Skip to content

Conversation

@openshift-cherrypick-robot

This is an automated cherry-pick of #2450

/assign ricardomaraschini

NONE

sxllwx and others added 4 commits September 10, 2025 08:02
…d write

Improve audit context handling by encapsulating event data and operations behind a structured API. Make
the Audit system more robust in concurrent environments by properly isolating mutable state. The cleaner
API simplifies interaction with audit events, improving maintainability. Encapsulation reduces bugs
by preventing direct manipulation of audit events.

Signed-off-by: Davanum Srinivas <[email protected]>
Co-Authored-By: Jordan Liggitt <[email protected]>
Co-Authored-By: sxllwx <[email protected]>
Signed-off-by: Davanum Srinivas <[email protected]>
Co-Authored-By: Jordan Liggitt <[email protected]>

Set event level during context init

Signed-off-by: Davanum Srinivas <[email protected]>
… going to use it

Merge pull request kubernetes#131725 from dims/avoid-encoding-in-log-response-object-when-we-dont-need-it
When backporting some changes from upstream's master branch a unit test
ended up being broken. The code covered by this test does not seem to
exist upstream, neither the test file.

The code this commit fixes was introduced by 57c60d8 and we should
squash this one with it once the time for rebasing arrives.

Even though 57c60d8 description reads "UPSTREAM: 115328: annotate early
and late requests" the upstream PR 115328 was closed without merging.
@openshift-ci-robot
Copy link

@openshift-cherrypick-robot: the contents of this pull request could not be automatically validated.

The following commits are valid:

The following commits could not be validated and must be approved by a top-level approver:

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

@openshift-ci openshift-ci bot added the vendor-update Touching vendor dir or related files label Sep 10, 2025
@openshift-ci-robot
Copy link

@openshift-cherrypick-robot: Jira Issue OCPBUGS-61347 has been cloned as Jira Issue OCPBUGS-61488. Will retitle bug to link to clone.
/retitle [release-4.19] OCPBUGS-61488: UPSTREAM: : backporting fix for concurrent map iteration and write

Details

In response to this:

This is an automated cherry-pick of #2450

/assign ricardomaraschini

NONE

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci bot changed the title [release-4.19] OCPBUGS-61347: UPSTREAM: <carry>: backporting fix for concurrent map iteration and write [release-4.19] OCPBUGS-61488: UPSTREAM: <carry>: backporting fix for concurrent map iteration and write Sep 10, 2025
@openshift-ci-robot openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Sep 10, 2025
@openshift-ci-robot
Copy link

@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-61488, which is invalid:

  • expected dependent Jira Issue OCPBUGS-61347 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ON_QA instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This is an automated cherry-pick of #2450

/assign ricardomaraschini

NONE

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@ricardomaraschini
Copy link

/retest

2 similar comments
@ricardomaraschini
Copy link

/retest

@wangke19
Copy link

/retest

@openshift-ci
Copy link

openshift-ci bot commented Sep 12, 2025

@openshift-cherrypick-robot: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@ricardomaraschini
Copy link

/jira refresh

@openshift-ci-robot openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Sep 12, 2025
@openshift-ci-robot
Copy link

@ricardomaraschini: This pull request references Jira Issue OCPBUGS-61488, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.19.z) matches configured target version for branch (4.19.z)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)
  • release note text is set and does not match the template
  • dependent bug Jira Issue OCPBUGS-61347 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
  • dependent Jira Issue OCPBUGS-61347 targets the "4.20.0" version, which is one of the valid target versions: 4.20.0
  • bug has dependents

Requesting review from QA contact:
/cc @wangke19

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot openshift-ci-robot removed the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Sep 12, 2025
@openshift-ci openshift-ci bot requested a review from wangke19 September 12, 2025 07:10
@ricardomaraschini
Copy link

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 12, 2025
@benluddy
Copy link

/approve
/remove-label backports/unvalidated-commits

@openshift-ci openshift-ci bot removed the backports/unvalidated-commits Indicates that not all commits come to merged upstream PRs. label Sep 12, 2025
@openshift-ci
Copy link

openshift-ci bot commented Sep 12, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: benluddy, openshift-cherrypick-robot, ricardomaraschini

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 12, 2025
@ingvagabund
Copy link
Member

