Skip to content

USHIFT-6401: Patch unbounded KAS context to break pre-hook deadlock #6635

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
copejon wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

USHIFT-6401: Patch unbounded KAS context to break pre-hook deadlock #6635

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f5bb013
fix(kube-apiserver): Add fail-fast RBAC bootstrap hook deadlock detec…
copejon Apr 7, 2026
d255cf8
Replace context.TODO() with cancelable context in RBAC bootstrap hook
copejon May 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 14 additions & 14 deletions deps/github.com/openshift/kubernetes/pkg/registry/rbac/rest/storage_rbac.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,7 +169,7 @@ func (p *PolicyData) EnsureRBACPolicy() genericapiserver.PostStartHookFunc {
utilruntime.HandleError(fmt.Errorf("unable to initialize client set: %v", err))
return false, nil
}
return ensureRBACPolicy(p, client)
return ensureRBACPolicy(hookContext, p, client)
})
// if we're never able to make it through initialization, kill the API server
if err != nil {
Expand All @@ -180,26 +180,26 @@ func (p *PolicyData) EnsureRBACPolicy() genericapiserver.PostStartHookFunc {
}
}

func ensureRBACPolicy(p *PolicyData, client clientset.Interface) (done bool, err error) {
func ensureRBACPolicy(ctx context.Context, p *PolicyData, client clientset.Interface) (done bool, err error) {
failedReconciliation := false
// Make sure etcd is responding before we start reconciling
if _, err := client.RbacV1().ClusterRoles().List(context.TODO(), metav1.ListOptions{}); err != nil {
if _, err := client.RbacV1().ClusterRoles().List(ctx, metav1.ListOptions{}); err != nil {
utilruntime.HandleError(fmt.Errorf("unable to initialize clusterroles: %v", err))
return false, nil
}
if _, err := client.RbacV1().ClusterRoleBindings().List(context.TODO(), metav1.ListOptions{}); err != nil {
if _, err := client.RbacV1().ClusterRoleBindings().List(ctx, metav1.ListOptions{}); err != nil {
utilruntime.HandleError(fmt.Errorf("unable to initialize clusterrolebindings: %v", err))
return false, nil
}

// if the new cluster roles to aggregate do not yet exist, then we need to copy the old roles if they don't exist
// in new locations
if err := primeAggregatedClusterRoles(p.ClusterRolesToAggregate, client.RbacV1()); err != nil {
if err := primeAggregatedClusterRoles(ctx, p.ClusterRolesToAggregate, client.RbacV1()); err != nil {
utilruntime.HandleError(fmt.Errorf("unable to prime aggregated clusterroles: %v", err))
return false, nil
}

if err := primeSplitClusterRoleBindings(p.ClusterRoleBindingsToSplit, client.RbacV1()); err != nil {
if err := primeSplitClusterRoleBindings(ctx, p.ClusterRoleBindingsToSplit, client.RbacV1()); err != nil {
utilruntime.HandleError(fmt.Errorf("unable to prime split ClusterRoleBindings: %v", err))
return false, nil
}
Expand Down Expand Up @@ -345,17 +345,17 @@ func (p RESTStorageProvider) GroupName() string {

// primeAggregatedClusterRoles copies roles that have transitioned to aggregated roles and may need to pick up changes
// that were done to the legacy roles.
func primeAggregatedClusterRoles(clusterRolesToAggregate map[string]string, clusterRoleClient rbacv1client.ClusterRolesGetter) error {
func primeAggregatedClusterRoles(ctx context.Context, clusterRolesToAggregate map[string]string, clusterRoleClient rbacv1client.ClusterRolesGetter) error {
for oldName, newName := range clusterRolesToAggregate {
_, err := clusterRoleClient.ClusterRoles().Get(context.TODO(), newName, metav1.GetOptions{})
_, err := clusterRoleClient.ClusterRoles().Get(ctx, newName, metav1.GetOptions{})
if err == nil {
continue
}
if !apierrors.IsNotFound(err) {
return err
}

