Skip to content

Commit 95591ab

Browse files
vivzbansalvivzbansal
committed
Add AllowSidecarResizePolicy to relax resize policy validation check of sidecar containers
1 parent f5d1fdf commit 95591ab

File tree

3 files changed

+187
-1
lines changed

3 files changed

+187
-1
lines changed

‎pkg/api/pod/util.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -416,6 +416,8 @@ func GetValidationOptionsFromPodSpecAndMeta(podSpec, oldPodSpec *api.PodSpec, po
416416
}
417417

418418
opts.AllowPodLifecycleSleepActionZeroValue = opts.AllowPodLifecycleSleepActionZeroValue || podLifecycleSleepActionZeroValueInUse(podSpec)
419+
// If oldPod has resize policy set on the restartable init container, we must allow it
420+
opts.AllowSidecarResizePolicy = hasRestartableInitContainerResizePolicy(oldPodSpec)
419421
}
420422
if oldPodMeta != nil && !opts.AllowInvalidPodDeletionCost {
421423
// This is an update, so validate only if the existing object was valid.
@@ -1373,3 +1375,17 @@ func useOnlyRecursiveSELinuxChangePolicy(oldPodSpec *api.PodSpec) bool {
13731375
// No feature gate + no value in the old object -> only Recursive is allowed
13741376
return true
13751377
}
1378+
1379+
// hasRestartableInitContainerResizePolicy returns true if the pod spec is non-nil and
1380+
// it has any init container with ContainerRestartPolicyAlways and non-nil ResizePolicy.
1381+
func hasRestartableInitContainerResizePolicy(podSpec *api.PodSpec) bool {
1382+
if podSpec == nil {
1383+
return false
1384+
}
1385+
for _, c := range podSpec.InitContainers {
1386+
if IsRestartableInitContainer(&c) && len(c.ResizePolicy) > 0 {
1387+
return true
1388+
}
1389+
}
1390+
return false
1391+
}