/label backport-risk-assessed

@openshift-ci openshift-ci bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Sep 12, 2025
@wangke19
Copy link

/verified by @wangke19
Run unit test TestAuditBackendRaceCondition with the race detector for verification:

$ pr-review.sh openshift-cherrypick-robot:cherry-pick-2450-to-release-4.19
Remote: openshift-cherrypick-robot
Remote branch: cherry-pick-2450-to-release-4.19
Local branch: openshift-cherrypick-robot-cherry-pick-2450-to-release-4.19
Currently on: master
Default branch: master
From github.com:wangke19/kubernetes
 * branch                    master     -> FETCH_HEAD
Fetching branch cherry-pick-2450-to-release-4.19 from openshift-cherrypick-robot...
From github.com:openshift-cherrypick-robot/kubernetes
 * branch                    cherry-pick-2450-to-release-4.19 -> FETCH_HEAD
branch 'openshift-cherrypick-robot-cherry-pick-2450-to-release-4.19' set up to track 'openshift-cherrypick-robot/cherry-pick-2450-to-release-4.19'.
Switched to a new branch 'openshift-cherrypick-robot-cherry-pick-2450-to-release-4.19'

 Shell go test -race ./staging/src/k8s.io/apiserver/pkg/endpoints/filters -run TestAuditBackendRaceCondition -v (Run a specific Go test with the race detector enabled to check for race conditions…  │
 │                                                                                                                                                                                                         │
 │    === RUN   TestAuditBackendRaceCondition                                                                                                                                                              │
 │    === RUN   TestAuditBackendRaceCondition/log_audit_backend                                                                                                                                            │
 │    === RUN   TestAuditBackendRaceCondition/buffered_audit_backend                                                                                                                                       │
 │    === RUN   TestAuditBackendRaceCondition/webhook_audit_backend                                                                                                                                        │
 │    === RUN   TestAuditBackendRaceCondition/union_audit_backend                                                                                                                                          │
 │    --- PASS: TestAuditBackendRaceCondition (120.27s)                                                                                                                                                    │
 │        --- PASS: TestAuditBackendRaceCondition/log_audit_backend (30.03s)                                                                                                                               │
 │        --- PASS: TestAuditBackendRaceCondition/buffered_audit_backend (30.21s)                                                                                                                          │
 │        --- PASS: TestAuditBackendRaceCondition/webhook_audit_backend (30.01s)                                                                                                                           │
 │        --- PASS: TestAuditBackendRaceCondition/union_audit_backend (30.02s)                                                                                                                             │
 │    PASS                                                                                                                                                                                                 │
 │    ok        k8s.io/apiserver/pkg/endpoints/filters  121.353s 

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Sep 12, 2025
@openshift-ci-robot
Copy link

@wangke19: This PR has been marked as verified by @wangke19.

Details

In response to this:

/verified by @wangke19
Run unit test TestAuditBackendRaceCondition with the race detector for verification:

$ pr-review.sh openshift-cherrypick-robot:cherry-pick-2450-to-release-4.19
Remote: openshift-cherrypick-robot
Remote branch: cherry-pick-2450-to-release-4.19
Local branch: openshift-cherrypick-robot-cherry-pick-2450-to-release-4.19
Currently on: master
Default branch: master
From github.com:wangke19/kubernetes
* branch                    master     -> FETCH_HEAD
Fetching branch cherry-pick-2450-to-release-4.19 from openshift-cherrypick-robot...
From github.com:openshift-cherrypick-robot/kubernetes
* branch                    cherry-pick-2450-to-release-4.19 -> FETCH_HEAD
branch 'openshift-cherrypick-robot-cherry-pick-2450-to-release-4.19' set up to track 'openshift-cherrypick-robot/cherry-pick-2450-to-release-4.19'.
Switched to a new branch 'openshift-cherrypick-robot-cherry-pick-2450-to-release-4.19'