existingRole, err := clusterRoleClient.ClusterRoles().Get(context.TODO(), oldName, metav1.GetOptions{})
existingRole, err := clusterRoleClient.ClusterRoles().Get(ctx, oldName, metav1.GetOptions{})
if apierrors.IsNotFound(err) {
continue
}
Expand All @@ -369,7 +369,7 @@ func primeAggregatedClusterRoles(clusterRolesToAggregate map[string]string, clus
klog.V(1).Infof("migrating %v to %v", existingRole.Name, newName)
existingRole.Name = newName
existingRole.ResourceVersion = "" // clear this so the object can be created.
if _, err := clusterRoleClient.ClusterRoles().Create(context.TODO(), existingRole, metav1.CreateOptions{}); err != nil && !apierrors.IsAlreadyExists(err) {
if _, err := clusterRoleClient.ClusterRoles().Create(ctx, existingRole, metav1.CreateOptions{}); err != nil && !apierrors.IsAlreadyExists(err) {
return err
}
}
Expand All @@ -380,10 +380,10 @@ func primeAggregatedClusterRoles(clusterRolesToAggregate map[string]string, clus
// primeSplitClusterRoleBindings ensures the existence of target ClusterRoleBindings
// by copying Subjects, Annotations, and Labels from the specified source
// ClusterRoleBinding, if present.
func primeSplitClusterRoleBindings(clusterRoleBindingToSplit map[string]rbacapiv1.ClusterRoleBinding, clusterRoleBindingClient rbacv1client.ClusterRoleBindingsGetter) error {
func primeSplitClusterRoleBindings(ctx context.Context, clusterRoleBindingToSplit map[string]rbacapiv1.ClusterRoleBinding, clusterRoleBindingClient rbacv1client.ClusterRoleBindingsGetter) error {
for existingBindingName, clusterRoleBindingToCreate := range clusterRoleBindingToSplit {
// If source ClusterRoleBinding does not exist, do nothing.
existingRoleBinding, err := clusterRoleBindingClient.ClusterRoleBindings().Get(context.TODO(), existingBindingName, metav1.GetOptions{})
existingRoleBinding, err := clusterRoleBindingClient.ClusterRoleBindings().Get(ctx, existingBindingName, metav1.GetOptions{})
if apierrors.IsNotFound(err) {
continue
}
Expand All @@ -392,7 +392,7 @@ func primeSplitClusterRoleBindings(clusterRoleBindingToSplit map[string]rbacapiv
}

// If the target ClusterRoleBinding already exists, do nothing.
_, err = clusterRoleBindingClient.ClusterRoleBindings().Get(context.TODO(), clusterRoleBindingToCreate.Name, metav1.GetOptions{})
_, err = clusterRoleBindingClient.ClusterRoleBindings().Get(ctx, clusterRoleBindingToCreate.Name, metav1.GetOptions{})
if err == nil {
continue
}
Expand All @@ -407,7 +407,7 @@ func primeSplitClusterRoleBindings(clusterRoleBindingToSplit map[string]rbacapiv
newCRB.Subjects = existingRoleBinding.Subjects
newCRB.Labels = existingRoleBinding.Labels
newCRB.Annotations = existingRoleBinding.Annotations
if _, err := clusterRoleBindingClient.ClusterRoleBindings().Create(context.TODO(), newCRB, metav1.CreateOptions{}); err != nil && !apierrors.IsAlreadyExists(err) {
if _, err := clusterRoleBindingClient.ClusterRoleBindings().Create(ctx, newCRB, metav1.CreateOptions{}); err != nil && !apierrors.IsAlreadyExists(err) {
return err
}
}
Expand Down
3 changes: 2 additions & 1 deletion deps/github.com/openshift/kubernetes/pkg/registry/rbac/rest/storage_rbac_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ limitations under the License.
package rest

import (
"context"
"testing"

"k8s.io/client-go/kubernetes/fake"
Expand All @@ -34,6 +35,6 @@ func BenchmarkEnsureRBACPolicy(b *testing.B) {
ClusterRoleBindingsToSplit: bootstrappolicy.ClusterRoleBindingsToSplit(),
}
coreClientSet := fake.NewSimpleClientset()
_, _ = ensureRBACPolicy(policy, coreClientSet)
_, _ = ensureRBACPolicy(context.Background(), policy, coreClientSet)
}
}
28 changes: 14 additions & 14 deletions vendor/k8s.io/kubernetes/pkg/registry/rbac/rest/storage_rbac.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.