kubernetes-sigs / lws / 32169438917

61%

push

github

Verify controller ownership before GetForRole/Scale/legacy-slice0 mutate an LWS (#983)

* Verify controller ownership before GetForRole/Scale/legacy-slice0/Create mutate an LWS

GetForRole and Scale looked up an LWS by its generated name only, with
no check that the found object is actually controller-owned by the
DisaggregatedSet calling them. During rapid same-name recreation (a DS
named "foo" is deleted and a new one also named "foo" is created
before garbage collection removes the old one's LWS objects), the new
controller's reconcileRoleSimple could find and then Scale the old
"foo"'s still-present LWS - mutating an object it doesn't own. This is
the same class of bug already fixed for List via metav1.IsControlledBy;
GetForRole/Scale are a separate code path that fix didn't cover.

recreateLegacySlice0 had the identical gap: it fetched a legacy-named
LWS by raw Get with no ownership check before deleting it to make way
for the slice-aware migration.

- Added LeaderWorkerSetManager.getOwned, an ownership-filtered wrapper
  around Get (mirrors List's existing filtering). GetForRole now uses
  it for both the slice-aware and legacy-name lookups; a foreign-owned
  LWS at either name is treated as absent rather than returned.
- Scale now takes the DisaggregatedSet (instead of a bare namespace)
  and refuses to patch a same-named LWS that isn't controller-owned by
  it, returning an error instead of silently mutating a foreign object.
  Updated all three call sites (reconcileRoleSimple, scaleUpNew, and
  the scale-down path in executor.go).
- recreateLegacySlice0 uses getOwned instead of a raw Get before
  deleting a legacy-named LWS.
- Create's AlreadyExists handling now checks ownership too: if the
  taken name is owned by this DisaggregatedSet, it's a benign
  concurrent-reconcile race (no-op, as before); if foreign-owned, it
  now errors instead of silently returning success, so the reconcile
  requeues. A silent no-op here would otherwise be perma... (continued)

26 of 29 new or added lines in 3 files covered. (89.66%)

2664 of 4390 relevant lines covered (60.68%)

47.44 hits per line