Skip to content

Fix conversion gen cross package conversions - #143367

Open
yashaggarwal85d wants to merge 2 commits into
kubernetes:masterfrom
yashaggarwal85d:fix-conversion-gen-cross-package-conversions
Open

yashaggarwal85d wants to merge 2 commits into
kubernetes:masterfrom
yashaggarwal85d:fix-conversion-gen-cross-package-conversions

Conversation

@yashaggarwal85d

Copy link
Copy Markdown

What type of PR is this?

/kind bug
/sig api-machinery

What this PR does / why we need it:

When a type references a struct from another API group (for example authorization/v1alpha1.AuthorizationConditionsRequest -> admission/v1.AdmissionRequest, or AuthorizationConditionsResponse -> authorization/v1.ConditionsAwareDecision), conversion-gen only looked for hand-written Convert_* functions. The functions it generates itself into the other package live in zz_generated.conversion.go, which is not parsed, so it emitted compileErrorOnMissingConversion(). The workaround was a hand-written wrapper that just calls autoConvert_*. Those wrappers count as manual conversions, so every type that contains the wrapped type lost its memory-identical (unsafe cast) conversion.

This PR:

  1. conversion-gen: before generating, records the public Convert_X_To_Y functions that will be generated into each input package (types with a peer, convertible, and without a manual conversion). When a conversion is needed between types from another package, conversion-gen calls that function instead of emitting compileErrorOnMissingConversion(). These functions are kept separate from the manual conversions, so they don't block memory-identical conversions and aren't registered with AddConversionFunc.
  2. Cleanup: removes the wrappers in pkg/apis/admission/v1/conversion.go and pkg/apis/authorization/v1/conversion.go and regenerates. ConditionsAwareDecision, NamedConditionsAwareDecision, SubjectAccessReviewStatus and AuthorizationConditionsResponse now convert with an unsafe cast, and SubjectAccessReview, SelfSubjectAccessReview and LocalSubjectAccessReview are removed from the TestMemoryIdenticalConversion exemptions (part of Conditional Authz [3/n]: Make the webhook authorizer support conditions #137633, as requested in the issue). AuthorizationConditionsReview stays exempt because admission.AdmissionRequest has runtime.Object fields.

Which issue(s) this PR is related to:

Fixes #142345

Special notes for your reviewer:

  • AI tools were used to help explore the generator code and draft the change and the unit test. I reviewed every line, re-ran the generators and tests listed below, and can explain each change.
  • The two commits are split into the generator change and the regenerated code, so the first one can be reviewed on its own. With the wrappers still present, the first commit produces no generated diff.
  • Only packages generated in the same conversion-gen run are considered, which is how hack/update-codegen.sh runs it (all tagged packages in one invocation). Packages outside the run behave as before.
  • If the peer package can't generate the public function (a field needs manual conversion), the caller now references an undefined Convert_* function instead of compileErrorOnMissingConversion(). Both fail to compile, and adding the manual function fixes both.
  • Tested with hack/verify-codegen.sh, hack/verify-golangci-lint.sh, hack/verify-gofmt.sh, hack/update-codegen.sh conversions and hack/update-codegen.sh subprojects (no diff in the subprojects or code-generator examples), go test ./staging/src/k8s.io/code-generator/cmd/conversion-gen/... (new TestCrossPackageGeneratedConversions), go test ./pkg/api/testing/... (including TestMemoryIdenticalConversion and the round-trip tests), and go test ./pkg/apis/authorization/... ./pkg/apis/admission/... ./pkg/registry/authorization/....

Does this PR introduce a user-facing change?

Fixed conversion-gen to call the conversion functions it generates for types in other packages of the same run, instead of emitting `compileErrorOnMissingConversion()`. Hand-written wrappers that only call the autogenerated `autoConvert_*` function are no longer needed; removing them lets types that contain the wrapped type use memory-identical conversions.

AI usage disclosure:

YES. This PR was written in part with the assistance of generative AI (exploring the generator code, drafting the change and the unit test). The solution was reviewed and tested by me (Yash), and I am responsible for the submitted changes.

When a type refers to a struct from another API group, conversion-gen
only looked for hand-written Convert_* functions. The functions it
generates into the other package live in zz_generated files, which are
not parsed, so it emitted compileErrorOnMissingConversion() and authors
had to add manual wrappers. Those wrappers count as manual conversions,
which stops the wrapped type, and every type that contains it, from
using memory-identical unsafe conversions.

Record the public conversion functions that will be generated into each
input package and call them when a conversion between types from
another package is needed. They are not treated as manual conversions,
so they do not block memory-identical conversions.
conversion-gen now finds the conversion functions it generates for
admission/v1 AdmissionRequest and authorization/v1
ConditionsAwareDecision, so drop the hand-written wrappers and
regenerate.

SubjectAccessReview, SelfSubjectAccessReview and
LocalSubjectAccessReview are memory-identical again, so remove them
from the TestMemoryIdenticalConversion exemptions.
@kubernetes-prow kubernetes-prow Bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/bug Categorizes issue or PR as related to a bug. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. labels Oct 24, 2026
@linux-foundation-easycla

linux-foundation-easycla Bot commented Oct 24, 2026 •

Copy link
Copy Markdown

CLA Signed
The committers listed above are authorized under a signed CLA.

@kubernetes-prow kubernetes-prow Bot added the needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. label Oct 24, 2026
@kubernetes-prow

Copy link
Copy Markdown
Contributor

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@kubernetes-prow

Copy link
Copy Markdown
Contributor

Welcome @yashaggarwal85d!

It looks like this is your first PR to kubernetes/kubernetes 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/kubernetes has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

@kubernetes-prow kubernetes-prow Bot added needs-priority Indicates a PR lacks a `priority/foo` label and requires one. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Oct 24, 2026
@kubernetes-prow

Copy link
Copy Markdown
Contributor

Hi @yashaggarwal85d. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@kubernetes-prow kubernetes-prow Bot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Oct 24, 2026
@kubernetes-prow

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: yashaggarwal85d
Once this PR has been reviewed and has the lgtm label, please assign jpbetz for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubernetes-prow
kubernetes-prow Bot requested review from enj and jpbetz October 24, 2026 08:01
@kubernetes-prow kubernetes-prow Bot added area/code-generation sig/auth Categorizes an issue or PR as relevant to SIG Auth. labels Oct 24, 2026
@kubernetes-prow kubernetes-prow Bot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Oct 24, 2026
@enj enj moved this to Needs Triage in SIG Auth Oct 24, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/code-generation cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/auth Categorizes an issue or PR as relevant to SIG Auth. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

Status: Needs Triage

Development

Successfully merging this pull request may close these issues.

Make conversion-gen automatically pick up autogenerated conversion functions of types across packages

1 participant