Skip to content

Commit 8c5416d

Browse files
abhi0324abhi0324
authored
Merge branch 'openkruise:master' into update-vertical
2 parents 1618c22 + 715f209 commit 8c5416d

File tree

14 files changed

+748
-51
lines changed

14 files changed

+748
-51
lines changed

‎.github/workflows/ci.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ jobs:
127127
make test
128128
git status
129129
- name: Publish Unit Test Coverage
130-
uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # v5.4.0
130+
uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
131131
env:
132132
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
133133
with:

‎CONTRIBUTING.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ We encourage contributors to follow the [PR template](./.github/PULL_REQUEST_TEM
8989
As a contributor, if you want to make any contribution to the Kruise project, we should reach an agreement on the version of tools used in the development environment.
9090
Here are some dependencies with specific versions:
9191

92-
- Golang : v1.18+
92+
- Golang : v1.22+
9393
- Kubernetes: v1.16+
9494

9595
### Developing guide

‎SECURITY_CONTACTS.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Defined below are the security persons of contact for this project. If you have questions regarding the triaging and handling of incoming problems, they may be contacted.
22

3-
The following security contacts have agreed to abide by the Embargo Policy $LINK and will be removed and replaced if found to be in violation of that agreement.
3+
The following security contacts have agreed to abide by the [Embargo Policy](embargo-policy.md) and will be removed and replaced if found to be in violation of that agreement.
44

55
DO NOT REPORT SECURITY VULNERABILITIES DIRECTLY TO THESE NAMES, USE THE INSTRUCTIONS AT [SECURITY.md](SECURITY.md)
66

‎pkg/control/sidecarcontrol/fuzz_util_test.go

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
package sidecarcontrol
2+
3+
import (
4+
"encoding/json"
5+
"testing"
6+
7+
fuzz "github.com/AdaLogics/go-fuzz-headers"
8+
appsv1alpha1 "github.com/openkruise/kruise/apis/apps/v1alpha1"
9+
fuzzutils "github.com/openkruise/kruise/test/fuzz"
10+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
11+
)
12+
13+
func FuzzPatchPodMetadata(f *testing.F) {
14+
f.Fuzz(func(t *testing.T, data []byte) {
15+
cf := fuzz.NewConsumer(data)
16+
metadata := &metav1.ObjectMeta{}
17+
if err := cf.GenerateStruct(metadata); err != nil {
18+
return
19+
}
20+
21+
jsonPatch, err := cf.GetBool()
22+
if err != nil {
23+
return
24+
}
25+
26+
patch, err := fuzzutils.GeneratePatchPodMetadata(cf, jsonPatch)
27+
if err != nil || patch == nil {
28+
return
29+
}
30+
31+
// Make sure there is a probability that the same key exists.
32+
if exist, err := cf.GetBool(); exist && err == nil {
33+
for key := range patch.Annotations {
34+
if jsonPatch {
35+
m := make(map[string]string)
36+
if err := cf.FuzzMap(&m); err != nil {
37+
return
38+
}
39+
bytes, _ := json.Marshal(m)
40+
metadata.GetAnnotations()[key] = string(bytes)
41+
} else {
42+
val, err := cf.GetString()
43+
if err != nil {
44+
return
45+
}
46+
metadata.GetAnnotations()[key] = val
47+
}
48+
}
49+
}
50+
51+
_, err = PatchPodMetadata(metadata, []appsv1alpha1.SidecarSetPatchPodMetadata{*patch})
52+
// Because function can capture panic error, so here to deal with the errors due to panic,
53+
// Meanwhile, the error of the failed Patch merge in JSON format needs to be ignored.
54+
if err != nil {
55+
if !jsonPatch && patch.PatchPolicy == appsv1alpha1.SidecarSetMergePatchJsonPatchPolicy {
56+
t.Logf("Ignore patch merge in JSON format failed: %s", err)
57+
return
58+
}
59+
// The panic error will be printed.
60+
t.Errorf("Panic: %s", err)
61+
}
62+
})
63+
}

‎pkg/controller/uniteddeployment/fuzz_uniteddeployment_controller_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ func FuzzParseSubsetReplicas(f *testing.F) {
4747
}
4848
udReplicas := int32(udReplicasInt)
4949

50-
subsetReplicas, err := fuzzutils.GenerateSubsetReplicas(cf)
50+
subsetReplicas, err := fuzzutils.GenerateIntOrString(cf)
5151
if err != nil {
5252
return
5353
}

‎pkg/webhook/pod/mutating/fuzz_sidecarset_test.go

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
package mutating
2+
3+
import (
4+
"context"
5+
"testing"
6+
7+
fuzz "github.com/AdaLogics/go-fuzz-headers"
8+
appsv1alpha1 "github.com/openkruise/kruise/apis/apps/v1alpha1"
9+
"github.com/openkruise/kruise/pkg/util/fieldindex"
10+
fuzzutils "github.com/openkruise/kruise/test/fuzz"
11+
admissionv1 "k8s.io/api/admission/v1"
12+
corev1 "k8s.io/api/core/v1"
13+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
14+
"k8s.io/apimachinery/pkg/runtime"
15+
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
16+
"sigs.k8s.io/controller-runtime/pkg/client/fake"
17+
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
18+
)
19+
20+
var (
21+
fakeScheme = runtime.NewScheme()
22+
23+
defaultPod = &corev1.Pod{
24+
ObjectMeta: metav1.ObjectMeta{
25+
Name: "test-pod",
26+
Namespace: "default",
27+
Labels: map[string]string{"app": "fuzz-test"},
28+
},
29+
Spec: corev1.PodSpec{
30+
InitContainers: []corev1.Container{
31+
{
32+
Name: "init-0",
33+
Image: "busybox:1.0.0",
34+
},
35+
},
36+
Containers: []corev1.Container{
37+
{
38+
Name: "nginx",
39+
Image: "nginx:1.15.1",
40+
},
41+
},
42+
},
43+
}
44+
45+
req = admission.Request{
46+
AdmissionRequest: admissionv1.AdmissionRequest{
47+
Operation: admissionv1.Create,
48+
Object: runtime.RawExtension{},
49+
OldObject: runtime.RawExtension{},
50+
Resource: metav1.GroupVersionResource{Group: corev1.SchemeGroupVersion.Group, Version: corev1.SchemeGroupVersion.Version, Resource: "pods"},
51+
SubResource: "",
52+
},
53+
}
54+
)
55+
56+
func init() {
57+
_ = clientgoscheme.AddToScheme(fakeScheme)
58+
_ = appsv1alpha1.AddToScheme(fakeScheme)
59+
_ = appsv1alpha1.AddToScheme(clientgoscheme.Scheme)
60+
}
61+
62+
func FuzzSidecarSetMutatingPod(f *testing.F) {
63+
f.Fuzz(func(t *testing.T, data []byte) {
64+
cf := fuzz.NewConsumer(data)
65+
66+
sidecarSet := &appsv1alpha1.SidecarSet{}
67+
if err := cf.GenerateStruct(sidecarSet); err != nil {
68+
return
69+
}
70+
71+
if err := fuzzutils.GenerateSidecarSetSpec(cf, sidecarSet,
72+
fuzzutils.GenerateSidecarSetUpdateStrategy,
73+
fuzzutils.GenerateSidecarSetInjectionStrategy,
74+
fuzzutils.GenerateSidecarSetInitContainer,
75+
fuzzutils.GenerateSidecarSetContainer,
76+
fuzzutils.GenerateSidecarSetPatchPodMetadata); err != nil {
77+
return
78+
}
79+
matched, err := cf.GetBool()
80+
if err != nil {
81+
return
82+
}
83+
if matched {
84+
// Make sure can select to defaultPod
85+
sidecarSet.Spec.Selector.MatchLabels = defaultPod.GetLabels()
86+
sidecarSet.Spec.Selector.MatchExpressions = nil
87+
sidecarSet.Spec.Namespace = defaultPod.GetNamespace()
88+
sidecarSet.Spec.NamespaceSelector = nil
89+
sidecarSet.Spec.InjectionStrategy.Revision = nil
90+
}
91+
92+
if sidecarSet.GetDeletionTimestamp() != nil && len(sidecarSet.GetFinalizers()) == 0 {
93+
sidecarSet.SetDeletionTimestamp(nil)
94+
}
95+
96+
c := fake.NewClientBuilder().WithObjects(sidecarSet).WithIndex(
97+
&appsv1alpha1.SidecarSet{}, fieldindex.IndexNameForSidecarSetNamespace, fieldindex.IndexSidecarSet,
98+
).WithScheme(fakeScheme).Build()
99+
100+
handler := &PodCreateHandler{
101+
Decoder: admission.NewDecoder(fakeScheme),
102+
Client: c,
103+
}
104+
_, _ = handler.sidecarsetMutatingPod(context.Background(), req, defaultPod)
105+
})
106+
}

