• Kubernetes Submit Queue's avatar
    Merge pull request #58375 from liggitt/decrypt · 4257f759
    Kubernetes Submit Queue authored
    Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
    
    Recheck if transformed data is stale when doing live lookup during update
    
    Fixes #49565
    
    Caching storage can pass in a cached object to `GuaranteedUpdate` as a hint for the current object.
    
    If the hint is identical to the data we want to persist, before short-circuiting as a no-op update, we force a live lookup.
    
    We should check two things on the result of that live lookup before short-circuiting as a no-op update:
    1. the bytes we want to persist still match the transformed bytes read from etcd
    2. the state read from etcd didn't report itself as stale. this would mean the transformer used to read the data would not be the transformer used to write it, and "no-op" writes should still be performed, since transformation will make the underlying content actually different.
    
    After a live lookup, we checked byte equality, but not the stale indicator. This meant that key rotation or encrypted->decrypted, and decrypted->encrypted updates are broken.
    
    Introduced in #54780 and picked back to 1.8 in #55294
    
    ```release-note
    Fixed encryption key and encryption provider rotation
    ```
    4257f759
Name
Last commit
Last update
..
src/k8s.io Loading commit data...
BUILD Loading commit data...
OWNERS Loading commit data...
README.md Loading commit data...