diff --git a/go.mod b/go.mod index dbfdb2f2..7600bff1 100644 --- a/go.mod +++ b/go.mod @@ -16,10 +16,10 @@ require ( github.com/stretchr/testify v1.11.1 github.com/txn2/txeh v1.8.1 go.uber.org/mock v0.6.0 - golang.org/x/term v0.44.0 + golang.org/x/term v0.45.0 gopkg.in/yaml.v3 v3.0.1 k8s.io/api v0.36.2 - k8s.io/apimachinery v0.36.2 + k8s.io/apimachinery v0.37.1 k8s.io/client-go v0.36.2 ) @@ -39,17 +39,18 @@ require ( github.com/go-logr/logr v1.4.3 // indirect github.com/go-openapi/jsonpointer v1.0.0 // indirect github.com/go-openapi/jsonreference v1.0.0 // indirect - github.com/go-openapi/swag v0.27.0 // indirect - github.com/go-openapi/swag/cmdutils v0.27.0 // indirect - github.com/go-openapi/swag/conv v0.27.0 // indirect - github.com/go-openapi/swag/fileutils v0.27.0 // indirect - github.com/go-openapi/swag/jsonutils v0.27.0 // indirect - github.com/go-openapi/swag/loading v0.27.0 // indirect - github.com/go-openapi/swag/mangling v0.27.0 // indirect - github.com/go-openapi/swag/netutils v0.27.0 // indirect - github.com/go-openapi/swag/stringutils v0.27.0 // indirect - github.com/go-openapi/swag/typeutils v0.27.0 // indirect - github.com/go-openapi/swag/yamlutils v0.27.0 // indirect + github.com/go-openapi/swag v0.27.1 // indirect + github.com/go-openapi/swag/cmdutils v0.27.1 // indirect + github.com/go-openapi/swag/conv v0.27.1 // indirect + github.com/go-openapi/swag/fileutils v0.27.1 // indirect + github.com/go-openapi/swag/jsonutils v0.27.1 // indirect + github.com/go-openapi/swag/loading v0.27.1 // indirect + github.com/go-openapi/swag/mangling v0.27.1 // indirect + github.com/go-openapi/swag/netutils v0.27.1 // indirect + github.com/go-openapi/swag/pools v0.27.1 // indirect + github.com/go-openapi/swag/stringutils v0.27.1 // indirect + github.com/go-openapi/swag/typeutils v0.27.1 // indirect + github.com/go-openapi/swag/yamlutils v0.27.1 // indirect github.com/google/gnostic-models v0.7.1 // indirect github.com/google/uuid v1.6.0 // indirect github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect @@ -74,17 +75,17 @@ require ( github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect go.yaml.in/yaml/v2 v2.4.4 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect - golang.org/x/net v0.56.0 // indirect + golang.org/x/net v0.57.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sys v0.47.0 // indirect - golang.org/x/text v0.39.0 // indirect + golang.org/x/text v0.40.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect k8s.io/klog/v2 v2.140.0 // indirect - k8s.io/kube-openapi v0.0.0-20260706235625-cdb1db5517a0 // indirect - k8s.io/streaming v0.36.2 // indirect + k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect + k8s.io/streaming v0.37.1 // indirect k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 // indirect sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect sigs.k8s.io/randfill v1.0.0 // indirect diff --git a/go.sum b/go.sum index 17e6518e..a144fef6 100644 --- a/go.sum +++ b/go.sum @@ -49,30 +49,32 @@ github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxg github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y= github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY= github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0= -github.com/go-openapi/swag v0.27.0 h1:8ecSuZlh4NXc3GsmAOqECIYqDTApCWaMe3gO4gjJNEE= -github.com/go-openapi/swag v0.27.0/go.mod h1:Kkgz9Ht0+ul9/aVdFmc9xSyPzUwf/aFF5KiFPBXfSY0= -github.com/go-openapi/swag/cmdutils v0.27.0 h1:aIKiqhB29AaP+7xm8/CPg3uOpeHx2SUp6TvMpu/a31Y= -github.com/go-openapi/swag/cmdutils v0.27.0/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM= -github.com/go-openapi/swag/conv v0.27.0 h1:EKOH4feXrvdo8DbSsXSAqRT8fz1epEnS5O2IfXUOzE8= -github.com/go-openapi/swag/conv v0.27.0/go.mod h1:pfiv0uKQTbaGApk8Zs/lZV3uSjmSpa2FO1y183YngN8= -github.com/go-openapi/swag/fileutils v0.27.0 h1:ib5jMUqGq5tY1EyO4inlrabsaeDAleFU+XD1FXQcgp8= -github.com/go-openapi/swag/fileutils v0.27.0/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8= -github.com/go-openapi/swag/jsonutils v0.27.0 h1:VYtd9jEQYeU4j8q5vdn5KWotF4vKywhGdMBrALtAsfE= -github.com/go-openapi/swag/jsonutils v0.27.0/go.mod h1:U7pb8AGuwhok3RDicHeHwSG4L3PXSq6PAL98Aon632g= -github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.0 h1:+d7C7Ur/SsGg/UZ9G0JEovnfRqtMNZCJQGKc2h/ojoE= -github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.0/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY= -github.com/go-openapi/swag/loading v0.27.0 h1:s8DA9aPEdFH6OluHUYUn3DnIuoTdyWs9RwffXBUfyeI= -github.com/go-openapi/swag/loading v0.27.0/go.mod h1:VOz+Jg6UGGywcmRvYsI4fvtp+bd7NfioseGEPleYdA4= -github.com/go-openapi/swag/mangling v0.27.0 h1:rpPJuqQHa6z2pDiP3iIpXOyNXlSs9cQCxnJSAxzdfOc= -github.com/go-openapi/swag/mangling v0.27.0/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w= -github.com/go-openapi/swag/netutils v0.27.0 h1:lEUG+hHvPvLggB3A8snFk0IRKNf9uC0YKc+7WYqvAF8= -github.com/go-openapi/swag/netutils v0.27.0/go.mod h1:J+WYyFMLtvtCGqa6jLv+YNUmIKI3ZRQRrvfNDMoQoEQ= -github.com/go-openapi/swag/stringutils v0.27.0 h1:Of7w/HljWsNZvuxsUAnw3n+hCOyI6HLJOxW2kQRAxio= -github.com/go-openapi/swag/stringutils v0.27.0/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM= -github.com/go-openapi/swag/typeutils v0.27.0 h1:aCf4MSGo8NLwZP8Q6t32DWLJSvl/WwNqgmEG+xJ6v2o= -github.com/go-openapi/swag/typeutils v0.27.0/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ= -github.com/go-openapi/swag/yamlutils v0.27.0 h1:bQ6eAMil5X9tdcf7dMn4t15alzG6jddnrKPuKa/zxKM= -github.com/go-openapi/swag/yamlutils v0.27.0/go.mod h1:yRfIo7qqVkmJRQjX8exjA3AfcI8rH1KDNPsTparoCv4= +github.com/go-openapi/swag v0.27.1 h1:VotvOLWW8q/EAxB0YdsBBGC8XYyeL1YwBj2ungAGPNg= +github.com/go-openapi/swag v0.27.1/go.mod h1:GTkJPwHfhJp6MWr4/rCh64HVI3Ofu+tcsbfjfHmTxpE= +github.com/go-openapi/swag/cmdutils v0.27.1 h1:I7sYqaWVl5mq0NEmNQkAmFDyNin9ufvMX/p2zwtQaOE= +github.com/go-openapi/swag/cmdutils v0.27.1/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM= +github.com/go-openapi/swag/conv v0.27.1 h1:8wi9ZG+olmY1wXphl93EWniPtbSPkXM/feH7FgjsvrU= +github.com/go-openapi/swag/conv v0.27.1/go.mod h1:QbqMivkpKhC3g1B1GGGOJ6ANewI3S62dbzYu3Duowqs= +github.com/go-openapi/swag/fileutils v0.27.1 h1:QQqBSoi5mW4XpU85nS0mLcA+zAE6vLzrb0QkmLKf9oM= +github.com/go-openapi/swag/fileutils v0.27.1/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8= +github.com/go-openapi/swag/jsonutils v0.27.1 h1:SVgK3i4USzCU5mibOOS/l4ea2h9UQXy7J7RNLTjuXjU= +github.com/go-openapi/swag/jsonutils v0.27.1/go.mod h1:tdlEpZqdcQ17uj6J4YdK9vd8It5qWMwjWXOs0tjpRlk= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1 h1:mJu3COL9WEaZVp/Kf2PRMi7tPszPEJfSr/OO75ynCs8= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY= +github.com/go-openapi/swag/loading v0.27.1 h1:/DxUgDXKbBX4bcn7r9uEXfJyzN5XpiJmZplzQTjrRCY= +github.com/go-openapi/swag/loading v0.27.1/go.mod h1:jvGh3iA2+zyUUycB5fgJWzeHnhrpvGnJJM0RVE9ZShE= +github.com/go-openapi/swag/mangling v0.27.1 h1:yC9D0HyUE8gbP+BfmGx9+AA89ikwZTMjESK3OnnoaqA= +github.com/go-openapi/swag/mangling v0.27.1/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w= +github.com/go-openapi/swag/netutils v0.27.1 h1:mICMFoS82F5TZ4Zy3cqmcQk+BFeCp3Uyq3Np7GI0/qU= +github.com/go-openapi/swag/netutils v0.27.1/go.mod h1:J+WYyFMLtvtCGqa6jLv+YNUmIKI3ZRQRrvfNDMoQoEQ= +github.com/go-openapi/swag/pools v0.27.1 h1:9LeadcMyb2GJCbXX5hVQDbZ2Lq9TL4dCs/nx1j5DO0E= +github.com/go-openapi/swag/pools v0.27.1/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE= +github.com/go-openapi/swag/stringutils v0.27.1 h1:ZXePZ0r2p1qSjo8tD3Un4vFj8+FqlCkczxDrJIhYUp8= +github.com/go-openapi/swag/stringutils v0.27.1/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM= +github.com/go-openapi/swag/typeutils v0.27.1 h1:KSTdFlfnse4r6dP9IrEnwMldjE+zs71UeEB3//PtVXc= +github.com/go-openapi/swag/typeutils v0.27.1/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ= +github.com/go-openapi/swag/yamlutils v0.27.1 h1:ftxv6xvXb1E3zohUc+okZ9nSqNb9StQX/FXnKZ98sQA= +github.com/go-openapi/swag/yamlutils v0.27.1/go.mod h1:bnxFIB1qewGRiZHypXGZ3fNgf13/0HfRgnS/iZBDrOo= github.com/go-openapi/testify/enable/yaml/v2 v2.6.0 h1:gGHwAJ0R/5jU8BEGDbfRNR3hL68dAVi84WuOApp29B0= github.com/go-openapi/testify/enable/yaml/v2 v2.6.0/go.mod h1:tY+St1SGq4NFl0QIqdTY4aEdbChAHxhyB77XQi9iJCo= github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug= @@ -160,8 +162,8 @@ go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI= golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo= -golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= -golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -169,10 +171,10 @@ golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc= -golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y= -golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus= -golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM= +golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= +golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= +golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= +golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= @@ -188,16 +190,16 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= k8s.io/api v0.36.2 h1:TF6YDLIzKfccK7cq9YpTcGX8TJmEkHVRv78DM51fRYY= k8s.io/api v0.36.2/go.mod h1:F4LbMO4brjZYh7yFkXWhynSvtB7YauxV4c+HHkNRGNg= -k8s.io/apimachinery v0.36.2 h1:0PE/W/WNy1UX61NLbXY5TMbJ6UwLL6E6lAPkYrKFxbQ= -k8s.io/apimachinery v0.36.2/go.mod h1:fvf/HOLXq9RId0rnDIbN1OEBvHXdQbLMM8nu0LcBUf4= +k8s.io/apimachinery v0.37.1 h1:hGCYyvKHCwtwMitj2vU4vYx0Z16N9GyZk9BBnz0wDAE= +k8s.io/apimachinery v0.37.1/go.mod h1:jF84AyUi/IRIXRot5f+lm6MpxoWI+F1XgjaMmwCdTFw= k8s.io/client-go v0.36.2 h1:bfgxmFKc9CgqsgX4xKLAAdmTQlWee7Ob/HlDOrJ5TBI= k8s.io/client-go v0.36.2/go.mod h1:1vgO4OAlfPnoLcb+Rze2GF5rAr14w8qjrYMoyXJzQj0= k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc= k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0= -k8s.io/kube-openapi v0.0.0-20260706235625-cdb1db5517a0 h1:CVjOUCTXINUThEmDs25FNSna0+vnGSoTleN+wiJu6hE= -k8s.io/kube-openapi v0.0.0-20260706235625-cdb1db5517a0/go.mod h1:rcZ+P5cEvHQB+m154WBOatIGBgOEPjzmLkXjkHfg3ms= -k8s.io/streaming v0.36.2 h1:NSKthPPg9UFSKsRauVJUVGH2Dvn8fhKmY4qrMkw/p98= -k8s.io/streaming v0.36.2/go.mod h1:z6fV3D+NVkoeqRMtWwlUZK6U17SY/LqNzOxWL6GyR/s= +k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A= +k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I= +k8s.io/streaming v0.37.1 h1:TpzVfQeFuVndn2g9mFqxy1UcUYPwDzqjUmwR/IzJCWc= +k8s.io/streaming v0.37.1/go.mod h1:APlJR26ZWRcVy5bIEj0QRrKUXROtBHPcxl2NT7EAzPU= k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 h1:jVkFFVfXdXP74B/zbO3hM3hpSFD0xvhQ5U686DPurkE= k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3/go.mod h1:M2s5JB1lIYP3jzZdorPLHXIPJzt9vv2muW5a6L9DtNM= pgregory.net/rapid v1.3.0 h1:vBvO0VSqti75J1jjYqpgPNBLKMd1+gxa9fYo7vk/Exc= diff --git a/vendor/github.com/go-openapi/swag/CONTRIBUTORS.md b/vendor/github.com/go-openapi/swag/CONTRIBUTORS.md index b619a01d..0f0711cd 100644 --- a/vendor/github.com/go-openapi/swag/CONTRIBUTORS.md +++ b/vendor/github.com/go-openapi/swag/CONTRIBUTORS.md @@ -4,11 +4,11 @@ | Total Contributors | Total Contributions | | --- | --- | -| 24 | 247 | +| 24 | 251 | | Username | All Time Contribution Count | All Commits | | --- | --- | --- | -| @fredbi | 117 | | +| @fredbi | 121 | | | @casualjim | 98 | | | @alexandear | 4 | | | @orisano | 3 | | diff --git a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/adapter.go b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/adapter.go index 0213ff5c..94185f79 100644 --- a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/adapter.go +++ b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/adapter.go @@ -5,6 +5,7 @@ package json import ( stdjson "encoding/json" + "fmt" "github.com/go-openapi/swag/jsonutils/adapters/ifaces" "github.com/go-openapi/swag/typeutils" @@ -24,11 +25,16 @@ var ErrStdlib jsonError = "error from the JSON adapter stdlib" var _ ifaces.Adapter = &Adapter{} type Adapter struct { + options } // NewAdapter yields an [ifaces.Adapter] using the standard library. -func NewAdapter() *Adapter { - return &Adapter{} +func NewAdapter(opts ...Option) *Adapter { + var o options + + return &Adapter{ + options: buildOptions(o, opts), + } } func (a *Adapter) Marshal(value any) ([]byte, error) { @@ -40,45 +46,18 @@ func (a *Adapter) Unmarshal(data []byte, value any) error { } func (a *Adapter) OrderedMarshal(value ifaces.Ordered) ([]byte, error) { - w := poolOfWriters.Borrow() - defer func() { - poolOfWriters.Redeem(w) - }() - - if typeutils.IsNil(value) { - w.RawString("null") - - return w.BuildBytes() - } - - w.RawByte('{') - first := true - for k, v := range value.OrderedItems() { - if first { - first = false - } else { - w.RawByte(',') - } + w, redeem := poolOfWriters.BorrowWithRedeem() + defer redeem() + w.setBuf() - w.String(k) - w.RawByte(':') - - switch val := v.(type) { - case ifaces.Ordered: - w.Raw(a.OrderedMarshal(val)) - default: - w.Raw(stdjson.Marshal(v)) - } - } - - w.RawByte('}') + a.orderedMarshal(w, value, 1) return w.BuildBytes() } func (a *Adapter) OrderedUnmarshal(data []byte, value ifaces.SetOrdered) error { var m MapSlice - if err := m.OrderedUnmarshalJSON(data); err != nil { + if err := m.orderedUnmarshalJSON(data, a.maxDepth()); err != nil { return err } @@ -112,4 +91,43 @@ func (a *Adapter) Redeem() { } func (a *Adapter) Reset() { + a.options = options{} +} + +// orderedMarshal writes value to w, tracking the container nesting depth to guard +// against stack overflow on deeply nested structures. +func (a *Adapter) orderedMarshal(w *jwriter, value ifaces.Ordered, depth int) { + if typeutils.IsNil(value) { + w.RawString("null") + + return + } + + if maxDepth := a.maxDepth(); depth > maxDepth { + w.SetErr(fmt.Errorf("maximum nesting depth of %d exceeded: %w", maxDepth, ErrStdlib)) + + return + } + + w.RawByte('{') + first := true + for k, v := range value.OrderedItems() { + if first { + first = false + } else { + w.RawByte(',') + } + + w.String(k) + w.RawByte(':') + + switch val := v.(type) { + case ifaces.Ordered: + a.orderedMarshal(w, val, depth+1) + default: + w.Raw(stdjson.Marshal(v)) + } + } + + w.RawByte('}') } diff --git a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/lexer.go b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/lexer.go index b5aa1c79..ac81cbc7 100644 --- a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/lexer.go +++ b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/lexer.go @@ -54,7 +54,7 @@ func (t token) Delim() byte { return 0 } - return byte(r) + return byte(r) //nolint:gosec // delimiter runes are single byte } type tokenKind uint8 @@ -91,6 +91,13 @@ type jlexer struct { // current token next token // started bool + + // depth tracks the current JSON container nesting level, and maxDepth caps it + // to guard against stack-overflow on adversarially deep documents. The standard + // library's streaming [encoding/json.Decoder.Token] API (used here) does not + // enforce the max-depth guard that [encoding/json.Unmarshal] provides, so we do. + depth int + maxDepth int } type bytesReader struct { @@ -130,7 +137,8 @@ var _ io.Reader = &bytesReader{} func newLexer(data []byte) *jlexer { l := &jlexer{ // current: undefToken, - next: undefToken, + next: undefToken, + maxDepth: defaultMaxNestingDepth, } l.buf = &bytesReader{ buf: data, @@ -143,7 +151,11 @@ func newLexer(data []byte) *jlexer { func (l *jlexer) Reset() { l.err = nil l.next = undefToken - // leave l.dec and l.buf alone, since they are replaced at every Borrow + l.depth = 0 + l.maxDepth = defaultMaxNestingDepth + l.dec = nil + // leave l.buf alone, since they are replaced at every Borrow + l.buf = nil } func (l *jlexer) Error() error { @@ -228,6 +240,21 @@ func (l *jlexer) Delim(c byte) { if tok.Delim() != c { l.err = fmt.Errorf("expected delimiter '%q' but got '%q': %w", c, tok.Delim(), ErrStdlib) + + return + } + + // Track container nesting depth centrally: every '{' or '[' opens a level and + // every '}' or ']' closes one. This guards the mutually-recursive unmarshal + // routines (unmarshalObject/unmarshalArray/asInterface) against stack overflow. + switch c { + case '{', '[': + l.depth++ + if l.maxDepth > 0 && l.depth > l.maxDepth { + l.err = fmt.Errorf("maximum nesting depth of %d exceeded: %w", l.maxDepth, ErrStdlib) + } + case '}', ']': + l.depth-- } } @@ -318,3 +345,12 @@ func (l *jlexer) fetchToken() token { return token{Token: jtok} } + +func (l *jlexer) setBuf(data []byte) func() { + rdr, redeemBuf := poolOfReaders.BorrowWithRedeem() + l.buf = rdr + l.buf.buf = data + l.dec = stdjson.NewDecoder(l.buf) // cannot pool, not exposed by the encoding/json API + + return redeemBuf +} diff --git a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/options.go b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/options.go new file mode 100644 index 00000000..f114f1f1 --- /dev/null +++ b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/options.go @@ -0,0 +1,52 @@ +// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers +// SPDX-License-Identifier: Apache-2.0 + +package json + +// defaultMaxNestingDepth is the default maximum number of nested JSON containers +// ('{' or '[') that the ordered-JSON marshaler and unmarshaler will process before +// returning an error. +// +// It mirrors the limit enforced by the standard library's [encoding/json] decoder +// (see encoding/json's internal maxNestingDepth), which this adapter would otherwise +// not benefit from since it drives [encoding/json.Decoder.Token] directly. +const defaultMaxNestingDepth = 10000 + +// Option selects options for the stdlib adapter. +type Option func(o options) options + +type options struct { + maxNestingDepth int +} + +func buildOptions(o options, opts []Option) options { + for _, apply := range opts { + o = apply(o) + } + + return o +} + +// maxDepth returns the configured maximum nesting depth, or the default when unset. +func (o options) maxDepth() int { + if o.maxNestingDepth <= 0 { + return defaultMaxNestingDepth + } + + return o.maxNestingDepth +} + +// WithMaxNestingDepth sets the maximum number of nested JSON containers accepted +// when marshaling or unmarshaling ordered JSON. +// +// A value <= 0 selects the default (10,000). +// +// This guards against stack-overflow crashes on deeply nested (possibly adversarial) +// JSON documents or in-memory structures. +func WithMaxNestingDepth(depth int) Option { + return func(o options) options { + o.maxNestingDepth = depth + + return o + } +} diff --git a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/ordered_map.go b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/ordered_map.go index 54deef40..a5a8f4b6 100644 --- a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/ordered_map.go +++ b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/ordered_map.go @@ -70,12 +70,11 @@ func (s MapSlice) MarshalJSON() ([]byte, error) { } func (s MapSlice) OrderedMarshalJSON() ([]byte, error) { - w := poolOfWriters.Borrow() - defer func() { - poolOfWriters.Redeem(w) - }() + w, redeem := poolOfWriters.BorrowWithRedeem() + defer redeem() + w.setBuf() - s.marshalObject(w) + s.marshalObject(w, 1) return w.BuildBytes() // this clones data, so it's okay to redeem the writer and its buffer } @@ -88,23 +87,38 @@ func (s *MapSlice) UnmarshalJSON(data []byte) error { } func (s *MapSlice) OrderedUnmarshalJSON(data []byte) error { - l := poolOfLexers.Borrow(data) - defer func() { - poolOfLexers.Redeem(l) - }() + return s.orderedUnmarshalJSON(data, defaultMaxNestingDepth) +} + +func (s *MapSlice) orderedUnmarshalJSON(data []byte, maxDepth int) error { + l, redeem := poolOfLexers.BorrowWithRedeem() + defer redeem() + + redeemBuf := l.setBuf(data) + defer redeemBuf() + + if maxDepth > 0 { + l.maxDepth = maxDepth + } s.unmarshalObject(l) return l.Error() } -func (s MapSlice) marshalObject(w *jwriter) { +func (s MapSlice) marshalObject(w *jwriter, depth int) { if s == nil { w.RawString("null") return } + if depth > defaultMaxNestingDepth { + w.SetErr(fmt.Errorf("maximum nesting depth of %d exceeded: %w", defaultMaxNestingDepth, ErrStdlib)) + + return + } + w.RawByte('{') if len(s) == 0 { @@ -113,11 +127,11 @@ func (s MapSlice) marshalObject(w *jwriter) { return } - s[0].marshalJSON(w) + s[0].marshalJSON(w, depth) for i := 1; i < len(s); i++ { w.RawByte(',') - s[i].marshalJSON(w) + s[i].marshalJSON(w, depth) } w.RawByte('}') @@ -162,9 +176,18 @@ type MapItem struct { Value any } -func (s MapItem) marshalJSON(w *jwriter) { +func (s MapItem) marshalJSON(w *jwriter, depth int) { w.String(s.Key) w.RawByte(':') + + // Recurse internally for nested ordered maps so the depth guard is not lost across + // the stdjson.Marshal boundary (which would reset it and re-enable stack overflow). + if nested, ok := s.Value.(MapSlice); ok { + nested.marshalObject(w, depth+1) + + return + } + w.Raw(stdjson.Marshal(s.Value)) } diff --git a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/pool.go b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/pool.go index 709b97c3..2f06b88e 100644 --- a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/pool.go +++ b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/pool.go @@ -4,118 +4,15 @@ package json import ( - "encoding/json" - "sync" - "github.com/go-openapi/swag/jsonutils/adapters/ifaces" + "github.com/go-openapi/swag/pools" ) -type adaptersPool struct { - sync.Pool -} - -func (p *adaptersPool) Borrow() *Adapter { - return p.Get().(*Adapter) -} - -func (p *adaptersPool) BorrowIface() ifaces.Adapter { - return p.Get().(*Adapter) -} - -func (p *adaptersPool) Redeem(a *Adapter) { - p.Put(a) -} - -type writersPool struct { - sync.Pool -} - -func (p *writersPool) Borrow() *jwriter { - ptr := p.Get() - - jw := ptr.(*jwriter) - jw.Reset() - - return jw -} - -func (p *writersPool) Redeem(w *jwriter) { - p.Put(w) -} - -type lexersPool struct { - sync.Pool -} - -func (p *lexersPool) Borrow(data []byte) *jlexer { - ptr := p.Get() - - l := ptr.(*jlexer) - l.buf = poolOfReaders.Borrow(data) - l.dec = json.NewDecoder(l.buf) // cannot pool, not exposed by the encoding/json API - l.Reset() - - return l -} - -func (p *lexersPool) Redeem(l *jlexer) { - l.dec = nil - discard := l.buf - l.buf = nil - poolOfReaders.Redeem(discard) - p.Put(l) -} - -type readersPool struct { - sync.Pool -} - -func (p *readersPool) Borrow(data []byte) *bytesReader { - ptr := p.Get() - - b := ptr.(*bytesReader) - b.Reset() - b.buf = data - - return b -} - -func (p *readersPool) Redeem(b *bytesReader) { - p.Put(b) -} - var ( - poolOfAdapters = &adaptersPool{ - Pool: sync.Pool{ - New: func() any { - return NewAdapter() - }, - }, - } - - poolOfWriters = &writersPool{ - Pool: sync.Pool{ - New: func() any { - return newJWriter() - }, - }, - } - - poolOfLexers = &lexersPool{ - Pool: sync.Pool{ - New: func() any { - return newLexer(nil) - }, - }, - } - - poolOfReaders = &readersPool{ - Pool: sync.Pool{ - New: func() any { - return &bytesReader{} - }, - }, - } + poolOfAdapters = pools.New[Adapter]() + poolOfWriters = pools.NewRedeemable[jwriter]() + poolOfLexers = pools.NewRedeemable[jlexer]() + poolOfReaders = pools.NewRedeemable[bytesReader]() ) // BorrowAdapter borrows an [Adapter] from the pool, recycling already allocated instances. @@ -124,10 +21,12 @@ func BorrowAdapter() *Adapter { } // BorrowAdapterIface borrows a stdlib [Adapter] and converts it directly -// to [ifaces.Adapter]. This is useful to avoid further allocations when -// translating the concrete type into an interface. +// to [ifaces.Adapter]. +// +// This is useful to avoid further allocations when translating the concrete type into +// an interface. func BorrowAdapterIface() ifaces.Adapter { - return poolOfAdapters.BorrowIface() + return poolOfAdapters.Borrow() } // RedeemAdapter redeems an [Adapter] to the pool, so it may be recycled. diff --git a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/register.go b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/register.go index fc881869..0dec8542 100644 --- a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/register.go +++ b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/register.go @@ -10,14 +10,22 @@ import ( "github.com/go-openapi/swag/jsonutils/adapters/ifaces" ) -func Register(dispatcher ifaces.Registrar) { +func Register(dispatcher ifaces.Registrar, opts ...Option) { t := reflect.TypeOf(Adapter{}) + var o options + o = buildOptions(o, opts) + dispatcher.RegisterFor( ifaces.RegistryEntry{ - Who: fmt.Sprintf("%s.%s", t.PkgPath(), t.Name()), - What: ifaces.AllCapabilities, - Constructor: BorrowAdapterIface, - Support: support, + Who: fmt.Sprintf("%s.%s", t.PkgPath(), t.Name()), + What: ifaces.AllCapabilities, + Constructor: func() ifaces.Adapter { + a := BorrowAdapter() + a.options = o + + return a + }, + Support: support, }) } diff --git a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/writer.go b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/writer.go index dc2325c1..c84e02cd 100644 --- a/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/writer.go +++ b/vendor/github.com/go-openapi/swag/jsonutils/adapters/stdlib/json/writer.go @@ -14,17 +14,21 @@ type jwriter struct { err error } -func newJWriter() *jwriter { - buf := make([]byte, 0, sensibleBufferSize) - - return &jwriter{buf: bytes.NewBuffer(buf)} -} - func (w *jwriter) Reset() { - w.buf.Reset() + if w.buf != nil { + w.buf.Reset() + } w.err = nil } +// SetErr records the first error encountered while building the JSON output. +func (w *jwriter) SetErr(err error) { + if w.err != nil { + return + } + w.err = err +} + func (w *jwriter) RawString(s string) { if w.err != nil { return @@ -73,3 +77,12 @@ func (w *jwriter) BuildBytes() ([]byte, error) { return bytes.Clone(w.buf.Bytes()), nil } + +func (w *jwriter) setBuf() { + if w.buf != nil { + return + } + + buf := make([]byte, 0, sensibleBufferSize) + w.buf = bytes.NewBuffer(buf) +} diff --git a/vendor/github.com/go-openapi/swag/pools/LICENSE b/vendor/github.com/go-openapi/swag/pools/LICENSE new file mode 100644 index 00000000..d6456956 --- /dev/null +++ b/vendor/github.com/go-openapi/swag/pools/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/vendor/github.com/go-openapi/swag/pools/README.md b/vendor/github.com/go-openapi/swag/pools/README.md new file mode 100644 index 00000000..1966461c --- /dev/null +++ b/vendor/github.com/go-openapi/swag/pools/README.md @@ -0,0 +1 @@ +# pools diff --git a/vendor/github.com/go-openapi/swag/pools/debug.go b/vendor/github.com/go-openapi/swag/pools/debug.go new file mode 100644 index 00000000..94415e98 --- /dev/null +++ b/vendor/github.com/go-openapi/swag/pools/debug.go @@ -0,0 +1,17 @@ +// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers +// SPDX-License-Identifier: Apache-2.0 + +package pools + +// TB is the subset of [testing.TB] used by [AssertNoLeaks]. +// +// It is satisfied by *[testing.T] and *[testing.B]. +// +// A local interface is used (rather than importing "testing") so that the +// release build does not pull the testing package — and its flags — into +// production binaries. +type TB interface { + Helper() + Errorf(format string, args ...any) + Logf(format string, args ...any) +} diff --git a/vendor/github.com/go-openapi/swag/pools/debug_off.go b/vendor/github.com/go-openapi/swag/pools/debug_off.go new file mode 100644 index 00000000..9163d6d6 --- /dev/null +++ b/vendor/github.com/go-openapi/swag/pools/debug_off.go @@ -0,0 +1,51 @@ +//go:build !poolsdebug + +// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers +// SPDX-License-Identifier: Apache-2.0 + +package pools + +// This is the release implementation of the pool instrumentation: it does +// nothing. +// +// tracker is an empty struct, so it adds no field to the pool types and its +// methods inline away to nothing. +// +// Build with -tags poolsdebug to get the instrumented variant (see +// debug_on.go). + +// debugBuild reports whether the pool instrumentation is compiled in (the +// poolsdebug tag). +const debugBuild = false + +// DebugBuild reports whether the pool instrumentation is compiled in (the +// poolsdebug build tag). +// +// It lets a test that must run in both modes skip the parts that are invalid +// under instrumentation — e.g. an allocation-count assertion, since the +// instrumented build allocates a per-borrow tracker. +const DebugBuild = debugBuild + +type tracker[T any] struct{} + +func (tracker[T]) register() {} + +func (tracker[T]) onBorrow(*T) {} + +func (tracker[T]) onRedeem(*T) {} + +func (tracker[T]) borrowRedeemer(_ *T, cached func()) func() { return cached } + +// AssertNoLeaks reports whether every borrowed object has been redeemed across +// all pools. +// +// It is only meaningful in the instrumented build (-tags poolsdebug). +// +// In a release build it is a no-op that always reports true, so the same test +// can run in both modes. +func AssertNoLeaks(TB) bool { return true } + +// ResetTracking clears all recorded borrow/redeem tracking. +// +// This is a no-op in a release build. +func ResetTracking() {} diff --git a/vendor/github.com/go-openapi/swag/pools/debug_on.go b/vendor/github.com/go-openapi/swag/pools/debug_on.go new file mode 100644 index 00000000..64ccc57d --- /dev/null +++ b/vendor/github.com/go-openapi/swag/pools/debug_on.go @@ -0,0 +1,237 @@ +//go:build poolsdebug + +// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers +// SPDX-License-Identifier: Apache-2.0 + +package pools + +import ( + "fmt" + "runtime" + "sync" +) + +// This is the instrumented implementation of the pool tracking, enabled with +// -tags poolsdebug. +// +// Each pool carries a tracker that records, per recycled pointer, whether it is +// currently borrowed or redeemed, together with the call sites of the last +// borrow and redeem. +// It panics loudly (with those call sites) when it detects misuse: +// +// - a double redeem (the same object returned to the pool twice — corrupts sync.Pool); +// - for the redeemable pools, a redeem of a stale borrow (the slot was re-borrowed since — the +// ABA case the production atomic guard cannot catch), thanks to a per-borrow generation; +// - a redeem of an object the pool never handed out; +// - a borrow of an object still checked out (a symptom of an earlier double-Put). +// +// Borrowed-but-never-redeemed objects (leaks) are reported by [AssertNoLeaks]. + +// debugBuild reports whether the pool instrumentation is compiled in (the +// poolsdebug tag). +const debugBuild = true + +// DebugBuild reports whether the pool instrumentation is compiled in (the +// poolsdebug build tag). +// +// See the release-build doc for usage. +const DebugBuild = debugBuild + +type trackStatus uint8 + +const ( + trackBorrowed trackStatus = iota + 1 + trackRedeemed +) + +type trackEntry struct { + status trackStatus + gen uint64 // identifies the current borrow, to detect a redeem racing a re-borrow (ABA) + borrowedAt string + redeemedAt string +} + +type tracker[T any] struct { + mu sync.Mutex + entries map[*T]*trackEntry + nextGen uint64 +} + +func (t *tracker[T]) register() { + t.mu.Lock() + if t.entries == nil { + t.entries = make(map[*T]*trackEntry) + } + t.mu.Unlock() + + registerLeakChecker(t) +} + +// markBorrow records a borrow of ptr and returns its generation. +// +// Caller must hold no lock. +func (t *tracker[T]) markBorrow(ptr *T, site string) uint64 { + t.mu.Lock() + defer t.mu.Unlock() + + e := t.entries[ptr] + if e == nil { + e = &trackEntry{} + t.entries[ptr] = e + } else if e.status == trackBorrowed { + panic(fmt.Sprintf( + "pools: borrow of an object still checked out (borrowed at %s); "+ + "this usually means it was redeemed twice earlier", e.borrowedAt)) + } + + t.nextGen++ + e.status = trackBorrowed + e.gen = t.nextGen + e.borrowedAt = site + + return t.nextGen +} + +// markRedeem validates and records a redeem of ptr. gen is the borrow +// generation the caller is redeeming, or 0 to skip the ABA check (plain +// Pool[T], which has no per-borrow token). +func (t *tracker[T]) markRedeem(ptr *T, gen uint64, site string) { + t.mu.Lock() + defer t.mu.Unlock() + + e := t.entries[ptr] + switch { + case e == nil: + panic("pools: redeem of an object this pool never handed out") + case e.status != trackBorrowed: + panic(fmt.Sprintf("pools: double redeem (first redeemed at %s)", e.redeemedAt)) + case gen != 0 && e.gen != gen: + panic(fmt.Sprintf( + "pools: redeem of a stale borrow (the slot was re-borrowed at %s since this borrow); "+ + "a redeem is racing a re-borrow of the same slot (ABA)", e.borrowedAt)) + } + + e.status = trackRedeemed + e.redeemedAt = site +} + +const stackOffset = 3 + +func (t *tracker[T]) onBorrow(ptr *T) { + t.markBorrow(ptr, caller(stackOffset)) +} + +func (t *tracker[T]) onRedeem(ptr *T) { + t.markRedeem(ptr, 0, caller(stackOffset)) +} + +// borrowRedeemer records the borrow and returns a generation-stamped redeemer +// that validates the redeem (catching double-redeem and ABA) before delegating +// to the cached redeemer. +func (t *tracker[T]) borrowRedeemer(ptr *T, cached func()) func() { + gen := t.markBorrow(ptr, caller(stackOffset)) + + return func() { + t.markRedeem(ptr, gen, caller(stackOffset-1)) + cached() + } +} + +func (t *tracker[T]) checkLeaks(tb TB) bool { + t.mu.Lock() + defer t.mu.Unlock() + + ok := true + for _, e := range t.entries { + if e.status != trackRedeemed { + tb.Logf("pools: object borrowed but never redeemed (borrowed at %s)", e.borrowedAt) + ok = false + } + } + + return ok +} + +func (t *tracker[T]) resetTracking() { + t.mu.Lock() + t.entries = make(map[*T]*trackEntry) + t.nextGen = 0 + t.mu.Unlock() +} + +// leakChecker is the build-erased view of a tracker that the global registry +// holds, so trackers of different element types can be checked uniformly. +type leakChecker interface { + checkLeaks(tb TB) bool + resetTracking() +} + +var ( + registryMu sync.Mutex + registry []leakChecker +) + +func registerLeakChecker(c leakChecker) { + registryMu.Lock() + registry = append(registry, c) + registryMu.Unlock() +} + +// AssertNoLeaks reports whether every borrowed object has been redeemed across +// all pools created so far. +// +// It logs the borrow call site of each leaked object and fails tb when any are +// found. +// +// Typical use, with [ResetTracking] to isolate the test from earlier ones: +// +// func TestX(t *testing.T) { +// pools.ResetTracking() +// t.Cleanup(func() { pools.AssertNoLeaks(t) }) +// // ... exercise code that borrows/redeems ... +// } +func AssertNoLeaks(tb TB) bool { + tb.Helper() + registryMu.Lock() + defer registryMu.Unlock() + + ok := true + for _, c := range registry { + if !c.checkLeaks(tb) { + ok = false + } + } + if !ok { + tb.Errorf("pools: leaked pooled objects detected (borrowed but never redeemed)") + } + + return ok +} + +// ResetTracking clears all recorded borrow/redeem tracking across every pool. +// +// Call it at the start of a test so leaks from earlier tests are not attributed +// to it. +func ResetTracking() { + registryMu.Lock() + defer registryMu.Unlock() + + for _, c := range registry { + c.resetTracking() + } +} + +// caller returns "file:line" of the frame skip levels above caller itself. +func caller(skip int) string { + pc, _, _, ok := runtime.Caller(skip) + if !ok { + return "unknown" + } + fn := runtime.FuncForPC(pc) + if fn == nil { + return "unknown" + } + file, line := fn.FileLine(pc) + + return fmt.Sprintf("%s:%d", file, line) +} diff --git a/vendor/github.com/go-openapi/swag/pools/doc.go b/vendor/github.com/go-openapi/swag/pools/doc.go new file mode 100644 index 00000000..395c24d2 --- /dev/null +++ b/vendor/github.com/go-openapi/swag/pools/doc.go @@ -0,0 +1,26 @@ +// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers +// SPDX-License-Identifier: Apache-2.0 + +// Package pools provide utilities to recycle allocated objects. +// +// This package provides: +// +// - a generic [Pool] type that wraps [sync.Pool], +// - a [PoolRedeemable] variant that hands out a cached redeem closure, +// - a [PoolSlice] for recycling slices without juggling pointers. +// +// # Debug build +// +// Building with the "poolsdebug" tag (go test -tags poolsdebug ./...) turns on +// instrumentation that tracks every borrow and redeem and panics on misuse: +// +// - double redeem (including the A -> B -> A case for the redeemable pools), +// - redeem of a foreign object, +// - borrow of an object still checked out +// +// It reports the offending call sites. +// +// [AssertNoLeaks] then reports any object borrowed but never redeemed. +// +// The instrumentation is a no-op with zero overhead when the tag is absent. +package pools diff --git a/vendor/github.com/go-openapi/swag/pools/pools.go b/vendor/github.com/go-openapi/swag/pools/pools.go new file mode 100644 index 00000000..d78ea579 --- /dev/null +++ b/vendor/github.com/go-openapi/swag/pools/pools.go @@ -0,0 +1,410 @@ +// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers +// SPDX-License-Identifier: Apache-2.0 + +package pools + +import ( + "iter" + "slices" + "sync" + "sync/atomic" +) + +// Resettable is an interface for types that want to recycle a clean instance +// from a [Pool]. +// +// When T (or rather *T) implements [Resettable], the pool calls Reset on an +// instance both when it is redeemed and when it is borrowed: +// +// - on redeem, so that no references held by the instance are retained while it sits idle in the +// pool (which would pin a reference graph alive across a GC cycle); +// - on borrow, so that the next borrower receives a clean object regardless of how the instance +// reached the pool. +// +// Reset must be safe to call more than once on the same instance (it runs at +// least twice per cycle). +type Resettable interface { + Reset() +} + +// resetIfResettable calls Reset on v when *T implements [Resettable]. +func resetIfResettable[T any](v *T) { + if r, ok := any(v).(Resettable); ok { + r.Reset() + } +} + +// borrow state of a [redeemable] wrapper, used to detect double-redeem. +const ( + stateIdle uint32 = iota // sitting in the pool (or freshly created), not checked out + stateBorrowed // checked out by a borrower +) + +type redeemable[T any] struct { + inner *T + redeemer func() + // state guards against a double-redeem (the same wrapper Put into the pool + // twice, which would let one object be handed to two borrowers). + // + // It is set to stateBorrowed on borrow and atomically flipped back to + // stateIdle on redeem; a redeem that finds it already idle panics. + state atomic.Uint32 +} + +// redeemPanic is the message raised when a slot is redeemed while already idle. +const redeemPanic = "pools: " + + "double redeem detected (object already returned to the pool); " + + "a borrowed object must be redeemed exactly once" + +// Pool wraps a [sync.Pool] to make it available for any type. +// +// T must be the value type of the pooled object (e.g. Pool[bytes.Buffer]): +// [Pool.Borrow] returns a *T. Using a pointer type as T (e.g. +// Pool[*bytes.Buffer]) would yield a **T and is almost certainly a mistake. +type Pool[T any] struct { + pool sync.Pool + tracker tracker[T] // empty (zero-cost) unless built with the poolsdebug tag +} + +// PoolRedeemable wraps a [sync.Pool] to make it available for any type. +// +// It differs from [Pool] in the way objects are redeemed to the pool: borrowing +// also yields a cached redeem closure, so no closure is allocated at redeem +// time. +type PoolRedeemable[T any] struct { + pool sync.Pool + tracker tracker[redeemable[T]] // empty (zero-cost) unless built with the poolsdebug tag +} + +// New builds a new [Pool] to recycle allocations of type T explicitly using +// [Pool.Redeem] and the allocated pointer. +// +// Freshly allocated instances of type T are set to their zero value; like +// recycled instances they are reset (if [Resettable]) when borrowed, so +// [Pool.Borrow] always yields a clean object. +func New[T any]() *Pool[T] { + p := &Pool[T]{} + p.pool = sync.Pool{ + New: func() any { + return new(T) + }, + } + p.tracker.register() + + return p +} + +// NewRedeemable builds a new redeemable [Pool] to recycle allocations of type +// T, and use the inner redeemer to relinquish objects to the pool. +func NewRedeemable[T any]() *PoolRedeemable[T] { + p := &PoolRedeemable[T]{} + p.pool = sync.Pool{ + New: func() any { + r := &redeemable[T]{inner: new(T)} + r.redeemer = func() { + if !r.state.CompareAndSwap(stateBorrowed, stateIdle) { + panic(redeemPanic) + } + resetIfResettable(r.inner) + p.pool.Put(r) + } + + return r + }, + } + p.tracker.register() + + return p +} + +// Borrow an instance from the pool. +// +// If the type implements [Resettable], the returned instance is reset before +// being handed out, so it is always clean. +func (p *Pool[T]) Borrow() *T { + target := p.pool.Get().(*T) + resetIfResettable(target) + p.tracker.onBorrow(target) + + return target +} + +// Redeem a borrowed instance to the pool. +// +// A nil pointer is ignored (it would otherwise corrupt the pool: a typed-nil +// boxed into an interface is not the nil interface that [sync.Pool.Put] skips). +// +// The instance is reset (if it implements [Resettable]) before being returned +// to the pool. +// After calling Redeem, the caller must drop its reference to ptr: continuing +// to use it is a use-after-redeem bug. +// +// Unlike [PoolRedeemable], this plain pool holds no per-object state, so it +// cannot detect a double-redeem of the same pointer (which corrupts the pool). +// +// Prefer [PoolRedeemable] when you want that guard, or the debug build for full +// tracking. +func (p *Pool[T]) Redeem(ptr *T) { + if ptr == nil { + return + } + p.tracker.onRedeem(ptr) + resetIfResettable(ptr) + p.pool.Put(ptr) +} + +// BorrowWithRedeem borrows an instance from the pool and provides the +// corresponding redeem function. +// +// This is useful for instance to use with defer. +// +// The instance is reset (if it implements [Resettable]) both when borrowed and +// when the returned redeem closure is called. +// After calling the redeem closure, the caller must drop its reference to the +// returned instance. +// +// Calling the redeem closure more than once panics (see [redeemable.state]): a +// borrowed instance must be redeemed exactly once. +func (p *PoolRedeemable[T]) BorrowWithRedeem() (*T, func()) { + container := p.pool.Get().(*redeemable[T]) + container.state.Store(stateBorrowed) + resetIfResettable(container.inner) + + // In release builds borrowRedeemer returns container.redeemer unchanged (zero + // cost). + // Under the poolsdebug tag it returns a generation-stamped wrapper that tracks + // the borrow and detects double-redeem (incl. + // + // ABA), foreign-redeem and leaks. + return container.inner, p.tracker.borrowRedeemer(container, container.redeemer) +} + +// Slice is a struct that wraps a slice []T. +// +// This is useful to borrow and redeem slices from a pool, without having to +// constantly manipulate pointers to the slice. +// +// The wrapper holds the authoritative slice header. +// +// Its mutating methods ([Slice.Append], [Slice.Concat], [Slice.Grow]) return +// the current backing slice for convenience, so it reads as an idiomatic []T. +// +// But the returned slice is only a snapshot of the wrapper's state at that +// moment: if you keep it and grow it yourself with the builtin append and it +// reallocates, the new backing array lives only in your local copy and is NOT +// tracked by the wrapper — it will not be recycled when the wrapper is +// redeemed (and a later borrower would get the old, smaller array). +// +// Rule of thumb: it is fine to read or pass the returned []T to a consumer; but +// if you plan to grow the slice, keep calling the wrapper's methods so the +// growth is tracked and recycled. +type Slice[T any] struct { + length int + inner []T +} + +// Slice returns the inner slice. +// +// Treat the result as a read-only view (for ranging or passing to a consumer), +// valid until the next mutation or redeem. +// To grow or append, use the wrapper methods so the new backing array is +// tracked and recycled (see [Slice]). +func (s *Slice[T]) Slice() []T { + return s.inner +} + +// Grow the inner slice so it can accommodate at least size more elements +// without reallocating, and return the current backing slice. +// +// Growth is tracked by the wrapper, so the enlarged backing array is recycled +// on redeem. +// See [Slice] for the caveat about growing the returned slice yourself. +func (s *Slice[T]) Grow(size int) []T { + s.inner = slices.Grow(s.inner, size) + + return s.inner +} + +func (s *Slice[T]) Len() int { + return len(s.inner) +} + +func (s *Slice[T]) Cap() int { + return cap(s.inner) +} + +// Append elements to the inner slice and return the current backing slice. +// +// This should be preferred to the append builtin if you plan that the slice will +// grow and you want the newly allocated space to be tracked and recycled. +// See [Slice] for the caveat about growing the returned slice yourself. +func (s *Slice[T]) Append(elems ...T) []T { + s.inner = append(s.inner, elems...) + + return s.inner +} + +// Concat another slice to the inner slice and return the current backing slice. +// +// Unlike [slices.Concat], this reuses the inner slice's capacity instead of +// always allocating a fresh backing array. +// See [Slice] for the caveat about growing the returned slice yourself. +func (s *Slice[T]) Concat(slice []T) []T { + s.inner = append(s.inner, slice...) + + return s.inner +} + +// IndexedElems iterates over the inner slice. +func (s *Slice[T]) IndexedElems() iter.Seq2[int, T] { + return func(yield func(int, T) bool) { + for i, elem := range s.inner { + if !yield(i, elem) { + return + } + } + } +} + +// Reset the inner slice to its configured initial length, keeping allocated +// capacity. +// +// All elements are zeroed, so the pool never retains stale element references +// (which would keep a referenced graph alive for slices of pointers) and so a +// [WithLength] slice is handed out clean rather than carrying data from a +// previous borrower. +func (s *Slice[T]) Reset() { + clear(s.inner) + if s.length > cap(s.inner) { + s.inner = slices.Grow(s.inner[:0], s.length) + } + s.inner = s.inner[:s.length] +} + +// Clip removes unused capacity from the inner slice. +func (s *Slice[T]) Clip() { + s.inner = slices.Clip(s.inner) +} + +// resetWithCapacity discards the current backing array and replaces it with a +// fresh one of the configured length and the given capacity. +// +// It is used by a capacity-capped pool to stop recycling an oversized backing +// array (the old array is left for the GC). +func (s *Slice[T]) resetWithCapacity(capacity int) { + s.inner = make([]T, s.length, max(s.length, capacity)) +} + +// PoolSlice is a pool of [Slice[T]]. +// +// [PoolSlice.BorrowWithRedeem] will return an empty inner slice by default. +// This default may be altered using [WithMinimumCapacity]. +// +// Use [PoolSlice.BorrowWithSizeAndRedeem] or [Slice.Grow] to grow the capacity +// of the inner slice. +type PoolSlice[T any] struct { + // redeemable is held as an unexported field rather than embedded, so the + // underlying [PoolRedeemable] and its [sync.Pool] are not part of PoolSlice's + // public surface. + redeemable *PoolRedeemable[Slice[T]] +} + +// PoolSliceOption alters the default settings to allocate new pooled slices +type PoolSliceOption func(*poolSliceOptions) + +type poolSliceOptions struct { + minCapacity int + length int + maxCapacity int +} + +func WithMinimumCapacity(size int) PoolSliceOption { + return func(o *poolSliceOptions) { + o.minCapacity = size + } +} + +// WithMaxCapacity bounds the capacity of recycled slices. +// +// When a borrowed slice has grown past size at redeem time, its (oversized) +// backing array is discarded and replaced with a fresh one sized to the minimum +// capacity, instead of being recycled. +// +// This stops the pool from accumulating large backing arrays after an +// occasional large request, keeping the steady-state memory bounded. +// +// The trade-off: a workload that genuinely needs slices larger than size will +// reallocate on every cycle. +// Set size from the high-water mark you actually expect, not below it. +// A size of 0 (the default) means no cap: grown slices are recycled as-is. +func WithMaxCapacity(size int) PoolSliceOption { + return func(o *poolSliceOptions) { + o.maxCapacity = size + } +} + +// WithLength ensures that the borrowed slices have a fixed given initial +// length. +// +// By default, the borrowed slices are reset to length 0. +func WithLength(size int) PoolSliceOption { + return func(o *poolSliceOptions) { + o.length = size + } +} + +// NewPoolSlice builds a pool to recycle slices of type []T. +func NewPoolSlice[T any](opts ...PoolSliceOption) *PoolSlice[T] { + var o poolSliceOptions + for _, apply := range opts { + apply(&o) + } + + rp := &PoolRedeemable[Slice[T]]{} + rp.pool = sync.Pool{ + New: func() any { + s := &redeemable[Slice[T]]{ + inner: &Slice[T]{ + length: o.length, + inner: make([]T, o.length, max(o.length, o.minCapacity)), + }, + } + + s.redeemer = func() { + if !s.state.CompareAndSwap(stateBorrowed, stateIdle) { + panic(redeemPanic) + } + if o.maxCapacity > 0 && s.inner.Cap() > o.maxCapacity { + s.inner.resetWithCapacity(o.minCapacity) + } else { + s.inner.Reset() + } + rp.pool.Put(s) + } + + return s + }, + } + rp.tracker.register() + + return &PoolSlice[T]{redeemable: rp} +} + +// BorrowWithRedeem returns the slice wrapper and the redeem closure to +// relinquish the allocated wrapper. +// +// The wrapper is reset (elements zeroed, length restored) both on borrow and +// when the redeem closure is called. +// Calling the redeem closure more than once panics. +func (p *PoolSlice[T]) BorrowWithRedeem() (*Slice[T], func()) { + return p.redeemable.BorrowWithRedeem() +} + +// BorrowWithSizeAndRedeem borrows a slice []T from the pool and ensures that +// its capacity is at least the provided size. +func (p *PoolSlice[T]) BorrowWithSizeAndRedeem(size int) (*Slice[T], func()) { + s, redeem := p.BorrowWithRedeem() + s.Grow(size) + + return s, redeem +} diff --git a/vendor/github.com/go-openapi/swag/yamlutils/ordered_map.go b/vendor/github.com/go-openapi/swag/yamlutils/ordered_map.go index 3daf68db..24d951f8 100644 --- a/vendor/github.com/go-openapi/swag/yamlutils/ordered_map.go +++ b/vendor/github.com/go-openapi/swag/yamlutils/ordered_map.go @@ -123,7 +123,7 @@ func (s YAMLMapSlice) MarshalYAML() (any, error) { var nodes []*yaml.Node for _, item := range s { - nn, err := json2yaml(item.Value) + nn, err := json2yaml(item.Value, 1) if err != nil { return nil, err } @@ -153,6 +153,17 @@ func (s YAMLMapSlice) MarshalYAML() (any, error) { // // It implements [yaml.Unmarshaler]. func (s *YAMLMapSlice) UnmarshalYAML(node *yaml.Node) error { + return s.unmarshalYAML(newYAMLWalker(), node, 0) +} + +// unmarshalYAML builds the slice from a [yaml.Node], tracking the recursion depth (against +// stack-overflow) and threading the [yamlWalker] so anchor/alias expansion stays bounded +// across the whole document. +func (s *YAMLMapSlice) unmarshalYAML(w *yamlWalker, node *yaml.Node, depth int) error { + if depth > defaultMaxNestingDepth { + return errMaxNestingDepth + } + if typeutils.IsNil(*s) { // allow to unmarshal with a simple var declaration (nil slice) *s = YAMLMapSlice{} @@ -167,13 +178,17 @@ func (s *YAMLMapSlice) UnmarshalYAML(node *yaml.Node) error { m = m[:0] for i := 0; i < len(node.Content); i += 2 { + if err := w.account(); err != nil { // account the key node + return err + } + var nmi YAMLMapItem k, err := yamlStringScalarC(node.Content[i]) if err != nil { return fmt.Errorf("unable to decode YAML map key: %w: %w", err, ErrYAML) } nmi.Key = k - v, err := yamlNode(node.Content[i+1]) + v, err := w.node(node.Content[i+1], depth+1) if err != nil { return fmt.Errorf("unable to process YAML map value for key %q: %w: %w", k, err, ErrYAML) } @@ -186,7 +201,11 @@ func (s *YAMLMapSlice) UnmarshalYAML(node *yaml.Node) error { return nil } -func json2yaml(item any) (*yaml.Node, error) { +func json2yaml(item any, depth int) (*yaml.Node, error) { + if depth > defaultMaxNestingDepth { + return nil, errMaxNestingDepth + } + if typeutils.IsNil(item) { return &yaml.Node{ Kind: yaml.ScalarNode, @@ -196,7 +215,7 @@ func json2yaml(item any) (*yaml.Node, error) { switch val := item.(type) { case ifaces.Ordered: - return orderedYAML(val) + return orderedYAML(val, depth) case map[string]any: var n yaml.Node @@ -209,7 +228,7 @@ func json2yaml(item any) (*yaml.Node, error) { for _, k := range keys { v := val[k] - childNode, err := json2yaml(v) + childNode, err := json2yaml(v, depth+1) if err != nil { return nil, err } @@ -225,7 +244,7 @@ func json2yaml(item any) (*yaml.Node, error) { var n yaml.Node n.Kind = yaml.SequenceNode for i := range val { - childNode, err := json2yaml(val[i]) + childNode, err := json2yaml(val[i], depth+1) if err != nil { return nil, err } @@ -297,11 +316,11 @@ func uintegerNode[T conv.Unsigned](val T) (*yaml.Node, error) { }, nil } -func orderedYAML[T ifaces.Ordered](val T) (*yaml.Node, error) { +func orderedYAML[T ifaces.Ordered](val T, depth int) (*yaml.Node, error) { var n yaml.Node n.Kind = yaml.MappingNode for key, value := range val.OrderedItems() { - childNode, err := json2yaml(value) + childNode, err := json2yaml(value, depth+1) if err != nil { return nil, err } diff --git a/vendor/github.com/go-openapi/swag/yamlutils/yaml.go b/vendor/github.com/go-openapi/swag/yamlutils/yaml.go index e3aff3c2..d4b5335f 100644 --- a/vendor/github.com/go-openapi/swag/yamlutils/yaml.go +++ b/vendor/github.com/go-openapi/swag/yamlutils/yaml.go @@ -12,13 +12,99 @@ import ( yaml "go.yaml.in/yaml/v3" ) +// defaultMaxNestingDepth caps the recursion depth of the YAML<->JSON transforms to +// guard against stack-overflow on deeply nested (possibly adversarial) input. +// +// It matches the limit enforced by go.yaml.in/yaml/v3's own parser and by +// encoding/json's decoder. +const defaultMaxNestingDepth = 10000 + +// Bounds on YAML anchor/alias expansion. +// +// go.yaml.in/yaml/v3 enforces these when decoding into Go values, but that guard is +// coupled to the library's own tree walk: when we decode into a low-level [yaml.Node] +// (to preserve key order) and expand aliases ourselves in [yamlWalker.node], we bypass +// it. We therefore reproduce it here, with the same constants and ratio schedule as the +// library's decoder (see go.yaml.in/yaml/v3 decode.go, "excessive aliasing"). +const ( + aliasCountThreshold = 100 + decodeCountThreshold = 1000 + + // 400,000 decode operations is ~500kb of dense object declarations, or + // ~5kb of dense object declarations with 10000% alias expansion. + aliasRatioRangeLow = 400000 + // 4,000,000 decode operations is ~5MB of dense object declarations. + aliasRatioRangeHigh = 4000000 + aliasRatioRange = float64(aliasRatioRangeHigh - aliasRatioRangeLow) + + // tolerated share of alias-driven decodes: from aliasRatioSmall (small/medium documents) + // down to aliasRatioLarge (very large ones), interpolated with slope aliasRatioSlope. + aliasRatioSmall = 0.99 + aliasRatioLarge = 0.10 + aliasRatioSlope = aliasRatioSmall - aliasRatioLarge +) + +var ( + // errMaxNestingDepth is returned when a document nests deeper than [defaultMaxNestingDepth]. + errMaxNestingDepth = fmt.Errorf("maximum nesting depth of %d exceeded: %w", defaultMaxNestingDepth, ErrYAML) + + // errExcessiveAliasing is returned when anchor/alias expansion is disproportionate to the + // size of the document, i.e. an "alias bomb". + errExcessiveAliasing = fmt.Errorf("document contains excessive aliasing: %w", ErrYAML) +) + +// allowedAliasRatio scales the tolerated share of alias-driven decode operations from 99% +// for small-to-medium documents down to 10% for very large ones, mirroring go.yaml.in/yaml/v3. +func allowedAliasRatio(decodeCount int) float64 { + switch { + case decodeCount <= aliasRatioRangeLow: + return aliasRatioSmall + case decodeCount >= aliasRatioRangeHigh: + return aliasRatioLarge + default: + return aliasRatioSmall - aliasRatioSlope*(float64(decodeCount-aliasRatioRangeLow)/aliasRatioRange) + } +} + +// yamlWalker carries the state needed to bound a single YAML-tree traversal: +// anchor/alias expansion accounting and cycle detection. +// +// A fresh walker is created per top-level conversion; it is threaded (not copied) through +// the whole recursive walk so its counters accumulate across the entire document. +type yamlWalker struct { + decodeCount int + aliasCount int + aliasDepth int + aliases map[*yaml.Node]bool // anchors currently being expanded, for cycle detection +} + +func newYAMLWalker() *yamlWalker { + return &yamlWalker{aliases: make(map[*yaml.Node]bool)} +} + +// account records one processed node and fails if alias expansion has become excessive. +func (w *yamlWalker) account() error { + w.decodeCount++ + if w.aliasDepth > 0 { + w.aliasCount++ + } + + if w.aliasCount > aliasCountThreshold && + w.decodeCount > decodeCountThreshold && + float64(w.aliasCount)/float64(w.decodeCount) > allowedAliasRatio(w.decodeCount) { + return errExcessiveAliasing + } + + return nil +} + // YAMLToJSON converts a YAML document into JSON bytes. // // Note: a YAML document is the output from a [yaml.Marshaler], e.g a pointer to a [yaml.Node]. // // [YAMLToJSON] is typically called after [BytesToYAMLDoc]. func YAMLToJSON(value any) (json.RawMessage, error) { - jm, err := transformData(value) + jm, err := transformData(value, 0) if err != nil { return nil, err } @@ -44,46 +130,73 @@ func BytesToYAMLDoc(data []byte) (any, error) { return &document, nil } -func yamlNode(root *yaml.Node) (any, error) { +func (w *yamlWalker) node(root *yaml.Node, depth int) (any, error) { + if depth > defaultMaxNestingDepth { + return nil, errMaxNestingDepth + } + if err := w.account(); err != nil { + return nil, err + } + switch root.Kind { case yaml.DocumentNode: - return yamlDocument(root) + return w.document(root, depth) case yaml.SequenceNode: - return yamlSequence(root) + return w.sequence(root, depth) case yaml.MappingNode: - return yamlMapping(root) + return w.mapping(root, depth) case yaml.ScalarNode: return yamlScalar(root) case yaml.AliasNode: - return yamlNode(root.Alias) + return w.alias(root, depth) default: return nil, fmt.Errorf("unsupported YAML node type: %v: %w", root.Kind, ErrYAML) } } -func yamlDocument(node *yaml.Node) (any, error) { +// alias resolves an anchor reference, expanding the anchored subtree. It detects cycles +// (an anchor whose expansion transitively references itself) and accounts the expansion +// against the alias-bomb budget via [yamlWalker.aliasDepth]. +func (w *yamlWalker) alias(node *yaml.Node, depth int) (any, error) { + if node.Alias == nil { + return nil, fmt.Errorf("invalid YAML alias node %q: %w", node.Value, ErrYAML) + } + if w.aliases[node.Alias] { + return nil, fmt.Errorf("anchor %q contains itself: %w", node.Value, ErrYAML) + } + + w.aliases[node.Alias] = true + w.aliasDepth++ + out, err := w.node(node.Alias, depth+1) + w.aliasDepth-- + delete(w.aliases, node.Alias) + + return out, err +} + +func (w *yamlWalker) document(node *yaml.Node, depth int) (any, error) { if len(node.Content) != 1 { return nil, fmt.Errorf("unexpected YAML Document node content length: %d: %w", len(node.Content), ErrYAML) } - return yamlNode(node.Content[0]) + return w.node(node.Content[0], depth+1) } -func yamlMapping(node *yaml.Node) (any, error) { +func (w *yamlWalker) mapping(node *yaml.Node, depth int) (any, error) { const sensibleAllocDivider = 2 // nodes concatenate (key,value) sequences m := make(YAMLMapSlice, len(node.Content)/sensibleAllocDivider) - if err := m.UnmarshalYAML(node); err != nil { + if err := m.unmarshalYAML(w, node, depth); err != nil { return nil, err } return m, nil } -func yamlSequence(node *yaml.Node) (any, error) { +func (w *yamlWalker) sequence(node *yaml.Node, depth int) (any, error) { s := make([]any, 0) for i := range len(node.Content) { - v, err := yamlNode(node.Content[i]) + v, err := w.node(node.Content[i], depth+1) if err != nil { return nil, fmt.Errorf("unable to decode YAML sequence value: %w: %w", err, ErrYAML) } @@ -174,12 +287,16 @@ func format(t any) (string, error) { } } -func transformData(input any) (out any, err error) { +func transformData(input any, depth int) (out any, err error) { + if depth > defaultMaxNestingDepth { + return nil, errMaxNestingDepth + } + switch in := input.(type) { case yaml.Node: - return yamlNode(&in) + return newYAMLWalker().node(&in, depth) case *yaml.Node: - return yamlNode(in) + return newYAMLWalker().node(in, depth) case map[any]any: o := make(YAMLMapSlice, 0, len(in)) for ke, va := range in { @@ -188,7 +305,7 @@ func transformData(input any) (out any, err error) { return nil, err } - v, ert := transformData(va) + v, ert := transformData(va, depth+1) if ert != nil { return nil, ert } @@ -200,7 +317,7 @@ func transformData(input any) (out any, err error) { len1 := len(in) o := make([]any, len1) for i := range len1 { - o[i], err = transformData(in[i]) + o[i], err = transformData(in[i], depth+1) if err != nil { return nil, err } diff --git a/vendor/golang.org/x/net/http2/transport_wrap.go b/vendor/golang.org/x/net/http2/transport_wrap.go index eab2e6b0..534e77ab 100644 --- a/vendor/golang.org/x/net/http2/transport_wrap.go +++ b/vendor/golang.org/x/net/http2/transport_wrap.go @@ -55,7 +55,7 @@ type transportConfig struct { // Registered is called by net/http.Transport.RegisterProtocol, // to let us know that it understands the registration mechanism we're using. func (t transportConfig) Registered(t1 *http.Transport) { - t.t.t1 = t1 + t.t.lazyt1 = t1 } func (t transportConfig) DisableCompression() bool { @@ -145,29 +145,30 @@ func (t transportConfig) DialFromContext(ctx context.Context, network, address s type transportInternal struct { initOnce sync.Once - t1 *http.Transport + lazyt1 *http.Transport } -func (t *Transport) init() { +func (t *Transport) init() *http.Transport { t.initOnce.Do(func() { - if t.t1 != nil { + if t.lazyt1 != nil { return } t1 := &http.Transport{} t.configure(t1) }) + return t.lazyt1 } func (t *Transport) configure(t1 *http.Transport) { t1.RegisterProtocol("http/2", transportConfig{t}) - // tr2.t1 is set by transportConfig.Registered. - if t.t1 != t1 { + // tr2.lazyt1 is set by transportConfig.Registered. + if t.lazyt1 != t1 { panic("http2: net/http does not support this version of x/net/http2") } } func (t *Transport) roundTripOpt(req *http.Request, opt RoundTripOpt) (*http.Response, error) { - t.init() + t1 := t.init() if req.URL.Scheme == "http" && !t.AllowHTTP { return nil, errors.New("http2: unencrypted HTTP/2 not enabled") @@ -188,22 +189,23 @@ func (t *Transport) roundTripOpt(req *http.Request, opt RoundTripOpt) (*http.Res ctx := context.WithValue(req.Context(), http2TransportContextKey{}, t) req = req.WithContext(ctx) - return t.t1.RoundTrip(req) + return t1.RoundTrip(req) } func (t *Transport) closeIdleConnections() { - t.init() - t.t1.CloseIdleConnections() + t1 := t.init() + t1.CloseIdleConnections() } func (t *Transport) newUserClientConn(c net.Conn) (*ClientConn, error) { + t1 := t.init() // http.Transport's NewClientConn doesn't provide a supported way to create // a connection from a net.Conn. (This might be useful to add in the future?) // We're going to craftily sneak one in via the context key, with the // scheme of "http/2" telling NewClientConn to look for it. ctx := context.WithValue(context.Background(), netConnContextKey{}, c) - nhcc, err := t.t1.NewClientConn(ctx, "http/2", "") + nhcc, err := t1.NewClientConn(ctx, "http/2", "") if err != nil { return nil, err } diff --git a/vendor/golang.org/x/net/idna/idna.go b/vendor/golang.org/x/net/idna/idna.go index 22767125..e2f28fed 100644 --- a/vendor/golang.org/x/net/idna/idna.go +++ b/vendor/golang.org/x/net/idna/idna.go @@ -400,7 +400,11 @@ func (p *Profile) process(s string, toASCII bool) (string, error) { // Spec says keep the old label. continue } - if unicode16 && err == nil && len(u) > 0 && isASCII(u) { + if err == nil && len(u) > 0 && isASCII(u) { + // UTS 43 pre-revision 33 doesn't classify a xn-- label + // which contains only ASCII characters as an error, + // but that's a specification bug and a security issue. + // Always return an error in this case. err = punyError(enc) } isBidi = isBidi || bidirule.DirectionString(u) != bidi.LeftToRight diff --git a/vendor/k8s.io/apimachinery/pkg/api/meta/interfaces.go b/vendor/k8s.io/apimachinery/pkg/api/meta/interfaces.go index a35ce3bd..628187ee 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/meta/interfaces.go +++ b/vendor/k8s.io/apimachinery/pkg/api/meta/interfaces.go @@ -17,6 +17,8 @@ limitations under the License. package meta import ( + "context" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/runtime/schema" @@ -109,7 +111,9 @@ type RESTMapping struct { // to API groups. In other words, kinds and resources should not be assumed to be // unique across groups. // -// TODO: split into sub-interfaces +// RESTMapperWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use RESTMapperWithContext instead. type RESTMapper interface { // KindFor takes a partial resource and returns the single match. Returns an error if there are multiple matches KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) @@ -133,11 +137,114 @@ type RESTMapper interface { ResourceSingularizer(resource string) (singular string, err error) } +// RESTMapperWithContext allows clients to map resources to kind, and map kind and version +// to interfaces for manipulating those objects. It is primarily intended for +// consumers of Kubernetes compatible REST APIs as defined in docs/devel/api-conventions.md. +// +// The Kubernetes API provides versioned resources and object kinds which are scoped +// to API groups. In other words, kinds and resources should not be assumed to be +// unique across groups. +type RESTMapperWithContext interface { + // KindFor takes a partial resource and returns the single match. Returns an error if there are multiple matches + KindForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionKind, error) + + // KindsFor takes a partial resource and returns the list of potential kinds in priority order + KindsForWithContext(ctx context.Context, resource schema.GroupVersionResource) ([]schema.GroupVersionKind, error) + + // ResourceFor takes a partial resource and returns the single match. Returns an error if there are multiple matches + ResourceForWithContext(ctx context.Context, input schema.GroupVersionResource) (schema.GroupVersionResource, error) + + // ResourcesFor takes a partial resource and returns the list of potential resource in priority order + ResourcesForWithContext(ctx context.Context, input schema.GroupVersionResource) ([]schema.GroupVersionResource, error) + + // RESTMapping identifies a preferred resource mapping for the provided group kind. + RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (*RESTMapping, error) + // RESTMappings returns all resource mappings for the provided group kind if no + // version search is provided. Otherwise identifies a preferred resource mapping for + // the provided version(s). + RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) + + ResourceSingularizerWithContext(ctx context.Context, resource string) (singular string, err error) +} + +func ToRESTMapperWithContext(m RESTMapper) RESTMapperWithContext { + if m == nil { + return nil + } + if m, ok := m.(RESTMapperWithContext); ok { + return m + } + return &restMapperWrapper{ + delegate: m, + } +} + +type restMapperWrapper struct { + delegate RESTMapper +} + +func (m *restMapperWrapper) KindForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionKind, error) { + return m.delegate.KindFor(resource) +} +func (m *restMapperWrapper) KindsForWithContext(ctx context.Context, resource schema.GroupVersionResource) ([]schema.GroupVersionKind, error) { + return m.delegate.KindsFor(resource) +} +func (m *restMapperWrapper) ResourceForWithContext(ctx context.Context, input schema.GroupVersionResource) (schema.GroupVersionResource, error) { + return m.delegate.ResourceFor(input) +} +func (m *restMapperWrapper) ResourcesForWithContext(ctx context.Context, input schema.GroupVersionResource) ([]schema.GroupVersionResource, error) { + return m.delegate.ResourcesFor(input) +} +func (m *restMapperWrapper) RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (*RESTMapping, error) { + return m.delegate.RESTMapping(gk, versions...) +} +func (m *restMapperWrapper) RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) { + return m.delegate.RESTMappings(gk, versions...) +} +func (m *restMapperWrapper) ResourceSingularizerWithContext(ctx context.Context, resource string) (singular string, err error) { + return m.delegate.ResourceSingularizer(resource) +} + // ResettableRESTMapper is a RESTMapper which is capable of resetting itself // from discovery. // All rest mappers that delegate to other rest mappers must implement this interface and dynamically // check if the delegate mapper supports the Reset() operation. +// +// ResettableRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use ResettableRESTMapperWithContext instead. type ResettableRESTMapper interface { RESTMapper Reset() } + +// ResettableRESTMapperWithContext is a RESTMapper which is capable of resetting itself +// from discovery. +// All rest mappers that delegate to other rest mappers must implement this interface and dynamically +// check if the delegate mapper supports the ResetWithContext() operation. +type ResettableRESTMapperWithContext interface { + RESTMapperWithContext + ResetWithContext(ctx context.Context) +} + +func ToResettableRESTMapperWithContext(m ResettableRESTMapper) ResettableRESTMapperWithContext { + if m == nil { + return nil + } + if m, ok := m.(ResettableRESTMapperWithContext); ok { + return m + } + return &resettableRESTMapperWrapper{ + RESTMapperWithContext: ToRESTMapperWithContext(m), + delegate: m, + } +} + +type resettableRESTMapperWrapper struct { + RESTMapperWithContext + delegate ResettableRESTMapper +} + +func (m *resettableRESTMapperWrapper) ResetWithContext(ctx context.Context) { + m.delegate.Reset() +} diff --git a/vendor/k8s.io/apimachinery/pkg/api/meta/meta.go b/vendor/k8s.io/apimachinery/pkg/api/meta/meta.go index 2551f07f..4bf24da5 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/meta/meta.go +++ b/vendor/k8s.io/apimachinery/pkg/api/meta/meta.go @@ -600,6 +600,7 @@ func (a genericAccessor) GetOwnerReferences() []metav1.OwnerReference { var ret []metav1.OwnerReference s := a.ownerReferences if s.Kind() != reflect.Pointer || s.Elem().Kind() != reflect.Slice { + //nolint:logcheck // Should not happen. klog.Errorf("expect %v to be a pointer to slice", s) return ret } @@ -608,6 +609,7 @@ func (a genericAccessor) GetOwnerReferences() []metav1.OwnerReference { ret = make([]metav1.OwnerReference, s.Len(), s.Len()+1) for i := 0; i < s.Len(); i++ { if err := extractFromOwnerReference(s.Index(i), &ret[i]); err != nil { + //nolint:logcheck // Should not happen. klog.Errorf("extractFromOwnerReference failed: %v", err) return ret } @@ -618,12 +620,14 @@ func (a genericAccessor) GetOwnerReferences() []metav1.OwnerReference { func (a genericAccessor) SetOwnerReferences(references []metav1.OwnerReference) { s := a.ownerReferences if s.Kind() != reflect.Pointer || s.Elem().Kind() != reflect.Slice { + //nolint:logcheck // Should not happen. klog.Errorf("expect %v to be a pointer to slice", s) } s = s.Elem() newReferences := reflect.MakeSlice(s.Type(), len(references), len(references)) for i := 0; i < len(references); i++ { if err := setOwnerReference(newReferences.Index(i), &references[i]); err != nil { + //nolint:logcheck // Should not happen. klog.Errorf("setOwnerReference failed: %v", err) return } diff --git a/vendor/k8s.io/apimachinery/pkg/api/meta/multirestmapper.go b/vendor/k8s.io/apimachinery/pkg/api/meta/multirestmapper.go index b7e97125..2b2c143c 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/meta/multirestmapper.go +++ b/vendor/k8s.io/apimachinery/pkg/api/meta/multirestmapper.go @@ -17,6 +17,7 @@ limitations under the License. package meta import ( + "context" "fmt" "strings" @@ -25,13 +26,31 @@ import ( ) var ( - _ ResettableRESTMapper = MultiRESTMapper{} + _ ResettableRESTMapper = MultiRESTMapper{} + _ fmt.Stringer = MultiRESTMapper{} + _ ResettableRESTMapperWithContext = MultiRESTMapperWithContext{} + _ fmt.Stringer = MultiRESTMapperWithContext{} ) // MultiRESTMapper is a wrapper for multiple RESTMappers. +// +// MultiRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use MultiRESTMapperWithContext instead. type MultiRESTMapper []RESTMapper +// MultiRESTMapperWithContext is a wrapper for multiple RESTMapperWithContext instances. +type MultiRESTMapperWithContext []RESTMapperWithContext + func (m MultiRESTMapper) String() string { + return stringifyMapper("MultiRESTMapper", m) +} + +func (m MultiRESTMapperWithContext) String() string { + return stringifyMapper("MultiRESTMapperWithContext", m) +} + +func stringifyMapper[T any](typeName string, m []T) string { nested := make([]string, 0, len(m)) for _, t := range m { currString := fmt.Sprintf("%v", t) @@ -39,14 +58,93 @@ func (m MultiRESTMapper) String() string { nested = append(nested, strings.Join(splitStrings, "\n\t")) } - return fmt.Sprintf("MultiRESTMapper{\n\t%s\n}", strings.Join(nested, "\n\t")) + return fmt.Sprintf("%s{\n\t%s\n}", typeName, strings.Join(nested, "\n\t")) +} + +func ToMultiRESTMapperWithContext(m MultiRESTMapper) MultiRESTMapperWithContext { + if m == nil { + return nil + } + mc := make(MultiRESTMapperWithContext, len(m)) + for i, m := range m { + mc[i] = ToRESTMapperWithContext(m) + } + return mc } // ResourceSingularizer converts a REST resource name from plural to singular (e.g., from pods to pod) // This implementation supports multiple REST schemas and return the first match. +// +// MultiRESTMapperWithContext.ResourceSingularizerWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use MultiRESTMapperWithContext.ResourceSingularizerWithContext instead. func (m MultiRESTMapper) ResourceSingularizer(resource string) (singular string, err error) { + return ToMultiRESTMapperWithContext(m).ResourceSingularizerWithContext(context.Background(), resource) +} + +// MultiRESTMapperWithContext.ResourcesForWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use MultiRESTMapperWithContext.ResourcesForWithContext instead. +func (m MultiRESTMapper) ResourcesFor(resource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) { + return ToMultiRESTMapperWithContext(m).ResourcesForWithContext(context.Background(), resource) +} + +// MultiRESTMapperWithContext.KindsForWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use MultiRESTMapperWithContext.KindsForWithContext instead. +func (m MultiRESTMapper) KindsFor(resource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) { + return ToMultiRESTMapperWithContext(m).KindsForWithContext(context.Background(), resource) +} + +// MultiRESTMapperWithContext.ResourceForWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use MultiRESTMapperWithContext.ResourceForWithContext instead. +func (m MultiRESTMapper) ResourceFor(resource schema.GroupVersionResource) (schema.GroupVersionResource, error) { + return ToMultiRESTMapperWithContext(m).ResourceForWithContext(context.Background(), resource) +} + +// MultiRESTMapperWithContext.KindForWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use MultiRESTMapperWithContext.KindForWithContext instead. +func (m MultiRESTMapper) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) { + return ToMultiRESTMapperWithContext(m).KindForWithContext(context.Background(), resource) +} + +// RESTMapping provides the REST mapping for the resource based on the +// kind and version. This implementation supports multiple REST schemas and +// return the first match. +// +// MultiRESTMapperWithContext.RESTMappingWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use MultiRESTMapperWithContext.RESTMappingWithContext instead. +func (m MultiRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (*RESTMapping, error) { + return ToMultiRESTMapperWithContext(m).RESTMappingWithContext(context.Background(), gk, versions...) +} + +// RESTMappings returns all possible RESTMappings for the provided group kind, or an error +// if the type is not recognized. +// +// MultiRESTMapperWithContext.RESTMappingsWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use MultiRESTMapperWithContext.RESTMappingsWithContext instead. +func (m MultiRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) { + return ToMultiRESTMapperWithContext(m).RESTMappingsWithContext(context.Background(), gk, versions...) +} + +// MultiRESTMapperWithContext.Reset is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use MultiRESTMapperWithContext.Reset instead. +func (m MultiRESTMapper) Reset() { for _, t := range m { - singular, err = t.ResourceSingularizer(resource) + MaybeResetRESTMapper(t) + } +} + +// ResourceSingularizer converts a REST resource name from plural to singular (e.g., from pods to pod) +// This implementation supports multiple REST schemas and return the first match. +func (m MultiRESTMapperWithContext) ResourceSingularizerWithContext(ctx context.Context, resource string) (singular string, err error) { + for _, t := range m { + singular, err = t.ResourceSingularizerWithContext(ctx, resource) if err == nil { return } @@ -54,10 +152,10 @@ func (m MultiRESTMapper) ResourceSingularizer(resource string) (singular string, return } -func (m MultiRESTMapper) ResourcesFor(resource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) { +func (m MultiRESTMapperWithContext) ResourcesForWithContext(ctx context.Context, resource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) { allGVRs := []schema.GroupVersionResource{} for _, t := range m { - gvrs, err := t.ResourcesFor(resource) + gvrs, err := t.ResourcesForWithContext(ctx, resource) // ignore "no match" errors, but any other error percolates back up if IsNoMatchError(err) { continue @@ -89,10 +187,10 @@ func (m MultiRESTMapper) ResourcesFor(resource schema.GroupVersionResource) ([]s return allGVRs, nil } -func (m MultiRESTMapper) KindsFor(resource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) { +func (m MultiRESTMapperWithContext) KindsForWithContext(ctx context.Context, resource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) { allGVKs := []schema.GroupVersionKind{} for _, t := range m { - gvks, err := t.KindsFor(resource) + gvks, err := t.KindsForWithContext(ctx, resource) // ignore "no match" errors, but any other error percolates back up if IsNoMatchError(err) { continue @@ -124,8 +222,8 @@ func (m MultiRESTMapper) KindsFor(resource schema.GroupVersionResource) (gvk []s return allGVKs, nil } -func (m MultiRESTMapper) ResourceFor(resource schema.GroupVersionResource) (schema.GroupVersionResource, error) { - resources, err := m.ResourcesFor(resource) +func (m MultiRESTMapperWithContext) ResourceForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionResource, error) { + resources, err := m.ResourcesForWithContext(ctx, resource) if err != nil { return schema.GroupVersionResource{}, err } @@ -136,8 +234,8 @@ func (m MultiRESTMapper) ResourceFor(resource schema.GroupVersionResource) (sche return schema.GroupVersionResource{}, &AmbiguousResourceError{PartialResource: resource, MatchingResources: resources} } -func (m MultiRESTMapper) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) { - kinds, err := m.KindsFor(resource) +func (m MultiRESTMapperWithContext) KindForWithContext(ctx context.Context, resource schema.GroupVersionResource) (schema.GroupVersionKind, error) { + kinds, err := m.KindsForWithContext(ctx, resource) if err != nil { return schema.GroupVersionKind{}, err } @@ -151,12 +249,12 @@ func (m MultiRESTMapper) KindFor(resource schema.GroupVersionResource) (schema.G // RESTMapping provides the REST mapping for the resource based on the // kind and version. This implementation supports multiple REST schemas and // return the first match. -func (m MultiRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (*RESTMapping, error) { +func (m MultiRESTMapperWithContext) RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (*RESTMapping, error) { allMappings := []*RESTMapping{} errors := []error{} for _, t := range m { - currMapping, err := t.RESTMapping(gk, versions...) + currMapping, err := t.RESTMappingWithContext(ctx, gk, versions...) // ignore "no match" errors, but any other error percolates back up if IsNoMatchError(err) { continue @@ -188,12 +286,12 @@ func (m MultiRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (* // RESTMappings returns all possible RESTMappings for the provided group kind, or an error // if the type is not recognized. -func (m MultiRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) { +func (m MultiRESTMapperWithContext) RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) { var allMappings []*RESTMapping var errors []error for _, t := range m { - currMappings, err := t.RESTMappings(gk, versions...) + currMappings, err := t.RESTMappingsWithContext(ctx, gk, versions...) // ignore "no match" errors, but any other error percolates back up if IsNoMatchError(err) { continue @@ -213,8 +311,8 @@ func (m MultiRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) ( return allMappings, nil } -func (m MultiRESTMapper) Reset() { +func (m MultiRESTMapperWithContext) ResetWithContext(ctx context.Context) { for _, t := range m { - MaybeResetRESTMapper(t) + MaybeResetRESTMapperWithContext(ctx, t) } } diff --git a/vendor/k8s.io/apimachinery/pkg/api/meta/priority.go b/vendor/k8s.io/apimachinery/pkg/api/meta/priority.go index 4f097c9c..d152e7e3 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/meta/priority.go +++ b/vendor/k8s.io/apimachinery/pkg/api/meta/priority.go @@ -17,6 +17,7 @@ limitations under the License. package meta import ( + "context" "fmt" "k8s.io/apimachinery/pkg/runtime/schema" @@ -30,11 +31,17 @@ const ( ) var ( - _ ResettableRESTMapper = PriorityRESTMapper{} + _ ResettableRESTMapper = PriorityRESTMapper{} + _ ResettableRESTMapperWithContext = PriorityRESTMapperWithContext{} + _ fmt.Stringer = PriorityRESTMapperWithContext{} ) // PriorityRESTMapper is a wrapper for automatically choosing a particular Resource or Kind // when multiple matches are possible +// +// PriorityRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use PriorityRESTMapperWithContext instead. type PriorityRESTMapper struct { // Delegate is the RESTMapper to use to locate all the Kind and Resource matches Delegate RESTMapper @@ -56,9 +63,100 @@ func (m PriorityRESTMapper) String() string { return fmt.Sprintf("PriorityRESTMapper{\n\t%v\n\t%v\n\t%v\n}", m.ResourcePriority, m.KindPriority, m.Delegate) } +// PriorityRESTMapperWithContext is a wrapper for automatically choosing a particular Resource or Kind +// when multiple matches are possible +type PriorityRESTMapperWithContext struct { + // Delegate is the RESTMapperWithContext to use to locate all the Kind and Resource matches + Delegate RESTMapperWithContext + + // ResourcePriority is a list of priority patterns to apply to matching resources. + // The list of all matching resources is narrowed based on the patterns until only one remains. + // A pattern with no matches is skipped. A pattern with more than one match uses its + // matches as the list to continue matching against. + ResourcePriority []schema.GroupVersionResource + + // KindPriority is a list of priority patterns to apply to matching kinds. + // The list of all matching kinds is narrowed based on the patterns until only one remains. + // A pattern with no matches is skipped. A pattern with more than one match uses its + // matches as the list to continue matching against. + KindPriority []schema.GroupVersionKind +} + +func (m PriorityRESTMapperWithContext) String() string { + return fmt.Sprintf("PriorityRESTMapperWithContext{\n\t%v\n\t%v\n\t%v\n}", m.ResourcePriority, m.KindPriority, m.Delegate) +} + +func ToPriorityRESTMapperWithContext(m PriorityRESTMapper) PriorityRESTMapperWithContext { + return PriorityRESTMapperWithContext{ + Delegate: ToRESTMapperWithContext(m.Delegate), + ResourcePriority: m.ResourcePriority, + KindPriority: m.KindPriority, + } +} + // ResourceFor finds all resources, then passes them through the ResourcePriority patterns to find a single matching hit. +// +// PriorityRESTMapperWithContext.ResourceForWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use PriorityRESTMapperWithContext.ResourceForWithContext instead. func (m PriorityRESTMapper) ResourceFor(partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionResource, error) { - originalGVRs, originalErr := m.Delegate.ResourcesFor(partiallySpecifiedResource) + return ToPriorityRESTMapperWithContext(m).ResourceForWithContext(context.Background(), partiallySpecifiedResource) +} + +// KindFor finds all kinds, then passes them through the KindPriority patterns to find a single matching hit. +// +// PriorityRESTMapperWithContext.KindForWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use PriorityRESTMapperWithContext.KindForWithContext instead. +func (m PriorityRESTMapper) KindFor(partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionKind, error) { + return ToPriorityRESTMapperWithContext(m).KindForWithContext(context.Background(), partiallySpecifiedResource) +} + +// PriorityRESTMapperWithContext.RESTMappingWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use PriorityRESTMapperWithContext.RESTMappingWithContext instead. +func (m PriorityRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (mapping *RESTMapping, err error) { + return ToPriorityRESTMapperWithContext(m).RESTMappingWithContext(context.Background(), gk, versions...) +} + +// PriorityRESTMapperWithContext.RESTMappingsWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use PriorityRESTMapperWithContext.RESTMappingsWithContext instead. +func (m PriorityRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) { + return m.Delegate.RESTMappings(gk, versions...) +} + +// PriorityRESTMapperWithContext.ResourceSingularizerWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use PriorityRESTMapperWithContext.ResourceSingularizerWithContext instead. +func (m PriorityRESTMapper) ResourceSingularizer(resource string) (singular string, err error) { + return m.Delegate.ResourceSingularizer(resource) +} + +// PriorityRESTMapperWithContext.ResourcesForWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use PriorityRESTMapperWithContext.ResourcesForWithContext instead. +func (m PriorityRESTMapper) ResourcesFor(partiallySpecifiedResource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) { + return m.Delegate.ResourcesFor(partiallySpecifiedResource) +} + +// PriorityRESTMapperWithContext.KindsForWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use PriorityRESTMapperWithContext.KindsForWithContext instead. +func (m PriorityRESTMapper) KindsFor(partiallySpecifiedResource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) { + return m.Delegate.KindsFor(partiallySpecifiedResource) +} + +// PriorityRESTMapperWithContext.ResetWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use PriorityRESTMapperWithContext.ResetWithContext instead. +func (m PriorityRESTMapper) Reset() { + MaybeResetRESTMapper(m.Delegate) +} + +// ResourceFor finds all resources, then passes them through the ResourcePriority patterns to find a single matching hit. +func (m PriorityRESTMapperWithContext) ResourceForWithContext(ctx context.Context, partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionResource, error) { + originalGVRs, originalErr := m.Delegate.ResourcesForWithContext(ctx, partiallySpecifiedResource) if originalErr != nil && len(originalGVRs) == 0 { return schema.GroupVersionResource{}, originalErr } @@ -93,8 +191,8 @@ func (m PriorityRESTMapper) ResourceFor(partiallySpecifiedResource schema.GroupV } // KindFor finds all kinds, then passes them through the KindPriority patterns to find a single matching hit. -func (m PriorityRESTMapper) KindFor(partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionKind, error) { - originalGVKs, originalErr := m.Delegate.KindsFor(partiallySpecifiedResource) +func (m PriorityRESTMapperWithContext) KindForWithContext(ctx context.Context, partiallySpecifiedResource schema.GroupVersionResource) (schema.GroupVersionKind, error) { + originalGVKs, originalErr := m.Delegate.KindsForWithContext(ctx, partiallySpecifiedResource) if originalErr != nil && len(originalGVKs) == 0 { return schema.GroupVersionKind{}, originalErr } @@ -156,8 +254,8 @@ func kindMatches(pattern schema.GroupVersionKind, kind schema.GroupVersionKind) return true } -func (m PriorityRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) (mapping *RESTMapping, err error) { - mappings, originalErr := m.Delegate.RESTMappings(gk, versions...) +func (m PriorityRESTMapperWithContext) RESTMappingWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) (mapping *RESTMapping, err error) { + mappings, originalErr := m.Delegate.RESTMappingsWithContext(ctx, gk, versions...) if originalErr != nil && len(mappings) == 0 { return nil, originalErr } @@ -209,22 +307,22 @@ func (m PriorityRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) return nil, &AmbiguousKindError{PartialKind: gk.WithVersion(""), MatchingKinds: kinds} } -func (m PriorityRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) { - return m.Delegate.RESTMappings(gk, versions...) +func (m PriorityRESTMapperWithContext) RESTMappingsWithContext(ctx context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) { + return m.Delegate.RESTMappingsWithContext(ctx, gk, versions...) } -func (m PriorityRESTMapper) ResourceSingularizer(resource string) (singular string, err error) { - return m.Delegate.ResourceSingularizer(resource) +func (m PriorityRESTMapperWithContext) ResourceSingularizerWithContext(ctx context.Context, resource string) (singular string, err error) { + return m.Delegate.ResourceSingularizerWithContext(ctx, resource) } -func (m PriorityRESTMapper) ResourcesFor(partiallySpecifiedResource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) { - return m.Delegate.ResourcesFor(partiallySpecifiedResource) +func (m PriorityRESTMapperWithContext) ResourcesForWithContext(ctx context.Context, partiallySpecifiedResource schema.GroupVersionResource) ([]schema.GroupVersionResource, error) { + return m.Delegate.ResourcesForWithContext(ctx, partiallySpecifiedResource) } -func (m PriorityRESTMapper) KindsFor(partiallySpecifiedResource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) { - return m.Delegate.KindsFor(partiallySpecifiedResource) +func (m PriorityRESTMapperWithContext) KindsForWithContext(ctx context.Context, partiallySpecifiedResource schema.GroupVersionResource) (gvk []schema.GroupVersionKind, err error) { + return m.Delegate.KindsForWithContext(ctx, partiallySpecifiedResource) } -func (m PriorityRESTMapper) Reset() { - MaybeResetRESTMapper(m.Delegate) +func (m PriorityRESTMapperWithContext) ResetWithContext(ctx context.Context) { + MaybeResetRESTMapperWithContext(ctx, m.Delegate) } diff --git a/vendor/k8s.io/apimachinery/pkg/api/meta/restmapper.go b/vendor/k8s.io/apimachinery/pkg/api/meta/restmapper.go index 91cb98ca..d64db33d 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/meta/restmapper.go +++ b/vendor/k8s.io/apimachinery/pkg/api/meta/restmapper.go @@ -18,6 +18,7 @@ limitations under the License. package meta import ( + "context" "fmt" "sort" "strings" @@ -72,6 +73,8 @@ func (m *DefaultRESTMapper) String() string { } var _ RESTMapper = &DefaultRESTMapper{} +var _ RESTMapperWithContext = &DefaultRESTMapper{} +var _ fmt.Stringer = &DefaultRESTMapper{} // NewDefaultRESTMapper initializes a mapping between Kind and APIVersion // to a resource name and back based on the objects in a runtime.Scheme @@ -179,6 +182,10 @@ func (m *DefaultRESTMapper) ResourceSingularizer(resourceType string) (string, e return singular.Resource, nil } +func (m *DefaultRESTMapper) ResourceSingularizerWithContext(_ context.Context, resourceType string) (string, error) { + return m.ResourceSingularizer(resourceType) +} + // coerceResourceForMatching makes the resource lower case and converts internal versions to unspecified (legacy behavior) func coerceResourceForMatching(resource schema.GroupVersionResource) schema.GroupVersionResource { resource.Resource = strings.ToLower(resource.Resource) @@ -276,6 +283,10 @@ func (m *DefaultRESTMapper) ResourcesFor(input schema.GroupVersionResource) ([]s return ret, nil } +func (m *DefaultRESTMapper) ResourcesForWithContext(_ context.Context, input schema.GroupVersionResource) ([]schema.GroupVersionResource, error) { + return m.ResourcesFor(input) +} + func (m *DefaultRESTMapper) ResourceFor(resource schema.GroupVersionResource) (schema.GroupVersionResource, error) { resources, err := m.ResourcesFor(resource) if err != nil { @@ -288,6 +299,10 @@ func (m *DefaultRESTMapper) ResourceFor(resource schema.GroupVersionResource) (s return schema.GroupVersionResource{}, &AmbiguousResourceError{PartialResource: resource, MatchingResources: resources} } +func (m *DefaultRESTMapper) ResourceForWithContext(_ context.Context, resource schema.GroupVersionResource) (schema.GroupVersionResource, error) { + return m.ResourceFor(resource) +} + func (m *DefaultRESTMapper) KindsFor(input schema.GroupVersionResource) ([]schema.GroupVersionKind, error) { resource := coerceResourceForMatching(input) @@ -355,6 +370,10 @@ func (m *DefaultRESTMapper) KindsFor(input schema.GroupVersionResource) ([]schem return ret, nil } +func (m *DefaultRESTMapper) KindsForWithContext(_ context.Context, input schema.GroupVersionResource) ([]schema.GroupVersionKind, error) { + return m.KindsFor(input) +} + func (m *DefaultRESTMapper) KindFor(resource schema.GroupVersionResource) (schema.GroupVersionKind, error) { kinds, err := m.KindsFor(resource) if err != nil { @@ -367,6 +386,10 @@ func (m *DefaultRESTMapper) KindFor(resource schema.GroupVersionResource) (schem return schema.GroupVersionKind{}, &AmbiguousResourceError{PartialResource: resource, MatchingKinds: kinds} } +func (m *DefaultRESTMapper) KindForWithContext(_ context.Context, resource schema.GroupVersionResource) (schema.GroupVersionKind, error) { + return m.KindFor(resource) +} + type kindByPreferredGroupVersion struct { list []schema.GroupVersionKind sortOrder []schema.GroupVersion @@ -461,6 +484,10 @@ func (m *DefaultRESTMapper) RESTMapping(gk schema.GroupKind, versions ...string) return mappings[0], nil } +func (m *DefaultRESTMapper) RESTMappingWithContext(_ context.Context, gk schema.GroupKind, versions ...string) (*RESTMapping, error) { + return m.RESTMapping(gk, versions...) +} + // RESTMappings returns the RESTMappings for the provided group kind. If a version search order // is not provided, the search order provided to DefaultRESTMapper will be used. func (m *DefaultRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) { @@ -520,10 +547,33 @@ func (m *DefaultRESTMapper) RESTMappings(gk schema.GroupKind, versions ...string return mappings, nil } -// MaybeResetRESTMapper calls Reset() on the mapper if it is a ResettableRESTMapper. +func (m *DefaultRESTMapper) RESTMappingsWithContext(_ context.Context, gk schema.GroupKind, versions ...string) ([]*RESTMapping, error) { + return m.RESTMappings(gk, versions...) +} + +// MaybeResetRESTMapper calls Reset() on the mapper if it is a ResettableRESTMapper or +// ResetWithContext() if it is a ResettableRESTMapperWithContext. +// +// MaybeResetRESTMapperWithContext is a better alternative because it supports contextual logging and cancellation. +// +// Contextual logging: Use MaybeResetRESTMapperWithContext instead. func MaybeResetRESTMapper(mapper RESTMapper) { - m, ok := mapper.