Skip to content

fix: versioned validation test avoid incorrect conversion #132465

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 1, 2025

Conversation

yongruilin
Copy link
Contributor

What type of PR is this?

/kind bug

What this PR does / why we need it:

This PRs fix test failure by avoid conversion between versioned types.
e.g.

validation.go:95: converting (v1beta1.CertificateSigningRequest) to (v1.CertificateSigningRequest): unknown conversion

Which issue(s) this PR is related to:

Ref:
kubernetes/enhancements#5073

Special notes for your reviewer:

This is the prerequisite to enable the declarative validation for APIs with multiple versions. (e.g. certificates/(v1,v1alpha1,v1beta1).

Does this PR introduce a user-facing change?

NONE

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:


@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. kind/bug Categorizes issue or PR as related to a bug. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Jun 23, 2025
@yongruilin
Copy link
Contributor Author

/cc @aaron-prindle @jpbetz

/sig api-machinery
/triage accepted

@k8s-ci-robot k8s-ci-robot added the sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. label Jun 23, 2025
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. label Jun 23, 2025
@k8s-ci-robot k8s-ci-robot requested a review from jpbetz June 23, 2025 16:46
@k8s-ci-robot k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Jun 23, 2025
@jpbetz
Copy link
Contributor

jpbetz commented Jun 23, 2025

Thanks for fixing.

I agree that this fix is safe and a good filter to have in this code flow.

I'm a bit confused about how the invalid conversion is requested. Shouldn't all calls to runValidation request validation from internal to all the versioned types? How do we end up with a conversion from a versioned type?

Comment on lines 89 to 93
// skip if the version is not the same as the unversioned object.
// We should not convert between different versions of the same object.
if gvk.Version != unversionedGVK.Version {
continue
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This comment might be confusing to someone without a lot of context. Should we instead has a if unversionedGVK.Version != runtime.APIVersionInternal { continue } precondition just inside the outer for loop? That way all the unversionGVK entries are guaranteed to be internal types and then the inner loop can continue to skip internal?

We might also be able to get rid of the gvk := gv.WithKind(unversionedGVK.Kind) mutation.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The unversioned runtime.Object is actually versioned, passed from

obj, err := legacyscheme.Scheme.New(gv.WithKind(kind))

It seems that this test is always trying to convert versioned to versioned, should we consider refactor this test instead?

func TestVersionedValidationByFuzzing(t *testing.T) {

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the fix is ok as we want to reuse the same VerifyVersionedValidationEquivalence, though we always pass in a versioned obj and convert from a versioned to versioned.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the test to always convert the versioned to unversioned(internal) first before passing it to RunValidationForEachVersion

@yongruilin yongruilin force-pushed the master_vg_fix-fuzz-test branch from 0beea4a to 2f3ca54 Compare June 26, 2025 23:56
@k8s-ci-robot k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jun 26, 2025
Copy link
Contributor

@jpbetz jpbetz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 27, 2025
@k8s-ci-robot
Copy link
Contributor

LGTM label has been added.

Git tree hash: ab6ea969e25e26756032c13a9001079ce3abb228

@jpbetz
Copy link
Contributor

jpbetz commented Jun 27, 2025

/retest

@yongruilin
Copy link
Contributor Author

/cc @thockin for api-approver
No api related change, only because code change under pkg/api/ .

@k8s-ci-robot k8s-ci-robot requested a review from thockin June 27, 2025 02:22
@k8s-ci-robot
Copy link
Contributor

@yongruilin: GitHub didn't allow me to request PR reviews from the following users: for.

Note that only kubernetes members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

/cc @thockin for api-approver
No api related change, only because code change under pkg/api/ .

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

}
if internalObj == nil {
return
}
if old == nil {
runtimetest.RunValidationForEachVersion(t, legacyscheme.Scheme, []string{}, obj, accumulate, subresources...)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not clear to me why this uses obj but update now uses internalObj -- Can you add comments here explaining what's going on a bit more?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh.. it should be internalObj. Updated and added some comments.

@@ -52,6 +52,10 @@ func runValidation(t *testing.T, scheme *runtime.Scheme, options []string, unver
t.Fatal(err)
}
for _, unversionedGVK := range unversionedGVKs {
// skip if passed in unversioned object is not internal.
if unversionedGVK.Version != runtime.APIVersionInternal {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given this started with unversioned runtime.Object and scheme.ObjectKinds(unversioned), how would we end up with a non-internal version?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's because the previous implementation passed here

VerifyVersionedValidationEquivalence(t, obj, nil)

is an versioned obj.

@yongruilin yongruilin force-pushed the master_vg_fix-fuzz-test branch from 2f3ca54 to a55318f Compare June 30, 2025 23:12
@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 30, 2025
@k8s-ci-robot k8s-ci-robot requested a review from jpbetz June 30, 2025 23:12
Copy link
Member

@thockin thockin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 30, 2025
@k8s-ci-robot
Copy link
Contributor

LGTM label has been added.

Git tree hash: 64914f1069e48891a454e0fe7af0de7cf3b5d029

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jpbetz, thockin, yongruilin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 30, 2025
@k8s-ci-robot k8s-ci-robot merged commit bc9a784 into kubernetes:master Jul 1, 2025
13 checks passed
@k8s-ci-robot k8s-ci-robot added this to the v1.34 milestone Jul 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. release-note-none Denotes a PR that doesn't merit a release note. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants