Skip to content

Fix IntOrString cost estimation when schema has a MaxLength constraint #132837

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

JoelSpeed
Copy link
Contributor

What type of PR is this?

/kind bug

What this PR does / why we need it:

This updates the way that the maximum size of an IntOrString is calculated in the CEL cost estimator to take into account an openapi maxlength constraint.

I was working with someone on a field like:

// request is the minimum amount of the resource required (e.g. "2Mi", "1Gi").
	// This field is optional.
	// When limit is specified, request cannot be greater than limit.
	// +optional
	Request resource.Quantity `json:"request,omitempty"`

We then started adding some CEL rules, for example,

	// +kubebuilder:validation:XValidation:rule="isQuantity(self) && quantity(self).isGreaterThan(quantity('0'))",message="request must be a positive, non-zero quantity"

The API server started to complain of high validation costs. Typically this is because the unbounded string length results in a high MaxElements in the cost estimates.

The usual fix would be to add a maximum length, for example:

	// +kubebuilder:validation:MaxLength=20

But this doesn't work initially because of the way controller-gen is applying different parts of the schema, adding

	// +kubebuilder:validation:XIntOrString

Allows it to produce the following schema:

request:
  anyOf:
  - type: integer
  - type: string
  description: |-
    request is the minimum amount of the resource required (e.g. "2Mi", "1Gi").
    This field is optional.
    When limit is specified, request cannot be greater than limit.
  maxLength: 20 // This is the only part we've added on top of the default schema that controller tools produced
  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
  x-kubernetes-int-or-string: true
  x-kubernetes-validations:
  - message: request must be a non-negative quantity
    rule: isQuantity(self) && quantity(self).isGreaterThan(quantity('0'))

We then noticed that the cost estimates were still particularly high. It turns out, that the logic handling any XIntOrString field isn't correctly observing the MaxLength.

As far as I can tell, the above is a valid schema and the API server appears to accept this schema, and enforce the maximum string length (note int64 has a maximum length of 19 so the integer max length should be covered by this case too, though CELs cost estimates for integers doesn't set a max elements AFAICT)

This PR updates the logic to take into account the max length and resolves our issue.

Which issue(s) this PR is related to:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Fix runtime cost estimation for x-int-or-string custom resource schemas with maximum lengths

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:


@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/bug Categorizes issue or PR as related to a bug. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Jul 9, 2025
@k8s-ci-robot k8s-ci-robot requested a review from cici37 July 9, 2025 11:51
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: JoelSpeed
Once this PR has been reviewed and has the lgtm label, please assign jiahuif for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot requested a review from jpbetz July 9, 2025 11:51
@k8s-ci-robot k8s-ci-robot added area/apiserver sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Jul 9, 2025
@k8s-ci-robot
Copy link
Contributor

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added the needs-priority Indicates a PR lacks a `priority/foo` label and requires one. label Jul 9, 2025
@JoelSpeed
Copy link
Contributor Author

/test all

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/apiserver cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy