Change:
Originally posted by in
Hello, I'm new here. Can I try solving this? it seems like a good first issue
sure, context is the change is needed here: We have to tolerate existing pods / pod specs that fail this validation, so we should only do this additional validation on create or if the existing object passes this validation. To do this: an field to , initialize that field to false, and then conditionally override it to if is non-nil and has a projected token volume path that fails (will have to export the function to check this) , if is false, call the validation on the path:
Hi, I'd like to work on this if there is no one is proceeding on. /assign

Discussion:
return false } <ins> // hasNonLocalProjectedTokenPath return true if spec.Volumes have any entry with non-local projected token path func hasNonLocalProjectedTokenPath(spec *api.PodSpec) bool { for _, volume := range spec.Volumes { if volume.Projected != nil { for _, source := range volume.Projected.Sources { if source.ServiceAccountToken == nil { continue } errs := apivalidation.ValidateLocalNonReservedPath(source.ServiceAccountToken.Path, nil) if len(errs) != 0 { return true } } } } return false } </ins> // GetValidationOptionsFromPodSpecAndMeta returns validation options based on pod specs and metadata func GetValidationOptionsFromPodSpecAndMeta(podSpec, oldPodSpec *api.PodSpec, podMeta, oldPodMeta *metav1.ObjectMeta) apivalidation.PodValidationOptions { // default pod validation options based on feature gate

AllowInvalidTopologySpreadConstraintLabelSelector: false, AllowMutableNodeSelectorAndNodeAffinity:           utilfeature.DefaultFeatureGate.Enabled(features.PodSchedulingReadiness), AllowNamespacedSysctlsForHostNetAndHostIPC:        false, <ins> AllowNonLocalProjectedTokenPath:                   false, </ins> } if oldPodSpec != nil {

opts.AllowInvalidLabelValueInSelector = hasInvalidLabelValueInAffinitySelector(oldPodSpec) // if old spec has invalid labelSelector in topologySpreadConstraint, we must allow it opts.AllowInvalidTopologySpreadConstraintLabelSelector = hasInvalidTopologySpreadConstraintLabelSelector(oldPodSpec) <ins> // if old spec has an invalid projected token volume path, we must allow it opts.AllowNonLocalProjectedTokenPath = hasNonLocalProjectedTokenPath(oldPodSpec) </ins> // if old spec has invalid sysctl with hostNet or hostIPC, we must allow it when update if oldPodSpec.SecurityContext != nil && len(oldPodSpec.SecurityContext.Sysctls) != 0 {

} } <ins> func TestValidateAllowNonLocalProjectedTokenPathOption(t *testing.T) { testCases := []struct { name       string oldPodSpec *api.PodSpec wantOption bool }{ { name:       "Create", wantOption: false, }, { name: "UpdateInvalidProjectedTokenPath", oldPodSpec: &api.PodSpec{ Volumes: []api.Volume{ { Name: "foo", VolumeSource: api.VolumeSource{ Projected: &api.ProjectedVolumeSource{ Sources: []api.VolumeProjection{ { ServiceAccountToken: &api.ServiceAccountTokenProjection{ Path: "../foo", }, }, }, }, }, }, }, }, wantOption: true, }, { name: "UpdateValidProjectedTokenPath", oldPodSpec: &api.PodSpec{ Volumes: []api.Volume{ { Name: "foo", VolumeSource: api.VolumeSource{ Projected: &api.ProjectedVolumeSource{ Sources: []api.VolumeProjection{ { ServiceAccountToken: &api.ServiceAccountTokenProjection{ Path: "foo", }, }, }, }, }, }, }, }, wantOption: false, }, { name: "UpdateEmptyProjectedTokenPath", oldPodSpec: &api.PodSpec{ Volumes: []api.Volume{ { Name: "foo", VolumeSource: api.VolumeSource{ Projected: nil, HostPath:  &api.HostPathVolumeSource{Path: "foo"}, }, }, }, }, wantOption: false, }, } for _, tc := range testCases { t.Run(tc.name, func(t *testing.T) { // Pod meta doesn't impact the outcome. gotOptions := GetValidationOptionsFromPodSpecAndMeta(&api.PodSpec{}, tc.oldPodSpec, nil, nil) if tc.wantOption != gotOptions.AllowNonLocalProjectedTokenPath { t.Errorf("Got AllowNonLocalProjectedTokenPath=%t, want %t", gotOptions.AllowNonLocalProjectedTokenPath, tc.wantOption) } }) } } </ins> func TestDropInPlacePodVerticalScaling(t *testing.T) { podWithInPlaceVerticalScaling := func() *api.Pod { return &api.Pod{