(ResettableRESTMapper) - if ok { + maybeReset(context.Background(), mapper) +} + +// MaybeResetRESTMapperWithContext calls Reset() on the mapper if it is a ResettableRESTMapper or +// ResetWithContext() if it is a ResettableRESTMapperWithContext. +func MaybeResetRESTMapperWithContext(ctx context.Context, mapper RESTMapperWithContext) { + maybeReset(ctx, mapper) +} + +func maybeReset(ctx context.Context, mapper any) { + if m, ok := mapper.(ResettableRESTMapperWithContext); ok { + m.ResetWithContext(ctx) + return + } + if m, ok := mapper.(ResettableRESTMapper); ok { m.Reset() + return } } diff --git a/vendor/k8s.io/apimachinery/pkg/api/operation/operation.go b/vendor/k8s.io/apimachinery/pkg/api/operation/operation.go index 86b6ddf3..cccc7e60 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/operation/operation.go +++ b/vendor/k8s.io/apimachinery/pkg/api/operation/operation.go @@ -17,7 +17,6 @@ limitations under the License. package operation import ( - "slices" "strings" ) @@ -31,28 +30,27 @@ type Operation struct { // those into a single "Update" category. Type Type - // Options declare the options enabled for validation. + // Options are the validation options in effect for this operation, mapping option + // name to whether it is enabled. Option names typically match feature gates, but an + // option may be enabled even when its feature gate is off — e.g. when the feature is + // already in use by the object being updated. Set by the resource strategy and + // read-only during validation. // - // Options should be set according to a resource validation strategy before validation - // is performed, and must be treated as read-only during validation. - // - // Options are identified by string names. Option string names may match the name of a feature - // gate, in which case the presence of the name in the set indicates that the feature is - // considered enabled for the resource being validated. Note that a resource may have a - // feature enabled even when the feature gate is disabled. This can happen when feature is - // already in-use by a resource, often because the feature gate was enabled when the - // resource first began using the feature. - // - // Unset options are disabled/false. - Options []string + // Every option a validation tag references must be defined here by the strategy; an + // option that is not defined is a programming error (see HasOption). + Options map[string]bool // Request provides information about the request being validated. Request Request } -// HasOption returns true if the given string is in the Options slice. -func (o Operation) HasOption(option string) bool { - return slices.Contains(o.Options, option) +// HasOption returns whether the named option is enabled and whether it was defined by +// the strategy. Every option a validation tag references must be defined; callers treat +// an undefined option as an internal error (see validate.IfOption) rather than silently +// as disabled. +func (o Operation) HasOption(option string) (enabled, defined bool) { + enabled, defined = o.Options[option] + return } // Request provides information about the request being validated. diff --git a/vendor/k8s.io/apimachinery/pkg/api/resource/quantity.go b/vendor/k8s.io/apimachinery/pkg/api/resource/quantity.go index f3cd6006..e6b1f1b5 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/resource/quantity.go +++ b/vendor/k8s.io/apimachinery/pkg/api/resource/quantity.go @@ -878,3 +878,14 @@ func (q *QuantityValue) Set(s string) error { func (q QuantityValue) Type() string { return "quantity" } + +// QuantityPtrEqual compares two Quantity pointers and returns true if they are both nil or point to equal quantities. +func QuantityPtrEqual(a, b *Quantity) bool { + if a == nil && b == nil { + return true + } + if a == nil || b == nil { + return false + } + return a.Equal(*b) +} diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/content/kube.go b/vendor/k8s.io/apimachinery/pkg/api/validate/content/kube.go index 44e82eef..608073f7 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/validate/content/kube.go +++ b/vendor/k8s.io/apimachinery/pkg/api/validate/content/kube.go @@ -99,3 +99,19 @@ func prefixEach(msgs []string, prefix string) []string { } return msgs } + +// IsPrefixedLabelKey tests whether the value passed is a valid label key with +// a domain prefix. This allows "example.com/key" but not "key". +// If the value is not valid, a list of error strings is returned. Otherwise, +// an empty list (or nil) is returned. +func IsPrefixedLabelKey(value string) []string { + if errs := IsLabelKey(value); len(errs) > 0 { + return errs + } + + segments := strings.Split(value, "/") + if len(segments) != 2 { + return []string{"must include a prefix (e.g. 'example.com/key')"} + } + return nil +} diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/dependentrequired.go b/vendor/k8s.io/apimachinery/pkg/api/validate/dependentrequired.go new file mode 100644 index 00000000..69222c97 --- /dev/null +++ b/vendor/k8s.io/apimachinery/pkg/api/validate/dependentrequired.go @@ -0,0 +1,83 @@ +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package validate + +import ( + "context" + "fmt" + + "k8s.io/apimachinery/pkg/api/operation" + "k8s.io/apimachinery/pkg/util/validation/field" +) + +// DependentRequired verifies that when triggerIsSet(obj) is true, dependentIsSet(obj) +// is also true; otherwise reports an error at fldPath.Child(dependentName). +// On Update, the check is skipped if neither side's set-ness changed from oldObj, +// so unrelated updates can proceed past a pre-existing violation. +func DependentRequired[T any](_ context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *T, + triggerName string, triggerIsSet ExtractorFn[*T, bool], + dependentName string, dependentIsSet ExtractorFn[*T, bool], +) field.ErrorList { + if obj == nil { + return nil + } + if op.Type == operation.Update && oldObj != nil { + if triggerIsSet(obj) == triggerIsSet(oldObj) && dependentIsSet(obj) == dependentIsSet(oldObj) { + return nil + } + } + if !triggerIsSet(obj) { + return nil + } + if dependentIsSet(obj) { + return nil + } + return field.ErrorList{ + field.Required(fldPath.Child(dependentName), + fmt.Sprintf("must be set when %s is set", triggerName)). + WithOrigin("dependentRequired"), + } +} + +// DependentForbidden verifies that when triggerIsSet(obj) is true, dependentIsSet(obj) +// is false; otherwise reports an error at fldPath.Child(dependentName). +// On Update, the check is skipped if neither side's set-ness changed from oldObj, +// so unrelated updates can proceed past a pre-existing violation. +func DependentForbidden[T any](_ context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *T, + triggerName string, triggerIsSet ExtractorFn[*T, bool], + dependentName string, dependentIsSet ExtractorFn[*T, bool], +) field.ErrorList { + if obj == nil { + return nil + } + if op.Type == operation.Update && oldObj != nil { + if triggerIsSet(obj) == triggerIsSet(oldObj) && dependentIsSet(obj) == dependentIsSet(oldObj) { + return nil + } + } + if !triggerIsSet(obj) { + return nil + } + if !dependentIsSet(obj) { + return nil + } + return field.ErrorList{ + field.Forbidden(fldPath.Child(dependentName), + fmt.Sprintf("may not be set when %s is set", triggerName)). + WithOrigin("dependentForbidden"), + } +} diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/discriminator.go b/vendor/k8s.io/apimachinery/pkg/api/validate/discriminator.go index 787ae6b0..6f4b3cdd 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/validate/discriminator.go +++ b/vendor/k8s.io/apimachinery/pkg/api/validate/discriminator.go @@ -35,6 +35,9 @@ type DiscriminatedRule[Tfield any, Tdisc comparable] struct { // // It performs ratcheting: if the operation is an Update, and neither the discriminator // nor the value (checked via equiv) have changed, validation is skipped. +// +// The equiv function can be called with nil arguments in the case of nilable +// fields. func Discriminated[Tfield any, Tdisc comparable, Tstruct any](ctx context.Context, op operation.Operation, structPath *field.Path, obj, oldObj *Tstruct, fieldName string, getMemberValue func(*Tstruct) Tfield, getDiscriminator func(*Tstruct) Tdisc, equiv MatchFunc[Tfield], defaultValidation ValidateFunc[Tfield], rules []DiscriminatedRule[Tfield, Tdisc], diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/each.go b/vendor/k8s.io/apimachinery/pkg/api/validate/each.go index c815d6d9..2930c218 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/validate/each.go +++ b/vendor/k8s.io/apimachinery/pkg/api/validate/each.go @@ -18,6 +18,7 @@ package validate import ( "context" + "slices" "sort" "k8s.io/apimachinery/pkg/api/equality" @@ -29,22 +30,29 @@ import ( // according to some criteria, and returns true if they match. type MatchFunc[T any] func(T, T) bool -// EachSliceVal performs validation on each element of newSlice using the provided validation function. +// EachValSliceVal performs validation on each element of a slice of values +// using the provided validation function. // -// For update operations, the match function finds corresponding values in oldSlice for each -// value in newSlice. This comparison can be either full or partial (e.g., matching only -// specific struct fields that serve as a unique identifier). If match is nil, validation -// proceeds without considering old values, and the equiv function is not used. +// For update operations, the match function finds corresponding values in +// oldSlice for each value in newSlice. This comparison can be either full or +// partial (e.g., matching only specific struct fields that serve as a unique +// identifier). If match is nil, validation proceeds without considering old +// values, and the equiv function is not used. // -// For update operations, the equiv function checks if a new value is equivalent to its -// corresponding old value, enabling validation ratcheting. If equiv is nil but match is -// provided, the match function is assumed to perform full value comparison. +// For update operations, the equiv function checks if a new value is +// equivalent to its corresponding old value, enabling validation ratcheting. +// If equiv is nil but match is provided, the match function is assumed to +// perform full value comparison. +// +// The match and equiv functions will never be called with nil arguments. // // Note: The slice element type must be non-nilable. -func EachSliceVal[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, newSlice, oldSlice []T, - match, equiv MatchFunc[T], validator ValidateFunc[*T]) field.ErrorList { +func EachValSliceVal[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, newSlice, oldSlice []T, + match, equiv MatchFunc[*T], validator ValidateFunc[*T]) field.ErrorList { var errs field.ErrorList - for i, val := range newSlice { + for i := range newSlice { + val := &newSlice[i] + var old *T if match != nil && len(oldSlice) > 0 { old = lookup(oldSlice, val, match) @@ -55,33 +63,90 @@ func EachSliceVal[T any](ctx context.Context, op operation.Operation, fldPath *f // 2. The equiv function confirms the values are equivalent (either directly or semantically) // // The equiv function provides equality comparison when match uses partial comparison. - if op.Type == operation.Update && old != nil && (equiv == nil || equiv(val, *old)) { + if op.Type == operation.Update && old != nil && (equiv == nil || equiv(val, old)) { + continue + } + errs = append(errs, validator(ctx, op, fldPath.Index(i), val, old)...) + } + return errs +} + +// EachPtrSliceVal performs validation on each element of a slice of pointers +// using the provided validation function. +// +// For update operations, the match function finds corresponding values in +// oldSlice for each value in newSlice. This comparison can be either full or +// partial (e.g., matching only specific struct fields that serve as a unique +// identifier). If match is nil, validation proceeds without considering old +// values, and the equiv function is not used. +// +// For update operations, the equiv function checks if a new value is +// equivalent to its corresponding old value, enabling validation ratcheting. +// If equiv is nil but match is provided, the match function is assumed to +// perform full value comparison. +// +// The match and equiv functions will never be called with nil arguments. +func EachPtrSliceVal[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, newSlice, oldSlice []*T, + match, equiv MatchFunc[*T], validator ValidateFunc[*T]) field.ErrorList { + var errs field.ErrorList + for i := range newSlice { + val := newSlice[i] + if val == nil { + // Ignore nil items; they are supposed to have been checked by PtrSliceNoNils. + continue + } + + var old *T + if match != nil && len(oldSlice) > 0 { + old = lookupPointer(oldSlice, val, match) + } + if op.Type == operation.Update && old != nil && (equiv == nil || equiv(val, old)) { continue } - errs = append(errs, validator(ctx, op, fldPath.Index(i), &val, old)...) + errs = append(errs, validator(ctx, op, fldPath.Index(i), val, old)...) } return errs } // lookup returns a pointer to the first element in the list that matches the // target, according to the provided comparison function, or else nil. -func lookup[T any](list []T, target T, match MatchFunc[T]) *T { +func lookup[T any](list []T, target *T, match MatchFunc[*T]) *T { for i := range list { - if match(list[i], target) { + if match(&list[i], target) { return &list[i] } } return nil } +// lookupPointer returns the first non-nil element in the list that matches the +// target, according to the provided comparison function, or else nil. +// Nil elements in the list are skipped. +func lookupPointer[T any](list []*T, target *T, match MatchFunc[*T]) *T { + for i := range list { + if list[i] == nil { + // We can't really do anything about nil entries in the old list, + // just skip them. + continue + } + if match(list[i], target) { + return list[i] + } + } + return nil +} + // EachMapVal validates each value in newMap using the specified validation // function, passing the corresponding old value from oldMap if the key exists in oldMap. // For update operations, it implements validation ratcheting by skipping validation // when the old value exists and the equiv function confirms the values are equivalent. // The value-type of the map is assumed to not be nilable. +// +// The equiv function will never be called with nil arguments. +// // If equiv is nil, value-based ratcheting is disabled and all values will be validated. func EachMapVal[K ~string, V any](ctx context.Context, op operation.Operation, fldPath *field.Path, newMap, oldMap map[K]V, - equiv MatchFunc[V], validator ValidateFunc[*V]) field.ErrorList { + equiv MatchFunc[*V], validator ValidateFunc[*V]) field.ErrorList { var errs field.ErrorList for key, val := range newMap { var old *V @@ -90,7 +155,7 @@ func EachMapVal[K ~string, V any](ctx context.Context, op operation.Operation, f } // If the operation is an update, for validation ratcheting, skip re-validating if the old // value is found and the equiv function confirms the values are equivalent. - if op.Type == operation.Update && old != nil && equiv != nil && equiv(val, *old) { + if op.Type == operation.Update && old != nil && equiv != nil && equiv(&val, old) { continue } errs = append(errs, validator(ctx, op, fldPath.Key(string(key)), &val, old)...) @@ -119,19 +184,20 @@ func EachMapKey[K ~string, T any](ctx context.Context, op operation.Operation, f return errs } -// Unique verifies that each element of newSlice is unique, according to the -// match function. It compares every element of the slice with every other -// element and returns errors for non-unique items. -func Unique[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, newSlice, _ []T, match MatchFunc[T]) field.ErrorList { +// ValSliceUnique verifies that each element of a slice of values is unique, +// according to the match function. It compares every element of the slice with +// every other element and returns errors for non-unique items. +// +// The match function will never be called with nil arguments. +func ValSliceUnique[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, newSlice, _ []T, match MatchFunc[*T]) field.ErrorList { var dups []int - for i, val := range newSlice { + for i := range newSlice { for j := i + 1; j < len(newSlice); j++ { - other := newSlice[j] - if match(val, other) { + if match(&newSlice[i], &newSlice[j]) { if dups == nil { dups = make([]int, 0, len(newSlice)) } - if lookup(dups, j, func(a, b int) bool { return a == b }) == nil { + if !slices.Contains(dups, j) { dups = append(dups, j) } } @@ -152,6 +218,42 @@ func Unique[T any](_ context.Context, _ operation.Operation, fldPath *field.Path return errs } +// PtrSliceUnique verifies that each element of a slice of pointers is unique, +// according to the match function. It compares every element of the slice with +// every other element and returns errors for non-unique items. +// +// The match function will never be called with nil arguments. +func PtrSliceUnique[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, newSlice, _ []*T, match MatchFunc[*T]) field.ErrorList { + var errs field.ErrorList + var dups []int + for i := range newSlice { + if newSlice[i] == nil { + // Ignore nil items; they are supposed to have been checked by PtrSliceNoNils. + continue + } + for j := i + 1; j < len(newSlice); j++ { + if newSlice[j] == nil { + continue + } + if match(newSlice[i], newSlice[j]) { + if dups == nil { + dups = make([]int, 0, len(newSlice)) + } + if !slices.Contains(dups, j) { + dups = append(dups, j) + } + } + } + } + + sort.Ints(dups) + for _, i := range dups { + var val any = newSlice[i] + errs = append(errs, field.Duplicate(fldPath.Index(i), val)) + } + return errs +} + // SemanticDeepEqual is a MatchFunc that uses equality.Semantic.DeepEqual to // compare two values. // This wrapper is needed because MatchFunc requires a function that takes two @@ -163,19 +265,12 @@ func SemanticDeepEqual[T any](a, b T) bool { return equality.Semantic.DeepEqual(a, b) } -// DirectEqual is a MatchFunc that uses the == operator to compare two values. -// It can be used by any other function that needs to compare two values -// directly. -func DirectEqual[T comparable](a, b T) bool { - return a == b -} - -// DirectEqualPtr is a MatchFunc that dereferences two pointers and uses the == +// DirectEqual is a MatchFunc that dereferences two pointers and uses the == // operator to compare the values. If both pointers are nil, it returns true. // If one pointer is nil and the other is not, it returns false. // It can be used by any other function that needs to compare two pointees // directly. -func DirectEqualPtr[T comparable](a, b *T) bool { +func DirectEqual[T comparable](a, b *T) bool { if a == b { return true } @@ -184,3 +279,14 @@ func DirectEqualPtr[T comparable](a, b *T) bool { } return *a == *b } + +// PtrSliceNoNils returns a Required error for each nil element in a slice of +// pointers. +func PtrSliceNoNils[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, newSlice, _ []*T) (errs field.ErrorList) { + for i := range newSlice { + if newSlice[i] == nil { + errs = append(errs, field.Required(fldPath.Index(i), "")) + } + } + return +} diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/enum.go b/vendor/k8s.io/apimachinery/pkg/api/validate/enum.go index 6e5bcf37..4d8e2c0a 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/validate/enum.go +++ b/vendor/k8s.io/apimachinery/pkg/api/validate/enum.go @@ -18,6 +18,7 @@ package validate import ( "context" + "fmt" "slices" "k8s.io/apimachinery/pkg/api/operation" @@ -32,24 +33,36 @@ func Enum[T ~string](_ context.Context, op operation.Operation, fldPath *field.P if value == nil { return nil } - if !validValues.Has(*value) || isExcluded(op, exclusions, *value) { - return field.ErrorList{field.NotSupported[T](fldPath, *value, supportedValues(op, validValues, exclusions))} + excluded, err := isExcluded(op, exclusions, *value) + if err != nil { + return field.ErrorList{field.InternalError(fldPath, err)} + } + if !validValues.Has(*value) || excluded { + supported, err := supportedValues(op, validValues, exclusions) + if err != nil { + return field.ErrorList{field.InternalError(fldPath, err)} + } + return field.ErrorList{field.NotSupported[T](fldPath, *value, supported)} } return nil } // supportedValues returns a sorted list of supported values. // Excluded enum values are not included in the list. -func supportedValues[T ~string](op operation.Operation, values sets.Set[T], exclusions []EnumExclusion[T]) []T { +func supportedValues[T ~string](op operation.Operation, values sets.Set[T], exclusions []EnumExclusion[T]) ([]T, error) { res := make([]T, 0, len(values)) for key := range values { - if isExcluded(op, exclusions, key) { + excluded, err := isExcluded(op, exclusions, key) + if err != nil { + return nil, err + } + if excluded { continue } res = append(res, key) } slices.Sort(res) - return res + return res, nil } // EnumExclusion represents a single enum exclusion rule. @@ -64,11 +77,15 @@ type EnumExclusion[T ~string] struct { Option string } -func isExcluded[T ~string](op operation.Operation, exclusions []EnumExclusion[T], value T) bool { +func isExcluded[T ~string](op operation.Operation, exclusions []EnumExclusion[T], value T) (bool, error) { for _, rule := range exclusions { - if rule.Value == value && rule.ExcludeWhen == op.HasOption(rule.Option) { - return true + on, defined := op.HasOption(rule.Option) + if !defined { + return false, fmt.Errorf("undefined validation option %q", rule.Option) + } + if rule.Value == value && rule.ExcludeWhen == on { + return true, nil } } - return false + return false, nil } diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/errors.go b/vendor/k8s.io/apimachinery/pkg/api/validate/errors.go new file mode 100644 index 00000000..a9dc4b01 --- /dev/null +++ b/vendor/k8s.io/apimachinery/pkg/api/validate/errors.go @@ -0,0 +1,96 @@ +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package validate + +import ( + "context" + "errors" + + "k8s.io/apimachinery/pkg/util/validation/field" +) + +type allDeclarativeEnforcedKeyType struct{} + +var allDeclarativeEnforcedKey = allDeclarativeEnforcedKeyType{} + +// WithAllDeclarativeEnforcedForTest returns a copy of parent context with allDeclarativeEnforcedKey set to true. +// This is used for testing to expose all declarative validation errors and filter all handwritten validation errors +// that are covered by declarative validation, regardless of the feature gate or maturity level. +// +// NOTE: This function is intended for testing purposes only and should not be used in production code. +func WithAllDeclarativeEnforcedForTest(ctx context.Context) context.Context { + return context.WithValue(ctx, allDeclarativeEnforcedKey, true) +} + +// AllDeclarativeEnforced returns true if the context contains allDeclarativeEnforcedKey set to true. +func AllDeclarativeEnforced(ctx context.Context) bool { + if ctx == nil { + return false + } + return ctx.Value(allDeclarativeEnforcedKey) == true +} + +// FilterCoveredHandwrittenErrors removes a CoveredByDeclarative handwritten error when a matching enforced +// beta declarative error exists (matched by type, field, and origin). In AllDeclarativeEnforced +// (testing-only) mode every covered handwritten error is removed. +func FilterCoveredHandwrittenErrors(ctx context.Context, imperativeErrs, enforcedDeclarativeErrs field.ErrorList, betaEnabled bool, rules ...field.NormalizationRule) field.ErrorList { + matcher := field.ErrorMatcher{}.ByType().ByOrigin().RequireOriginWhenInvalid().ByFieldNormalized(rules) + allDeclarativeEnforced := AllDeclarativeEnforced(ctx) + return imperativeErrs.Filter(func(e error) bool { + var fe *field.Error + if !errors.As(e, &fe) || !fe.CoveredByDeclarative { + return false + } + if allDeclarativeEnforced { + return true + } + for _, dErr := range enforcedDeclarativeErrs { + if dErr.IsBeta() && matcher.Matches(fe, dErr) { + return true + } + } + return false + }) +} + +// FilterEnforcedDeclarativeErrors collects the declarative errors that are enforced (i.e. surfaced to the user) in the +// current mode. A declarative error is enforced when any of the following holds: +// - AllDeclarativeEnforced is set (testing): every declarative error is enforced. +// - It is an internal error: always enforced, regardless of lifecycle. +// - It is a beta error and BetaEnabled is true. +// - It is a standard (unprefixed) error: always enforced. +// +// Alpha errors are never enforced; they remain shadowed by handwritten validation. +func FilterEnforcedDeclarativeErrors(ctx context.Context, declarativeErrs field.ErrorList, betaEnabled bool) field.ErrorList { + enforcedDeclarativeErrs := make(field.ErrorList, 0, len(declarativeErrs)) + allDeclarativeEnforced := AllDeclarativeEnforced(ctx) + for _, dvErr := range declarativeErrs { + switch { + case allDeclarativeEnforced: + enforcedDeclarativeErrs = append(enforcedDeclarativeErrs, dvErr) + case dvErr.Type == field.ErrorTypeInternal: + enforcedDeclarativeErrs = append(enforcedDeclarativeErrs, dvErr) + case dvErr.IsBeta(): + if betaEnabled { + enforcedDeclarativeErrs = append(enforcedDeclarativeErrs, dvErr) + } + case !dvErr.IsAlpha(): + enforcedDeclarativeErrs = append(enforcedDeclarativeErrs, dvErr) // Standard + } + } + return enforcedDeclarativeErrs +} diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/item.go b/vendor/k8s.io/apimachinery/pkg/api/validate/item.go index aba417fa..4ddb2860 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/validate/item.go +++ b/vendor/k8s.io/apimachinery/pkg/api/validate/item.go @@ -23,36 +23,39 @@ import ( "k8s.io/apimachinery/pkg/util/validation/field" ) -// MatchItemFn takes a pointer to an item and returns true if it matches the criteria. -type MatchItemFn[T any] func(*T) bool +// MatchItemFunc takes an item and returns true if it matches the criteria. +type MatchItemFunc[T any] func(T) bool -// SliceItem finds the first item in newList that satisfies the match function, -// and if found, also looks for a matching item in oldList. If the value of the -// item is the same as the previous value, as per the equiv function, then no -// validation is performed. Otherwise, it invokes 'itemValidator' on these items. +// ValSliceItem finds the first item in a list of values which satisfies the +// match function, and if found, also looks for a matching item in oldList. If +// the value of the item is the same as the previous value, as per the equiv +// function, then no validation is performed. Otherwise, it invokes +// 'itemValidator' on these items. // // This function processes only the *first* matching item found in newList. It // assumes that the match functions targets a unique identifier (primary key) // and will match at most one element per list. If this assumption is violated, // changes in list order can lead this function to have inconsistent behavior. // +// The match and equiv functions will never be called with nil arguments. +// // The fldPath passed to itemValidator is indexed to the matched item's // position in newList. // // This function does not validate items that were removed (present in oldList // but not in newList). -func SliceItem[TList ~[]TItem, TItem any]( +func ValSliceItem[TList ~[]TItem, TItem any]( ctx context.Context, op operation.Operation, fldPath *field.Path, newList, oldList TList, - matches MatchItemFn[TItem], - equiv MatchFunc[TItem], + match MatchItemFunc[*TItem], + equiv MatchFunc[*TItem], itemValidator func(ctx context.Context, op operation.Operation, fldPath *field.Path, newObj, oldObj *TItem) field.ErrorList, ) field.ErrorList { var matchedNew, matchedOld *TItem var newIndex int for i := range newList { - if matches(&newList[i]) { + if match(&newList[i]) { matchedNew = &newList[i] newIndex = i break @@ -63,13 +66,73 @@ func SliceItem[TList ~[]TItem, TItem any]( } for i := range oldList { - if matches(&oldList[i]) { + if match(&oldList[i]) { matchedOld = &oldList[i] break } } - if op.Type == operation.Update && matchedOld != nil && equiv(*matchedNew, *matchedOld) { + if op.Type == operation.Update && matchedOld != nil && equiv(matchedNew, matchedOld) { + return nil + } + + return itemValidator(ctx, op, fldPath.Index(newIndex), matchedNew, matchedOld) +} + +// PtrSliceItem finds the first item in a list of pointers which satisfies the +// match function, and if found, also looks for a matching item in oldList. If +// the value of the item is the same as the previous value, as per the equiv +// function, then no validation is performed. Otherwise, it invokes +// 'itemValidator' on these items. +// +// This function processes only the *first* matching item found in newList. It +// assumes that the match functions targets a unique identifier (primary key) +// and will match at most one element per list. If this assumption is violated, +// changes in list order can lead this function to have inconsistent behavior. +// +// The match and equiv functions will never be called with nil arguments. +// +// The fldPath passed to itemValidator is indexed to the matched item's +// position in newList. +// +// This function does not validate items that were removed (present in oldList +// but not in newList). +func PtrSliceItem[TList ~[]*TItem, TItem any]( + ctx context.Context, op operation.Operation, fldPath *field.Path, + newList, oldList TList, + match MatchItemFunc[*TItem], + equiv MatchFunc[*TItem], + itemValidator func(ctx context.Context, op operation.Operation, fldPath *field.Path, newObj, oldObj *TItem) field.ErrorList, +) field.ErrorList { + var matchedNew, matchedOld *TItem + var newIndex int + + for i := range newList { + if newList[i] == nil { + // Ignore nil items; they are supposed to have been checked by PtrSliceNoNils. + continue + } + if match(newList[i]) { + matchedNew = newList[i] + newIndex = i + break + } + } + if matchedNew == nil { + return nil + } + + for i := range oldList { + if oldList[i] == nil { + continue + } + if match(oldList[i]) { + matchedOld = oldList[i] + break + } + } + + if op.Type == operation.Update && matchedOld != nil && equiv(matchedNew, matchedOld) { return nil } diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/limits.go