‎pkg/api/pod/util_test.go‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4036,3 +4036,171 @@ func TestDropSELinuxChangePolicy(t *testing.T) {
40364036
})
40374037
}
40384038
}
4039+
4040+
func TestValidateAllowSidecarResizePolicy(t *testing.T) {
4041+
restartPolicyAlways := api.ContainerRestartPolicyAlways
4042+
testCases := []struct {
4043+
name string
4044+
oldPodSpec *api.PodSpec
4045+
wantOption bool
4046+
}{
4047+
{
4048+
name: "old pod spec is nil",
4049+
wantOption: false,
4050+
},
4051+
{
4052+
name: "one sidecar container + one regular init container, no resize policy set on any of them",
4053+
oldPodSpec: &api.PodSpec{
4054+
InitContainers: []api.Container{
4055+
{
4056+
Name: "c1-restartable-init",
4057+
Image: "image",
4058+
RestartPolicy: &restartPolicyAlways,
4059+
},
4060+
{
4061+
Name: "c1-init",
4062+
Image: "image",
4063+
},
4064+
},
4065+
},
4066+
wantOption: false,
4067+
},
4068+
{
4069+
name: "one sidecar container + one regular init container, resize policy set on regular init container",
4070+
oldPodSpec: &api.PodSpec{
4071+
InitContainers: []api.Container{
4072+
{
4073+
Name: "c1-restartable-init",
4074+
Image: "image",
4075+
RestartPolicy: &restartPolicyAlways,
4076+
},
4077+
{
4078+
Name: "c1-init",
4079+
Image: "image",
4080+
ResizePolicy: []api.ContainerResizePolicy{
4081+
{ResourceName: api.ResourceCPU, RestartPolicy: api.NotRequired},
4082+
},
4083+
},
4084+
},
4085+
},
4086+
wantOption: false,
4087+
},
4088+
{
4089+
name: "one sidecar container + one regular init container, resize policy set on sidecar container",
4090+
oldPodSpec: &api.PodSpec{
4091+
InitContainers: []api.Container{
4092+
{
4093+
Name: "c1-restartable-init",
4094+
Image: "image",
4095+
RestartPolicy: &restartPolicyAlways,
4096+
ResizePolicy: []api.ContainerResizePolicy{
4097+
{ResourceName: api.ResourceCPU, RestartPolicy: api.NotRequired},
4098+
},
4099+
},
4100+
{
4101+
Name: "c1-init",
4102+
Image: "image",
4103+
},
4104+
},
4105+
},
4106+
wantOption: true,
4107+
},
4108+
{
4109+
name: "one sidecar container + one regular init container, resize policy set on both of them",
4110+
oldPodSpec: &api.PodSpec{
4111+
InitContainers: []api.Container{
4112+
{
4113+
Name: "c1-restartable-init",
4114+
Image: "image",
4115+
RestartPolicy: &restartPolicyAlways,
4116+
ResizePolicy: []api.ContainerResizePolicy{
4117+
{ResourceName: api.ResourceCPU, RestartPolicy: api.NotRequired},
4118+
},
4119+
},
4120+
{
4121+
Name: "c1-init",
4122+
Image: "image",
4123+
ResizePolicy: []api.ContainerResizePolicy{
4124+
{ResourceName: api.ResourceCPU, RestartPolicy: api.NotRequired},
4125+
},
4126+
},
4127+
},
4128+
},
4129+
wantOption: true,
4130+
},
4131+
{
4132+
name: "two sidecar containers, resize policy set on one of them",
4133+
oldPodSpec: &api.PodSpec{
4134+
InitContainers: []api.Container{
4135+
{
4136+
Name: "c1-restartable-init",
4137+
Image: "image",
4138+
RestartPolicy: &restartPolicyAlways,
4139+
ResizePolicy: []api.ContainerResizePolicy{
4140+
{ResourceName: api.ResourceCPU, RestartPolicy: api.NotRequired},
4141+
},
4142+
},
4143+
{
4144+
Name: "c2-restartable-init",
4145+
Image: "image",
4146+
RestartPolicy: &restartPolicyAlways,
4147+
},
4148+
},
4149+
},
4150+
wantOption: true,
4151+
},
4152+
{
4153+
name: "two regular init containers, resize policy set on both of them",
4154+
oldPodSpec: &api.PodSpec{
4155+
InitContainers: []api.Container{
4156+
{
4157+
Name: "c1-init",
4158+
Image: "image",
4159+
ResizePolicy: []api.ContainerResizePolicy{
4160+
{ResourceName: api.ResourceCPU, RestartPolicy: api.NotRequired},
4161+
},
4162+
},
4163+
{
4164+
Name: "c2-init",
4165+
Image: "image",
4166+
ResizePolicy: []api.ContainerResizePolicy{
4167+
{ResourceName: api.ResourceCPU, RestartPolicy: api.NotRequired},
4168+
},
4169+
},
4170+
},
4171+
},
4172+
wantOption: false,
4173+
},
4174+
{
4175+
name: "two non-init containers, resize policy set on both of them",
4176+
oldPodSpec: &api.PodSpec{
4177+
Containers: []api.Container{
4178+
{
4179+
Name: "c1",
4180+
Image: "image",
4181+
ResizePolicy: []api.ContainerResizePolicy{
4182+
{ResourceName: api.ResourceCPU, RestartPolicy: api.NotRequired},
4183+
},
4184+
},
4185+
{
4186+
Name: "c2",
4187+
Image: "image",
4188+
ResizePolicy: []api.ContainerResizePolicy{
4189+
{ResourceName: api.ResourceCPU, RestartPolicy: api.NotRequired},
4190+
},
4191+
},
4192+
},
4193+
},
4194+
wantOption: false,
4195+
},
4196+
}
4197+
4198+
for _, tc := range testCases {
4199+
t.Run(tc.name, func(t *testing.T) {
4200+
gotOptions := GetValidationOptionsFromPodSpecAndMeta(&api.PodSpec{}, tc.oldPodSpec, nil, nil)
4201+
if tc.wantOption != gotOptions.AllowSidecarResizePolicy {
4202+
t.Errorf("Got AllowSidecarResizePolicy=%t, want %t", gotOptions.AllowSidecarResizePolicy, tc.wantOption)
4203+
}
4204+
})
4205+
}
4206+
}

‎pkg/apis/core/validation/validation.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3543,7 +3543,7 @@ func validateInitContainers(containers []core.Container, regularContainers []cor
35433543
}
35443544
}
35453545

3546-
if len(ctr.ResizePolicy) > 0 {
3546+
if !opts.AllowSidecarResizePolicy && len(ctr.ResizePolicy) > 0 {
35473547
allErrs = append(allErrs, field.Invalid(idxPath.Child("resizePolicy"), ctr.ResizePolicy, "must not be set for init containers"))
35483548
}
35493549
}
@@ -4051,6 +4051,8 @@ type PodValidationOptions struct {
40514051
AllowOnlyRecursiveSELinuxChangePolicy bool
40524052
// Indicates whether PodLevelResources feature is enabled or disabled.
40534053
PodLevelResourcesEnabled bool
4054+
// Allow sidecar containers resize policy for backward compatibility
4055+
AllowSidecarResizePolicy bool
40544056
}
40554057

40564058
// validatePodMetadataAndSpec tests if required fields in the pod.metadata and pod.spec are set,

0 commit comments

Comments
 (0)