‎pkg/webhook/sidecarset/validating/fuzz_sidecarset_validation_test.go

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
/*
2+
Copyright 2025 The Kruise Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package validating
18+
19+
import (
20+
"encoding/json"
21+
"testing"
22+
23+
fuzz "github.com/AdaLogics/go-fuzz-headers"
24+
appsv1alpha1 "github.com/openkruise/kruise/apis/apps/v1alpha1"
25+
"github.com/openkruise/kruise/pkg/control/sidecarcontrol"
26+
"github.com/openkruise/kruise/pkg/util"
27+
"github.com/openkruise/kruise/pkg/util/configuration"
28+
webhookutil "github.com/openkruise/kruise/pkg/webhook/util"
29+
fuzzutils "github.com/openkruise/kruise/test/fuzz"
30+
apps "k8s.io/api/apps/v1"
31+
corev1 "k8s.io/api/core/v1"
32+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
33+
"k8s.io/apimachinery/pkg/runtime"
34+
"k8s.io/apimachinery/pkg/util/validation/field"
35+
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
36+
"sigs.k8s.io/controller-runtime/pkg/client/fake"
37+
"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
38+
)
39+
40+
var (
41+
fakeScheme = runtime.NewScheme()
42+
)
43+
44+
func init() {
45+
_ = clientgoscheme.AddToScheme(fakeScheme)
46+
_ = appsv1alpha1.AddToScheme(fakeScheme)
47+
_ = appsv1alpha1.AddToScheme(clientgoscheme.Scheme)
48+
}
49+
50+
func FuzzValidateSidecarSetSpec(f *testing.F) {
51+
f.Fuzz(func(t *testing.T, data []byte) {
52+
cf := fuzz.NewConsumer(data)
53+
54+
ss := &appsv1alpha1.SidecarSet{}
55+
if err := cf.GenerateStruct(ss); err != nil {
56+
return
57+
}
58+
59+
if err := fuzzutils.GenerateSidecarSetSpec(cf, ss,
60+
fuzzutils.GenerateSidecarSetSelector,
61+
fuzzutils.GenerateSidecarSetNamespace,
62+
fuzzutils.GenerateSidecarSetNamespaceSelector,
63+
fuzzutils.GenerateSidecarSetInitContainer,
64+
fuzzutils.GenerateSidecarSetContainer,
65+
fuzzutils.GenerateSidecarSetUpdateStrategy,
66+
fuzzutils.GenerateSidecarSetInjectionStrategy,
67+
fuzzutils.GenerateSidecarSetPatchPodMetadata); err != nil {
68+
return
69+
}
70+
71+
h, err := newFakeSidecarSetCreateUpdateHandler(cf, ss)
72+
if err != nil {
73+
return
74+
}
75+
76+
_ = h.validateSidecarSetSpec(ss, field.NewPath("spec"))
77+
})
78+
}
79+
80+
func newFakeSidecarSetCreateUpdateHandler(cf *fuzz.ConsumeFuzzer, ss *appsv1alpha1.SidecarSet) (*SidecarSetCreateUpdateHandler, error) {
81+
name, hash := "", ""
82+
if ss.Spec.InjectionStrategy.Revision != nil && ss.Spec.InjectionStrategy.Revision.RevisionName != nil {
83+
name = *ss.Spec.InjectionStrategy.Revision.RevisionName
84+
}
85+
86+
if ss.Spec.InjectionStrategy.Revision != nil && ss.Spec.InjectionStrategy.Revision.CustomVersion != nil {
87+
hash = *ss.Spec.InjectionStrategy.Revision.CustomVersion
88+
}
89+
90+
object := &apps.ControllerRevision{
91+
ObjectMeta: metav1.ObjectMeta{
92+
Namespace: webhookutil.GetNamespace(),
93+
Name: name,
94+
},
95+
}
96+
97+
objectList := &apps.ControllerRevisionList{
98+
Items: []apps.ControllerRevision{
99+
{
100+
ObjectMeta: metav1.ObjectMeta{
101+
Namespace: webhookutil.GetNamespace(),
102+
Name: "default",
103+
Labels: map[string]string{
104+
sidecarcontrol.SidecarSetKindName: ss.GetName(),
105+
appsv1alpha1.SidecarSetCustomVersionLabel: hash,
106+
},
107+
},
108+
},
109+
},
110+
}
111+
112+
whiteList := &configuration.SidecarSetPatchMetadataWhiteList{}
113+
if err := fuzzutils.GenerateSidecarSetWhiteListRule(cf, whiteList); err != nil {
114+
return nil, err
115+
}
116+
whiteListJson, err := json.Marshal(whiteList)
117+
if err != nil {
118+
return nil, err
119+
}
120+
121+
config := &corev1.ConfigMap{
122+
ObjectMeta: metav1.ObjectMeta{
123+
Name: configuration.KruiseConfigurationName,
124+
Namespace: util.GetKruiseNamespace(),
125+
},
126+
Data: map[string]string{
127+
configuration.SidecarSetPatchPodMetadataWhiteListKey: string(whiteListJson),
128+
},
129+
}
130+
131+
return &SidecarSetCreateUpdateHandler{
132+
Client: fake.NewClientBuilder().WithScheme(fakeScheme).WithObjects(object, config).WithLists(objectList).Build(),
133+
Decoder: admission.NewDecoder(fakeScheme),
134+
}, err
135+
}

