kube-openapi icon indicating copy to clipboard operation
kube-openapi copied to clipboard
verified publisher icon kubernetes

OpenAPI Gen should fail for invalid x-kubernetes-map-type/keys/etc combinations

Open apelisse opened this issue 3 years ago • 7 comments

See https://github.com/kubernetes/kubernetes/pull/114585,

We've been able to generate a bogus OpenAPI with x-kubernetes-list-type=set for a list of non-atomic maps. And we haven't been able to detect that until after the type was released and people were trying to re-import that type and create CRDs for it. We should detect these errors as early as possible, ideally while generating the OpenAPI for these types.

apelisse avatar Dec 20 '22 18:12 apelisse

/wg api-expression /priority important-soon

apelisse avatar Dec 20 '22 18:12 apelisse

until we have automated scanning, have we checked manually that there are no other in-tree examples of this issue (in less popular types than podspec maybe no one tried to embed into a CRD)?

liggitt avatar Dec 20 '22 19:12 liggitt

Hey @apelisse, I didn't understand what this issue this. Can you please guide me?

ibilalkayy avatar Jan 31 '23 15:01 ibilalkayy

The behavior of the annotations, like x-kubernetes-list-type=set is described in the server-side apply documentation. You'll find there that the "set" type is meant to only work for primitive types. Unfortunately, the code that parses this in go files and generate the actual openapi does NOT verify that the types are indeed primitives (code mostly lives in https://github.com/kubernetes/kube-openapi/blob/master/pkg/generators/extension.go and https://github.com/kubernetes/kube-openapi/blob/master/pkg/generators/openapi.go). It'd be nice if we could notice that the annotation is mis-used and fail rather than ignore the mis-use.

apelisse avatar Feb 04 '23 00:02 apelisse

Hey @apelisse, Sorry for the late response. The x-kubernetes-list-type=set was not present on this page. But only the x-kubernetes-list-type were present. One is present in line #55, one is present in line #78 and the last one is present in line #183. The second page does not contain x-kubernetes-list-type.

ibilalkayy avatar Feb 06 '23 15:02 ibilalkayy

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar May 07 '23 16:05 k8s-triage-robot

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle rotten
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-triage-robot avatar Jun 06 '23 17:06 k8s-triage-robot