Merge patches to ImagePullSecrets for Service Accounts #91256

Jamstah · 2020-05-19T15:43:27Z

What type of PR is this?
/kind feature

What this PR does / why we need it:
Adds the merge strategy to imagePullSecrets in the ServiceAccount API

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

When using `kubectl patch` to update `ServiceAccount` image pull secrets, new pull secrets will be added without replacing the whole array.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

k8s-ci-robot · 2020-05-19T15:43:30Z

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://git.k8s.io/community/CLA.md#the-contributor-license-agreement to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized.
If you have done the above and are still having issues with the CLA being reported as unsigned, please log a ticket with the Linux Foundation Helpdesk: https://support.linuxfoundation.org/
Should you encounter any issues with the Linux Foundation Helpdesk, send a message to the backup e-mail support address at: [email protected]

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

k8s-ci-robot · 2020-05-19T15:43:34Z

Welcome @Jamstah!

It looks like this is your first PR to kubernetes/kubernetes 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/kubernetes has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2020-05-19T15:43:35Z

Hi @Jamstah. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

fejta-bot · 2020-05-19T15:52:38Z

This PR may require API review.

If so, when the changes are ready, complete the pre-review checklist and request an API review.

Status of requested reviews is tracked in the API Review project.

apelisse · 2020-05-22T15:29:53Z

@jennybuckley Can you double check, is this an API change that we have to worry about?

bai · 2020-07-28T09:38:35Z

/sig api-machinery

apelisse · 2020-09-21T22:21:26Z

/assign @jpbetz

Is this fine? :-p

jpbetz · 2020-09-21T23:11:31Z

/assign Joe Betz

Is this fine? :-p

This looks like an example of a atomic->granular schema change I'm working to support as part of kubernetes-sigs/structured-merge-diff#170

Until we get the fix into k8s, making the schema change will result in server side apply reading managed field data written before the schema change and then mis-interpreting it. For this specific schema change, I expect it will fail to detect conflicts on the first apply after an upgrade, and for HA clusters, it will also fail to detect conflicts on some applies during upgrade. Same thing for rollback.

The best thing might be to hold this fix until kubernetes-sigs/structured-merge-diff#170 is resolved and merged into k8s, which I'd like to get in for 1.20.

staging/src/k8s.io/api/core/v1/types.go

jpbetz · 2020-09-21T23:42:41Z

/hold for kubernetes-sigs/structured-merge-diff#170

jpbetz · 2021-02-04T22:57:39Z

/lgtm

This looks right.

fejta-bot · 2021-05-05T23:51:00Z

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

k8s-ci-robot · 2021-05-06T09:02:28Z

New changes are detected. LGTM label has been removed.

Jamstah · 2021-05-06T09:03:02Z

/remove-lifecycle stale

rebased.

k8s-ci-robot · 2021-05-06T11:15:18Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Jamstah
To complete the pull request process, please assign liggitt after the PR has been reviewed.
You can assign the PR to them by writing /assign @liggitt in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Jamstah · 2021-05-06T12:18:16Z

Resuscitated, rebased, and recodegened.

@jpbetz apologies for the re-review request but this one languished. I guess I missed a step. If I can get another lgtm from you I'll pass it to @liggitt for approval.

liggitt · 2021-05-06T12:26:49Z

if this changes the API behavior of a kubectl patch request to leave existing items in the list, isn't that an incompatible change?

Jamstah · 2021-05-06T13:01:08Z

if this changes the API behavior of a kubectl patch request to leave existing items in the list, isn't that an incompatible change?

I had that concern but haven't seen a good answer. The original issue rotted (#91250) - should I repoen that as well or is the pr enough?

liggitt · 2021-05-06T13:05:50Z

staging/src/k8s.io/api/core/v1/types.go

+	// +listType=map
+	// +listMapKey=name


this addition makes server-side-apply (which is beta prior to 1.22) consistent with client-side-apply and seems reasonable

To be honest, we already infer listType and listMapKey if patchMergeKey and patchStrategy is present, so this is mostly a no-op, but yes, it's fine.

liggitt · 2021-05-06T13:06:41Z

staging/src/k8s.io/api/core/v1/types.go

+	// +listType=map
+	// +listMapKey=name


adding server-side-apply directives here makes this field consistent with podSpec.ImagePullSecrets and seems reasonable since ssa was beta prior to 1.22

liggitt · 2021-05-06T13:07:32Z

staging/src/k8s.io/api/core/v1/types.go

+	// +patchMergeKey=name
+	// +patchStrategy=merge


This addition is the bit that is incompatible with GA API functionality and needs more consideration, since it will break clients computing strategic merge patches using older versions of k8s.io/api types

Jamstah · 2021-05-06T16:25:31Z

Am also still interested in an answer to this question:

As a side note - I see there are lots of places where we need to add listType and listMapKey based on the exception files. Would it be a worthwhile exercise for me to clean some of those up and submit another PR? I'm not sure if there is real or imagined value, or if the work is already assigned elsewhere.

apelisse · 2021-05-06T18:43:41Z

We've done all the clean-up already (presumably of course), thanks!

k8s-triage-robot · 2021-08-04T18:58:19Z

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

k8s-triage-robot · 2021-09-03T19:05:26Z

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-triage-robot · 2021-10-03T19:20:04Z

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Reopen this issue or PR with /reopen
Mark this issue or PR as fresh with /remove-lifecycle rotten
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

k8s-ci-robot · 2021-10-03T19:20:21Z

@k8s-triage-robot: Closed this PR.

