Skip to content

Commit

Permalink
Fix churning patch (kube-burner#320)
Browse files Browse the repository at this point in the history
The previous patching implementation was causing warnings b/c it was
removing all the previous labels from the namespace. i.e:

```console
$airflow@414awsovnsmallcpclusterdensity-97775a0f892d4636a9fe8f5a2c677f0c:~/auth kubectl get  namespace/cluster-density-288 --show-labels
NAME                  STATUS   AGE   LABELS
cluster-density-288   Active   58s    churndelete=delete,kube-burner-job=cluster-density,kube-burner-uuid=b509253e-cluster-density-20230524,kubernetes.io/metadata.name=cluster-density-288,pod-security.kubernetes.io/audit=privileged,pod-security.kubernetes.io/enforce=privileged,pod-security.kubernetes.io/warn=privileged,security.openshift.io/scc.podSecurityLabelSync=false
$ kubectl patch ns cluster-density-288 --type=json -p '[{"op":"add","path":"/metadata/labels","value":{"churndelete":"delete"}}]'
Warning: existing pods in namespace "cluster-density-288" violate the new PodSecurity enforce level "restricted:latest"
Warning: cluster-density-1-build: privileged, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true, runAsUser=0, seccompProfile
namespace/cluster-density-288 patched
$ kubectl get  namespace/cluster-density-288 --show-labels    # Note that some of the labels were removed
NAME                  STATUS   AGE   LABELS
cluster-density-288   Active   96s   churndelete=delete,kubernetes.io/metadata.name=cluster-density-288,pod-security.kubernetes.io/enforce-version=v1.24,pod-security.kubernetes.io/enforce=restricted
```

---

Updating the patch expression to `[{"op":"add","path":"/metadata/labels/churndelete","value": "delete"}]` as per [RFC6902](https://datatracker.ietf.org/doc/html/rfc6902#appendix-A.1) states
does not cause this issue:

```console
$ kubectl patch ns cluster-density-300 --type=json -p '[{"op":"add","path":"/metadata/labels/churndelete","value": "delete"}]'
namespace/cluster-density-300 patched
$ kubectl get ns cluster-density-300 --show-labels
NAME                  STATUS   AGE     LABELS
cluster-density-300   Active   6m12s    churndelete=delete,kube-burner-job=cluster-density,kube-burner-uuid=b509253e-cluster-density-20230524,kubernetes.io/metadata.name=cluster-density-300,pod-security.kubernetes.io/audit=privileged,pod-security.kubernetes.io/enforce=privileged,pod-security.kubernetes.io/warn=privileged,security.openshift.io/scc.podSecurityLabelSync=false
```

Signed-off-by: Raul Sevilla <[email protected]>
  • Loading branch information
rsevilla87 authored May 25, 2023
1 parent e343d56 commit be7b493
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion pkg/burner/create.go
Original file line number Diff line number Diff line change
Expand Up @@ -279,7 +279,7 @@ func (ex *Executor) RunCreateJobWithChurn() {
// Create timer for the churn duration
timer := time.After(ex.Config.ChurnDuration)
// Patch to label namespaces for deletion
delPatch := []byte(`[{"op":"add","path":"/metadata/labels","value":{"churndelete":"delete"}}]`)
delPatch := []byte(`[{"op":"add","path":"/metadata/labels/churndelete","value": "delete"}]`)
for {
select {
case <-timer:
Expand Down

0 comments on commit be7b493

Please sign in to comment.