protect admission against empty keys #97

dbenque · 2023-06-28T08:38:59Z

prevent admission to inject corrupted VPA object that would contain a recommendation for a resource that has an empty key like here:

  recommendation:
    containerRecommendations:
    - containerName: event-context-publisher
      lowerBound:
        "": "0"
        cpu: "1"
      target:
        "": "0"
        cpu: "1"
      uncappedTarget:
        cpu: "1"
      upperBound:
        "": "0"
        cpu: "1"

zaymat · 2023-06-28T08:46:28Z

...d-autoscaler/pkg/admission-controller/resource/pod/recommendation/recommendation_provider.go

+	// Ensure that we are not propagating empty resource key if any.
+	for _, resource := range containerResources {
+		if resource.RemoveEmptyResourceKeyIfAny() {
+			klog.Error("An empty resource key was found and purge for pod=%s/%s with vpa=", pod.Namespace, pod.Name, vpa.Name)


Suggested change

klog.Error("An empty resource key was found and purge for pod=%s/%s with vpa=", pod.Namespace, pod.Name, vpa.Name)

klog.Error("An empty resource key was found and purged for pod=%s/%s with vpa=", pod.Namespace, pod.Name, vpa.Name)

dbenque requested review from iksaif and zaymat June 28, 2023 08:38

dbenque force-pushed the david.benque/prevent-empty-resource-propagation branch from b585ae1 to 448e777 Compare June 28, 2023 08:41

iksaif approved these changes Jun 28, 2023

View reviewed changes

dbenque force-pushed the david.benque/prevent-empty-resource-propagation branch from 448e777 to 95e0824 Compare June 28, 2023 08:42

zaymat approved these changes Jun 28, 2023

View reviewed changes

protect admission against empty keys

64dfd92

dbenque force-pushed the david.benque/prevent-empty-resource-propagation branch from a20ff7b to 64dfd92 Compare June 28, 2023 09:29

dbenque merged commit 25a8a96 into datadog-master-vpa-0.13.0 Jun 28, 2023
5 checks passed

dbenque deleted the david.benque/prevent-empty-resource-propagation branch June 28, 2023 16:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

protect admission against empty keys #97

protect admission against empty keys #97

dbenque commented Jun 28, 2023

zaymat Jun 28, 2023

	klog.Error("An empty resource key was found and purge for pod=%s/%s with vpa=", pod.Namespace, pod.Name, vpa.Name)
	klog.Error("An empty resource key was found and purged for pod=%s/%s with vpa=", pod.Namespace, pod.Name, vpa.Name)

protect admission against empty keys #97

protect admission against empty keys #97

Conversation

dbenque commented Jun 28, 2023

zaymat Jun 28, 2023

Choose a reason for hiding this comment