Skip to content

Bump k8s.io/kube-openapi to latest and enable numeric format validation - #136582

Merged
k8s-ci-robot merged 6 commits into
kubernetes:masterfrom
yongruilin:master_kubeopenapi-format
Jan 28, 2026
Merged

Bump k8s.io/kube-openapi to latest and enable numeric format validation#136582
k8s-ci-robot merged 6 commits into
kubernetes:masterfrom
yongruilin:master_kubeopenapi-format

Conversation

@yongruilin

@yongruilin yongruilin commented Jan 27, 2026

Copy link
Copy Markdown
Contributor

What type of PR is this?

/kind feature
/kind dependency

What this PR does / why we need it:

This PR bumps k8s.io/kube-openapi to the latest and enables stricter validation for numeric formats in CRDs.

Previously, Kubernetes would strip unrecognized formats for number and integer types during schema processing. This PR updates apiextensions-apiserver to retain valid numeric formats (int32, int64 for integer; float, double for number) so they can be validated by the underlying kube-openapivalidator.

  • Dependency Update: Bumps k8s.io/kube-openapi to pick up latest validation improvements.
  • Format Preservation: Updates StripUnsupportedFormatsPostProcessorForVersion and GetUnrecognizedFormats in apiextensions-apiserver to stop stripping valid numeric formats.
  • Validation Coverage: Adds comprehensive unit tests for:
    • Valid and invalid numeric format ranges (e.g., int32 overflow).
    • Numeric format validation in anyOf and allOf schemas.
    • Ratcheting behavior for numeric formats, ensuring existing invalid data can be preserved while preventing new invalid data.

Which issue(s) this PR is related to:

Fixes: #136091

Special notes for your reviewer:

Does this PR introduce a user-facing change?

CRD validation now strictly enforces ranges for numeric formats (int32, int64, float, double) when specified in the schema. Existing objects with out-of-range values are preserved via validation ratcheting

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/feature Categorizes issue or PR as related to a new feature. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. kind/dependency Categorizes issue or PR as related to a dependency update. area/apiserver area/cloudprovider do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. area/code-generation labels Jan 27, 2026
@k8s-ci-robot

k8s-ci-robot commented Jan 27, 2026

Copy link
Copy Markdown
Contributor

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added area/dependency Issues or PRs related to dependency changes needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. area/kube-proxy needs-priority Indicates a PR lacks a `priority/foo` label and requires one. area/kubectl labels Jan 27, 2026
@k8s-ci-robot
k8s-ci-robot requested a review from a team January 27, 2026 22:38
@k8s-ci-robot k8s-ci-robot added sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/architecture Categorizes an issue or PR as relevant to SIG Architecture. sig/auth Categorizes an issue or PR as relevant to SIG Auth. sig/cli Categorizes an issue or PR as relevant to SIG CLI. and removed do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Jan 27, 2026
@yongruilin

yongruilin commented Jan 27, 2026

Copy link
Copy Markdown
Contributor Author

/assign @liggitt
/assign @jpbetz
/sig api-machinery

@liggitt

liggitt commented Jan 27, 2026

Copy link
Copy Markdown
Member

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jan 27, 2026
@k8s-ci-robot

k8s-ci-robot commented Jan 27, 2026

Copy link
Copy Markdown
Contributor

LGTM label has been added.

DetailsGit tree hash: 803507574748656c2e06d1e5dbdf765109cca546

@k8s-ci-robot

k8s-ci-robot commented Jan 27, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, yongruilin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 27, 2026
@yongruilin

yongruilin commented Jan 27, 2026

Copy link
Copy Markdown
Contributor Author

/test pull-kubernetes-e2e-kind

@k8s-ci-robot
k8s-ci-robot merged commit b90909e into kubernetes:master Jan 28, 2026
14 checks passed
@k8s-ci-robot k8s-ci-robot added this to the v1.36 milestone Jan 28, 2026
@github-project-automation github-project-automation Bot moved this from Needs Triage to Done in SIG Instrumentation Jan 28, 2026
@github-project-automation github-project-automation Bot moved this from Needs Triage to Done in SIG CLI Jan 28, 2026
@github-project-automation github-project-automation Bot moved this to Closed / Done in SIG Auth Jan 28, 2026
@xpivarc xpivarc mentioned this pull request May 13, 2026
Merged
9 tasks
@a7i a7i mentioned this pull request May 19, 2026
Closed
a7i added a commit to a7i/descheduler that referenced this pull request May 19, 2026
@a7i
revert: ensureVMIsLiveMigratable retry helper
2119bae 
Reverts b767b9c. The helper was added to work around what looked like
the virt-handler containerdisk-socket race on k8s 1.36, but the actual
root cause is unrelated: k8s 1.36's stricter CRD numeric format
validation (kubernetes/kubernetes#136582) rejects VMI status updates
with the pre-fix uint32 Checksum schema. See
kubevirt/kubevirt#17858 for the upstream
context and kubevirt/kubevirt#17469 for the upstream fix (merged to
main, included in v1.9.0-alpha.0, not in v1.8.x).

