@@ -698,29 +698,13 @@ These situations are:
698
698
fields via `x-kubernetes-preserve-unknown-fields`).
699
699
2. The field is duplicated in the object.
700
700
701
- # ## Setting the field validation level
701
+ # ## Validation for unrecognized or duplicate fields (#setting-the-field-validation- level)
702
702
703
703
{{< feature-state for_k8s_version="v1.27" state="stable" >}}
704
704
705
- Provided that the `ServerSideFieldValidation` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) is enabled (disabled
706
- by default in 1.23 and 1.24, enabled by default starting in 1.25), you can take
707
- advantage of server side field validation to catch these unrecognized fields.
708
-
709
- When you use HTTP verbs that can submit data (`POST`, `PUT`, and `PATCH`), field
710
- validation gives you the option to choose how you would like to be notified of
711
- these fields that are being dropped by the API server. Possible levels of
712
- validation are `Ignore`, `Warn`, and `Strict`.
713
-
714
- {{< note >}}
715
- If you submit a request that specifies an unrecognized field, and that is also invalid for
716
- a different reason (for example, the request provides a string value where the API expects
717
- an integer), then the API server responds with a 400 Bad Request error response.
718
-
719
- You always receive an error response in this case, no matter what field validation level you requested.
720
- {{< /note >}}
721
-
722
- Field validation is set by the `fieldValidation` query parameter. The three
723
- values that you can provide for this parameter are :
705
+ From 1.25 onward, unrecognized or duplicate fields in an object are detected via
706
+ validation on the server when you use HTTP verbs that can submit data (`POST`, `PUT`, and `PATCH`). Possible levels of
707
+ validation are `Ignore`, `Warn` (default), and `Strict`.
724
708
725
709
` Ignore`
726
710
: The API server succeeds in handling the request as it would without the erroneous fields
@@ -740,20 +724,38 @@ detects any unknown or duplicate fields. The response message from the API
740
724
server specifies all the unknown or duplicate fields that the API server has
741
725
detected.
742
726
727
+ The field validation level is set by the `fieldValidation` query parameter.
728
+
729
+ {{< note >}}
730
+ If you submit a request that specifies an unrecognized field, and that is also invalid for
731
+ a different reason (for example, the request provides a string value where the API expects
732
+ an integer for a known field), then the API server responds with a 400 Bad Request error, but will
733
+ not provide any information on unknown or duplicate fields (only which fatal
734
+ error it encountered first).
735
+
736
+ You always receive an error response in this case, no matter what field validation level you requested.
737
+ {{< /note >}}
738
+
743
739
Tools that submit requests to the server (such as `kubectl`), might set their own
744
740
defaults that are different from the `Warn` validation level that the API server uses
745
741
by default.
746
742
747
- The `kubectl` tool uses the `--validate` flag to set the level of field validation.
748
- Historically `--validate` was used to toggle client-side validation on or off as
749
- a boolean flag. Since Kubernetes 1.25, kubectl uses
750
- server-side field validation when sending requests to a server with this feature
751
- enabled. Validation will fall back to client-side only when it cannot connect
752
- to an API server with field validation enabled.
753
- It accepts the values `ignore`, `warn`,
754
- and `strict` while also accepting the values `true` (equivalent to `strict`) and `false`
755
- (equivalent to `ignore`). The default validation setting for kubectl is `--validate=true`,
756
- which means strict server-side field validation.
743
+ The `kubectl` tool uses the `--validate` flag to set the level of field
744
+ validation. It accepts the values `ignore`, `warn`, and `strict` while
745
+ also accepting the values `true` (equivalent to `strict`) and `false`
746
+ (equivalent to `ignore`). The default validation setting for kubectl is
747
+ ` --validate=true` , which means strict server-side field validation.
748
+
749
+ When kubectl cannot connect to an API server with field validation (API servers
750
+ prior to Kubernetes 1.27), it will fall back to using client-side validation.
751
+ Client-side validation will be removed entirely in a future version of kubectl.
752
+
753
+ {{< note >}}
754
+
755
+ Prior to Kubernetes 1.25 `kubectl --validate` was used to toggle client-side validation on or off as
756
+ a boolean flag.
757
+
758
+ {{< /note >}}
757
759
758
760
# # Dry-run
759
761
0 commit comments