‎pkg/webhook/workloadspread/validating/fuzz_workloadspread_validation_test.go

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,14 @@ limitations under the License.
1717
package validating
1818

1919
import (
20+
"encoding/json"
2021
"testing"
2122

2223
fuzz "github.com/AdaLogics/go-fuzz-headers"
24+
appsv1alpha1 "github.com/openkruise/kruise/apis/apps/v1alpha1"
25+
"github.com/openkruise/kruise/pkg/util"
26+
"github.com/openkruise/kruise/pkg/util/configuration"
27+
fuzzutils "github.com/openkruise/kruise/test/fuzz"
2328
appsv1 "k8s.io/api/apps/v1"
2429
batchv1 "k8s.io/api/batch/v1"
2530
corev1 "k8s.io/api/core/v1"
@@ -28,9 +33,6 @@ import (
2833
"k8s.io/apimachinery/pkg/util/validation/field"
2934
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
3035
"sigs.k8s.io/controller-runtime/pkg/client/fake"
31-
32-
appsv1alpha1 "github.com/openkruise/kruise/apis/apps/v1alpha1"
33-
fuzzutils "github.com/openkruise/kruise/test/fuzz"
3436
)
3537

3638
var (
@@ -64,15 +66,13 @@ func FuzzValidateWorkloadSpreadSpec(f *testing.F) {
6466
return
6567
}
6668

67-
whiteList, err := cf.GetString()
68-
if err != nil {
69+
whiteList := &configuration.WSCustomWorkloadWhiteList{}
70+
if err := fuzzutils.GenerateWorkloadSpreadWhiteList(cf, whiteList); err != nil {
6971
return
7072
}
71-
if validWhiteList, err := cf.GetBool(); err == nil && validWhiteList {
72-
whiteList = "{\"workloads\":[{\"Group\":\"test\",\"Kind\":\"TFJob\"}]}"
73-
if matched, err := cf.GetBool(); err == nil && matched {
74-
whiteList = "{\"workloads\":[{\"Group\":\"training.kubedl.io\",\"Kind\":\"TFJob\"}]}"
75-
}
73+
whiteListJson, err := json.Marshal(whiteList)
74+
if err != nil {
75+
return
7676
}
7777

7878
fakeClient := fake.NewClientBuilder().
@@ -82,8 +82,8 @@ func FuzzValidateWorkloadSpreadSpec(f *testing.F) {
8282
&appsv1.StatefulSet{ObjectMeta: metav1.ObjectMeta{Name: "valid-target", Namespace: "default"}},
8383
&batchv1.Job{ObjectMeta: metav1.ObjectMeta{Name: "valid-target", Namespace: "default"}},
8484
&appsv1.ReplicaSet{ObjectMeta: metav1.ObjectMeta{Name: "valid-target", Namespace: "default"}},
85-
&corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: "kruise-configuration", Namespace: "kruise-system"},
86-
Data: map[string]string{"WorkloadSpread_Watch_Custom_Workload_WhiteList": whiteList}},
85+
&corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: configuration.KruiseConfigurationName, Namespace: util.GetKruiseNamespace()},
86+
Data: map[string]string{configuration.WSWatchCustomWorkloadWhiteList: string(whiteListJson)}},
8787
).Build()
8888

8989
h := &WorkloadSpreadCreateUpdateHandler{Client: fakeClient}

0 commit comments

Comments
 (0)