b/vendor/k8s.io/apimachinery/pkg/api/validate/limits.go index dcc7f518..768546f6 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/validate/limits.go +++ b/vendor/k8s.io/apimachinery/pkg/api/validate/limits.go @@ -78,6 +78,18 @@ func MaxItems[T any](_ context.Context, _ operation.Operation, fldPath *field.Pa return nil } +// MaxProperties verifies that the specified map has no more than max keys. +func MaxProperties[K comparable, V any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ map[K]V, max int) field.ErrorList { + if value == nil { + return nil + } + + if len(value) > max { + return field.ErrorList{field.TooMany(fldPath, len(value), max).WithOrigin("maxProperties")} + } + return nil +} + // MinItems verifies that the specified slice is not shorter than min items. func MinItems[T any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ []T, min int) field.ErrorList { if len(value) < min { @@ -86,6 +98,14 @@ func MinItems[T any](_ context.Context, _ operation.Operation, fldPath *field.Pa return nil } +// MinProperties verifies that the specified map is not shorter than min properties. +func MinProperties[K comparable, V any](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ map[K]V, min int) field.ErrorList { + if len(value) < min { + return field.ErrorList{field.TooFew(fldPath, len(value), min).WithOrigin("minProperties")} + } + return nil +} + // Minimum verifies that the specified value is greater than or equal to min. func Minimum[T constraints.Integer](_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *T, min T) field.ErrorList { if value == nil { diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/monotonic.go b/vendor/k8s.io/apimachinery/pkg/api/validate/monotonic.go new file mode 100644 index 00000000..f0526c9f --- /dev/null +++ b/vendor/k8s.io/apimachinery/pkg/api/validate/monotonic.go @@ -0,0 +1,43 @@ +/* +Copyright 2025 The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package validate + +import ( + "context" + "fmt" + + "k8s.io/apimachinery/pkg/api/operation" + "k8s.io/apimachinery/pkg/api/validate/constraints" + "k8s.io/apimachinery/pkg/util/validation/field" +) + +// Monotonic validates that an integer value has not decreased on update. +func Monotonic[T constraints.Integer](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T) field.ErrorList { + if op.Type != operation.Update { + return nil + } + + if value == nil || oldValue == nil { + return nil + } + + if *value < *oldValue { + return field.ErrorList{field.Invalid(fldPath, *value, fmt.Sprintf("may not be decreased from %v", *oldValue)).WithOrigin("monotonic")} + } + + return nil +} diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/options.go b/vendor/k8s.io/apimachinery/pkg/api/validate/options.go index 44236550..143be3b6 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/validate/options.go +++ b/vendor/k8s.io/apimachinery/pkg/api/validate/options.go @@ -18,6 +18,7 @@ package validate import ( "context" + "fmt" "k8s.io/apimachinery/pkg/api/operation" "k8s.io/apimachinery/pkg/util/validation/field" @@ -25,10 +26,14 @@ import ( // IfOption conditionally evaluates a validation function. If the option and enabled are both true the validator // is called. If the option and enabled are both false the validator is called. Otherwise, the validator is not called. -func IfOption[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, - optionName string, enabled bool, validator func(context.Context, operation.Operation, *field.Path, *T, *T) field.ErrorList, +func IfOption[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue T, + optionName string, enabled bool, validator func(context.Context, operation.Operation, *field.Path, T, T) field.ErrorList, ) field.ErrorList { - if op.HasOption(optionName) == enabled { + on, defined := op.HasOption(optionName) + if !defined { + return field.ErrorList{field.InternalError(fldPath, fmt.Errorf("undefined validation option %q", optionName))} + } + if on == enabled { return validator(ctx, op, fldPath, value, oldValue) } return nil diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/strfmt.go b/vendor/k8s.io/apimachinery/pkg/api/validate/strfmt.go index 190fa8db..893f55d7 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/validate/strfmt.go +++ b/vendor/k8s.io/apimachinery/pkg/api/validate/strfmt.go @@ -97,6 +97,28 @@ func LabelKey[T ~string](_ context.Context, op operation.Operation, fldPath *fie return allErrs } +// PrefixedLabelKey verifies that the specified value is a valid label key with +// a domain prefix. +// A prefixed label key is composed of a prefix and a name, separated by a '/'. +// The name part is required and must: +// - be 63 characters or less +// - begin and end with an alphanumeric character ([a-z0-9A-Z]) +// - contain only alphanumeric characters, dashes (-), underscores (_), or dots (.) +// +// The prefix must: +// - be a DNS subdomain +// - be no more than 253 characters +func PrefixedLabelKey[T ~string](_ context.Context, op operation.Operation, fldPath *field.Path, value, _ *T) field.ErrorList { + if value == nil { + return nil + } + var allErrs field.ErrorList + for _, msg := range content.IsPrefixedLabelKey((string)(*value)) { + allErrs = append(allErrs, field.Invalid(fldPath, *value, msg).WithOrigin("format=k8s-prefixed-label-key")) + } + return allErrs +} + // LongNameCaseless verifies that the specified value is a valid "long name" // (sometimes known as a "DNS subdomain"), but is case-insensitive. // - must not be empty diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/subfield.go b/vendor/k8s.io/apimachinery/pkg/api/validate/subfield.go index 896f3c3f..7aa48d33 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/validate/subfield.go +++ b/vendor/k8s.io/apimachinery/pkg/api/validate/subfield.go @@ -31,6 +31,9 @@ type GetFieldFunc[Tstruct any, Tfield any] func(*Tstruct) Tfield // the value of the subfield is the same as the previous value, as per the // equiv function, then no validation is performed. // +// The equiv function can be called with nil arguments in the case of nilable +// fields. +// // The fldPath passed to the validator includes the subfield name. func Subfield[Tstruct any, Tfield any]( ctx context.Context, op operation.Operation, fldPath *field.Path, diff --git a/vendor/k8s.io/apimachinery/pkg/api/validate/update.go b/vendor/k8s.io/apimachinery/pkg/api/validate/update.go index e67ee28d..c258e6d1 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/validate/update.go +++ b/vendor/k8s.io/apimachinery/pkg/api/validate/update.go @@ -18,6 +18,8 @@ package validate import ( "context" + "fmt" + "slices" "k8s.io/apimachinery/pkg/api/equality" "k8s.io/apimachinery/pkg/api/operation" @@ -34,11 +36,16 @@ const ( NoUnset // NoModify prevents value changes but allows set/unset transitions NoModify + // NoAddItem prevents adding items to a slice or map + NoAddItem + // NoRemoveItem prevents removing items from a slice or map + NoRemoveItem ) // UpdateValueByCompare verifies update constraints for comparable value types. func UpdateValueByCompare[T comparable](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList { - if op.Type != operation.Update { + // nil oldValue means no prior value to compare against (eg: a new item at +k8s:eachVal scope) -> no transition to check. + if op.Type != operation.Update || oldValue == nil { return nil } @@ -101,7 +108,8 @@ func UpdatePointer[T any](_ context.Context, op operation.Operation, fldPath *fi // UpdateValueByReflect verifies update constraints for non-comparable value types using reflection. func UpdateValueByReflect[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList { - if op.Type != operation.Update { + // nil oldValue means no prior value to compare against (eg: a new item at +k8s:eachVal scope) -> no transition to check. + if op.Type != operation.Update || oldValue == nil { return nil } @@ -136,7 +144,8 @@ func UpdateValueByReflect[T any](_ context.Context, op operation.Operation, fldP // UpdateStruct verifies update constraints for non-pointer struct types. // Non-pointer structs are always considered "set" and never "unset". func UpdateStruct[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *T, constraints ...UpdateConstraint) field.ErrorList { - if op.Type != operation.Update { + // nil oldValue means no prior value to compare against (eg: a new item at +k8s:eachVal scope) -> no transition to check. + if op.Type != operation.Update || oldValue == nil { return nil } @@ -158,3 +167,142 @@ func UpdateStruct[T any](_ context.Context, op operation.Operation, fldPath *fie return errs } + +// ValSliceUpdate verifies update constraints for slices of values. +// NoAddItem and NoRemoveItem use the match function to find corresponding +// elements between value and oldValue. NoSet and NoUnset treat len == 0 as +// "unset". +// +// The match function will never be called with nil arguments. +func ValSliceUpdate[T any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue []T, match MatchFunc[*T], constraints ...UpdateConstraint) field.ErrorList { + if op.Type != operation.Update { + return nil + } + + if match == nil && (slices.Contains(constraints, NoAddItem) || slices.Contains(constraints, NoRemoveItem)) { + return field.ErrorList{field.InternalError(fldPath, fmt.Errorf("ValSliceUpdate: NoAddItem/NoRemoveItem require a non-nil match function"))} + } + + var errs field.ErrorList + + for _, constraint := range constraints { + switch constraint { + case NoSet: + if len(oldValue) == 0 && len(value) > 0 { + errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update")) + } + case NoUnset: + if len(oldValue) > 0 && len(value) == 0 { + errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update")) + } + case NoAddItem: + for i := range value { + newItem := &value[i] + if lookup(oldValue, newItem, match) == nil { + errs = append(errs, field.Forbidden(fldPath.Index(i), "item may not be added").WithOrigin("update")) + } + } + case NoRemoveItem: + for i := range oldValue { + oldItem := &oldValue[i] + if lookup(value, oldItem, match) == nil { + errs = append(errs, field.Forbidden(fldPath, "item may not be removed").WithOrigin("update")) + } + } + } + } + + return errs +} + +// PtrSliceUpdate verifies update constraints for slices of pointers. +// NoAddItem and NoRemoveItem use the match function to find corresponding +// elements between value and oldValue. NoSet and NoUnset treat len == 0 as +// "unset". +// +// The match function will never be called with nil arguments. +func PtrSliceUpdate[T any](ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue []*T, match MatchFunc[*T], constraints ...UpdateConstraint) field.ErrorList { + if op.Type != operation.Update { + return nil + } + + if match == nil && (slices.Contains(constraints, NoAddItem) || slices.Contains(constraints, NoRemoveItem)) { + return field.ErrorList{field.InternalError(fldPath, fmt.Errorf("PtrSliceUpdate: NoAddItem/NoRemoveItem require a non-nil match function"))} + } + + var errs field.ErrorList + + for _, constraint := range constraints { + switch constraint { + case NoSet: + if len(oldValue) == 0 && len(value) > 0 { + errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update")) + } + case NoUnset: + if len(oldValue) > 0 && len(value) == 0 { + errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update")) + } + case NoAddItem: + for i := range value { + newItem := value[i] + if newItem == nil { + // Ignore nil items; they are supposed to have been checked by PtrSliceNoNils. + continue + } + if lookupPointer(oldValue, newItem, match) == nil { + errs = append(errs, field.Forbidden(fldPath.Index(i), "item may not be added").WithOrigin("update")) + } + } + case NoRemoveItem: + for i := range oldValue { + oldItem := oldValue[i] + if oldItem == nil { + continue + } + if lookupPointer(value, oldItem, match) == nil { + errs = append(errs, field.Forbidden(fldPath, "item may not be removed").WithOrigin("update")) + } + } + } + } + + return errs +} + +// UpdateMap verifies update constraints for map types. +// NoAddItem and NoRemoveItem compare keys between value and oldValue. NoSet +// and NoUnset treat len == 0 as "unset". +func UpdateMap[K comparable, V any](_ context.Context, op operation.Operation, fldPath *field.Path, value, oldValue map[K]V, constraints ...UpdateConstraint) field.ErrorList { + if op.Type != operation.Update { + return nil + } + + var errs field.ErrorList + + for _, constraint := range constraints { + switch constraint { + case NoSet: + if len(oldValue) == 0 && len(value) > 0 { + errs = append(errs, field.Invalid(fldPath, nil, "field cannot be set once created").WithOrigin("update")) + } + case NoUnset: + if len(oldValue) > 0 && len(value) == 0 { + errs = append(errs, field.Invalid(fldPath, nil, "field cannot be cleared once set").WithOrigin("update")) + } + case NoAddItem: + for k := range value { + if _, ok := oldValue[k]; !ok { + errs = append(errs, field.Forbidden(fldPath.Key(fmt.Sprintf("%v", k)), "item may not be added").WithOrigin("update")) + } + } + case NoRemoveItem: + for k := range oldValue { + if _, ok := value[k]; !ok { + errs = append(errs, field.Forbidden(fldPath.Key(fmt.Sprintf("%v", k)), "item may not be removed").WithOrigin("update")) + } + } + } + } + + return errs +} diff --git a/vendor/k8s.io/apimachinery/pkg/api/validation/objectmeta.go b/vendor/k8s.io/apimachinery/pkg/api/validation/objectmeta.go index 9a4f3784..ff86973f 100644 --- a/vendor/k8s.io/apimachinery/pkg/api/validation/objectmeta.go +++ b/vendor/k8s.io/apimachinery/pkg/api/validation/objectmeta.go @@ -17,11 +17,14 @@ limitations under the License. package validation import ( + "context" "fmt" "strings" apiequality "k8s.io/apimachinery/pkg/api/equality" "k8s.io/apimachinery/pkg/api/meta" + "k8s.io/apimachinery/pkg/api/operation" + "k8s.io/apimachinery/pkg/api/validate" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" v1validation "k8s.io/apimachinery/pkg/apis/meta/v1/validation" "k8s.io/apimachinery/pkg/runtime/schema" @@ -68,20 +71,23 @@ func ValidateAnnotationsSize(annotations map[string]string) error { func validateOwnerReference(ownerReference metav1.OwnerReference, fldPath *field.Path) field.ErrorList { allErrs := field.ErrorList{} - gvk := schema.FromAPIVersionAndKind(ownerReference.APIVersion, ownerReference.Kind) + gv, err := schema.ParseGroupVersion(ownerReference.APIVersion) // gvk.Group is empty for the legacy group. - if len(gvk.Version) == 0 { - allErrs = append(allErrs, field.Invalid(fldPath.Child("apiVersion"), ownerReference.APIVersion, "version must not be empty")) + if len(ownerReference.APIVersion) == 0 { + allErrs = append(allErrs, field.Required(fldPath.Child("apiVersion"), "must not be empty").MarkCoveredByDeclarative()) + } else if err != nil || len(gv.Version) == 0 { + allErrs = append(allErrs, field.Invalid(fldPath.Child("apiVersion"), ownerReference.APIVersion, "must be / or ")) } - if len(gvk.Kind) == 0 { - allErrs = append(allErrs, field.Invalid(fldPath.Child("kind"), ownerReference.Kind, "must not be empty")) + if len(ownerReference.Kind) == 0 { + allErrs = append(allErrs, field.Required(fldPath.Child("kind"), "must not be empty").MarkCoveredByDeclarative()) } if len(ownerReference.Name) == 0 { - allErrs = append(allErrs, field.Invalid(fldPath.Child("name"), ownerReference.Name, "must not be empty")) + allErrs = append(allErrs, field.Required(fldPath.Child("name"), "must not be empty").MarkCoveredByDeclarative()) } if len(ownerReference.UID) == 0 { - allErrs = append(allErrs, field.Invalid(fldPath.Child("uid"), ownerReference.UID, "must not be empty")) + allErrs = append(allErrs, field.Required(fldPath.Child("uid"), "must not be empty").MarkCoveredByDeclarative()) } + gvk := gv.WithKind(ownerReference.Kind) if _, ok := BannedOwners[gvk]; ok { allErrs = append(allErrs, field.Invalid(fldPath, ownerReference, fmt.Sprintf("%s is disallowed from being an owner", gvk))) } @@ -92,8 +98,8 @@ func validateOwnerReference(ownerReference metav1.OwnerReference, fldPath *field func ValidateOwnerReferences(ownerReferences []metav1.OwnerReference, fldPath *field.Path) field.ErrorList { allErrs := field.ErrorList{} firstControllerName := "" - for _, ref := range ownerReferences { - allErrs = append(allErrs, validateOwnerReference(ref, fldPath)...) + for idx, ref := range ownerReferences { + allErrs = append(allErrs, validateOwnerReference(ref, fldPath.Index(idx))...) if ref.Controller != nil && *ref.Controller { curControllerName := ref.Kind + "/" + ref.Name if firstControllerName != "" { @@ -136,6 +142,25 @@ func ValidateImmutableField(newVal, oldVal interface{}, fldPath *field.Path) fie return allErrs } +// ValidateObjectMetaDeclaratively validates an ObjectMeta instance declaratively and deduplicates handwritten errors. +// betaEnabled controls whether declarative validation rules at the Beta stability level are enforced. +// NOTE: This method should be used in the types for which declarative validation is not enabled yet or cannot be enabled. The types +// for which declarative validation is enabled and valdiation code is generated must use ValidateObjectMeta and ValidateObjectMetaUpdate. +func ValidateObjectMetaDeclaratively(ctx context.Context, op operation.Type, obj, oldObj *metav1.ObjectMeta, requiresNamespace bool, nameFn ValidateNameFunc, fldPath *field.Path, betaEnabled bool) field.ErrorList { + var errs field.ErrorList + switch op { + case operation.Create: + errs = ValidateObjectMeta(obj, requiresNamespace, nameFn, fldPath) + case operation.Update: + errs = ValidateObjectMetaUpdate(obj, oldObj, fldPath) + } + dvErrs := v1validation.Validate_ObjectMeta(ctx, operation.Operation{Type: op}, fldPath, obj, oldObj) + enforcedDVErrs := validate.FilterEnforcedDeclarativeErrors(ctx, dvErrs, betaEnabled) + errs = errs.MarkFromImperative() + errs = validate.FilterCoveredHandwrittenErrors(ctx, errs, enforcedDVErrs, betaEnabled) + return append(errs, enforcedDVErrs...) +} + // ValidateObjectMeta validates an object's metadata on creation. It expects that name generation has already // been performed. func ValidateObjectMeta(objMeta *metav1.ObjectMeta, requiresNamespace bool, nameFn ValidateNameFunc, fldPath *field.Path) field.ErrorList { @@ -262,12 +287,12 @@ func validateObjectMetaAccessorWithOptsCommon(meta metav1.Object, isNamespaced b } } - allErrs = append(allErrs, ValidateNonnegativeField(meta.GetGeneration(), fldPath.Child("generation"))...) + allErrs = append(allErrs, ValidateNonnegativeField(meta.GetGeneration(), fldPath.Child("generation")).MarkCoveredByDeclarative()...) allErrs = append(allErrs, v1validation.ValidateLabels(meta.GetLabels(), fldPath.Child("labels"))...) allErrs = append(allErrs, ValidateAnnotations(meta.GetAnnotations(), fldPath.Child("annotations"))...) allErrs = append(allErrs, ValidateOwnerReferences(meta.GetOwnerReferences(), fldPath.Child("ownerReferences"))...) allErrs = append(allErrs, ValidateFinalizers(meta.GetFinalizers(), fldPath.Child("finalizers"))...) - allErrs = append(allErrs, v1validation.ValidateManagedFields(meta.GetManagedFields(), fldPath.Child("managedFields"))...) + allErrs = append(allErrs, v1validation.ValidateManagedFields(meta.GetManagedFields(), fldPath.Child("managedFields"), v1validation.CoveredByDeclarative)...) return allErrs } @@ -323,21 +348,22 @@ func ValidateObjectMetaAccessorUpdate(newMeta, oldMeta metav1.Object, fldPath *f } // Generation shouldn't be decremented + allErrs = append(allErrs, ValidateNonnegativeField(newMeta.GetGeneration(), fldPath.Child("generation")).MarkCoveredByDeclarative()...) if newMeta.GetGeneration() < oldMeta.GetGeneration() { allErrs = append(allErrs, field.Invalid(fldPath.Child("generation"), newMeta.GetGeneration(), "must not be decremented")) } allErrs = append(allErrs, ValidateImmutableField(newMeta.GetName(), oldMeta.GetName(), fldPath.Child("name"))...) allErrs = append(allErrs, ValidateImmutableField(newMeta.GetNamespace(), oldMeta.GetNamespace(), fldPath.Child("namespace"))...) - allErrs = append(allErrs, ValidateImmutableField(newMeta.GetUID(), oldMeta.GetUID(), fldPath.Child("uid"))...) - allErrs = append(allErrs, ValidateImmutableField(newMeta.GetCreationTimestamp(), oldMeta.GetCreationTimestamp(), fldPath.Child("creationTimestamp"))...) - allErrs = append(allErrs, ValidateImmutableField(newMeta.GetDeletionTimestamp(), oldMeta.GetDeletionTimestamp(), fldPath.Child("deletionTimestamp"))...) - allErrs = append(allErrs, ValidateImmutableField(newMeta.GetDeletionGracePeriodSeconds(), oldMeta.GetDeletionGracePeriodSeconds(), fldPath.Child("deletionGracePeriodSeconds"))...) + allErrs = append(allErrs, ValidateImmutableField(newMeta.GetUID(), oldMeta.GetUID(), fldPath.Child("uid")).WithOrigin("immutable").MarkCoveredByDeclarative()...) + allErrs = append(allErrs, ValidateImmutableField(newMeta.GetCreationTimestamp(), oldMeta.GetCreationTimestamp(), fldPath.Child("creationTimestamp")).WithOrigin("immutable").MarkCoveredByDeclarative()...) + allErrs = append(allErrs, ValidateImmutableField(newMeta.GetDeletionTimestamp(), oldMeta.GetDeletionTimestamp(), fldPath.Child("deletionTimestamp")).WithOrigin("immutable").MarkCoveredByDeclarative()...) + allErrs = append(allErrs, ValidateImmutableField(newMeta.GetDeletionGracePeriodSeconds(), oldMeta.GetDeletionGracePeriodSeconds(), fldPath.Child("deletionGracePeriodSeconds")).WithOrigin("immutable").MarkCoveredByDeclarative()...) allErrs = append(allErrs, v1validation.ValidateLabels(newMeta.GetLabels(), fldPath.Child("labels"))...) allErrs = append(allErrs, ValidateAnnotations(newMeta.GetAnnotations(), fldPath.Child("annotations"))...) allErrs = append(allErrs, ValidateOwnerReferences(newMeta.GetOwnerReferences(), fldPath.Child("ownerReferences"))...) - allErrs = append(allErrs, v1validation.ValidateManagedFields(newMeta.GetManagedFields(), fldPath.Child("managedFields"))...) + allErrs = append(allErrs, v1validation.ValidateManagedFields(newMeta.GetManagedFields(), fldPath.Child("managedFields"), v1validation.CoveredByDeclarative)...) return allErrs } diff --git a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto index d03a7331..afc9b250 100644 --- a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto +++ b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto @@ -179,6 +179,9 @@ message ApplyOptions { // // +patchStrategy=merge // // +listType=map // // +listMapKey=type +// // +k8s:alpha(since: "1.37")=+k8s:optional +// // +k8s:alpha(since: "1.37")=+k8s:listType=map +// // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type // Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"` // // // other fields @@ -193,12 +196,14 @@ message Condition { // +kubebuilder:validation:Required // +kubebuilder:validation:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$` // +kubebuilder:validation:MaxLength=316 + // +k8s:alpha(since: "1.37")=+k8s:required optional string type = 1; // status of the condition, one of True, False, Unknown. // +required // +kubebuilder:validation:Required // +kubebuilder:validation:Enum=True;False;Unknown + // +k8s:alpha(since: "1.37")=+k8s:required optional string status = 2; // observedGeneration represents the .metadata.generation that the condition was set based upon. @@ -206,6 +211,8 @@ message Condition { // with respect to the current state of the instance. // +optional // +kubebuilder:validation:Minimum=0 + // +k8s:alpha(since: "1.37")=+k8s:optional + // +k8s:alpha(since: "1.37")=+k8s:minimum=0 optional int64 observedGeneration = 3; // lastTransitionTime is the last time the condition transitioned from one status to another. @@ -214,6 +221,7 @@ message Condition { // +kubebuilder:validation:Required // +kubebuilder:validation:Type=string // +kubebuilder:validation:Format=date-time + // +k8s:alpha(since: "1.37")=+k8s:customValidation optional Time lastTransitionTime = 4; // reason contains a programmatic identifier indicating the reason for the condition's last transition. @@ -226,6 +234,8 @@ message Condition { // +kubebuilder:validation:MaxLength=1024 // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:Pattern=`^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$` + // +k8s:alpha(since: "1.37")=+k8s:required + // +k8s:alpha(since: "1.37")=+k8s:maxBytes=1024 optional string reason = 5; // message is a human readable message indicating details about the transition. @@ -700,6 +710,7 @@ message ManagedFieldsEntry { // Operation is the type of operation which lead to this ManagedFieldsEntry being created. // The only valid values for this field are 'Apply' and 'Update'. + // +k8s:alpha(since: "1.37")=+k8s:required optional string operation = 2; // APIVersion defines the version of this resource that this field set @@ -802,6 +813,8 @@ message ObjectMeta { // Read-only. // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids // +optional + // +k8s:alpha(since: "1.37")=+k8s:optional + // +k8s:alpha(since: "1.37")=+k8s:immutable optional string uid = 5; // An opaque value that represents the internal version of this object that can @@ -820,6 +833,8 @@ message ObjectMeta { // A sequence number representing a specific generation of the desired state. // Populated by the system. Read-only. // +optional + // +k8s:alpha(since: "1.37")=+k8s:optional + // +k8s:alpha(since: "1.37")=+k8s:minimum=0 optional int64 generation = 7; // CreationTimestamp is a timestamp representing the server time when this object was @@ -831,6 +846,7 @@ message ObjectMeta { // Null for lists. // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata // +optional + // +k8s:alpha(since: "1.37")=+k8s:immutable optional Time creationTimestamp = 8; // DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This @@ -852,6 +868,8 @@ message ObjectMeta { // Read-only. // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata // +optional + // +k8s:alpha(since: "1.37")=+k8s:optional + // +k8s:alpha(since: "1.37")=+k8s:immutable optional Time deletionTimestamp = 9; // Number of seconds allowed for this object to gracefully terminate before @@ -859,6 +877,8 @@ message ObjectMeta { // May only be shortened. // Read-only. // +optional + // +k8s:alpha(since: "1.37")=+k8s:optional + // +k8s:alpha(since: "1.37")=+k8s:immutable optional int64 deletionGracePeriodSeconds = 10; // Map of string keys and values that can be used to organize and categorize @@ -884,6 +904,7 @@ message ObjectMeta { // +patchStrategy=merge // +listType=map // +listMapKey=uid + // +k8s:alpha(since:"1.37")=+k8s:optional repeated OwnerReference ownerReferences = 13; // Must be empty before the object is deleted from the registry. Each entry @@ -914,6 +935,7 @@ message ObjectMeta { // // +optional // +listType=atomic + // +k8s:alpha(since: "1.37")=+k8s:optional repeated ManagedFieldsEntry managedFields = 17; } @@ -923,18 +945,22 @@ message ObjectMeta { // +structType=atomic message OwnerReference { // API version of the referent. + // +k8s:alpha(since:"1.37")=+k8s:required optional string apiVersion = 5; // Kind of the referent. // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + // +k8s:alpha(since:"1.37")=+k8s:required optional string kind = 1; // Name of the referent. // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + // +k8s:alpha(since:"1.37")=+k8s:required optional string name = 3; // UID of the referent. // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids + // +k8s:alpha(since:"1.37")=+k8s:required optional string uid = 4; // If true, this reference points to the managing controller. @@ -960,6 +986,7 @@ message PartialObjectMetadata { // Standard object's metadata. // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata // +optional + // +k8s:opaqueType optional ObjectMeta metadata = 1; } diff --git a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/types.go b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/types.go index c8b87f20..f88212e1 100644 --- a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/types.go +++ b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/types.go @@ -176,6 +176,8 @@ type ObjectMeta struct { // Read-only. // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids // +optional + // +k8s:alpha(since: "1.37")=+k8s:optional + // +k8s:alpha(since: "1.37")=+k8s:immutable UID types.UID `json:"uid,omitempty" protobuf:"bytes,5,opt,name=uid,casttype=k8s.io/kubernetes/pkg/types.UID"` // An opaque value that represents the internal version of this object that can @@ -194,6 +196,8 @@ type ObjectMeta struct { // A sequence number representing a specific generation of the desired state. // Populated by the system. Read-only. // +optional + // +k8s:alpha(since: "1.37")=+k8s:optional + // +k8s:alpha(since: "1.37")=+k8s:minimum=0 Generation int64 `json:"generation,omitempty" protobuf:"varint,7,opt,name=generation"` // CreationTimestamp is a timestamp representing the server time when this object was @@ -205,6 +209,7 @@ type ObjectMeta struct { // Null for lists. // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata // +optional + // +k8s:alpha(since: "1.37")=+k8s:immutable CreationTimestamp Time `json:"creationTimestamp,omitempty,omitzero" protobuf:"bytes,8,opt,name=creationTimestamp"` // DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This @@ -226,6 +231,8 @@ type ObjectMeta struct { // Read-only. // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata // +optional + // +k8s:alpha(since: "1.37")=+k8s:optional + // +k8s:alpha(since: "1.37")=+k8s:immutable DeletionTimestamp *Time `json:"deletionTimestamp,omitempty" protobuf:"bytes,9,opt,name=deletionTimestamp"` // Number of seconds allowed for this object to gracefully terminate before @@ -233,6 +240,8 @@ type ObjectMeta struct { // May only be shortened. // Read-only. // +optional + // +k8s:alpha(since: "1.37")=+k8s:optional + // +k8s:alpha(since: "1.37")=+k8s:immutable DeletionGracePeriodSeconds *int64 `json:"deletionGracePeriodSeconds,omitempty" protobuf:"varint,10,opt,name=deletionGracePeriodSeconds"` // Map of string keys and values that can be used to organize and categorize @@ -258,6 +267,7 @@ type ObjectMeta struct { // +patchStrategy=merge // +listType=map // +listMapKey=uid + // +k8s:alpha(since:"1.37")=+k8s:optional OwnerReferences []OwnerReference `json:"ownerReferences,omitempty" patchStrategy:"merge" patchMergeKey:"uid" protobuf:"bytes,13,rep,name=ownerReferences"` // Must be empty before the object is deleted from the registry. Each entry @@ -292,6 +302,7 @@ type ObjectMeta struct { // // +optional // +listType=atomic + // +k8s:alpha(since: "1.37")=+k8s:optional ManagedFields []ManagedFieldsEntry `json:"managedFields,omitempty" protobuf:"bytes,17,rep,name=managedFields"` } @@ -314,15 +325,19 @@ const ( // +structType=atomic type OwnerReference struct { // API version of the referent. + // +k8s:alpha(since:"1.37")=+k8s:required APIVersion string `json:"apiVersion" protobuf:"bytes,5,opt,name=apiVersion"` // Kind of the referent. // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + // +k8s:alpha(since:"1.37")=+k8s:required Kind string `json:"kind" protobuf:"bytes,1,opt,name=kind"` // Name of the referent. // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names + // +k8s:alpha(since:"1.37")=+k8s:required Name string `json:"name" protobuf:"bytes,3,opt,name=name"` // UID of the referent. // More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids + // +k8s:alpha(since:"1.37")=+k8s:required UID types.UID `json:"uid" protobuf:"bytes,4,opt,name=uid,casttype=k8s.io/apimachinery/pkg/types.UID"` // If true, this reference points to the managing controller. // +optional @@ -344,7 +359,7 @@ type OwnerReference struct { // ListOptions is the query options to a standard REST list call. type ListOptions struct { - TypeMeta `json:",inline"` + TypeMeta `json:""` // A selector to restrict the list of returned objects by their labels. // Defaults to everything. @@ -517,7 +532,7 @@ const ( // GetOptions is the standard query options to the standard REST get call. type GetOptions struct { - TypeMeta `json:",inline"` + TypeMeta `json:""` // resourceVersion sets a constraint on what resource versions a request may be served from. // See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for // details. @@ -557,7 +572,7 @@ const ( // DeleteOptions may be provided when deleting an API object. type DeleteOptions struct { - TypeMeta `json:",inline"` + TypeMeta `json:""` // The duration in seconds before the object should be deleted. Value must be non-negative integer. // The value zero indicates delete immediately. If this value is nil, the default grace period for the @@ -629,7 +644,7 @@ const ( // CreateOptions may be provided when creating an API object. type CreateOptions struct { - TypeMeta `json:",inline"` + TypeMeta `json:""` // When present, indicates that modifications should not be // persisted. An invalid or unrecognized dryRun directive will @@ -674,7 +689,7 @@ type CreateOptions struct { // PatchOptions may be provided when patching an API object. // PatchOptions is meant to be a superset of UpdateOptions. type PatchOptions struct { - TypeMeta `json:",inline"` + TypeMeta `json:""` // When present, indicates that modifications should not be // persisted. An invalid or unrecognized dryRun directive will @@ -726,7 +741,7 @@ type PatchOptions struct { // ApplyOptions is equivalent to PatchOptions. It is provided as a convenience with documentation // that speaks specifically to how the options fields relate to apply. type ApplyOptions struct { - TypeMeta `json:",inline"` + TypeMeta `json:""` // When present, indicates that modifications should not be // persisted. An invalid or unrecognized dryRun directive will @@ -759,7 +774,7 @@ func (o ApplyOptions) ToPatchOptions() PatchOptions { // UpdateOptions may be provided when updating an API object. // All fields in UpdateOptions should also be present in PatchOptions. type UpdateOptions struct { - TypeMeta `json:",inline"` + TypeMeta `json:""` // When present, indicates that modifications should not be // persisted. An invalid or unrecognized dryRun directive will @@ -811,7 +826,7 @@ type Preconditions struct { // Status is a return value for calls that don't return other objects. type Status struct { - TypeMeta `json:",inline"` + TypeMeta `json:""` // Standard list metadata. // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds // +optional @@ -1131,7 +1146,7 @@ const ( // List holds a list of objects, which may not be known by the server. type List struct { - TypeMeta `json:",inline"` + TypeMeta `json:""` // Standard list metadata. // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds // +optional @@ -1147,7 +1162,7 @@ type List struct { // +protobuf.options.