webhook config manager: HasSynced returns true when the manager is synced with existing webhookconfig objects at startup #95783
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
k8s-ci-robot
added
release-note-none
|
/triage accepted |
k8s-ci-robot
added
triage/accepted
pacoxu
approved these changes
Dec 17, 2020
|
/cc @liggitt |
liggitt
reviewed
Feb 12, 2021
staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/testing/testcase.go
Outdated
Show resolved
Hide resolved
staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook/testing/testcase.go
Outdated
Show resolved
Hide resolved
This was referenced Mar 17, 2021
roycaihw
force-pushed
the
flake/wait-for-webhook-registration
branch
2 times, most recently
from
d3a21d8
to
e124292
Compare
k8s-ci-robot
added
size/M
roycaihw
changed the title
roycaihw
force-pushed
the
flake/wait-for-webhook-registration
branch
from
e124292
to
e0bc203
Compare
|
/retest |
liggitt
reviewed
Mar 18, 2021
staging/src/k8s.io/apiserver/pkg/admission/configuration/mutating_webhook_manager.go
Outdated
Show resolved
Hide resolved
|
one comment on making this more efficient for servers without any webhooks configured, functionally lgtm otherwise. |
…nced with existing webhookconfig objects at startup
roycaihw
force-pushed
the
flake/wait-for-webhook-registration
branch
from
e0bc203
to
37d171e
Compare
|
/retest |
|
/lgtm /milestone v1.21 |
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: liggitt, pacoxu, roycaihw The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
This was referenced Mar 23, 2021
Merged
Merged
k8s-ci-robot
added a commit
that referenced
this pull request
Mar 23, 2021
…783-upstream-release-1.19 Automated cherry pick of #95783: webhook config manager: HasSynced returns true when the
k8s-ci-robot
added a commit
that referenced
this pull request
Mar 23, 2021
…783-upstream-release-1.20 Automated cherry pick of #95783: webhook config manager: HasSynced returns true when the
k8s-ci-robot
added a commit
that referenced
this pull request
Mar 23, 2021
…783-upstream-release-1.18 Automated cherry pick of #95783: webhook config manager: HasSynced returns true when the
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind bug
What this PR does / why we need it:
Fix a webhook unittest flake. The test waits for informers to be synced, which guarantees the watch events being sent (the delta fifo queue in the informer has no initial object left), but it doesn't guarantee the webhook configuration manager finishing processing those watch events. Adding a marker to wait for webhook registration, like what we do in the e2e tests.The original race can be reliably reproduced by adding a sleep to the configuration managers.
What happened: webhook config manager
HasSynced()function returned true if the informer was synced, which could cause requests being allowed without existing webhook configurations being effective at startup.[EDIT] Thanks to @liggitt who pointed out that this isn't just a test issue and suggested the proper fix-- on API server startup, the webhook waits to admit anything until it is synced with existing webhookconfig objects, meaning
validatingWebhookConfigurationManager#HasSyncedandmutatingWebhookConfigurationManager#HasSyncedshouldn't return true until the informer is synced and either has no items orupdateConfiguration()has completed. This fix guarantees that at no point should requests be allowed into a restarted API server without those previously created webhook configurations being effective.Which issue(s) this PR fixes:
Fixes #94810, #99911, #100070
Does this PR introduce a user-facing change?:
/sig api-machinery
/cc @sttts