Skip to content

⚠️ Default selectors to Nothing if it is nil for MatchingLabelsSelector and MatchingFieldsSelector #3279

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Aug 19, 2025

Conversation

acumino
Copy link
Contributor

@acumino acumino commented Aug 13, 2025

If the selector is not set for MatchingLabelsSelector and MatchingFieldsSelector, then the list call panics.
This PR updates MatchingLabelsSelector and MatchingFieldsSelector to default their Selector fields to labels.Nothing() and fields.Nothing() respectively if unset in ApplyToList.

@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Aug 13, 2025
@k8s-ci-robot k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 13, 2025
@k8s-ci-robot
Copy link
Contributor

Hi @acumino. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Aug 13, 2025
@acumino
Copy link
Contributor Author

acumino commented Aug 13, 2025

/cc @sbueringer

@troy0820
Copy link
Member

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Aug 13, 2025
@@ -644,6 +644,9 @@ type MatchingLabelsSelector struct {

// ApplyToList applies this configuration to the given list options.
func (m MatchingLabelsSelector) ApplyToList(opts *ListOptions) {
if m.Selector == nil {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why would a label or field selector be set if it has no value?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two reasons -

  • When a list call happens with empty/nil label selector, it lists everything, since MatchingLabelsSelector also wants to achieve a similar thing; therefore, in case of a nil label selector, it should list all the objects.
  • Currently if nil is passed for selector in MatchingLabelsSelector the list call panics, which should not happen

Copy link
Member

@sbueringer sbueringer Aug 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For what it's worth, this is the official godoc on metav1.LabelSelector

// A label selector is a label query over a set of resources. The result of matchLabels and
// matchExpressions are ANDed. An *empty* label selector matches *all objects*. A *null*
// label selector matches *no objects*.

If we follow that semantic here as well null would mean match no objects

Copy link
Contributor Author

@acumino acumino Aug 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If I use -

client.List(ctx, nodeList, &client.ListOptions{LabelSelector: nil})

It lists all objects. What should be the way to go here?

Also

A null label selector matches no objects.

If we follow this, then I can modify the PR to use Nothing instead of Everything when MatchingLabelsSelector's selector is not set so it doesn't panic.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you explain why you have code that ends up with a nil selector and why that is not considered to be a bug?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WDYT about the below changes -

// ApplyToList applies this configuration to the given list options.
func (m MatchingLabelsSelector) ApplyToList(opts *ListOptions) {
	if m.Selector == nil {
		m.Selector = labels.SelectorFromSet(labels.Set{})
	}
	opts.LabelSelector = m
}

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Having a nil selector in there is incorrect usage and we can not error. We do recover panics though so it seems all right to me.

Your suggestion makes a nil selector match everything, which as mentioned earlier we do not want.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

recover panics though so it seems all right to me.

This doesn't allow us to let the panic happen at the first place.

Also, IMO we should allow list all, because as per the doc string MatchingLabelsSelector is supposed to behave the same as LabelSelector, which it doesn't currently.

By my main concern for this PR was that we should not let the panic happen, we should stop it one way or another and not let the user figure it out after trial and error. I am open to suggestions for that.
If we really don't want to list anything in case of nil Selector in MatchingLabelsSelector, I can use labels.Nothing instead of Everything.
This will fix both of our concerns.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, IMO we should allow list all, because as per the doc string MatchingLabelsSelector is supposed to behave the same as LabelSelector, which it doesn't currently.

Which could also be fixed by changing LabelSelector rather than MatchingLabelSelector.

I don't personally mind the panic, given our default is to recover panics and this is basically incorrect usage and we don't have a way to report that, as the listOpts can not error. I am okay changing it to labels.Nothing() if you want to do that, but I would veto changing it to labels.Everything() due to potential security implications.

Copy link
Contributor Author

@acumino acumino Aug 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My main issue was nil pointer panic, I am ok with nothing also.
Update the PR, PTAL.

@acumino acumino requested a review from alvaroaleman August 14, 2025 05:58
@alvaroaleman alvaroaleman changed the title 🐛 Default selectors to Everything if it is nil for MatchingLabelsSelector and MatchingFieldsSelector 🐛 Default selectors to Nothing if it is nil for MatchingLabelsSelector and MatchingFieldsSelector Aug 18, 2025
@alvaroaleman alvaroaleman changed the title 🐛 Default selectors to Nothing if it is nil for MatchingLabelsSelector and MatchingFieldsSelector ⚠️ Default selectors to Nothing if it is nil for MatchingLabelsSelector and MatchingFieldsSelector Aug 18, 2025
@alvaroaleman alvaroaleman added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Aug 18, 2025
@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 18, 2025
@k8s-ci-robot
Copy link
Contributor

LGTM label has been added.

Git tree hash: 16a47334870891aed9482e6966ba44660880fdb8

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 18, 2025
@alvaroaleman
Copy link
Member

/hold

in case @sbueringer wants to check

@k8s-ci-robot k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 18, 2025
@sbueringer
Copy link
Member

Thx!

/lgtm
/approve
/hold cancel

@k8s-ci-robot k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 19, 2025
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: acumino, alvaroaleman, sbueringer

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [alvaroaleman,sbueringer]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot merged commit e4f9a24 into kubernetes-sigs:main Aug 19, 2025
23 of 24 checks passed
@acumino acumino deleted the selec-ehc branch August 19, 2025 11:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants