Warn on inconsistencies of a patch and a patched object #527
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nolar
force-pushed
the
warn-on-patch-inconsistencies
branch
from
862e0ed to
4337e7b
Compare
The implementation is conceptually based on another PR, but it was heavily reworked to a forked repo, which went far ahead, and the implementation is significantly changed: * Instead of the RFC patch simulation locally, a one-way diff is used to check if the selected fields of the response are different from what is intended in the patch. Other fields and changes are ignored. * The patch-vs-response check is also performed in daemons/timers. * The tests are different.
nolar
force-pushed
the
warn-on-patch-inconsistencies
branch
2 times, most recently
from
6c9c1b1 to
ff18ca2
Compare
5 tasks
5 tasks
Closed
2 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What do these changes do?
Warn (in logs) if the patched object does not match the patch as a result of the PATCH operation. This should make such cases easier to debug, as they will be at least visible (previously, completely hidden).
Description
In some cases, when Kopf wanted to PATCH an object, the PATCH API request was performed, but the object didn't actually change. K8s API returns status 2xx for that, so the request is believed to be successful. This issue happened on multiple occasions:
x-kubernetes-preserve-unknown-fields: trueset on.status. As a result, state persistence was lost after the first handler, and the next handling cycle was not invoked.Now, Kopf reconstructs the patched object from the responses of the PATCH requests (1 or 2 of per call) and compares that reconstructed object with the patch. If some patched fields mismatch, a warning is logged.
Note that the reconstructed object is not exactly the full object: it can be only the status stanza, or the main object without status, or an empty object — depending on which PATCH requests were actually needed and performed.
All object fields that are not in the patch, are ignored: this is normal that something changes remotely without this specific operator knowing: e.g. metadata's resourceVersion/generation fields are updated by K8s itself, other operators and controllers can store additional status fields or labels or annotations. As long as they are not in the scope of the current operator's intentions to modify the object, they are irrelevant.
Issues/PRs
Type of changes
Checklist
CONTRIBUTORS.txt