fix inherited APIBinding not inheriting default permission claim selector#3786
fix inherited APIBinding not inheriting default permission claim selector#3786olamilekan000 wants to merge 1 commit intokcp-dev:mainfrom
Conversation
|
/retest |
3 similar comments
|
/retest |
|
/retest |
|
/retest |
fec326a to
1a0d605
Compare
|
/retest |
4766801 to
34d26b9
Compare
|
/retest |
|
/test |
|
@olamilekan000: The Use DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/retest |
1 similar comment
|
/retest |
34d26b9 to
cfb0e0e
Compare
|
/retest |
cfb0e0e to
e139340
Compare
|
/retest |
mjudeikis
left a comment
There was a problem hiding this comment.
I have feeling this might fail in sharded setup. Did you tested this with sharded api server?
pkg/reconciler/tenancy/defaultapibindinglifecycle/default_apibinding_lifecycle_controller.go
Outdated
Show resolved
Hide resolved
| return logicalClusterInformer.Lister().Cluster(clusterName).Get(corev1alpha1.LogicalClusterName) | ||
| }, | ||
| getLogicalClusterByPath: func(path logicalcluster.Path) (*corev1alpha1.LogicalCluster, error) { | ||
| clusters, err := indexers.ByIndex[*corev1alpha1.LogicalCluster](logicalClustersInformer.Informer().GetIndexer(), indexers.ByLogicalClusterPath, path.String()) |
There was a problem hiding this comment.
This will consult with local shard only. If logicalcluster lives on different shard, this should fail.
Is this not the case? We should be using fallback informers?
There was a problem hiding this comment.
I didn't test this with a shard setup but my intention here was to fetch a cluster using the path . By the way, the shard tests are passing, I guess everything's good.
There was a problem hiding this comment.
im not sure sharding tests are testing this. And if both workspaces land on the same shard, it would pass. So failure would be transiant
There was a problem hiding this comment.
I think this needs to be WithFallback to be able to resolve clusters frm other shards. If parent is located on other shard this will fail.
There was a problem hiding this comment.
What does WithFallback mean in this case?
ps: I am actually trying to carryout a manual test with a shard setup, but havn't really had time to
There was a problem hiding this comment.
Fallback takes 2 informers: the local shard and the cache server.
If the object is not found in the local shard informer, it goes to the cache server.
So cross-shard operation objects need to be replicated to the cache server so other shards can "consult" them.
There was a problem hiding this comment.
I didn't forget, but thanks for the Ping
There was a problem hiding this comment.
Can you kindly review once more @mjudeikis
e139340 to
9fd8aa4
Compare
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
/retest |
2 similar comments
|
/retest |
|
/retest |
|
/test all |
|
/retest |
2 similar comments
|
/retest |
|
/retest |
9fd8aa4 to
c46f724
Compare
|
/retest |
pkg/reconciler/tenancy/defaultapibindinglifecycle/default_apibinding_lifecycle_controller.go
Show resolved
Hide resolved
mjudeikis
left a comment
There was a problem hiding this comment.
just a question, but lgtm
c46f724 to
68d93c3
Compare
|
/retest |
mjudeikis-bot
left a comment
There was a problem hiding this comment.
A few minor issues spotted during review — sharding concern looks properly addressed with ByIndexWithFallback. Flagging the remaining nits below.
| return nil | ||
| } | ||
|
|
||
| var matchedSeclector *apisv1alpha2.PermissionClaimSelector |
There was a problem hiding this comment.
Typo: matchedSeclector → should be matchedSelector. This compiles fine since it's used consistently, but should be corrected for readability.
pkg/reconciler/tenancy/initialization/apibinder_initializer_controller.go
Show resolved
Hide resolved
| var parentPath logicalcluster.Path | ||
| if annPath, found := logicalCluster.Annotations[core.LogicalClusterPathAnnotationKey]; found { | ||
| currentPath := logicalcluster.NewPath(annPath) | ||
| parentPath, _ = currentPath.Parent() |
There was a problem hiding this comment.
Silent edge case: Parent() error is silently discarded with _. For root workspaces (no LogicalClusterPathAnnotationKey annotation), parentPath will be zero-value and get passed to findSelectorInWorkspace, which will hit a not-found and fall back to matchAll: true. Harmless, but fragile. Suggest guarding:
if !parentPath.Empty() {
if parentSelector := b.findSelectorInWorkspace(ctx, parentPath, exportRef, exportClaim); parentSelector != nil {
selector = *parentSelector
}
}There was a problem hiding this comment.
Parent doesn't retrun an error, it returns a path and a boolean
68d93c3 to
241418a
Compare
|
/retest |
3 similar comments
|
/retest |
|
/retest |
|
/retest |
|
@olamilekan000: The following test failed, say
DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
…laim Signed-off-by: olalekan odukoya <odukoyaonline@gmail.com>
241418a to
0628a9c
Compare
Summary
What Type of PR Is This?
/kind bug
Related Issue(s)
Fixes 3779
Release Notes