interface: [FEP-0001] prevent unsetting ClusterClaim selector terms - #812
Open
Yetkin Timocin (ytimocin) with Copilot wants to merge 1 commit into
Open
interface: [FEP-0001] prevent unsetting ClusterClaim selector terms#812Yetkin Timocin (ytimocin) with Copilot wants to merge 1 commit into
Yetkin Timocin (ytimocin) with Copilot wants to merge 1 commit into
Conversation
Copilot
AI
changed the title
[WIP] Fix immutability bypass for clusterSelectorTerms in ClusterRequest
interface: prevent unsetting ClusterRequest selector terms
Aug 12, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Collaborator
|
The single failing spec ( |
Yetkin Timocin (ytimocin)
force-pushed
the
copilot/fep-0001-fix-clusterrequest-immutability-bypass
branch
from
August 27, 2026 00:40
a669914 to
3626de2
Compare
Yetkin Timocin (ytimocin)
changed the title
ClusterClaim.spec.clusterSelectorTerms could be removed after creation because Kubernetes skips field-level transition rules when an optional field becomes absent. Unsetting the field silently widened the claim to match any member cluster, bypassing the field's immutability contract. Add a spec-level CEL transition rule that requires the field's presence to match between the old and new object, so the selector terms can be neither added nor removed after creation, and cover it with an envtest in the placement API validation suite. Signed-off-by: Yetkin Timocin <ytimocin@microsoft.com>
Yetkin Timocin (ytimocin)
force-pushed
the
copilot/fep-0001-fix-clusterrequest-immutability-bypass
branch
from
August 27, 2026 21:26
3626de2 to
965415c
Compare
Yetkin Timocin (ytimocin)
marked this pull request as ready for review
August 27, 2026 21:40
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ClusterClaim.spec.clusterSelectorTermscould be removed after creation because Kubernetes skips field-level transition rules when an optional field becomes absent. This silently widened the request to match any member cluster.API validation
Add a spec-level CEL presence guard while retaining the existing field-level immutability rule:
// +kubebuilder:validation:XValidation:rule="has(self.clusterSelectorTerms) == has(oldSelf.clusterSelectorTerms)",message="the clusterSelectorTerms field cannot be added or removed after creation"CRD
Regression coverage
clusterSelectorTermsis rejected.Rebased onto
mainafter #803 renamedClusterRequesttoClusterClaim; the rule now lives onClusterClaimSpec.