(gogoproto.goproto_stringer)=false // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object type APIVersions struct { - TypeMeta `json:",inline"` + TypeMeta `json:""` // versions are the api versions that are available. // +listType=atomic Versions []string `json:"versions" protobuf:"bytes,1,rep,name=versions"` @@ -1167,7 +1182,7 @@ type APIVersions struct { // APIGroupList is a list of APIGroup, to allow clients to discover the API at // /apis. type APIGroupList struct { - TypeMeta `json:",inline"` + TypeMeta `json:""` // groups is a list of APIGroup. // +listType=atomic Groups []APIGroup `json:"groups" protobuf:"bytes,1,rep,name=groups"` @@ -1178,7 +1193,7 @@ type APIGroupList struct { // APIGroup contains the name, the supported versions, and the preferred version // of a group. type APIGroup struct { - TypeMeta `json:",inline"` + TypeMeta `json:""` // name is the name of the group. Name string `json:"name" protobuf:"bytes,1,opt,name=name"` // versions are the versions supported in this group. @@ -1273,7 +1288,7 @@ func (vs Verbs) String() string { // resources supported in a specific group and version, and if the resource // is namespaced. type APIResourceList struct { - TypeMeta `json:",inline"` + TypeMeta `json:""` // groupVersion is the group and version this APIResourceList is for. GroupVersion string `json:"groupVersion" protobuf:"bytes,1,opt,name=groupVersion"` // resources contains the name of the resources and if they are namespaced. @@ -1394,6 +1409,7 @@ type ManagedFieldsEntry struct { Manager string `json:"manager,omitempty" protobuf:"bytes,1,opt,name=manager"` // Operation is the type of operation which lead to this ManagedFieldsEntry being created. // The only valid values for this field are 'Apply' and 'Update'. + // +k8s:alpha(since: "1.37")=+k8s:required Operation ManagedFieldsOperationType `json:"operation,omitempty" protobuf:"bytes,2,opt,name=operation,casttype=ManagedFieldsOperationType"` // APIVersion defines the version of this resource that this field set // applies to. The format is "group/version" just like the top-level @@ -1429,6 +1445,7 @@ type ManagedFieldsEntry struct { } // ManagedFieldsOperationType is the type of operation which lead to a ManagedFieldsEntry being created. +// +k8s:alpha(since: "1.37")=+k8s:enum type ManagedFieldsOperationType string const ( @@ -1446,7 +1463,7 @@ const ( // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object // +protobuf=false type Table struct { - TypeMeta `json:",inline"` + TypeMeta `json:""` // Standard list metadata. // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds // +optional @@ -1537,6 +1554,7 @@ const ( RowCompleted RowConditionType = "Completed" ) +// +k8s:alpha(since: "1.37")=+k8s:enum type ConditionStatus string // These are valid condition statuses. "ConditionTrue" means a resource is in the condition. @@ -1565,7 +1583,7 @@ const ( // +k8s:conversion-gen:explicit-from=net/url.Values // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object type TableOptions struct { - TypeMeta `json:",inline"` + TypeMeta `json:""` // NoHeaders is only exposed for internal callers. It is not included in our OpenAPI definitions // and may be removed as a field in a future release. @@ -1582,17 +1600,18 @@ type TableOptions struct { // to get access to a particular ObjectMeta schema without knowing the details of the version. // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object type PartialObjectMetadata struct { - TypeMeta `json:",inline"` + TypeMeta `json:""` // Standard object's metadata. // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata // +optional + // +k8s:opaqueType ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"` } // PartialObjectMetadataList contains a list of objects containing only their metadata // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object type PartialObjectMetadataList struct { - TypeMeta `json:",inline"` + TypeMeta `json:""` // Standard list metadata. // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds // +optional @@ -1613,6 +1632,9 @@ type PartialObjectMetadataList struct { // // +patchStrategy=merge // // +listType=map // // +listMapKey=type +// // +k8s:alpha(since: "1.37")=+k8s:optional +// // +k8s:alpha(since: "1.37")=+k8s:listType=map +// // +k8s:alpha(since: "1.37")=+k8s:listMapKey=type // Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"` // // // other fields @@ -1627,17 +1649,21 @@ type Condition struct { // +kubebuilder:validation:Required // +kubebuilder:validation:Pattern=`^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$` // +kubebuilder:validation:MaxLength=316 + // +k8s:alpha(since: "1.37")=+k8s:required Type string `json:"type" protobuf:"bytes,1,opt,name=type"` // status of the condition, one of True, False, Unknown. // +required // +kubebuilder:validation:Required // +kubebuilder:validation:Enum=True;False;Unknown + // +k8s:alpha(since: "1.37")=+k8s:required Status ConditionStatus `json:"status" protobuf:"bytes,2,opt,name=status"` // observedGeneration represents the .metadata.generation that the condition was set based upon. // For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date // with respect to the current state of the instance. // +optional // +kubebuilder:validation:Minimum=0 + // +k8s:alpha(since: "1.37")=+k8s:optional + // +k8s:alpha(since: "1.37")=+k8s:minimum=0 ObservedGeneration int64 `json:"observedGeneration,omitempty" protobuf:"varint,3,opt,name=observedGeneration"` // lastTransitionTime is the last time the condition transitioned from one status to another. // This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. @@ -1645,6 +1671,7 @@ type Condition struct { // +kubebuilder:validation:Required // +kubebuilder:validation:Type=string // +kubebuilder:validation:Format=date-time + // +k8s:alpha(since: "1.37")=+k8s:customValidation LastTransitionTime Time `json:"lastTransitionTime" protobuf:"bytes,4,opt,name=lastTransitionTime"` // reason contains a programmatic identifier indicating the reason for the condition's last transition. // Producers of specific condition types may define expected values and meanings for this field, @@ -1656,6 +1683,8 @@ type Condition struct { // +kubebuilder:validation:MaxLength=1024 // +kubebuilder:validation:MinLength=1 // +kubebuilder:validation:Pattern=`^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$` + // +k8s:alpha(since: "1.37")=+k8s:required + // +k8s:alpha(since: "1.37")=+k8s:maxBytes=1024 Reason string `json:"reason" protobuf:"bytes,5,opt,name=reason"` // message is a human readable message indicating details about the transition. // This may be an empty string. diff --git a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers.go b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers.go index 59f43b7b..592445d9 100644 --- a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers.go +++ b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/helpers.go @@ -523,6 +523,7 @@ func NewJSONFallbackEncoder(encoder runtime.Encoder) runtime.Encoder { } identifier, err := gojson.Marshal(result) if err != nil { + //nolint:logcheck // Should not be reached. klog.Fatalf("Failed marshaling identifier for jsonFallbackEncoder: %v", err) } return &jsonFallbackEncoder{ diff --git a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/doc.go b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/doc.go new file mode 100644 index 00000000..3b9cb30f --- /dev/null +++ b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/doc.go @@ -0,0 +1,21 @@ +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// +k8s:validation-gen=TypesWithField=TypeMeta +// +k8s:validation-gen-input=k8s.io/apimachinery/pkg/apis/meta/v1 + +// Package validation holds generated validations for meta/v1 types. +package validation diff --git a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation.go b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation.go index d0ca2001..b9ec3442 100644 --- a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation.go +++ b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/validation.go @@ -17,10 +17,12 @@ limitations under the License. package validation import ( + "context" "fmt" "regexp" "unicode" + "k8s.io/apimachinery/pkg/api/operation" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/types" "k8s.io/apimachinery/pkg/util/sets" @@ -266,14 +268,39 @@ func ValidateTableOptions(opts *metav1.TableOptions) field.ErrorList { const MaxSubresourceNameLength = 256 -func ValidateManagedFields(fieldsList []metav1.ManagedFieldsEntry, fldPath *field.Path) field.ErrorList { +// ManagedFieldsValidationOption specifies options for validating managed fields. +type ManagedFieldsValidationOption int + +const ( + // CoveredByDeclarative indicates whether errors should be marked as covered by declarative validation. + CoveredByDeclarative ManagedFieldsValidationOption = iota + 1 +) + +// ValidateManagedFields validates a list of managed fields. +func ValidateManagedFields(fieldsList []metav1.ManagedFieldsEntry, fldPath *field.Path, opts ...ManagedFieldsValidationOption) field.ErrorList { + coveredByDeclarative := false + for _, opt := range opts { + if opt == CoveredByDeclarative { + coveredByDeclarative = true + } + } var allErrs field.ErrorList for i, fields := range fieldsList { fldPath := fldPath.Index(i) switch fields.Operation { + case "": + err := field.Required(fldPath.Child("operation"), "must not be empty") + if coveredByDeclarative { + err = err.MarkCoveredByDeclarative() + } + allErrs = append(allErrs, err) case metav1.ManagedFieldsOperationApply, metav1.ManagedFieldsOperationUpdate: default: - allErrs = append(allErrs, field.Invalid(fldPath.Child("operation"), fields.Operation, "must be `Apply` or `Update`")) + err := field.NotSupported(fldPath.Child("operation"), fields.Operation, []metav1.ManagedFieldsOperationType{metav1.ManagedFieldsOperationApply, metav1.ManagedFieldsOperationUpdate}) + if coveredByDeclarative { + err = err.MarkCoveredByDeclarative() + } + allErrs = append(allErrs, err) } if len(fields.FieldsType) > 0 && fields.FieldsType != "FieldsV1" { allErrs = append(allErrs, field.Invalid(fldPath.Child("fieldsType"), fields.FieldsType, "must be `FieldsV1`")) @@ -293,7 +320,7 @@ func ValidateConditions(conditions []metav1.Condition, fldPath *field.Path) fiel conditionTypeToFirstIndex := map[string]int{} for i, condition := range conditions { if _, ok := conditionTypeToFirstIndex[condition.Type]; ok { - allErrs = append(allErrs, field.Duplicate(fldPath.Index(i).Child("type"), condition.Type)) + allErrs = append(allErrs, field.Duplicate(fldPath.Index(i), condition.Type).MarkCoveredByDeclarative()) } else { conditionTypeToFirstIndex[condition.Type] = i } @@ -316,29 +343,35 @@ func ValidateCondition(condition metav1.Condition, fldPath *field.Path) field.Er var allErrs field.ErrorList // type is set and is a valid format - allErrs = append(allErrs, ValidateLabelName(condition.Type, fldPath.Child("type"))...) + if len(condition.Type) == 0 { + allErrs = append(allErrs, field.Required(fldPath.Child("type"), "is required").MarkCoveredByDeclarative()) + } else { + allErrs = append(allErrs, ValidateLabelName(condition.Type, fldPath.Child("type"))...) + } // status is set and is an accepted value - if !validConditionStatuses.Has(string(condition.Status)) { - allErrs = append(allErrs, field.NotSupported(fldPath.Child("status"), condition.Status, validConditionStatuses.List())) + if len(condition.Status) == 0 { + allErrs = append(allErrs, field.Required(fldPath.Child("status"), "").MarkCoveredByDeclarative()) + } else if !validConditionStatuses.Has(string(condition.Status)) { + allErrs = append(allErrs, field.NotSupported(fldPath.Child("status"), condition.Status, validConditionStatuses.List()).MarkCoveredByDeclarative()) } if condition.ObservedGeneration < 0 { - allErrs = append(allErrs, field.Invalid(fldPath.Child("observedGeneration"), condition.ObservedGeneration, "must be greater than or equal to zero")) + allErrs = append(allErrs, field.Invalid(fldPath.Child("observedGeneration"), condition.ObservedGeneration, "must be greater than or equal to zero").WithOrigin("minimum").MarkCoveredByDeclarative()) } if condition.LastTransitionTime.IsZero() { - allErrs = append(allErrs, field.Required(fldPath.Child("lastTransitionTime"), "")) + allErrs = append(allErrs, field.Required(fldPath.Child("lastTransitionTime"), "").MarkCoveredByDeclarative()) } if len(condition.Reason) == 0 { - allErrs = append(allErrs, field.Required(fldPath.Child("reason"), "")) + allErrs = append(allErrs, field.Required(fldPath.Child("reason"), "").MarkCoveredByDeclarative()) } else { - for _, currErr := range isValidConditionReason(condition.Reason) { + for _, currErr := range IsValidConditionReason(condition.Reason) { allErrs = append(allErrs, field.Invalid(fldPath.Child("reason"), condition.Reason, currErr)) } if len(condition.Reason) > maxReasonLen { - allErrs = append(allErrs, field.TooLong(fldPath.Child("reason"), "" /*unused*/, maxReasonLen)) + allErrs = append(allErrs, field.TooLong(fldPath.Child("reason"), "" /*unused*/, maxReasonLen).WithOrigin("maxBytes").MarkCoveredByDeclarative()) } } @@ -354,8 +387,9 @@ const conditionReasonErrMsg string = "a condition reason must start with alphabe var conditionReasonRegexp = regexp.MustCompile("^" + conditionReasonFmt + "$") -// isValidConditionReason tests for a string that conforms to rules for condition reasons. This checks the format, but not the length. -func isValidConditionReason(value string) []string { +// IsValidConditionReason tests for a string that conforms to rules for condition +// reasons. This checks the format, but not the length. +func IsValidConditionReason(value string) []string { if !conditionReasonRegexp.MatchString(value) { return []string{validation.RegexError(conditionReasonErrMsg, conditionReasonFmt, "my_name", "MY_NAME", "MyName", "ReasonA,ReasonB", "ReasonA:ReasonB")} } @@ -370,9 +404,6 @@ func ValidateIgnoreStoreReadError(fldPath *field.Path, options *metav1.DeleteOpt return allErrs } - if len(options.DryRun) > 0 { - allErrs = append(allErrs, field.Invalid(fldPath, true, "cannot be set together with .dryRun")) - } if options.PropagationPolicy != nil { allErrs = append(allErrs, field.Invalid(fldPath, true, "cannot be set together with .propagationPolicy")) } @@ -389,3 +420,14 @@ func ValidateIgnoreStoreReadError(fldPath *field.Path, options *metav1.DeleteOpt return allErrs } + +// ValidateCustom_Condition_LastTransitionTime is wired into the generated +// declarative validation by +k8s:customValidation on Condition.LastTransitionTime. +// It enforces that the field is set, mirroring the handwritten check in +// ValidateCondition. +func ValidateCustom_Condition_LastTransitionTime(ctx context.Context, op operation.Operation, fldPath *field.Path, value, oldValue *metav1.Time) field.ErrorList { + if value.IsZero() { + return field.ErrorList{field.Required(fldPath, "")} + } + return nil +} diff --git a/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/zz_generated.validations.go b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/zz_generated.validations.go new file mode 100644 index 00000000..f79373a2 --- /dev/null +++ b/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/zz_generated.validations.go @@ -0,0 +1,638 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by validation-gen. DO NOT EDIT. + +package validation + +import ( + context "context" + + equality "k8s.io/apimachinery/pkg/api/equality" + operation "k8s.io/apimachinery/pkg/api/operation" + safe "k8s.io/apimachinery/pkg/api/safe" + validate "k8s.io/apimachinery/pkg/api/validate" + v1 "k8s.io/apimachinery/pkg/apis/meta/v1" + types "k8s.io/apimachinery/pkg/types" + sets "k8s.io/apimachinery/pkg/util/sets" + field "k8s.io/apimachinery/pkg/util/validation/field" +) + +// Validate_Condition validates an instance of Condition according +// to declarative validation rules in the API schema. +func Validate_Condition( + ctx context.Context, op operation.Operation, fldPath *field.Path, + obj, oldObj *v1.Condition) (errs field.ErrorList) { + + { // field v1.Condition.Type + fn := func( + fldPath *field.Path, + obj, oldObj *string, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *v1.Condition) *string { + return &oldObj.Type + }) + errs = append(errs, fn(fldPath.Child("type"), &obj.Type, oldVal, oldObj != nil)...) + } + + { // field v1.Condition.Status + fn := func( + fldPath *field.Path, + obj, oldObj *v1.ConditionStatus, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + // call the type's validation function + errs = append(errs, Validate_ConditionStatus(ctx, op, fldPath, obj, oldObj)...) + return + } + oldVal := safe.Field(oldObj, + func(oldObj *v1.Condition) *v1.ConditionStatus { + return &oldObj.Status + }) + errs = append(errs, fn(fldPath.Child("status"), &obj.Status, oldVal, oldObj != nil)...) + } + + { // field v1.Condition.ObservedGeneration + fn := func( + fldPath *field.Path, + obj, oldObj *int64, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 0).MarkAlpha(); len(e) != 0 { + errs = append(errs, e...) + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *v1.Condition) *int64 { + return &oldObj.ObservedGeneration + }) + errs = append(errs, fn(fldPath.Child("observedGeneration"), &obj.ObservedGeneration, oldVal, oldObj != nil)...) + } + + { // field v1.Condition.LastTransitionTime + fn := func( + fldPath *field.Path, + obj, oldObj *v1.Time, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if equality.Semantic.DeepEqual(obj, oldObj) { + return nil + } + } + // call field-attached validations + // custom validation + if e := ValidateCustom_Condition_LastTransitionTime(ctx, op, fldPath, obj, oldObj).MarkAlpha(); len(e) != 0 { + errs = append(errs, e...) + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *v1.Condition) *v1.Time { + return &oldObj.LastTransitionTime + }) + errs = append(errs, fn(fldPath.Child("lastTransitionTime"), &obj.LastTransitionTime, oldVal, oldObj != nil)...) + } + + { // field v1.Condition.Reason + fn := func( + fldPath *field.Path, + obj, oldObj *string, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + if e := validate.MaxBytes(ctx, op, fldPath, obj, oldObj, 1024).MarkAlpha(); len(e) != 0 { + errs = append(errs, e...) + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *v1.Condition) *string { + return &oldObj.Reason + }) + errs = append(errs, fn(fldPath.Child("reason"), &obj.Reason, oldVal, oldObj != nil)...) + } + + // field v1.Condition.Message has no validation + return errs +} + +var symbolsForConditionStatus = sets.New(v1.ConditionFalse, v1.ConditionTrue, v1.ConditionUnknown) + +// Validate_ConditionStatus validates an instance of ConditionStatus according +// to declarative validation rules in the API schema. +func Validate_ConditionStatus( + ctx context.Context, op operation.Operation, fldPath *field.Path, + obj, oldObj *v1.ConditionStatus) (errs field.ErrorList) { + + if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForConditionStatus, nil).MarkAlpha(); len(e) != 0 { + errs = append(errs, e...) + } + + return errs +} + +// Validate_ManagedFieldsEntry validates an instance of ManagedFieldsEntry according +// to declarative validation rules in the API schema. +func Validate_ManagedFieldsEntry( + ctx context.Context, op operation.Operation, fldPath *field.Path, + obj, oldObj *v1.ManagedFieldsEntry) (errs field.ErrorList) { + + // field v1.ManagedFieldsEntry.Manager has no validation + + { // field v1.ManagedFieldsEntry.Operation + fn := func( + fldPath *field.Path, + obj, oldObj *v1.ManagedFieldsOperationType, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + // call the type's validation function + errs = append(errs, Validate_ManagedFieldsOperationType(ctx, op, fldPath, obj, oldObj)...) + return + } + oldVal := safe.Field(oldObj, + func(oldObj *v1.ManagedFieldsEntry) *v1.ManagedFieldsOperationType { + return &oldObj.Operation + }) + errs = append(errs, fn(fldPath.Child("operation"), &obj.Operation, oldVal, oldObj != nil)...) + } + + // field v1.ManagedFieldsEntry.APIVersion has no validation + // field v1.ManagedFieldsEntry.Time has no validation + // field v1.ManagedFieldsEntry.FieldsType has no validation + // field v1.ManagedFieldsEntry.FieldsV1 has no validation + // field v1.ManagedFieldsEntry.Subresource has no validation + return errs +} + +var symbolsForManagedFieldsOperationType = sets.New(v1.ManagedFieldsOperationApply, v1.ManagedFieldsOperationUpdate) + +// Validate_ManagedFieldsOperationType validates an instance of ManagedFieldsOperationType according +// to declarative validation rules in the API schema. +func Validate_ManagedFieldsOperationType( + ctx context.Context, op operation.Operation, fldPath *field.Path, + obj, oldObj *v1.ManagedFieldsOperationType) (errs field.ErrorList) { + + if e := validate.Enum(ctx, op, fldPath, obj, oldObj, symbolsForManagedFieldsOperationType, nil).MarkAlpha(); len(e) != 0 { + errs = append(errs, e...) + } + + return errs +} + +// Validate_ObjectMeta validates an instance of ObjectMeta according +// to declarative validation rules in the API schema. +func Validate_ObjectMeta( + ctx context.Context, op operation.Operation, fldPath *field.Path, + obj, oldObj *v1.ObjectMeta) (errs field.ErrorList) { + + // field v1.ObjectMeta.Name has no validation + // field v1.ObjectMeta.GenerateName has no validation + // field v1.ObjectMeta.Namespace has no validation + // field v1.ObjectMeta.SelfLink has no validation + + { // field v1.ObjectMeta.UID + fn := func( + fldPath *field.Path, + obj, oldObj *types.UID, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *v1.ObjectMeta) *types.UID { + return &oldObj.UID + }) + errs = append(errs, fn(fldPath.Child("uid"), &obj.UID, oldVal, oldObj != nil)...) + } + + // field v1.ObjectMeta.ResourceVersion has no validation + + { // field v1.ObjectMeta.Generation + fn := func( + fldPath *field.Path, + obj, oldObj *int64, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.OptionalValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 0).MarkAlpha(); len(e) != 0 { + errs = append(errs, e...) + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *v1.ObjectMeta) *int64 { + return &oldObj.Generation + }) + errs = append(errs, fn(fldPath.Child("generation"), &obj.Generation, oldVal, oldObj != nil)...) + } + + { // field v1.ObjectMeta.CreationTimestamp + fn := func( + fldPath *field.Path, + obj, oldObj *v1.Time, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if equality.Semantic.DeepEqual(obj, oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *v1.ObjectMeta) *v1.Time { + return &oldObj.CreationTimestamp + }) + errs = append(errs, fn(fldPath.Child("creationTimestamp"), &obj.CreationTimestamp, oldVal, oldObj != nil)...) + } + + { // field v1.ObjectMeta.DeletionTimestamp + fn := func( + fldPath *field.Path, + obj, oldObj *v1.Time, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if equality.Semantic.DeepEqual(obj, oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *v1.ObjectMeta) *v1.Time { + return oldObj.DeletionTimestamp + }) + errs = append(errs, fn(fldPath.Child("deletionTimestamp"), obj.DeletionTimestamp, oldVal, oldObj != nil)...) + } + + { // field v1.ObjectMeta.DeletionGracePeriodSeconds + fn := func( + fldPath *field.Path, + obj, oldObj *int64, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if e := validate.Immutable(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *v1.ObjectMeta) *int64 { + return oldObj.DeletionGracePeriodSeconds + }) + errs = append(errs, fn(fldPath.Child("deletionGracePeriodSeconds"), obj.DeletionGracePeriodSeconds, oldVal, oldObj != nil)...) + } + + // field v1.ObjectMeta.Labels has no validation + // field v1.ObjectMeta.Annotations has no validation + + { // field v1.ObjectMeta.OwnerReferences + fn := func( + fldPath *field.Path, + obj, oldObj []v1.OwnerReference, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if equality.Semantic.DeepEqual(obj, oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + // iterate the list and call the type's validation function + if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_OwnerReference); len(e) != 0 { + errs = append(errs, e...) + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *v1.ObjectMeta) []v1.OwnerReference { + return oldObj.OwnerReferences + }) + errs = append(errs, fn(fldPath.Child("ownerReferences"), obj.OwnerReferences, oldVal, oldObj != nil)...) + } + + // field v1.ObjectMeta.Finalizers has no validation + + { // field v1.ObjectMeta.ManagedFields + fn := func( + fldPath *field.Path, + obj, oldObj []v1.ManagedFieldsEntry, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if equality.Semantic.DeepEqual(obj, oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + // iterate the list and call the type's validation function + if e := validate.EachValSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_ManagedFieldsEntry); len(e) != 0 { + errs = append(errs, e...) + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *v1.ObjectMeta) []v1.ManagedFieldsEntry { + return oldObj.ManagedFields + }) + errs = append(errs, fn(fldPath.Child("managedFields"), obj.ManagedFields, oldVal, oldObj != nil)...) + } + + return errs +} + +// Validate_OwnerReference validates an instance of OwnerReference according +// to declarative validation rules in the API schema. +func Validate_OwnerReference( + ctx context.Context, op operation.Operation, fldPath *field.Path, + obj, oldObj *v1.OwnerReference) (errs field.ErrorList) { + + { // field v1.OwnerReference.APIVersion + fn := func( + fldPath *field.Path, + obj, oldObj *string, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *v1.OwnerReference) *string { + return &oldObj.APIVersion + }) + errs = append(errs, fn(fldPath.Child("apiVersion"), &obj.APIVersion, oldVal, oldObj != nil)...) + } + + { // field v1.OwnerReference.Kind + fn := func( + fldPath *field.Path, + obj, oldObj *string, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *v1.OwnerReference) *string { + return &oldObj.Kind + }) + errs = append(errs, fn(fldPath.Child("kind"), &obj.Kind, oldVal, oldObj != nil)...) + } + + { // field v1.OwnerReference.Name + fn := func( + fldPath *field.Path, + obj, oldObj *string, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *v1.OwnerReference) *string { + return &oldObj.Name + }) + errs = append(errs, fn(fldPath.Child("name"), &obj.Name, oldVal, oldObj != nil)...) + } + + { // field v1.OwnerReference.UID + fn := func( + fldPath *field.Path, + obj, oldObj *types.UID, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkAlpha().MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *v1.OwnerReference) *types.UID { + return &oldObj.UID + }) + errs = append(errs, fn(fldPath.Child("uid"), &obj.UID, oldVal, oldObj != nil)...) + } + + // field v1.OwnerReference.Controller has no validation + // field v1.OwnerReference.BlockOwnerDeletion has no validation + return errs +} diff --git a/vendor/k8s.io/apimachinery/pkg/conversion/queryparams/convert.go b/vendor/k8s.io/apimachinery/pkg/conversion/queryparams/convert.go index b0a9246d..5eb25e2e 100644 --- a/vendor/k8s.io/apimachinery/pkg/conversion/queryparams/convert.go +++ b/vendor/k8s.io/apimachinery/pkg/conversion/queryparams/convert.go @@ -34,8 +34,8 @@ type Unmarshaler interface { } func jsonTag(field reflect.StructField) (string, bool) { - structTag := field.Tag.Get("json") - if len(structTag) == 0 { + structTag, exists := field.Tag.Lookup("json") + if !exists || len(structTag) == 0 { return "", false } parts := strings.Split(structTag, ",") diff --git a/vendor/k8s.io/apimachinery/pkg/labels/selector.go b/vendor/k8s.io/apimachinery/pkg/labels/selector.go index 031dcd21..f31a890f 100644 --- a/vendor/k8s.io/apimachinery/pkg/labels/selector.go +++ b/vendor/k8s.io/apimachinery/pkg/labels/selector.go @@ -269,13 +269,15 @@ func (r *Requirement) Matches(ls Labels) bool { } lsValue, err := strconv.ParseInt(val, 10, 64) if err != nil { - klog.V(10).Infof("ParseInt failed for value %+v in label %+v, %+v", val, ls, err) + //nolint:logcheck // Extending the API is not worth it for contextual, structured logging of this. + klog.V(10).InfoS("ParseInt failed", "value", val, "label", ls, "err", err) return false } // There should be only one strValue in r.strValues, and can be converted to an integer. if len(r.strValues) != 1 { - klog.V(10).Infof("Invalid values count %+v of requirement %#v, for 'Gt', 'Lt' operators, exactly one value is required", len(r.strValues), r) + //nolint:logcheck // Extending the API is not worth it for contextual, structured