Skip to content

Conversation

@dntosas
Copy link
Contributor

@dntosas dntosas commented Nov 13, 2025

/kind bug

The conversion webhook for AWSClusterControllerIdentity was failing with:

  • expected infrastructure.cluster.x-k8s.io/v1beta2, received infrastructure.cluster.x-k8s.io/v1beta1
  • Error from server: conversion webhook returned invalid object: invalid groupVersion

Root cause:
The auto-generated conversion function (Convert_v1beta1_AWSClusterControllerIdentity_To_v1beta2_AWSClusterControllerIdentity) copies TypeMeta directly from the source object, which includes the APIVersion field. This results in the converted v1beta2 object retaining the v1beta1 APIVersion, causing the conversion webhook to reject it as invalid.

Fix:
Explicitly set the APIVersion to the target version (v1beta2) after calling the auto-generated conversion function in both ConvertTo methods for AWSClusterControllerIdentity and AWSClusterControllerIdentityList. This ensures the converted object has the correct APIVersion that matches the target API version expected by Kubernetes.

This fix ensures that when Kubernetes requests conversion from v1beta1 to v1beta2, the webhook returns objects with the correct APIVersion, allowing the conversion to succeed.

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

Checklist:

  • squashed commits
  • includes documentation
  • includes emoji in title
  • adds unit tests
  • adds or updates e2e tests

Release note:

Fixes a regression at AWSClusterControllerIdentity v1beta1 to v1beta2 conversion

…sion

The conversion webhook for AWSClusterControllerIdentity was failing with:
- expected infrastructure.cluster.x-k8s.io/v1beta2, received infrastructure.cluster.x-k8s.io/v1beta1
- Error from server: conversion webhook returned invalid object: invalid groupVersion

Root cause:
The auto-generated conversion function (Convert_v1beta1_AWSClusterControllerIdentity_To_v1beta2_AWSClusterControllerIdentity)
copies TypeMeta directly from the source object, which includes the APIVersion field. This results in
the converted v1beta2 object retaining the v1beta1 APIVersion, causing the conversion webhook to reject
it as invalid.

Fix:
Explicitly set the APIVersion to the target version (v1beta2) after calling the auto-generated
conversion function in both ConvertTo methods for AWSClusterControllerIdentity and
AWSClusterControllerIdentityList. This ensures the converted object has the correct APIVersion
that matches the target API version expected by Kubernetes.

This fix ensures that when Kubernetes requests conversion from v1beta1 to v1beta2, the webhook
returns objects with the correct APIVersion, allowing the conversion to succeed.
@k8s-ci-robot k8s-ci-robot added kind/bug Categorizes issue or PR as related to a bug. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Nov 13, 2025
@k8s-ci-robot k8s-ci-robot requested a review from nrb November 13, 2025 15:42
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign richardcase for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@dntosas dntosas changed the title fix: ensure correct APIVersion in AWSClusterControllerIdentity conver… fix: ensure correct APIVersion in AWSClusterControllerIdentity conversion Nov 13, 2025
@k8s-ci-robot k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Nov 13, 2025
@dntosas dntosas changed the title fix: ensure correct APIVersion in AWSClusterControllerIdentity conversion 🐛 : fix: ensure correct APIVersion in AWSClusterControllerIdentity conversion Nov 13, 2025
@dntosas dntosas changed the title 🐛 : fix: ensure correct APIVersion in AWSClusterControllerIdentity conversion 🐛 fix: ensure correct APIVersion in AWSClusterControllerIdentity conversion Nov 13, 2025
@k8s-ci-robot k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Nov 13, 2025
@dntosas dntosas force-pushed the fix/conversion-awsclustercontroller branch from 0a62f61 to 9e21452 Compare November 13, 2025 16:02
Add comprehensive e2e tests to verify the conversion webhook fix for
AWSClusterControllerIdentity. The tests verify:

1. Basic conversion test:
   - Creates AWSClusterControllerIdentity in v1beta1 format using kubectl
   - Verifies the resource can be retrieved and has correct v1beta2 APIVersion
   - Tests both kubectl get and Go client retrieval
   - Verifies list operations work correctly

2. Provider upgrade simulation test:
   - Simulates creating resource with old provider (v1beta1)
   - Simulates provider upgrade scenario
   - Verifies conversion webhook correctly converts v1beta1 to v1beta2
   - Verifies resource spec is preserved during conversion
   - Tests both kubectl and Go client access patterns

These tests ensure that the conversion webhook fix properly handles
the APIVersion field during conversion, preventing the error:
'expected infrastructure.cluster.x-k8s.io/v1beta2, received
infrastructure.cluster.x-k8s.io/v1beta1'

Signed-off-by: dntosas <[email protected]>
@dntosas dntosas force-pushed the fix/conversion-awsclustercontroller branch from 9e21452 to 8b13926 Compare November 13, 2025 16:32
@k8s-ci-robot
Copy link
Contributor

@dntosas: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-cluster-api-provider-aws-test 8b13926 link true /test pull-cluster-api-provider-aws-test

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@damdo
Copy link
Member

damdo commented Nov 14, 2025

/close

in favour of #5739

@damdo damdo closed this Nov 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. needs-priority release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants