Skip to content

update webhooks: handle resourceVersion conflicts properly #2009

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
multi-io wants to merge 1 commit into
base: main
Choose a base branch
from
+8 −0
Open

update webhooks: handle resourceVersion conflicts properly #2009

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions pkg/admission/machinedeployments.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,10 @@ func (ad *admissionData) mutateMachineDeployments(ctx context.Context, ar admiss
if err := json.Unmarshal(ar.OldObject.Raw, &oldMachineDeployment); err != nil {
return nil, fmt.Errorf("failed to unmarshal OldObject: %w", err)
}
if oldMachineDeployment.ResourceVersion != machineDeployment.ResourceVersion {
// resource version conflict. Return success to fall back to the API server's default handler, which will respond with a proper 409
return createAdmissionResponse(log, machineDeploymentOriginal, &machineDeployment)
Copy link

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This line has inconsistent indentation (spaces instead of tabs) and will be rewritten by gofmt; it may also fail formatting/lint checks in CI. Please run gofmt (or fix indentation) so the return statement is properly aligned with the surrounding block.

Suggested change
return createAdmissionResponse(log, machineDeploymentOriginal, &machineDeployment)
return createAdmissionResponse(log, machineDeploymentOriginal, &machineDeployment)

Copilot uses AI. Check for mistakes.
Comment on lines +59 to +60
Copy link

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This new resourceVersion-conflict bypass is a behavior change that is currently untested. Please add a unit test that constructs an Update AdmissionRequest where OldObject.resourceVersion != Object.resourceVersion and asserts the mutator returns Allowed=true (and does not fail validation / does not return a patch).

Suggested change
// resource version conflict. Return success to fall back to the API server's default handler, which will respond with a proper 409
return createAdmissionResponse(log, machineDeploymentOriginal, &machineDeployment)
// Resource version conflict. Return success without a patch so the API server can respond with a proper 409.
return &admissionv1.AdmissionResponse{Allowed: true}, nil

Copilot uses AI. Check for mistakes.
}
Comment on lines +58 to +61
Copy link

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the conflict branch, the handler currently reaches this resourceVersion check only after running defaulting/mutations and validateMachineDeployment earlier in the function. That means an update with an outdated resourceVersion can still be rejected by the webhook with a 400 before the API server returns the intended 409. Consider moving the resourceVersion mismatch check to the very start of the Update path (before any mutation/validation) and returning Allowed=true with no patch when it mismatches.

Copilot uses AI. Check for mistakes.
if equal := apiequality.Semantic.DeepEqual(oldMachineDeployment.Spec.Template.Spec, machineDeployment.Spec.Template.Spec); equal {
machineSpecNeedsValidation = false
}
Expand Down
4 changes: 4 additions & 0 deletions pkg/admission/machines.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,10 @@ func (ad *admissionData) mutateMachines(ctx context.Context, ar admissionv1.Admi
if err := json.Unmarshal(ar.OldObject.Raw, &oldMachine); err != nil {
return nil, fmt.Errorf("failed to unmarshal OldObject: %w", err)
}
if oldMachine.ResourceVersion != machine.ResourceVersion {
// resource version conflict. Return success to fall back to the API server's default handler, which will respond with a proper 409
return createAdmissionResponse(log, machineOriginal, &machine)
}
Comment on lines +65 to +68
Copy link

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This new resourceVersion-conflict bypass is a behavior change that is currently untested. Please add a unit test that constructs an Update AdmissionRequest where OldObject.resourceVersion != Object.resourceVersion and asserts the mutator returns Allowed=true (and does not run the immutability checks / does not return a patch).

Copilot uses AI. Check for mistakes.
if oldMachine.Spec.Name != machine.Spec.Name && machine.Spec.Name == machine.Name {
oldMachine.Spec.Name = machine.Spec.Name
}
Expand Down
Loading