logging of this. + klog.V(10).InfoS("Invalid values count: for 'Gt', 'Lt' operators, exactly one value is required", "count", len(r.strValues), "requirement", r) return false } @@ -283,7 +285,8 @@ func (r *Requirement) Matches(ls Labels) bool { for i := range r.strValues { rValue, err = strconv.ParseInt(r.strValues[i], 10, 64) if err != nil { - klog.V(10).Infof("ParseInt failed for value %+v in requirement %#v, for 'Gt', 'Lt' operators, the value must be an integer", r.strValues[i], r) + //nolint:logcheck // Extending the API is not worth it for contextual, structured logging of this. + klog.V(10).InfoS("ParseInt failed: for 'Gt', 'Lt' operators, the value must be an integer", "value", r.strValues[i], "requirement", r, "err", err) return false } } diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/codec.go b/vendor/k8s.io/apimachinery/pkg/runtime/codec.go index 73f85286..654835b3 100644 --- a/vendor/k8s.io/apimachinery/pkg/runtime/codec.go +++ b/vendor/k8s.io/apimachinery/pkg/runtime/codec.go @@ -226,6 +226,7 @@ func identifier(e Encoder) Identifier { } identifier, err := json.Marshal(result) if err != nil { + //nolint:logcheck // Should not be reached. klog.Fatalf("Failed marshaling identifier for base64Serializer: %v", err) } return Identifier(identifier) @@ -390,6 +391,7 @@ func (v multiGroupVersioner) Identifier() string { } identifier, err := json.Marshal(result) if err != nil { + //nolint:logcheck // Should not be reached. klog.Fatalf("Failed marshaling Identifier for %#v: %v", v, err) } return string(identifier) diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/conversion.go b/vendor/k8s.io/apimachinery/pkg/runtime/conversion.go index d04d701f..7cef382d 100644 --- a/vendor/k8s.io/apimachinery/pkg/runtime/conversion.go +++ b/vendor/k8s.io/apimachinery/pkg/runtime/conversion.go @@ -20,7 +20,6 @@ package runtime import ( "fmt" - "reflect" "strconv" "strings" @@ -41,18 +40,6 @@ func DefaultMetaV1FieldSelectorConversion(label, value string) (string, string, } } -// JSONKeyMapper uses the struct tags on a conversion to determine the key value for -// the other side. Use when mapping from a map[string]* to a struct or vice versa. -func JSONKeyMapper(key string, sourceTag, destTag reflect.StructTag) (string, string) { - if s := destTag.Get("json"); len(s) > 0 { - return strings.SplitN(s, ",", 2)[0], key - } - if s := sourceTag.Get("json"); len(s) > 0 { - return key, strings.SplitN(s, ",", 2)[0] - } - return key, key -} - func Convert_Slice_string_To_string(in *[]string, out *string, s conversion.Scope) error { if len(*in) == 0 { *out = "" diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/converter.go b/vendor/k8s.io/apimachinery/pkg/runtime/converter.go index b1a30095..5aa118f5 100644 --- a/vendor/k8s.io/apimachinery/pkg/runtime/converter.go +++ b/vendor/k8s.io/apimachinery/pkg/runtime/converter.go @@ -251,9 +251,11 @@ func (c *unstructuredConverter) FromUnstructuredWithValidation(u map[string]inte newObj := reflect.New(t.Elem()).Interface() newErr := fromUnstructuredViaJSON(u, newObj) if (err != nil) != (newErr != nil) { + //nolint:logcheck // Should not be reached. klog.Fatalf("FromUnstructured unexpected error for %v: error: %v", u, err) } if err == nil && !c.comparison.DeepEqual(obj, newObj) { + //nolint:logcheck // Should not be reached. klog.Fatalf("FromUnstructured mismatch\nobj1: %#v\nobj2: %#v", obj, newObj) } } @@ -376,8 +378,8 @@ func fieldInfoFromField(structType reflect.Type, field int) *fieldInfo { // Cache miss - we need to compute the field name. info := &fieldInfo{} typeField := structType.Field(field) - jsonTag := typeField.Tag.Get("json") - if len(jsonTag) == 0 { + jsonTag, exists := typeField.Tag.Lookup("json") + if !exists || len(jsonTag) == 0 { if !typeField.Anonymous { // match stdlib behavior for naming fields that don't specify a json tag name info.name = typeField.Name @@ -385,7 +387,10 @@ func fieldInfoFromField(structType reflect.Type, field int) *fieldInfo { } else { items := strings.Split(jsonTag, ",") info.name = items[0] - if len(info.name) == 0 && !typeField.Anonymous { + if isInlinedFromTag(typeField, items[0], items[1:]) { + // match stdlib behavior when controlled by tag + info.name = "" + } else if len(info.name) == 0 && !typeField.Anonymous { // match stdlib behavior for naming fields that don't specify a json tag name info.name = typeField.Name } @@ -596,9 +601,11 @@ func (c *unstructuredConverter) ToUnstructured(obj interface{}) (map[string]inte newUnstr := map[string]interface{}{} newErr := toUnstructuredViaJSON(obj, &newUnstr) if (err != nil) != (newErr != nil) { + //nolint:logcheck // Should not be reached. klog.Fatalf("ToUnstructured unexpected error for %v: error: %v; newErr: %v", obj, err, newErr) } if err == nil && !c.comparison.DeepEqual(u, newUnstr) { + //nolint:logcheck // Should not be reached. klog.Fatalf("ToUnstructured mismatch\nobj1: %#v\nobj2: %#v", u, newUnstr) } } @@ -680,11 +687,11 @@ func toUnstructured(sv, dv reflect.Value) error { dv.Set(reflect.ValueOf(sv.Int())) return nil case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64: - uVal := sv.Uint() - if uVal > math.MaxInt64 { - return fmt.Errorf("unsigned value %d does not fit into int64 (overflow)", uVal) + val, err := uintToUnstructuredHelper(sv.Uint()) + if err != nil { + return err } - dv.Set(reflect.ValueOf(int64(uVal))) + dv.Set(reflect.ValueOf(val)) return nil case reflect.Float32, reflect.Float64: dv.Set(reflect.ValueOf(sv.Float())) @@ -846,7 +853,11 @@ func structToUnstructured(sv, dv reflect.Value) error { case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64: realMap[fieldInfo.name] = fv.Int() case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64: - realMap[fieldInfo.name] = fv.Uint() + val, err := uintToUnstructuredHelper(fv.Uint()) + if err != nil { + return err + } + realMap[fieldInfo.name] = val case reflect.Float32, reflect.Float64: realMap[fieldInfo.name] = fv.Float() default: @@ -867,3 +878,10 @@ func interfaceToUnstructured(sv, dv reflect.Value) error { } return toUnstructured(sv.Elem(), dv) } + +func uintToUnstructuredHelper(uVal uint64) (int64, error) { + if uVal > math.MaxInt64 { + return 0, fmt.Errorf("unsigned value %d does not fit into int64 (overflow)", uVal) + } + return int64(uVal), nil +} diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/fieldinfo_126.go b/vendor/k8s.io/apimachinery/pkg/runtime/fieldinfo_126.go new file mode 100644 index 00000000..686ff6ab --- /dev/null +++ b/vendor/k8s.io/apimachinery/pkg/runtime/fieldinfo_126.go @@ -0,0 +1,26 @@ +//go:build !go1.27 + +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package runtime + +import "reflect" + +func isInlinedFromTag(fieldType reflect.StructField, tagName string, tagDirectives []string) bool { + // go <1.27 doesn't honor ",inline" + return false +} diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/fieldinfo_127.go b/vendor/k8s.io/apimachinery/pkg/runtime/fieldinfo_127.go new file mode 100644 index 00000000..abaa79a2 --- /dev/null +++ b/vendor/k8s.io/apimachinery/pkg/runtime/fieldinfo_127.go @@ -0,0 +1,33 @@ +//go:build go1.27 + +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package runtime + +import ( + "reflect" +) + +func isInlinedFromTag(field reflect.StructField, tagName string, tagDirectives []string) bool { + fieldType := field.Type + if fieldType.Kind() == reflect.Pointer && fieldType.Name() == "" { + // optionally unwrap a single level + fieldType = fieldType.Elem() + } + // TODO: when switching to direct use of json/v2, error on non-struct embedding and use of embed with other directives + return fieldType.Kind() == reflect.Struct && tagName == "" && len(tagDirectives) == 1 && tagDirectives[0] == "embed" +} diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/generated.proto b/vendor/k8s.io/apimachinery/pkg/runtime/generated.proto index 5f06cc57..93d187d9 100644 --- a/vendor/k8s.io/apimachinery/pkg/runtime/generated.proto +++ b/vendor/k8s.io/apimachinery/pkg/runtime/generated.proto @@ -33,7 +33,7 @@ option go_package = "k8s.io/apimachinery/pkg/runtime"; // // Internal package: // // type MyAPIObject struct { -// runtime.TypeMeta `json:",inline"` +// runtime.TypeMeta `json:""` // MyPlugin runtime.Object `json:"myPlugin"` // } // @@ -44,7 +44,7 @@ option go_package = "k8s.io/apimachinery/pkg/runtime"; // // External package: // // type MyAPIObject struct { -// runtime.TypeMeta `json:",inline"` +// runtime.TypeMeta `json:""` // MyPlugin runtime.RawExtension `json:"myPlugin"` // } // @@ -85,7 +85,7 @@ message RawExtension { // like this: // // type MyAwesomeAPIObject struct { -// runtime.TypeMeta `json:",inline"` +// runtime.TypeMeta `json:""` // ... // other fields // } // diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/helper.go b/vendor/k8s.io/apimachinery/pkg/runtime/helper.go index 395dfdbd..242a3498 100644 --- a/vendor/k8s.io/apimachinery/pkg/runtime/helper.go +++ b/vendor/k8s.io/apimachinery/pkg/runtime/helper.go @@ -285,20 +285,26 @@ func (e *encoderWithAllocator) Identifier() Identifier { return e.encoder.Identifier() } +// The legacy discovery endpoint requires that its response Encoder implement Serializer. +// https://github.com/kubernetes/kubernetes/blob/4a1340bfd58fdb3846d4342c101e0bcb574fbfb1/staging/src/k8s.io/apiserver/pkg/endpoints/discovery/util.go#L101-L107 +var _ Serializer = nondeterministicEncoderToEncoderAdapter{} + type nondeterministicEncoderToEncoderAdapter struct { NondeterministicEncoder + + Decoder } func (e nondeterministicEncoderToEncoderAdapter) Encode(obj Object, w io.Writer) error { return e.EncodeNondeterministic(obj, w) } -// UseNondeterministicEncoding returns an Encoder that encodes objects using the provided Encoder's -// EncodeNondeterministic method if it implements NondeterministicEncoder, otherwise it returns the -// provided Encoder as-is. -func UseNondeterministicEncoding(encoder Encoder) Encoder { - if nondeterministic, ok := encoder.(NondeterministicEncoder); ok { - return nondeterministicEncoderToEncoderAdapter{nondeterministic} +// UseNondeterministicEncoding returns an Encoder that encodes objects using the provided +// Serializer's EncodeNondeterministic method if it implements NondeterministicEncoder, otherwise it +// returns the provided Serializer as-is. +func UseNondeterministicEncoding(serializer Serializer) Encoder { + if nondeterministic, ok := serializer.(NondeterministicEncoder); ok { + return nondeterministicEncoderToEncoderAdapter{NondeterministicEncoder: nondeterministic, Decoder: serializer} } - return encoder + return serializer } diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/scheme.go b/vendor/k8s.io/apimachinery/pkg/runtime/scheme.go index e2fbeabd..80662e55 100644 --- a/vendor/k8s.io/apimachinery/pkg/runtime/scheme.go +++ b/vendor/k8s.io/apimachinery/pkg/runtime/scheme.go @@ -370,7 +370,7 @@ func (s *Scheme) AddValidationFunc(srcType Object, fn func(ctx context.Context, // Validate validates the provided Object according to the generated declarative validation code. // WARNING: This does not validate all objects! The handwritten validation code in validation.go // is not run when this is called. Only the generated zz_generated.validations.go validation code is run. -func (s *Scheme) Validate(ctx context.Context, options []string, object Object, subresources ...string) field.ErrorList { +func (s *Scheme) Validate(ctx context.Context, options map[string]bool, object Object, subresources ...string) field.ErrorList { if fn, ok := s.validationFuncs[reflect.TypeOf(object)]; ok { return fn(ctx, operation.Operation{Type: operation.Create, Request: operation.Request{Subresources: subresources}, Options: options}, object, nil) } @@ -380,13 +380,21 @@ func (s *Scheme) Validate(ctx context.Context, options []string, object Object, // ValidateUpdate validates the provided object and oldObject according to the generated declarative validation code. // WARNING: This does not validate all objects! The handwritten validation code in validation.go // is not run when this is called. Only the generated zz_generated.validations.go validation code is run. -func (s *Scheme) ValidateUpdate(ctx context.Context, options []string, object, oldObject Object, subresources ...string) field.ErrorList { +func (s *Scheme) ValidateUpdate(ctx context.Context, options map[string]bool, object, oldObject Object, subresources ...string) field.ErrorList { if fn, ok := s.validationFuncs[reflect.TypeOf(object)]; ok { return fn(ctx, operation.Operation{Type: operation.Update, Request: operation.Request{Subresources: subresources}, Options: options}, object, oldObject) } return nil } +// HasValidationFunc reports whether a validation function is registered for the +// object's type. Unlike Validate, it distinguishes "no function registered" from +// "function ran and found no errors", which both yield a nil error list. +func (s *Scheme) HasValidationFunc(obj Object) bool { + _, ok := s.validationFuncs[reflect.TypeOf(obj)] + return ok +} + // Convert will attempt to convert in into out. Both must be pointers. For easy // testing of conversion functions. Returns an error if the conversion isn't // possible. You can call this with types that haven't been registered (for example, diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor.go b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor.go index 118579ec..e5730e3c 100644 --- a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor.go +++ b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/cbor.go @@ -68,8 +68,9 @@ type Serializer interface { var _ Serializer = &serializer{} type options struct { - strict bool - transcode bool + strict bool + transcode bool + streamingCollectionsEncoding bool } type Option func(*options) @@ -92,6 +93,13 @@ func Transcode(s bool) Option { } } +// StreamingCollectionsEncoding is used for testing purposes only. +func StreamingCollectionsEncoding(s bool) Option { + return func(opts *options) { + opts.streamingCollectionsEncoding = s + } +} + type serializer struct { metaFactory metaFactory creater runtime.ObjectCreater @@ -114,6 +122,7 @@ func newSerializer(metaFactory metaFactory, creater runtime.ObjectCreater, typer typer: typer, } s.options.transcode = true + s.options.streamingCollectionsEncoding = true for _, o := range options { o(&s.options) } @@ -147,15 +156,25 @@ func (s *serializer) EncodeNondeterministic(obj runtime.Object, w io.Writer) err } func (s *serializer) encode(mode modes.EncMode, obj runtime.Object, w io.Writer) error { + if _, err := w.Write(selfDescribedCBOR); err != nil { + return err + } + + if s.options.streamingCollectionsEncoding { + ok, err := streamEncodeCollections(obj, w, mode) + if err != nil { + return err + } + if ok { + return nil + } + } + var v interface{} = obj if u, ok := obj.(runtime.Unstructured); ok { v = u.UnstructuredContent() } - if _, err := w.Write(selfDescribedCBOR); err != nil { - return err - } - return mode.MarshalTo(v, w) } diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections.go b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections.go new file mode 100644 index 00000000..5aa0fb7c --- /dev/null +++ b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/collections.go @@ -0,0 +1,328 @@ +/* +Copyright The Kubernetes Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package cbor + +import ( + "encoding/json" + "fmt" + "io" + "maps" + "math/rand" + "reflect" + "slices" + "sort" + + "k8s.io/apimachinery/pkg/conversion" + + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes" + + "github.com/fxamacker/cbor/v2" +) + +func streamEncodeCollections(obj runtime.Object, w io.Writer, mode modes.EncMode) (bool, error) { + list, ok := obj.(*unstructured.UnstructuredList) + if ok { + return true, streamingEncodeUnstructuredList(w, list, mode) + } + if _, ok := obj.(cbor.Marshaler); ok { + return false, nil + } + if _, ok := obj.(json.Marshaler); ok { + return false, nil + } + typeMeta, listMeta, items, err := getListMeta(obj) + if err == nil { + return true, streamingEncodeList(w, typeMeta, listMeta, items, mode) + } + return false, nil +} + +// getListMeta implements list extraction logic for cbor stream serialization. +func getListMeta(list runtime.Object) (metav1.TypeMeta, metav1.ListMeta, []interface{}, error) { + listValue, err := conversion.EnforcePtr(list) + if err != nil { + return metav1.TypeMeta{}, metav1.ListMeta{}, nil, err + } + listType := listValue.Type() + if listType.NumField() != 3 { + return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected ListType to have 3 fields") + } + // The streaming encoder reproduces the field names and layout implied by the + // json struct tags (kind, apiVersion, metadata, items). The CBOR encoder, + // however, gives a "cbor" struct tag precedence over "json", so a cbor tag on + // any of these fields could rename a key, change its options (e.g. keyasint), + // or un-inline the embedded TypeMeta -- diverging from the streamed output. + // Refuse to stream such a type and fall back to the general encoder, which + // honors the cbor tag correctly. + for i := 0; i < listType.NumField(); i++ { + if _, ok := listType.Field(i).Tag.Lookup("cbor"); ok { + return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected list field %d to have no cbor tag", i) + } + } + // TypeMeta + typeMeta, ok := listValue.Field(0).Interface().(metav1.TypeMeta) + if !ok { + return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected TypeMeta field to have TypeMeta type") + } + if !listType.Field(0).Anonymous { + return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be embedded`) + } + if jsonTag, jsonTagExists := listType.Field(0).Tag.Lookup("json"); !jsonTagExists { + return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag`) + } else if jsonTag != "" && jsonTag != ",inline" { + return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be "" or ",inline"`) + } + // ListMeta + listMeta, ok := listValue.Field(1).Interface().(metav1.ListMeta) + if !ok { + return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected ListMeta field to have ListMeta type") + } + if listType.Field(1).Tag.Get("json") != "metadata,omitempty" { + return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected ListMeta json field tag to be "metadata,omitempty"`) + } + // Items + if listType.Field(2).Tag.Get("json") != "items" { + return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected Items json field tag to be "items"`) + } + items, err := getListItems(listValue.Field(2)) + if err != nil { + return metav1.TypeMeta{}, metav1.ListMeta{}, nil, err + } + return typeMeta, listMeta, items, nil +} + +// getListItems returns the elements of a list's Items field as addressable +// values. Marshaling each element directly (rather than routing through +// meta.ExtractList) preserves the element's own type and custom marshaler, so +// that e.g. a metav1.List whose Items are runtime.RawExtension holding CBOR +// bytes are encoded verbatim by runtime.RawExtension.MarshalCBOR instead of +// being flattened into a runtime.Unknown (which has no MarshalCBOR and would be +// misencoded as a struct or fail JSON transcoding). +// +// A nil Items slice returns a nil result, distinct from an empty non-nil slice, +// so the encoder can emit CBOR null rather than an empty array. +func getListItems(itemsValue reflect.Value) ([]interface{}, error) { + if itemsValue.Kind() != reflect.Slice { + return nil, fmt.Errorf("expected Items field to be a slice, got %s", itemsValue.Kind()) + } + if itemsValue.IsNil() { + return nil, nil + } + items := make([]interface{}, itemsValue.Len()) + for i := range items { + items[i] = itemsValue.Index(i).Addr().Interface() + } + return items, nil +} + +type cborMapEntry struct { + key string + write func() error +} + +func streamingEncodeList(w io.Writer, typeMeta metav1.TypeMeta, listMeta metav1.ListMeta, items []interface{}, mode modes.EncMode) error { + var entries []cborMapEntry + + if typeMeta.Kind != "" { + entries = append(entries, cborMapEntry{ + key: "kind", + write: func() error { + return encodeKeyValuePair(w, "kind", typeMeta.Kind, mode) + }, + }) + } + entries = append(entries, cborMapEntry{ + key: "items", + write: func() error { + if err := mode.MarshalTo("items", w); err != nil { + return err + } + if items == nil { + _, err := w.Write([]byte{0xf6}) // CBOR null + return err + } + if err := writeArrayHead(w, len(items)); err != nil { + return err + } + for _, item := range items { + if err := mode.MarshalTo(item, w); err != nil { + return err + } + } + return nil + }, + }) + entries = append(entries, cborMapEntry{ + key: "metadata", + write: func() error { + return encodeKeyValuePair(w, "metadata", listMeta, mode) + }, + }) + if typeMeta.APIVersion != "" { + entries = append(entries, cborMapEntry{ + key: "apiVersion", + write: func() error { + return encodeKeyValuePair(w, "apiVersion", typeMeta.APIVersion, mode) + }, + }) + } + + // entries is built in a fixed order (kind, items, metadata, apiVersion). + // Unlike streamingEncodeUnstructuredList, whose keys come in Go's randomized + // map-iteration order, there is no inherent randomness here, so for + // nondeterministic modes (SortFastShuffle) we rotate the encoding for-loop + // by a random initial offset. + start := 0 + if !mode.IsDeterministic() && len(entries) > 0 { + start = rand.Intn(len(entries)) + } + + if err := writeMapHead(w, len(entries)); err != nil { + return err + } + + for i := 0; i < len(entries); i++ { + entry := entries[(start+i)%len(entries)] + if err := entry.write(); err != nil { + return err + } + } + return nil +} + +func streamingEncodeUnstructuredList(w io.Writer, list *unstructured.UnstructuredList, mode modes.EncMode) error { + keys := slices.Collect(maps.Keys(list.Object)) + if _, exists := list.Object["items"]; !exists { + keys = append(keys, "items") + } + // keys starts in Go's randomized map-iteration order. For deterministic + // modes (SortBytewiseLexical) we sort it: shorter lengths come first, then + // lexicographic by content. For nondeterministic modes (SortFastShuffle) we + // leave the map-iteration order as-is, which already varies from call to + // call (analogous to what SortFastShuffle does for structs), so no explicit + // shuffling is needed. + if mode.IsDeterministic() { + sort.Slice(keys, func(i, j int) bool { + if len(keys[i]) != len(keys[j]) { + return len(keys[i]) < len(keys[j]) + } + return keys[i] < keys[j] + }) + } + + if err := writeMapHead(w, len(keys)); err != nil { + return err + } + + for _, key := range keys { + if err := mode.MarshalTo(key, w); err != nil { + return err + } + if key == "items" { + if err := writeArrayHead(w, len(list.Items)); err != nil { + return err + } + for _, item := range list.Items { + if err := mode.MarshalTo(item.Object, w); err != nil { + return err + } + } + } else { + if err := mode.MarshalTo(list.Object[key], w); err != nil { + return err + } + } + } + return nil +} + +func encodeKeyValuePair(w io.Writer, key string, value interface{}, mode modes.EncMode) error { + if err := mode.MarshalTo(key, w); err != nil { + return err + } + if err := mode.MarshalTo(value, w); err != nil { + return err + } + return nil +} + +// CBOR major type prefix bytes (the type in the high 3 bits, additional info +// zeroed), following RFC 8949 Section 3.1. +const ( + cborTypeArray byte = 0x80 // major type 4 + cborTypeMap byte = 0xa0 // major type 5 +) + +// writeMapHead writes a CBOR map header for a map with n entries. +func writeMapHead(w io.Writer, n int) error { + return writeCollectionHead(w, cborTypeMap, int64(n)) +} + +// writeArrayHead writes a CBOR array header for an array with n elements. +func writeArrayHead(w io.Writer, n int) error { + return writeCollectionHead(w, cborTypeArray, int64(n)) +} + +// writeCollectionHead writes a CBOR collection (array or map) header encoding +// the number of elements n, following RFC 8949 Section 3 additional info rules: +// +// - base: the prefix byte for the collection type. +// For maps: cborTypeMap (0xa0), for arrays: cborTypeArray (0x80). +// +// The extended form prefixes are derived from base using bitwise OR: +// - base|24: 1-byte length follows (additional info 24) +// - base|25: 2-byte length follows (additional info 25) +// - base|26: 4-byte length follows (additional info 26) +// - base|27: 8-byte length follows (additional info 27) +// +// Encoding table (map example, base=0xa0): +// +// n <= 23: 1 byte — 0xa0|n +// n <= 0xFF: 2 bytes — 0xb8 (0xa0|24), n +// n <= 0xFFFF: 3 bytes — 0xb9 (0xa0|25), n>>8, n +// n <= 0xFFFFFFFF: 5 bytes — 0xba (0xa0|26), n>>24..n +// n > 0xFFFFFFFF: 9 bytes — 0xbb (0xa0|27), n>>56..n +func writeCollectionHead(w io.Writer, base byte, n int64) error { + switch { + case n <= 23: + // Additional info 0–23: length is encoded directly in the low 5 bits. + _, err := w.Write([]byte{base + byte(n)}) + return err + case n <= 0xFF: + // Additional info 24: one additional byte carries the length. + _, err := w.Write([]byte{base | 24, byte(n)}) + return err + case n <= 0xFFFF: + // Additional info 25: two additional bytes carry the length (big-endian). + _, err := w.Write([]byte{base | 25, byte(n >> 8), byte(n)}) + return err + case n <= 0xFFFFFFFF: + // Additional info 26: four additional bytes carry the length (big-endian). + _, err := w.Write([]byte{base | 26, byte(n >> 24), byte(n >> 16), byte(n >> 8), byte(n)}) + return err + default: + // Additional info 27: eight additional bytes carry the length (big-endian). + _, err := w.Write([]byte{ + base | 27, byte(n >> 56), byte(n >> 48), byte(n >> 40), byte(n >> 32), byte(n >> 24), byte(n >> 16), + byte(n >> 8), byte(n), + }) + return err + } +} diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode.go b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode.go index 815dbe66..3287dfd3 100644 --- a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode.go +++ b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/cbor/internal/modes/encode.go @@ -107,6 +107,7 @@ var encode = EncMode{ } return encode }(), + deterministic: true, } var Encode = EncMode{ @@ -122,6 +123,7 @@ var Encode = EncMode{ } return em }(), + deterministic: true, } var EncodeNondeterministic = EncMode{ @@ -134,16 +136,22 @@ var EncodeNondeterministic = EncMode{ } return em }(), + deterministic: false, } type EncMode struct { - delegate cbor.UserBufferEncMode + delegate cbor.UserBufferEncMode + deterministic bool } func (em EncMode) options() cbor.EncOptions { return em.delegate.EncOptions() } +func (em EncMode) IsDeterministic() bool { + return em.deterministic +} + func (em EncMode) MarshalTo(v interface{}, w io.Writer) error { if buf, ok := w.(*buffer); ok { return em.delegate.MarshalToBuffer(v, &buf.Buffer) diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/collections.go b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/collections.go index 075163dd..3fa6012d 100644 --- a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/collections.go +++ b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/collections.go @@ -17,11 +17,10 @@ limitations under the License. package json import ( + "bytes" "encoding/json" "fmt" "io" - "maps" - "slices" "sort" "k8s.io/apimachinery/pkg/api/meta" @@ -35,14 +34,14 @@ import ( func streamEncodeCollections(obj runtime.Object, w io.Writer) (bool, error) { list, ok := obj.(*unstructured.UnstructuredList) if ok { - return true, streamingEncodeUnstructuredList(w, list) + return true, newStreamEncoder(w).encodeUnstructuredList(list) } if _, ok := obj.(json.Marshaler); ok { return false, nil } typeMeta, listMeta, items, err := getListMeta(obj) if err == nil { - return true, streamingEncodeList(w, typeMeta, listMeta, items) + return true, newStreamEncoder(w).encodeList(typeMeta, listMeta, items) } return false, nil } @@ -67,8 +66,13 @@ func getListMeta(list runtime.Object) (metav1.TypeMeta, metav1.ListMeta, []runti if !ok { return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf("expected TypeMeta field to have TypeMeta type") } - if listType.Field(0).Tag.Get("json") != ",inline" { - return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be ",inline"`) + if !listType.Field(0).Anonymous { + return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be embedded`) + } + if jsonTag, jsonTagExists := listType.Field(0).Tag.Lookup("json"); !jsonTagExists { + return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag`) + } else if jsonTag != "" && jsonTag != ",inline" { + return metav1.TypeMeta{}, metav1.ListMeta{}, nil, fmt.Errorf(`expected TypeMeta json field tag to be "" or ",inline"`) } // ListMeta listMeta, ok := listValue.Field(1).Interface().(metav1.ListMeta) @@ -89,45 +93,59 @@ func getListMeta(list runtime.Object) (metav1.TypeMeta, metav1.ListMeta, []runti return typeMeta, listMeta, items, nil } -func streamingEncodeList(w io.Writer, typeMeta metav1.TypeMeta, listMeta metav1.ListMeta, items []runtime.Object) error { +// streamEncoder encodes JSON values to w, reusing an internal buffer across +// values to avoid the fresh output allocation json.Marshal makes per call. +type streamEncoder struct { + w io.Writer + buf bytes.Buffer + json *json.Encoder +} + +func newStreamEncoder(w io.Writer) *streamEncoder { + e := &streamEncoder{w: w} + e.json = json.NewEncoder(&e.buf) + return e +} + +func (e *streamEncoder) encodeList(typeMeta metav1.TypeMeta, listMeta metav1.ListMeta, items []runtime.Object) error { // Start - if _, err := w.Write([]byte(`{`)); err != nil { + if _, err := e.w.Write([]byte(`{`)); err != nil { return err } // TypeMeta if typeMeta.Kind != "" { - if err := encodeKeyValuePair(w, "kind", typeMeta.Kind, []byte(",")); err != nil { + if err := e.encodeKeyValuePair("kind", typeMeta.Kind, []byte(",")); err != nil { return err } } if typeMeta.APIVersion != "" { - if err := encodeKeyValuePair(w, "apiVersion", typeMeta.APIVersion, []byte(",")); err != nil { + if err := e.encodeKeyValuePair("apiVersion", typeMeta.APIVersion, []byte(",")); err != nil { return err } } // ListMeta - if err := encodeKeyValuePair(w, "metadata", listMeta, []byte(",")); err != nil { + if err := e.encodeKeyValuePair("metadata", listMeta, []byte(",")); err != nil { return err } // Items - if err := encodeItemsObjectSlice(w, items); err != nil { + if err := e.encodeItemsObjectSlice(items); err != nil { return err } // End - _, err := w.Write([]byte("}\n")) + _, err := e.w.Write([]byte("}\n")) return err } -func encodeItemsObjectSlice(w io.Writer, items []runtime.Object) (err error) { +func (e *streamEncoder) encodeItemsObjectSlice(items []runtime.Object) (err error) { if items == nil { - err := encodeKeyValuePair(w, "items", nil, nil) + err := e.encodeKeyValuePair("items", nil, nil) return err } - _, err = w.Write([]byte(`"items":[`)) + _, err = e.w.Write([]byte(`"items":[`)) if err != nil { return err } @@ -136,24 +154,27 @@ func encodeItemsObjectSlice(w io.Writer, items []runtime.Object) (err error) { if i == len(items)-1 { suffix = nil } - err := encodeValue(w, item, suffix) + err := e.encodeValue(item, suffix) if err != nil { return err } } - _, err = w.Write([]byte("]")) + _, err = e.w.Write([]byte("]")) if err != nil { return err } return err } -func streamingEncodeUnstructuredList(w io.Writer, list *unstructured.UnstructuredList) error { - _, err := w.Write([]byte(`{`)) +func (e *streamEncoder) encodeUnstructuredList(list *unstructured.UnstructuredList) error { + _, err := e.w.Write([]byte(`{`)) if err != nil { return err } - keys := slices.Collect(maps.Keys(list.Object)) + keys := make([]string, 0, len(list.Object)+1) + for key := range list.Object { + keys = append(keys, key) + } if _, exists := list.Object["items"]; !exists { keys = append(keys, "items") } @@ -165,20 +186,20 @@ func streamingEncodeUnstructuredList(w io.Writer, list *unstructured.Unstructure suffix = nil } if key == "items" { - err = encodeItemsUnstructuredSlice(w, list.Items, suffix) + err = e.encodeItemsUnstructuredSlice(list.Items, suffix) } else { - err = encodeKeyValuePair(w, key, list.Object[key], suffix) + err = e.encodeKeyValuePair(key, list.Object[key], suffix) } if err != nil { return err } } - _, err = w.Write([]byte("}\n")) + _, err = e.w.Write([]byte("}\n")) return err } -func encodeItemsUnstructuredSlice(w io.Writer, items []unstructured.Unstructured, suffix []byte) (err error) { - _, err = w.Write([]byte(`"items":[`)) +func (e *streamEncoder) encodeItemsUnstructuredSlice(items []unstructured.Unstructured, suffix []byte) (err error) { + _, err = e.w.Write([]byte(`"items":[`)) if err != nil { return err } @@ -187,44 +208,42 @@ func encodeItemsUnstructuredSlice(w io.Writer, items []unstructured.Unstructured if i == len(items)-1 { comma = nil } - err := encodeValue(w, item.Object, comma) + err := e.encodeValue(item.Object, comma) if err != nil { return err } } - _, err = w.Write([]byte("]")) + _, err = e.w.Write([]byte("]")) if err != nil { return err } if len(suffix) > 0 { - _, err = w.Write(suffix) + _, err = e.w.Write(suffix) } return err } -func encodeKeyValuePair(w io.Writer, key string, value any, suffix []byte) (err error) { - err = encodeValue(w, key, []byte(":")) +func (e *streamEncoder) encodeKeyValuePair(key string, value any, suffix []byte) (err error) { + err = e.encodeValue(key, []byte(":")) if err != nil { return err } - err = encodeValue(w, value, suffix) + err = e.encodeValue(value, suffix) if err != nil { return err } return err } -func encodeValue(w io.Writer, value any, suffix []byte) error { - data, err := json.Marshal(value) - if err != nil { - return err - } - _, err = w.Write(data) - if err != nil { +func (e *streamEncoder) encodeValue(value any, suffix []byte) error { + e.buf.Reset() + if err := e.json.Encode(value); err != nil { return err } - if len(suffix) > 0 { - _, err = w.Write(suffix) - } + // Encode appends a newline after the value; replace it with the suffix to + // keep the output identical to json.Marshal's. + e.buf.Truncate(e.buf.Len() - 1) + e.buf.Write(suffix) + _, err := e.w.Write(e.buf.Bytes()) return err } diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/json.go b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/json.go index 24f66a10..52c81417 100644 --- a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/json.go +++ b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/json.go @@ -70,6 +70,7 @@ func identifier(options SerializerOptions) runtime.Identifier { } identifier, err := json.Marshal(result) if err != nil { + //nolint:logcheck // Should not be reached. klog.Fatalf("Failed marshaling identifier for json Serializer: %v", err) } return runtime.Identifier(identifier) diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections.go b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections.go index afac03e9..8db8932f 100644 --- a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections.go +++ b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/collections.go @@ -17,6 +17,7 @@ limitations under the License. package protobuf import ( + "encoding/binary" "errors" "io" "math/bits" @@ -134,15 +135,17 @@ func streamingEncodeUnknownList(w io.Writer, unk runtime.Unknown, listData strea } func streamingEncodeList(w io.Writer, listData streamingListData, memAlloc runtime.MemoryAllocator) (size int, err error) { + // headerScratch escapes via w.Write, so allocate it once per call instead of once per item. + headerScratch := make([]byte, 1+binary.MaxVarintLen64) // ListMeta; 0xa = (1 << 3) | 2; field number: 1, type: 2 (LEN). https://protobuf.dev/programming-guides/encoding/#structure - n, err := doEncodeWithHeader(&listData.listMeta, w, 0xa, listData.listMetaSize, memAlloc) + n, err := doEncodeWithHeader(&listData.listMeta, w, 0xa, listData.listMetaSize, headerScratch, memAlloc) size += n if err != nil { return size, err } // Items; 0x12 = (2 << 3) | 2; field number: 2, type: 2 (LEN). https://protobuf.dev/programming-guides/encoding/#structure for i, item := range listData.items { - n, err := doEncodeWithHeader(item, w, 0x12, listData.itemsSizes[i], memAlloc) + n, err := doEncodeWithHeader(item, w, 0x12, listData.itemsSizes[i], headerScratch, memAlloc) size += n if err != nil { return size, err @@ -151,12 +154,6 @@ func streamingEncodeList(w io.Writer, listData streamingListData, memAlloc runti return size, nil } -func writeVarintGenerated(w io.Writer, v int) (int, error) { - buf := make([]byte, sovGenerated(uint64(v))) - encodeVarintGenerated(buf, len(buf), uint64(v)) - return w.Write(buf) -} - // sovGenerated is copied from `generated.pb.go` returns size of varint. func sovGenerated(v uint64) int { return (bits.Len64(v|1) + 6) / 7 diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf.go b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf.go index 67a2d124..93ad95ce 100644 --- a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf.go +++ b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/protobuf.go @@ -199,6 +199,7 @@ func (s *Serializer) encode(obj runtime.Object, w io.Writer, memAlloc runtime.Me func (s *Serializer) doEncode(obj runtime.Object, w io.Writer, memAlloc runtime.MemoryAllocator) error { if memAlloc == nil { + //nolint:logcheck // Should not be reached in normal operations. klog.Error("a mandatory memory allocator wasn't provided, this might have a negative impact on performance, check invocations of EncodeWithAllocator method, falling back on runtime.SimpleAllocator") memAlloc = &runtime.SimpleAllocator{} } @@ -470,15 +471,12 @@ func (s *RawSerializer) doEncode(obj runtime.Object, w io.Writer, memAlloc runti return err } -func doEncodeWithHeader(obj any, w io.Writer, field byte, precomputedSize int, memAlloc runtime.MemoryAllocator) (size int, err error) { - // Field identifier - n, err := w.Write([]byte{field}) - size += n - if err != nil { - return size, err - } - // Size - n, err = writeVarintGenerated(w, precomputedSize) +func doEncodeWithHeader(obj any, w io.Writer, field byte, precomputedSize int, headerScratch []byte, memAlloc runtime.MemoryAllocator) (size int, err error) { + // Field identifier and size + header := headerScratch[:1+sovGenerated(uint64(precomputedSize))] + header[0] = field + encodeVarintGenerated(header, len(header), uint64(precomputedSize)) + n, err := w.Write(header) size += n if err != nil { return size, err @@ -500,6 +498,7 @@ func doEncodeWithHeader(obj any, w io.Writer, field byte, precomputedSize int, m // precomputedObjSize should not include header bytes (field identifier, size). func doEncode(obj any, w io.Writer, precomputedObjSize *int, memAlloc runtime.MemoryAllocator) (int, error) { if memAlloc == nil { + //nolint:logcheck // Should not be reached in normal operations. klog.Error("a mandatory memory allocator wasn't provided, this might have a negative impact on performance, check invocations of EncodeWithAllocator method, falling back on runtime.SimpleAllocator") memAlloc = &runtime.SimpleAllocator{} } diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning.go b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning.go index 25f955ed..6c86d5e1 100644 --- a/vendor/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning.go +++ b/vendor/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning.go @@ -116,6 +116,7 @@ func identifier(encodeGV runtime.GroupVersioner, encoder runtime.Encoder) runtim } identifier, err := json.Marshal(result) if err != nil { + //nolint:logcheck // Should not be reached. klog.Fatalf("Failed marshaling identifier for codec: %v", err) } identifiersMap.Store(result, runtime.Identifier(identifier)) @@ -222,6 +223,7 @@ func (c *codec) doEncode(obj runtime.Object, w io.Writer, memAlloc runtime.Memor return encoder.EncodeWithAllocator(obj, w, memAlloc) } } else { + //nolint:logcheck // Extending the API is not worth it for contextual, structured logging of this. klog.V(6).Infof("a memory allocator was provided but the encoder %s doesn't implement the runtime.EncoderWithAllocator, using regular encoder.Encode method", c.encoder.Identifier()) } } diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator.go b/vendor/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator.go index 5bc642bc..0d5a3e70 100644 --- a/vendor/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator.go +++ b/vendor/k8s.io/apimachinery/pkg/runtime/swagger_doc_generator.go @@ -25,7 +25,10 @@ import ( "go/token" "io" "reflect" + "strconv" "strings" + + "k8s.io/apimachinery/pkg/util/errors" ) // Pair of strings. We keed the name of fields and the doc @@ -94,23 +97,29 @@ func fmtRawDoc(rawDoc string) string { // fieldName returns the name of the field as it should appear in JSON format // "-" indicates that this field is not part of the JSON representation -func fieldName(field *ast.Field) string { +func fieldName(field *ast.Field) (string, error) { jsonTag := "" if field.Tag != nil { - jsonTag = reflect.StructTag(field.Tag.Value[1 : len(field.Tag.Value)-1]).Get("json") // Delete first and last quotation - if strings.Contains(jsonTag, "inline") { - return "-" + var jsonTagExists bool + tagValue, err := strconv.Unquote(field.Tag.Value) + if err != nil { + return "", err + } + jsonTag, jsonTagExists = reflect.StructTag(tagValue).Lookup("json") // Delete first and last quotation + // field is embedded, json tag is declared and has an empty name + if field.Names == nil && jsonTagExists && (jsonTag == "" || strings.HasPrefix(jsonTag, ",")) { + return "-", nil } } jsonTag = strings.Split(jsonTag, ",")[0] // This can return "-" if jsonTag == "" { if field.Names != nil { - return field.Names[0].Name + return field.Names[0].Name, nil } - return field.Type.(*ast.Ident).Name + return field.Type.(*ast.Ident).Name, nil } - return jsonTag + return jsonTag, nil } // A buffer of lines that will be written. @@ -171,8 +180,9 @@ func writeMapBody(b *buffer, kubeType []Pair, indent int) { // array. Each type is again represented as an array (we have to use arrays as we // need to be sure for the order of the fields). This function returns fields and // struct definitions that have no documentation as {name, ""}. -func ParseDocumentationFrom(src string) []KubeTypes { +func ParseDocumentationFrom(src string) ([]KubeTypes, error) { var docForTypes []KubeTypes + var errs []error pkg := astFrom(src) @@ -182,7 +192,9 @@ func ParseDocumentationFrom(src string) []KubeTypes { ks = append(ks, Pair{kubType.Name, fmtRawDoc(kubType.Doc)}) for _, field := range structType.Fields.List { - if n := fieldName(field); n != "-" { + if n, err := fieldName(field); err != nil { + errs = append(errs, err) + } else if n != "-" { fieldDoc := fmtRawDoc(field.Doc.Text()) ks = append(ks, Pair{n, fieldDoc}) } @@ -191,7 +203,7 @@ func ParseDocumentationFrom(src string) []KubeTypes { } } - return docForTypes + return docForTypes, errors.NewAggregate(errs) } // WriteSwaggerDocFunc writes a declaration of a function as a string. This function is used in diff --git a/vendor/k8s.io/apimachinery/pkg/runtime/types.go b/vendor/k8s.io/apimachinery/pkg/runtime/types.go index ca7b7cc2..6cded889 100644 --- a/vendor/k8s.io/apimachinery/pkg/runtime/types.go +++ b/vendor/k8s.io/apimachinery/pkg/runtime/types.go @@ -23,7 +23,7 @@ package runtime // like this: // // type MyAwesomeAPIObject struct { -// runtime.TypeMeta `json:",inline"` +// runtime.TypeMeta `json:""` // ... // other fields // } // @@ -59,7 +59,7 @@ const ( // // Internal package: // // type MyAPIObject struct { -// runtime.TypeMeta `json:",inline"` +// runtime.TypeMeta `json:""` // MyPlugin runtime.Object `json:"myPlugin"` // } // @@ -70,7 +70,7 @@ const ( // // External package: // // type MyAPIObject struct { -// runtime.TypeMeta `json:",inline"` +// runtime.TypeMeta `json:""` // MyPlugin runtime.RawExtension `json:"myPlugin"` // } // @@ -121,7 +121,7 @@ type RawExtension struct { // +protobuf=true // +k8s:openapi-gen=true type Unknown struct { - TypeMeta `json:",inline" protobuf:"bytes,1,opt,name=typeMeta"` + TypeMeta `json:"" protobuf:"bytes,1,opt,name=typeMeta"` // Raw will hold the complete serialized object which couldn't be matched // with a registered type. Most likely, nothing should be done with this // except for passing it through the system. diff --git a/vendor/k8s.io/apimachinery/pkg/util/intstr/intstr.go b/vendor/k8s.io/apimachinery/pkg/util/intstr/intstr.go index f372ae58..b0ca3803 100644 --- a/vendor/k8s.io/apimachinery/pkg/util/intstr/intstr.go +++ b/vendor/k8s.io/apimachinery/pkg/util/intstr/intstr.go @@ -59,6 +59,7 @@ const ( // Deprecated: use FromInt32 instead. func FromInt(val int) IntOrString { if val > math.MaxInt32 || val < math.MinInt32 { + //nolint:logcheck // Should not be reached. klog.Errorf("value: %d overflows int32\n%s\n", val, debug.Stack()) } return IntOrString{Type: Int, IntVal: int32(val)} diff --git a/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager.go b/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager.go index ac8d4279..2e2db655 100644 --- a/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager.go +++ b/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/fieldmanager.go @@ -140,24 +140,28 @@ func (f *FieldManager) Update(liveObj, newObj runtime.Object, manager string) (o } // UpdateNoErrors is the same as Update, but it will not return -// errors. If an error happens, the object is returned with -// managedFields cleared. +// errors. If an error happens, we preserve the managedFields from +// liveObj. func (f *FieldManager) UpdateNoErrors(liveObj, newObj runtime.Object, manager string) runtime.Object { obj, err := f.Update(liveObj, newObj, manager) if err != nil { - atMostEverySecond.Do(func() { - ns, name := "unknown", "unknown" - if accessor, err := meta.Accessor(newObj); err == nil { - ns = accessor.GetNamespace() - name = accessor.GetName() + // Preserve the managedFields from the live object rather than + // stripping them entirely, to avoid silent data loss when the + // managedFields update fails (e.g. due to an unavailable + // conversion webhook). + // Note: meta.Accessor for liveObj and newObj below never return an error in this code branch, + // because if they would f.Update above would return "newObj, nil". Accordingly, the case + // where one of the accessors returns an error is not handled here. + if liveAccessor, aErr := meta.Accessor(liveObj); aErr == nil { + if newAccessor, aErr := meta.Accessor(newObj); aErr == nil { + atMostEverySecond.Do(func() { + //nolint:logcheck // Should not be reached. + klog.ErrorS(err, "[SHOULD NOT HAPPEN] failed to update managedFields (restored previous managedFields from live object)", "versionKind", + newObj.GetObjectKind().GroupVersionKind(), "namespace", newAccessor.GetNamespace(), "name", newAccessor.GetName()) + }) + newAccessor.SetManagedFields(liveAccessor.GetManagedFields()) } - - klog.ErrorS(err, "[SHOULD NOT HAPPEN] failed to update managedFields", "versionKind", - newObj.GetObjectKind().GroupVersionKind(), "namespace", ns, "name", name) - }) - // Explicitly remove managedFields on failure, so that - // we can't have garbage in it. - RemoveObjectManagedFields(newObj) + } return newObj } return obj diff --git a/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter.go b/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter.go index cbefc2eb..40cc90da 100644 --- a/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter.go +++ b/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/typeconverter.go @@ -109,6 +109,24 @@ func valueToObject(val value.Value) (runtime.Object, error) { } } +// GroupVersionOfTypedValue returns the extracted GroupVersion from the TypeMeta +// fields of a TypedValue, or return false if no TypeMeta fields are found. +func GroupVersionOfTypedValue(object *typed.TypedValue) (schema.GroupVersion, bool) { + val := object.AsValue() + if val == nil || !val.IsMap() { + return schema.GroupVersion{}, false + } + apiVersion, ok := val.AsMap().Get("apiVersion") + if !ok || !apiVersion.IsString() { + return schema.GroupVersion{}, false + } + groupVersion, err := schema.ParseGroupVersion(apiVersion.AsString()) + if err != nil { + return schema.GroupVersion{}, false + } + return groupVersion, true +} + func indexModels( typeParser *typed.Parser, openAPISchemas map[string]*spec.Schema, diff --git a/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter.go b/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter.go index 86695e0c..917bdcd7 100644 --- a/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter.go +++ b/vendor/k8s.io/apimachinery/pkg/util/managedfields/internal/versionconverter.go @@ -63,24 +63,23 @@ func newCRDVersionConverter(t TypeConverter, o runtime.ObjectConvertor, h schema // Convert implements sigs.k8s.io/structured-merge-diff/merge.Converter func (v *versionConverter) Convert(object *typed.TypedValue, version fieldpath.APIVersion) (*typed.TypedValue, error) { - // Convert the smd typed value to a kubernetes object. - objectToConvert, err := v.typeConverter.TypedToObject(object) - if err != nil { - return object, err - } - - // Parse the target groupVersion. groupVersion, err := schema.ParseGroupVersion(string(version)) if err != nil { return object, err } // If attempting to convert to the same version as we already have, just return it. - fromVersion := objectToConvert.GetObjectKind().GroupVersionKind().GroupVersion() - if fromVersion == groupVersion { + if typedVersion, ok := GroupVersionOfTypedValue(object); ok && typedVersion == groupVersion { return object, nil } + // Convert the smd typed value to a kubernetes object. + objectToConvert, err := v.typeConverter.TypedToObject(object) + if err != nil { + return object, err + } + fromVersion := objectToConvert.GetObjectKind().GroupVersionKind().GroupVersion() + // Convert to internal internalObject, err := v.objectConvertor.ConvertToVersion(objectToConvert, v.hubGetter(fromVersion)) if err != nil { diff --git a/vendor/k8s.io/apimachinery/pkg/util/validation/field/error_matcher.go b/vendor/k8s.io/apimachinery/pkg/util/validation/field/error_matcher.go index 1eeb71ff..1a18b276 100644 --- a/vendor/k8s.io/apimachinery/pkg/util/validation/field/error_matcher.go +++ b/vendor/k8s.io/apimachinery/pkg/util/validation/field/error_matcher.go @@ -46,35 +46,57 @@ type ErrorMatcher struct { requireOriginWhenInvalid bool matchValidationStabilityLevel bool matchSource bool + matchAncestorShortCircuit bool + matchShortCircuit bool // normalizationRules holds the pre-compiled regex patterns for path normalization. normalizationRules []NormalizationRule } +// isChildPath returns true if child is a descendant path of parent. +// It avoids false positives like "spec.containers" being a child of "spec.container" +// by explicitly checking for '.' or '[' path separators. +func isChildPath(parent, child string) bool { + // "" as parent path not supported. It can un-intentionally match with any path. + // theoretically system errors can be matched with any path errors. + if len(parent) == 0 { + return false + } + if len(child) <= len(parent) { + return false + } + if child[:len(parent)] != parent { + return false + } + sep := child[len(parent)] + return sep == '.' || sep == '[' +} + // Matches returns true if the two Error objects match according to the // configured criteria. When field normalization is configured, only the // "got" error's field path is normalized (to bring older API versions up // to the internal/latest format), while "want" is assumed to already be // in the canonical internal API format. func (m ErrorMatcher) Matches(want, got *Error) bool { - if m.matchType && want.Type != got.Type { - return false + gotField := got.Field + if want.Field != gotField { + gotField = m.normalizePath(gotField) } - if m.matchField { - // Try direct match first (common case) - if want.Field != got.Field { - // Fields don't match, try normalization if rules are configured. - // Only normalize "got" - it may be from an older API version that - // needs to be brought up to the internal/latest format that "want" - // is already in. - if want.Field != m.normalizePath(got.Field) { - return false - } + if m.matchAncestorShortCircuit { + if got.ShortCircuit && (isChildPath(gotField, want.Field) || isChildPath(got.Field, want.Field)) { + return true } } + if m.matchType && want.Type != got.Type { + return false + } + if m.matchField && want.Field != gotField { + return false + } if m.matchValue && !reflect.DeepEqual(want.BadValue, got.BadValue) { return false } + if m.matchOrigin { if want.Origin != got.Origin { return false @@ -91,10 +113,12 @@ func (m ErrorMatcher) Matches(want, got *Error) bool { if m.matchValidationStabilityLevel && want.ValidationStabilityLevel != got.ValidationStabilityLevel { return false } - if m.matchSource && want.FromImperative != got.FromImperative { return false } + if m.matchShortCircuit && want.ShortCircuit != got.ShortCircuit { + return false + } return true } @@ -124,47 +148,51 @@ func (m ErrorMatcher) Render(e *Error) string { if m.matchType { comma() - buf.WriteString(fmt.Sprintf("Type=%q", e.Type)) + fmt.Fprintf(&buf, "Type=%q", e.Type) } if m.matchField { comma() if normalized := m.normalizePath(e.Field); normalized != e.Field { - buf.WriteString(fmt.Sprintf("Field=%q (aka %q)", normalized, e.Field)) + fmt.Fprintf(&buf, "Field=%q (aka %q)", normalized, e.Field) } else { - buf.WriteString(fmt.Sprintf("Field=%q", e.Field)) + fmt.Fprintf(&buf, "Field=%q", e.Field) } } if m.matchValue { comma() if s, ok := e.BadValue.(string); ok { - buf.WriteString(fmt.Sprintf("Value=%q", s)) + fmt.Fprintf(&buf, "Value=%q", s) } else { rv := reflect.ValueOf(e.BadValue) if rv.Kind() == reflect.Pointer && !rv.IsNil() { rv = rv.Elem() } if rv.IsValid() && rv.CanInterface() { - buf.WriteString(fmt.Sprintf("Value=%v", rv.Interface())) + fmt.Fprintf(&buf, "Value=%v", rv.Interface()) } else { - buf.WriteString(fmt.Sprintf("Value=%v", e.BadValue)) + fmt.Fprintf(&buf, "Value=%v", e.BadValue) } } } if m.matchOrigin || m.requireOriginWhenInvalid && e.Type == ErrorTypeInvalid { comma() - buf.WriteString(fmt.Sprintf("Origin=%q", e.Origin)) + fmt.Fprintf(&buf, "Origin=%q", e.Origin) } if m.matchDetail != nil { comma() - buf.WriteString(fmt.Sprintf("Detail=%q", e.Detail)) + fmt.Fprintf(&buf, "Detail=%q", e.Detail) } if m.matchValidationStabilityLevel { comma() - buf.WriteString(fmt.Sprintf("ValidationStabilityLevel=%s", e.ValidationStabilityLevel)) + fmt.Fprintf(&buf, "ValidationStabilityLevel=%s", e.ValidationStabilityLevel) } if m.matchSource { comma() - buf.WriteString(fmt.Sprintf("FromImperative=%t", e.FromImperative)) + fmt.Fprintf(&buf, "FromImperative=%t", e.FromImperative) + } + if m.matchShortCircuit { + comma() + fmt.Fprintf(&buf, "ShortCircuit=%t", e.ShortCircuit) } return "{" + buf.String() + "}" } @@ -249,6 +277,18 @@ func (m ErrorMatcher) BySource() ErrorMatcher { return m } +// MatchAncestorShortCircuit returns a derived ErrorMatcher which also matches when the "got" error short-circuited at an ancestor of the "want" error's field path. +func (m ErrorMatcher) MatchAncestorShortCircuit() ErrorMatcher { + m.matchAncestorShortCircuit = true + return m +} + +// MatchShortCircuit returns a derived ErrorMatcher which also matches by the ShortCircuit value. +func (m ErrorMatcher) MatchShortCircuit() ErrorMatcher { + m.matchShortCircuit = true + return m +} + // ByValidationStabilityLevel returns a derived ErrorMatcher which also matches by the validation stability level // value of field errors. func (m ErrorMatcher) ByValidationStabilityLevel() ErrorMatcher { @@ -300,9 +340,13 @@ type TestIntf interface { // "want" error can match multiple "got" errors, and they will all be consumed. // The only exception to this is if the matcher got multiple identical (in every way, // even those not being matched on) errors, which is likely to indicate a bug. +// This doesn't support matchAncestorShortCircuit as it it not needed to be used in the tests. func (m ErrorMatcher) Test(tb TestIntf, want, got ErrorList) { tb.Helper() + if m.matchAncestorShortCircuit { + tb.Errorf("matchAncestorShortCircuit is not supported for test") + } exactly := m.Exactly() // makes a copy // If we ever find an EXACT duplicate error, it's almost certainly a bug diff --git a/vendor/k8s.io/apimachinery/pkg/util/validation/field/errors.go b/vendor/k8s.io/apimachinery/pkg/util/validation/field/errors.go index 9357fb30..0d00acb4 100644 --- a/vendor/k8s.io/apimachinery/pkg/util/validation/field/errors.go +++ b/vendor/k8s.io/apimachinery/pkg/util/validation/field/errors.go @@ -59,6 +59,12 @@ type Error struct { // FromImperative denotes these errors are originating from the hand written validations. FromImperative bool + // ShortCircuit denotes that this error prevents further validation of the current field's children. + ShortCircuit bool + + // ShortCircuitedInDeclarative denotes this error is covered by declarative validation. But not returned by declarative validation due to a short circuiting behavior for the current input. + ShortCircuitedInDeclarative bool + // ValidationStabilityLevel denotes the validation stability level of the declarative validation from this error is returned. This should be used in the declarative validations only. ValidationStabilityLevel ValidationStabilityLevel } @@ -545,6 +551,12 @@ func (e *Error) MarkAlpha() *Error { return e } +// MarkShortCircuitedInDV marks that this error is not returned by declarative validations, because DV returns before running the current validation. Handwritten validations still return it. +func (e *Error) MarkShortCircuitedInDV() *Error { + e.ShortCircuitedInDeclarative = true + return e +} + // MarkAlpha marks the errors as alpha validation errors. func (list ErrorList) MarkAlpha() ErrorList { for _, err := range list { @@ -579,6 +591,14 @@ func (list ErrorList) MarkFromImperative() ErrorList { return list } +// MarkShortCircuit marks the errors as short-circuit errors. +func (list ErrorList) MarkShortCircuit() ErrorList { + for _, err := range list { + err.ShortCircuit = true + } + return list +} + // RemoveCoveredByDeclarative returns a new ErrorList containing only the errors that should not be covered by declarative validation. func (list ErrorList) RemoveCoveredByDeclarative() ErrorList { newList := ErrorList{} diff --git a/vendor/k8s.io/apimachinery/pkg/util/validation/ip.go b/vendor/k8s.io/apimachinery/pkg/util/validation/ip.go index 869fb0aa..95f4e621 100644 --- a/vendor/k8s.io/apimachinery/pkg/util/validation/ip.go +++ b/vendor/k8s.io/apimachinery/pkg/util/validation/ip.go @@ -105,6 +105,7 @@ func IsValidIP(fldPath *field.Path, value string) field.ErrorList { func GetWarningsForIP(fldPath *field.Path, value string) []string { ip := netutils.ParseIPSloppy(value) if ip == nil { + //nolint:logcheck // Should not be reached. klog.ErrorS(nil, "GetWarningsForIP called on value that was not validated with IsValidIPForLegacyField", "field", fldPath, "value", value) return nil } @@ -211,6 +212,7 @@ func IsValidCIDR(fldPath *field.Path, value string) field.ErrorList { func GetWarningsForCIDR(fldPath *field.Path, value string) []string { ip, ipnet, err := netutils.ParseCIDRSloppy(value) if err != nil { + //nolint:logcheck // Should not be reached. klog.ErrorS(err, "GetWarningsForCIDR called on value that was not validated with IsValidCIDRForLegacyField", "field", fldPath, "value", value) return nil } diff --git a/vendor/modules.txt b/vendor/modules.txt index 654ad148..49a55cb2 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -63,40 +63,43 @@ github.com/go-openapi/jsonpointer/jsonname ## explicit; go 1.25.0 github.com/go-openapi/jsonreference github.com/go-openapi/jsonreference/internal -# github.com/go-openapi/swag v0.27.0 +# github.com/go-openapi/swag v0.27.1 ## explicit; go 1.25.0 github.com/go-openapi/swag -# github.com/go-openapi/swag/cmdutils v0.27.0 +# github.com/go-openapi/swag/cmdutils v0.27.1 ## explicit; go 1.25.0 github.com/go-openapi/swag/cmdutils -# github.com/go-openapi/swag/conv v0.27.0 +# github.com/go-openapi/swag/conv v0.27.1 ## explicit; go 1.25.0 github.com/go-openapi/swag/conv -# github.com/go-openapi/swag/fileutils v0.27.0 +# github.com/go-openapi/swag/fileutils v0.27.1 ## explicit; go 1.25.0 github.com/go-openapi/swag/fileutils -# github.com/go-openapi/swag/jsonutils v0.27.0 +# github.com/go-openapi/swag/jsonutils v0.27.1 ## explicit; go 1.25.0 github.com/go-openapi/swag/jsonutils github.com/go-openapi/swag/jsonutils/adapters github.com/go-openapi/swag/jsonutils/adapters/ifaces github.com/go-openapi/swag/jsonutils/adapters/stdlib/json -# github.com/go-openapi/swag/loading v0.27.0 +# github.com/go-openapi/swag/loading v0.27.1 ## explicit; go 1.25.0 github.com/go-openapi/swag/loading -# github.com/go-openapi/swag/mangling v0.27.0 +# github.com/go-openapi/swag/mangling v0.27.1 ## explicit; go 1.25.0 github.com/go-openapi/swag/mangling -# github.com/go-openapi/swag/netutils v0.27.0 +# github.com/go-openapi/swag/netutils v0.27.1 ## explicit; go 1.25.0 github.com/go-openapi/swag/netutils -# github.com/go-openapi/swag/stringutils v0.27.0 +# github.com/go-openapi/swag/pools v0.27.1 +## explicit; go 1.25.0 +github.com/go-openapi/swag/pools +# github.com/go-openapi/swag/stringutils v0.27.1 ## explicit; go 1.25.0 github.com/go-openapi/swag/stringutils -# github.com/go-openapi/swag/typeutils v0.27.0 +# github.com/go-openapi/swag/typeutils v0.27.1 ## explicit; go 1.25.0 github.com/go-openapi/swag/typeutils -# github.com/go-openapi/swag/yamlutils v0.27.0 +# github.com/go-openapi/swag/yamlutils v0.27.1 ## explicit; go 1.25.0 github.com/go-openapi/swag/yamlutils # github.com/google/gnostic-models v0.7.1 @@ -203,7 +206,7 @@ go.yaml.in/yaml/v2 # go.yaml.in/yaml/v3 v3.0.4 ## explicit; go 1.16 go.yaml.in/yaml/v3 -# golang.org/x/net v0.56.0 +# golang.org/x/net v0.57.0 ## explicit; go 1.25.0 golang.org/x/net/http/httpguts golang.org/x/net/http2 @@ -223,10 +226,10 @@ golang.org/x/oauth2/internal golang.org/x/sys/plan9 golang.org/x/sys/unix golang.org/x/sys/windows -# golang.org/x/term v0.44.0 +# golang.org/x/term v0.45.0 ## explicit; go 1.25.0 golang.org/x/term -# golang.org/x/text v0.39.0 +# golang.org/x/text v0.40.0 ## explicit; go 1.25.0 golang.org/x/text/secure/bidirule golang.org/x/text/transform @@ -333,7 +336,7 @@ k8s.io/api/storage/v1 k8s.io/api/storage/v1alpha1 k8s.io/api/storage/v1beta1 k8s.io/api/storagemigration/v1beta1 -# k8s.io/apimachinery v0.36.2 +# k8s.io/apimachinery v0.37.1 ## explicit; go 1.26.0 k8s.io/apimachinery/pkg/api/equality k8s.io/apimachinery/pkg/api/errors @@ -601,8 +604,8 @@ k8s.io/klog/v2/internal/severity k8s.io/klog/v2/internal/sloghandler k8s.io/klog/v2/internal/verbosity k8s.io/klog/v2/textlogger -# k8s.io/kube-openapi v0.0.0-20260706235625-cdb1db5517a0 -## explicit; go 1.24.0 +# k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad +## explicit; go 1.25.0 k8s.io/kube-openapi/pkg/cached k8s.io/kube-openapi/pkg/common k8s.io/kube-openapi/pkg/handler3 @@ -618,7 +621,7 @@ k8s.io/kube-openapi/pkg/spec3 k8s.io/kube-openapi/pkg/util k8s.io/kube-openapi/pkg/util/proto k8s.io/kube-openapi/pkg/validation/spec -# k8s.io/streaming v0.36.2 +# k8s.io/streaming v0.37.1 ## explicit; go 1.26.0 k8s.io/streaming/pkg/httpstream k8s.io/streaming/pkg/httpstream/spdy