Skip to content

Fix OpenAPI validations by adding API list markers #3964

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 6, 2025

Conversation

erikgb
Copy link
Member

@erikgb erikgb commented Jul 29, 2025

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

Our openapi generator also generates a report of violations of the Kubernetes API best practices. This report is "thrown away" now, but this PR suggests adding it to Git to raise awareness of the importance of API array metadata. I have also tried to fix all reported violations in our APIs, but please review carefully! UPDATE: For now, all new list type markers are set to atomic (default without the marker), and I have created a WIP PR (#3972) for the proposed bugfixes that we can consider after merging this.

I have also reorganized the markers on some of the affected fields, as I think it's clearer to have a consistent order of the markers.

Which issue(s) this PR fixes:

Fixes #2942

Does this PR introduce a user-facing change?:

Add missing OpenAPI schema metadata to array fields in APIs

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jul 29, 2025
@erikgb erikgb force-pushed the fix-openapi-violations branch from 501acc1 to a716675 Compare July 30, 2025 07:23
@rikatz
Copy link
Contributor

rikatz commented Jul 31, 2025

hey @erikgb

As we are moving with the enablement of automated API validations, can you please check #3917 and https://docs.google.com/document/d/1DSyP7Vt9E9wX2ku1C0AvCLqQe9cCiDPCLiPP0wXFYQw/edit?disco=AAABnQWiOX8

and maybe add https://github.com/kubernetes-sigs/kube-api-linter/blob/main/pkg/analysis/ssatags/ to the analyzers list to validate the behavior during CI/CD?

Regarding this being a breaking change or not, per Joel's comment on the document we need to check with API Machinery if this change can represent any harm for already implemented or in use Gateway API resources.

Thanks!

@erikgb
Copy link
Member Author

erikgb commented Jul 31, 2025

As we are moving with the enablement of automated API validations, can you please check #3917 and https://docs.google.com/document/d/1DSyP7Vt9E9wX2ku1C0AvCLqQe9cCiDPCLiPP0wXFYQw/edit?disco=AAABnQWiOX8

and maybe add https://github.com/kubernetes-sigs/kube-api-linter/blob/main/pkg/analysis/ssatags/ to the analyzers list to validate the behavior during CI/CD?

Cool! I didn't know that you were in the process of adding KAL to Gateway API. I will definitely take a look and see if we can validate more in CI/CD.

Regarding this being a breaking change or not, per Joel's comment on the document we need to check with API Machinery if this change can represent any harm for already implemented or in use Gateway API resources.

Understood! I am a bit curious myself, as we are in the process of adding missing API list markers to cert-manager APIs. So, in general, it would be good to know which changes can be made non-breaking. Of course, the safest would be to mark all lists as atomic, which is the current default behavior, but that would be too defensive IMO. WDYT @rikatz?

@erikgb erikgb force-pushed the fix-openapi-violations branch from a716675 to 1c16684 Compare July 31, 2025 17:00
@erikgb
Copy link
Member Author

erikgb commented Jul 31, 2025

@rikatz, I have now enabled the ssatags analyzer in the KAL configuration, and it reports no issues. I have also reached out to sig-api-machinery on Slack and am waiting for someone to hopefully respond.

@rikatz
Copy link
Contributor

rikatz commented Jul 31, 2025

@rikatz, I have now enabled the ssatags analyzer in the KAL configuration, and it reports no issues. I have also reached out to sig-api-machinery on Slack and am waiting for someone to hopefully respond.

thank you!

About your questions on what is safer or not, I need to defer to people who actually know what they are doing (which is not me!)

@youngnick @robscott do you see any issue here? On a previous review on the linter proposal document, @JoelSpeed suggested that we keep the atomic for now to keep backward compatibility. I don't really know the impact here for controllers on changing things from atomic (the default) to something else.

@erikgb once you have some answer from apimachinery as well, let's see how this fits on the proposal.

Thank you!

@@ -137,12 +137,14 @@ type GRPCRouteSpec struct {
// Support: Core
//
// +optional
// +listType=set

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pre-existing validation that ensures that these are unique?

Copy link
Member Author

@erikgb erikgb Jul 31, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I cannot find such validation. Is this a strict requirement? Probably yes, as the api-server will reject a request with duplicate values (if changing this to set)?

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe this could be breaking otherwise yes. Unless we can prove that the CRD ratcheting validation would cover this change?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Even if the change is technically breaking, I think the key questions are:

  1. Does it make sense with duplicate values in this list?
  2. Does the order of the values in the list matter?
  3. Must the list be owned by a single SSA field manager?

If the answer to all the questions is NO, then I think it could be justified to "break" this as a bug fix.

Copy link
Member

@robscott robscott Aug 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree that this could/should be considered a bug fix. To keep things clean, I'd recommend starting with +listType=atomic in this PR to match the current and unfortunately flawed spec today, and then file a follow up PR to fix this after this initial PR has merged. That will make it easier to point our release notes to a single small PR for the breaking changes that swap atomic to set.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds like a good approach. I will update this PR.

Copy link
Member Author

@erikgb erikgb Aug 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@robscott I have now updated the PR, setting all list types to atomic for now, and prepared another branch with my proposed "breaking" changes. PTAL!

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And here is the WIP PR that I will rebase after this PR is merged: #3972

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@robscott I have now rebased #3972. PTAL!

@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 1, 2025
@erikgb erikgb force-pushed the fix-openapi-violations branch from 1c16684 to b42ad96 Compare August 1, 2025 09:47
@k8s-ci-robot k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 1, 2025
@erikgb erikgb force-pushed the fix-openapi-violations branch from b42ad96 to 8d6109b Compare August 2, 2025 08:51
@erikgb erikgb force-pushed the fix-openapi-violations branch from 8d6109b to 30733d6 Compare August 2, 2025 09:05
Copy link
Contributor

@youngnick youngnick left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes LGTM, just one question about the exceptions file.

@erikgb erikgb force-pushed the fix-openapi-violations branch from 30733d6 to 4096a1d Compare August 5, 2025 13:24
@JoelSpeed
Copy link

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 5, 2025
@robscott
Copy link
Member

robscott commented Aug 5, 2025

Thanks @erikgb!

/lgtm

@youngnick
Copy link
Contributor

/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: erikgb, youngnick

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 6, 2025
@k8s-ci-robot k8s-ci-robot merged commit 78496d8 into kubernetes-sigs:main Aug 6, 2025
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm "Looks good to me", indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Ensure OpenAPI schema is accurate in the Gateway types
6 participants