Details

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied

After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied

After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Reopen this issue or PR with /reopen

Mark this issue or PR as fresh with /remove-lifecycle rotten

Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/feature Categorizes issue or PR as related to a new feature. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels May 19, 2020

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels May 19, 2020

k8s-ci-robot added needs-priority Indicates a PR lacks a `priority/foo` label and requires one. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 19, 2020

k8s-ci-robot requested review from gmarek and sttts May 19, 2020 15:44

k8s-ci-robot added the kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API label May 19, 2020

Jamstah force-pushed the patch-1 branch from 5cd2365 to 730b0cc Compare May 19, 2020 16:14

Jamstah mentioned this pull request May 22, 2020

imagePullSecrets in ServiceAccount should have "x-kubernetes-patch-strategy": "merge" #91250

Closed

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels May 23, 2020

k8s-ci-robot added sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. and removed needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Jul 28, 2020

k8s-ci-robot assigned jpbetz Sep 21, 2020

jpbetz reviewed Sep 21, 2020

View reviewed changes

staging/src/k8s.io/api/core/v1/types.go Outdated Show resolved Hide resolved

jpbetz reviewed Sep 21, 2020

View reviewed changes

staging/src/k8s.io/api/core/v1/types.go Outdated Show resolved Hide resolved

jpbetz mentioned this pull request Sep 21, 2020

Support granular<->atomic schema changes kubernetes-sigs/structured-merge-diff#170

Merged

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 21, 2020

k8s-ci-robot added priority/important-longterm Important over the long term, but may not be staffed and/or may need multiple releases to complete. and removed needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Feb 4, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 4, 2021

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 5, 2021

Jamstah force-pushed the patch-1 branch from f9426c1 to aac0915 Compare May 6, 2021 09:02

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 6, 2021

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 6, 2021

Merge patches to ImagePullSecrets for Service Accounts

d18d761

Jamstah force-pushed the patch-1 branch from aac0915 to d18d761 Compare May 6, 2021 11:14

liggitt reviewed May 6, 2021

View reviewed changes

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 4, 2021

k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Sep 3, 2021

k8s-ci-robot closed this Oct 3, 2021

Merge patches to ImagePullSecrets for Service Accounts #91256

Merge patches to ImagePullSecrets for Service Accounts #91256

Uh oh!

Conversation

Jamstah commented May 19, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented May 19, 2020

Uh oh!

k8s-ci-robot commented May 19, 2020

Uh oh!

k8s-ci-robot commented May 19, 2020

Uh oh!

fejta-bot commented May 19, 2020

Uh oh!

apelisse commented May 22, 2020

Uh oh!

bai commented Jul 28, 2020

Uh oh!

apelisse commented Sep 21, 2020

Uh oh!

jpbetz commented Sep 21, 2020

Uh oh!

Uh oh!

Uh oh!

jpbetz commented Sep 21, 2020

Uh oh!

jpbetz commented Feb 4, 2021

Uh oh!

fejta-bot commented May 5, 2021

Uh oh!

k8s-ci-robot commented May 6, 2021

Uh oh!

Jamstah commented May 6, 2021

Uh oh!

k8s-ci-robot commented May 6, 2021

Uh oh!

Jamstah commented May 6, 2021

Uh oh!

liggitt commented May 6, 2021

Uh oh!

Jamstah commented May 6, 2021

Uh oh!

liggitt May 6, 2021

Choose a reason for hiding this comment

Uh oh!

apelisse May 6, 2021

Choose a reason for hiding this comment

Uh oh!

liggitt May 6, 2021

Choose a reason for hiding this comment

Uh oh!

liggitt May 6, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Jamstah commented May 6, 2021

Uh oh!

apelisse commented May 6, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-triage-robot commented Aug 4, 2021

Uh oh!

k8s-triage-robot commented Sep 3, 2021

Uh oh!

k8s-triage-robot commented Oct 3, 2021

Uh oh!

k8s-ci-robot commented Oct 3, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Jamstah commented May 19, 2020 •

edited

Loading

liggitt May 6, 2021 •

edited

Loading

apelisse commented May 6, 2021 •

edited

Loading