if len(kp.Path) == 0 { allErrs = append(allErrs, field.Required(fldPath.Child("path"), "")) } <del> allErrs = append(allErrs, validateLocalNonReservedPath(kp.Path, fldPath.Child("path"))...) </del> <ins> allErrs = append(allErrs, ValidateLocalNonReservedPath(kp.Path, fldPath.Child("path"))...) </ins> if kp.Mode != nil && (*kp.Mode > 0777 || *kp.Mode < 0) { allErrs = append(allErrs, field.Invalid(fldPath.Child("mode"), *kp.Mode, fileModeErrorMsg)) }

if len(file.Path) == 0 { allErrs = append(allErrs, field.Required(fldPath.Child("path"), "")) } <del> allErrs = append(allErrs, validateLocalNonReservedPath(file.Path, fldPath.Child("path"))...) </del> <ins> allErrs = append(allErrs, ValidateLocalNonReservedPath(file.Path, fldPath.Child("path"))...) </ins> if file.FieldRef != nil { allErrs = append(allErrs, validateObjectFieldSelector(file.FieldRef, &validVolumeDownwardAPIFieldPathExpressions, fldPath.Child("fieldRef"))...) if file.ResourceFieldRef != nil {

} if source.ServiceAccountToken.Path == "" { allErrs = append(allErrs, field.Required(fldPath.Child("path"), "")) <ins> } else if !opts.AllowNonLocalProjectedTokenPath { allErrs = append(allErrs, ValidateLocalNonReservedPath(source.ServiceAccountToken.Path, fldPath.Child("path"))...) </ins> } } if projPath := srcPath.Child("clusterTrustBundlePEM"); source.ClusterTrustBundle != nil {

allErrs = append(allErrs, field.Required(projPath.Child("path"), "")) } <del> allErrs = append(allErrs, validateLocalNonReservedPath(source.ClusterTrustBundle.Path, projPath.Child("path"))...) </del> <ins> allErrs = append(allErrs, ValidateLocalNonReservedPath(source.ClusterTrustBundle.Path, projPath.Child("path"))...) </ins> curPath := source.ClusterTrustBundle.Path if !allPaths.Has(curPath) {

return allErrs } <del> // This validate will make sure targetPath: </del> <ins> // ValidateLocalNonReservedPath makes sure targetPath: </ins> // 1. is not abs path // 2. does not contain any '..' elements // 3. does not start with '..' <del> func validateLocalNonReservedPath(targetPath string, fldPath *field.Path) field.ErrorList { </del> <ins> func ValidateLocalNonReservedPath(targetPath string, fldPath *field.Path) field.ErrorList { </ins> allErrs := field.ErrorList{} allErrs = append(allErrs, validateLocalDescendingPath(targetPath, fldPath)...) // Don't report this error if the check for .. elements already caught it.

AllowInvalidTopologySpreadConstraintLabelSelector bool // Allow node selector additions for gated pods. AllowMutableNodeSelectorAndNodeAffinity bool <ins> // Allow projected token volumes with non-local paths AllowNonLocalProjectedTokenPath bool </ins> // Allow namespaced sysctls in hostNet and hostIPC pods AllowNamespacedSysctlsForHostNetAndHostIPC bool // The top-level resource being validated is a Pod, not just a PodSpec