PodPresetSpec{
+			Selector: v1.LabelSelector{
+				MatchExpressions: []v1.LabelSelectorRequirement{
+					{
+						Key:      "security",
+						Operator: v1.LabelSelectorOpIn,
+						Values:   []string{"S2"},
+					},
+				},
+			},
+			Env: []api.EnvVar{{Name: "abc", Value: "value"}, {Name: "ABC", Value: "value"}},
+		},
+	}
+
+	err := admitPod(pod, pip)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(&origPod, pod) {
+		t.Fatalf("pod should not get modified in case of conflict origPod: %+v got: %+v", &origPod, pod)
+	}
+}
+
 func TestAdmit(t *testing.T) {
 	containerName := "container"
 
@@ -759,7 +809,7 @@ func TestAdmitEmptyPodNamespace(t *testing.T) {
 
 	// verify PodSpec has not been mutated
 	if !reflect.DeepEqual(pod, originalPod) {
-		t.Fatalf("Expected pod spec of '%v' to be unchanged", pod.Name)
+		t.Fatalf("pod should not get modified in case of emptyNamespace origPod: %+v got: %+v", originalPod, pod)
 	}
 }