Shell go test -race ./staging/src/k8s.io/apiserver/pkg/endpoints/filters -run TestAuditBackendRaceCondition -v (Run a specific Go test with the race detector enabled to check for race conditions…  │
│                                                                                                                                                                                                         │
│    === RUN   TestAuditBackendRaceCondition                                                                                                                                                              │
│    === RUN   TestAuditBackendRaceCondition/log_audit_backend                                                                                                                                            │
│    === RUN   TestAuditBackendRaceCondition/buffered_audit_backend                                                                                                                                       │
│    === RUN   TestAuditBackendRaceCondition/webhook_audit_backend                                                                                                                                        │
│    === RUN   TestAuditBackendRaceCondition/union_audit_backend                                                                                                                                          │
│    --- PASS: TestAuditBackendRaceCondition (120.27s)                                                                                                                                                    │
│        --- PASS: TestAuditBackendRaceCondition/log_audit_backend (30.03s)                                                                                                                               │
│        --- PASS: TestAuditBackendRaceCondition/buffered_audit_backend (30.21s)                                                                                                                          │
│        --- PASS: TestAuditBackendRaceCondition/webhook_audit_backend (30.01s)                                                                                                                           │
│        --- PASS: TestAuditBackendRaceCondition/union_audit_backend (30.02s)                                                                                                                             │
│    PASS                                                                                                                                                                                                 │
│    ok        k8s.io/apiserver/pkg/endpoints/filters  121.353s 

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-merge-bot openshift-merge-bot bot merged commit 335be3a into openshift:release-4.19 Sep 12, 2025
24 checks passed
@openshift-ci-robot
Copy link

@openshift-cherrypick-robot: Jira Issue Verification Checks: Jira Issue OCPBUGS-61488
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-61488 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

This is an automated cherry-pick of #2450

/assign ricardomaraschini

NONE

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-bot
Copy link

[ART PR BUILD NOTIFIER]

Distgit: openshift-enterprise-pod
This PR has been included in build openshift-enterprise-pod-container-v4.19.0-202509121737.p0.g335be3a.assembly.stream.el9.
All builds following this will include this PR.

@openshift-bot
Copy link

[ART PR BUILD NOTIFIER]

Distgit: kube-proxy
This PR has been included in build kube-proxy-container-v4.19.0-202509121737.p0.g335be3a.assembly.stream.el9.
All builds following this will include this PR.

@openshift-bot
Copy link

[ART PR BUILD NOTIFIER]

Distgit: openshift-enterprise-hyperkube
This PR has been included in build openshift-enterprise-hyperkube-container-v4.19.0-202509121737.p0.g335be3a.assembly.stream.el9.
All builds following this will include this PR.

@openshift-bot
Copy link

[ART PR BUILD NOTIFIER]

Distgit: ose-installer-kube-apiserver-artifacts
This PR has been included in build ose-installer-kube-apiserver-artifacts-container-v4.19.0-202509121737.p0.g335be3a.assembly.stream.el9.
All builds following this will include this PR.

@openshift-merge-robot
Copy link

Fix included in accepted release 4.19.0-0.nightly-2025-09-13-202922

@ricardomaraschini
Copy link

/cherry-pick release-4.18

@openshift-cherrypick-robot
Copy link
Author

@ricardomaraschini: #2456 failed to apply on top of branch "release-4.18":

Applying: UPSTREAM: 129472: Fix API server crash on concurrent map iteration and write
Applying: UPSTREAM: 131694: Eliminate AuditContext`s SetEventLevel
Using index info to reconstruct a base tree...
M	staging/src/k8s.io/apiserver/pkg/endpoints/handlers/delete_test.go
Falling back to patching base and 3-way merge...
Auto-merging staging/src/k8s.io/apiserver/pkg/endpoints/handlers/delete_test.go
CONFLICT (content): Merge conflict in staging/src/k8s.io/apiserver/pkg/endpoints/handlers/delete_test.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0002 UPSTREAM: 131694: Eliminate AuditContext`s SetEventLevel

Details

In response to this:

/cherry-pick release-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-merge-bot bot added a commit that referenced this pull request Oct 23, 2025
[release-4.18] OCPBUGS-61773: UPSTREAM: <carry>: backporting fix for concurrent map iteration and write #2456
openshift-merge-bot bot added a commit that referenced this pull request Oct 28, 2025
…2475-to-release-4.17

[release-4.17] OCPBUGS-63460: UPSTREAM: <carry>: backporting fix for concurrent map iteration and write #2456
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. vendor-update Touching vendor dir or related files verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.