TestVersionedValidationByFuzzing swept a hand-maintained list of
group/versions that had a typo (network.k8s.io) and omitted several
groups (apps, policy, rbac, flowcontrol, scheduling). Replace it with a
sweep of the scheme for served GVKs that have declarative validation,
so new group/versions are covered automatically.
Skip extensions/v1beta1 centrally in VerifyVersionedValidationEquivalence
instead of via the per-call WithSkipGroupVersions option: it opts out of
declarative validation but shares an internal type with versions that do
not. Any other version missing declarative validation now fails the sweep
rather than being silently skipped.
The gate is GA and locked to true, so explicitly setting it in the
equivalence test harness only emits a 'setting GA feature gate' warning
without changing behavior. Rely on its locked default instead.
Address review feedback on PR #139568:
- Group all test cases by the ObjectMeta field they cover (the stray
"finalizers: name too long" case previously sat at the bottom).
- Mirror the field grouping in the update suite. The update suite keeps
only the baseline valid case; field-level boundaries are covered by
the create suite and re-checking them on update adds no signal.
- Fix three errorlint warnings flagged by pull-kubernetes-linter-hints:
switch fmt.Errorf("...: %v", err) to %w in the metadata-accessor
failure paths of rest.ValidateCreate and validateCommonFields.
- Reword the extensions/v1beta1 skip comment in
TestVersionedValidationByFuzzing: drop the stray trailing semicolon
and explain that the group is unserved and does not carry DV.
Add WithSkipGroupVersions and apply it to the NetworkPolicy and Scale tests,
whose internal types also register under the now-unvalidated extensions/v1beta1.
With DV always enforced, the "hand written validation" subtest (which
set DeclarativeValidation=off and emulated 1.35) now exercises the
same code path as "Beta disabled". Remove it along with the
MinEmulationVersion option, the WithMinEmulationVersion helper,
deDuplicateErrors, and the now-tautological imperative-vs-declarative
equivalence checks.
Variant of VerifyUpdateValidationEquivalence that accepts a validate
closure instead of a RESTUpdateStrategy, for callers that produce
handwritten and declarative validation errors directly.
VerifyValidationEquivalence's all-rules-enforced subtest now extracts
the GVK from the request context and forwards each error to
coverage.RecordObservedRules so AssertDeclarativeCoverage (in the
generated TestMain) can confirm every declared rule fired.
Introduce the ResourcePoolStatusRequest resource type in the
resource.k8s.io/v1alpha3 API group, gated behind the
DRAResourcePoolStatus feature gate. This includes external and internal
type definitions, protobuf/OpenAPI generated code, client-go typed
clients, informers, listers, apply configurations, deepcopy, defaults,
conversion, fuzzer, declarative validation tags, and API discovery
metadata.
The fields become beta, enabled by default. DeviceTaintRule gets
added to the v1beta2 API, but support for it must remain off by default
because that API group is also off by default.
The v1beta1 API is left unchanged. No-one should be using it
anymore (deprecated in 1.33, could be removed now if it wasn't for
reading old objects and version emulation).
To achieve consistent validation, declarative validation must be enabled also
for v1alpha3 (was already enabled for other versions). Otherwise,
TestVersionedValidationByFuzzing fails:
--- FAIL: TestVersionedValidationByFuzzing (0.09s)
--- FAIL: TestVersionedValidationByFuzzing/resource.k8s.io/v1beta2,_Kind=DeviceTaintRule (0.00s)
validation_test.go:109: different error count (0 vs. 1)
resource.k8s.io/v1alpha3: <no errors>
resource.k8s.io/v1beta2: "spec.taint.effect: Unsupported value: \"幤HxÒQP¹¬永唂ȳ垞ş]嘨鶊\": supported values: \"NoExecute\", \"NoSchedule\", \"None\""
...
When a test enables a feature gate introduced after 1.35, the "hand
written validation" sub-test fails because SetFeatureGateEmulationVersionDuringTest
cannot downgrade to 1.35 for features that did not exist at that version.
This adds a WithMinEmulationVersion option so callers can declare the
minimum supported emulation version and skip the sub-test when incompatible.
- Register v1 MutatingAdmissionPolicy and Binding in apiserver storage.
- Add defaults and validation for v1 types.
- Update storage version hash data.
- Add API testdata.
- Test scenarios: Beta Enabled, Beta Disabled, and Legacy (emulated 1.35).
- Remove deprecated Takeover gate references and redundant coverage checks.
- Add TODO to remove legacy emulation in 1.39.
- Update documentation to match the new Validation Lifecycle strategy.
Refactor TestVersionedValidationByFuzzing to use a declarative map,
subresourceOnly, for resources that must be validated via a specific
subresource path (like autoscaling/Scale).
GVKs not in this map default to root-level validation (""), which is
sufficient for resources that share validation logic between their root
and subresources. This replaces the previous ad-hoc special-casing
with a cleaner, extensible mapping.
Fuzzing must be performed on the internal version of objects because
custom fuzzing functions are typically registered for internal types.
This ensures that all fields are properly initialized with random values
before being converted to various API versions for validation.
Move fuzzing logic into VerifyVersionedValidationEquivalence via a new
WithFuzzer option. This also fixes a panic that occurred when attempting
to fuzz types without an internal version (e.g., APIGroupList) by adding
a nil check after internal conversion.
This change graduates the 'DeclarativeValidation' feature gate to GA in v1.36.
The feature gate is now locked to 'true' by default.
Changes:
- Updated 'DeclarativeValidation' feature gate to GA in 'pkg/features/kube_features.go' and 'staging/src/k8s.io/apiserver/pkg/features/kube_features.go'.
- Updated feature gate documentation and versioned lists via 'hack/update-featuregates.sh'.
- Added feature gate emulation versioning to tests that explicitly disable 'DeclarativeValidation' to prevent panics now that the gate is locked to default.
This commit adds an 'IgnoreObjectConversionErrors' option to the
validation testing framework in 'k8s.io/apimachinery' and exposes it
via 'pkg/api/testing'.
This is useful for fuzzing tests where we might want to skip object
versions that cannot be converted from the internal version (e.g. due to
missing fields or incompatible types in older versions) but still want
to test validation for the versions that *can* be converted.
The 'autoscaling' group versions are added to 'TestVersionedValidationByFuzzing'
with this option enabled.