The follow-up commit bumps KUBEVIRT_VERSION so the test consumes a
KubeVirt release that contains the fix, which removes the need for any
test-side retry.
a7i added a commit to a7i/descheduler that referenced this pull request May 19, 2026
@a7i
ci(e2e): bump KubeVirt to v1.9.0-alpha.0 for k8s 1.36 compatibility
745146e 
KubeVirt v1.8.2 publishes VMI status checksum fields (uint32 in Go) as
format: int32 in its generated CRD schema. k8s 1.36 enables strict
numeric format validation in CRDs via
kubernetes/kubernetes#136582, which now rejects
the legacy schema and causes virt-handler to enter an infinite VMI
status update re-enqueue loop. Live migrations never complete and the
descheduler e2e TestLiveMigrationInBackground times out.

The schema fix landed upstream in
kubevirt/kubevirt#17469 (merged to main on
2026-04-18, included in v1.9.0-alpha.0 tagged 2026-05-11) but was not
backported to release-1.8, so no v1.8.x release contains it. Bump the
default KUBEVIRT_VERSION to v1.9.0-alpha.0 so the e2e suite consumes a
release whose generated CRDs are compatible with k8s 1.36's stricter
validator.

Tracked in kubevirt/kubevirt#17858.
@lexfrei lexfrei mentioned this pull request May 29, 2026
Closed
mhan8796 pushed a commit to mhan8796/kubernetes that referenced this pull request Jun 27, 2026
@k8s-ci-robot
Merge pull request kubernetes#136582 from yongruilin/master_kubeopena…
ccac58b 
…pi-format

Bump k8s.io/kube-openapi to latest and enable numeric format validation
@aa1ex aa1ex mentioned this pull request Jul 3, 2026
Merged
@coderabbitai coderabbitai Bot mentioned this pull request Jul 13, 2026
Merged
2 of 5 tasks
@coderabbitai coderabbitai Bot mentioned this pull request Jul 22, 2026
Merged
@tarabrind tarabrind mentioned this pull request Sep 24, 2026
Merged
1 of 4 tasks
@deckhouse-BOaTswain deckhouse-BOaTswain mentioned this pull request Sep 24, 2026
Merged
1 of 4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andyzhangx andyzhangx Awaiting requested review from andyzhangx
@apelisse apelisse Awaiting requested review from apelisse

Assignees

@jpbetz jpbetz

@liggitt liggitt

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. area/apiserver area/cloudprovider area/code-generation area/dependency Issues or PRs related to dependency changes area/kube-proxy area/kubectl area/kubelet cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/dependency Categorizes issue or PR as related to a dependency update. kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/architecture Categorizes an issue or PR as relevant to SIG Architecture. sig/auth Categorizes an issue or PR as relevant to SIG Auth. sig/cli Categorizes an issue or PR as relevant to SIG CLI. sig/cloud-provider Categorizes an issue or PR as relevant to SIG Cloud Provider. sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. sig/instrumentation Categorizes an issue or PR as relevant to SIG Instrumentation. sig/network Categorizes an issue or PR as relevant to SIG Network. sig/node Categorizes an issue or PR as relevant to SIG Node. sig/scheduling Categorizes an issue or PR as relevant to SIG Scheduling. sig/storage Categorizes an issue or PR as relevant to SIG Storage. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. wg/device-management Categorizes an issue or PR as relevant to WG Device Management.

Projects

Dynamic Resource Allocation
Archived in project
SIG Auth
Archived in project
SIG CLI
Archived in project
SIG Instrumentation
Archived in project
SIG Node: code and documentation PRs
Archived in project
SIG Scheduling
Archived in project

Milestone

v1.36

Development

Successfully merging this pull request may close these issues.

Standard numeric format validation (int32, int64, float, double) is not enforced in CRDs

4 participants

@yongruilin @k8s-ci-robot @liggitt @jpbetz