fix(webhook): propagate GetResourceIfExist errors in validation webhooks (#373)#377
Open
Elvand-Lie wants to merge 1 commit into
Open
Conversation
…oks (kubeslice#373) Signed-off-by: Elvand-Lie <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Seven call sites across three webhook validation files discard the error return from
util.GetResourceIfExistusing the patternexist, _ := util.GetResourceIfExist(...). When the API server is temporarily unreachable,GetResourceIfExistreturns(false, err). The discarded error causes the webhook to misinterpret an API failure as 'resource not found' and return a misleading validation error (e.g., 'cluster must be applied on project namespace' when the namespace exists but couldn't be looked up).Changes:
service/cluster_webhook_validation.go: Check error fromGetResourceIfExistinvalidateAppliedInProjectNamespaceand returnfield.InternalErrorservice/service_export_config_webhook_validation.go: Check errors from all 5GetResourceIfExistcalls invalidateServiceExportClusterAndSlice,validateServiceEndpoint, andvalidateServiceExportConfigNamespaceservice/slice_qos_config_webhook_validation.go: Check error fromGetResourceIfExistinvalidateSliceQosConfigAppliedInProjectNamespaceand addfmtimportAll 7 sites now return
field.InternalErrorwith a descriptive message when the API lookup fails, consistent with howvpn_key_rotation_webhook_validation.goalready handles errors.Fixes #373
How Has This Been Tested?
go build ./...passesChecklist:
Does this PR introduce a breaking change for other components like worker-operator?
No. This only affects webhook validation error reporting. No APIs, CRDs, or external interfaces are changed. The behavioral change is that API lookup failures now return accurate internal errors instead of misleading validation errors.