Bug 1848358 - CRDs with preserveUnknownFields:true don't reflect in status that they are non-structural
Summary: CRDs with preserveUnknownFields:true don't reflect in status that they are no...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: kube-apiserver
Version: 4.5
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: 4.7.0
Assignee: Stefan Schimanski
QA Contact: Xingxing Xia
URL:
Whiteboard:
Depends On:
Blocks: 1885620
TreeView+ depends on / blocked
 
Reported: 2020-06-18 08:43 UTC by Stefan Schimanski
Modified: 2022-03-01 11:41 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: preserveUnknowsFields is true in v1beta1 CRDs Consequence: There is no obvious error when "oc explan" does not explain CRD fields Fix: Added a validation condition for non structural schema preserveUnknownFields field Result: Status of v1beta1 CRDs without "preserveUnknownFields:false" will show violation "spec.preserveUnknownFields: Invalid value: true: must be false"
Clone Of:
Environment:
Last Closed: 2021-02-24 15:12:21 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift kubernetes pull 355 0 None closed Bug 1848358: Show error in status if preserve unknown fields is true for nonstructural schemas 2021-02-11 14:34:45 UTC
Red Hat Product Errata RHSA-2020:5633 0 None None None 2021-02-24 15:12:27 UTC

Description Stefan Schimanski 2020-06-18 08:43:10 UTC
Description of problem:

CRDs with preserveUnknownFields:true won't be published via OpenAPI and oc explain will not work. This is intentional. But:

Nothing in the CRD status suggests that preserveUnknownFields:true is the problem. 

How reproducible:

Create a CRD in apiextensions.k8s.io/v1beta1 

- with a structural schema
- but without preserveUnknownFields being set at all. 

The default for that field is true, and hence that CRD won't get a published schema.

Actual results:

`oc explain` won't show descriptions of fields.

Expected results:

The NonStructural condition on the CRD should show: "preserveUnknownFields must not be true".

Comment 1 Venkata Siva Teja Areti 2020-06-18 11:18:50 UTC
I will work on this after finishing up my current tasks.

Comment 2 Venkata Siva Teja Areti 2020-07-09 19:16:23 UTC
I might find some time in this sprint to work on this.

Comment 3 Venkata Siva Teja Areti 2020-07-31 18:46:55 UTC
I am working on other high priority items. I will get to this bug next sprint.

Comment 4 Venkata Siva Teja Areti 2020-08-21 22:02:38 UTC
I am occupied with other priority items. Working on this bug will be re-evaluated in next sprint.

Comment 10 Xingxing Xia 2020-10-15 14:59:54 UTC
First read Stefan's https://kubernetes.io/blog/2019/06/20/crd-structural-schema/ about structural and non-structural schema.
Then create a CRD in apiextensions.k8s.io/v1beta1:
- with a structural schema
- but without preserveUnknownFields being set at all
$ cat crd.yaml
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: testcrs.example.com
spec:
  group: example.com
  names:
    kind: TestCR
    plural: testcrs
  scope: Namespaced
  validation:
    openAPIV3Schema:
      type: object
      description: this is description for the crd
      properties:
        spec:
          type: object
          description: this is description for spec
          properties:
            a:
              type: string
              description: this is description for field a
  version: v1
  versions:
  - name: v1
    served: true
    storage: true

$ oc create -f crd.yaml

Then check oc explain, indeed cannot show description of fields.
Then check oc get crd testcrs.example.com -o yaml, 4.7.0-0.nightly-2020-10-15-051208 env shows condition NonStructuralSchema as below, this is expected by the PR (4.6.0-0.nightly-2020-10-14-095718 env does not show it).
...
spec:
...
  preserveUnknownFields: true
...
  conditions:
  - lastTransitionTime: "2020-10-15T14:50:01Z"
    message: 'spec.preserveUnknownFields: Invalid value: true: must be false'
    reason: Violations
    status: "True"  
    type: NonStructuralSchema

Comment 14 errata-xmlrpc 2021-02-24 15:12:21 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:5633


Note You need to log in before you can comment on or make changes to this bug.