WIP: First cut at input validation for Kubelet

* Add some util functions for basic validation
* Spec api fields more tightly
* Break a dep from util -> api, so I can do the reverse
* Add functions to validate structures
* Call those functions when running manifests

This does not validate as it unmarshals YAML or JSON because I want to be able
to validate structures that come from other inputs without forcing them to be
YAML.

This does not handle all api structures - I am not familiar wnough with the
rest to spec them this tightly - I hope someone else can do that.

There are a number of open questions, marked "FIXME".  Please offer feedback
or opinions.
As it exists today, even the file source is on a poll loop it's on a
different frequency than the sync loop, but it's still polling and
re-sending all file contents on every loop.  What we *should* be doing
(eventually) is making each source as low-overhead as possible, submitting
updates only when they are actually changed.  File source, for example,
should use inotify or something so it doesn't submit the same pods over and
over.  Once we get to that state, it doesn't matter where validation
happens because it will only happen when we actually believe there was a
change (e.g. an inotify() said there was).

In short, moving this check out towards the sources doesn't help at all
right now (still polling), makes work for each source, and doesn't even
help in the long-term.

Or did I misunderstand your remark?


On Fri, Jun 27, 2014 at 11:53 PM, Justin Huff <notifications@github.com>
wrote:

> In pkg/kubelet/kubelet.go:
>
> > @@ -726,12 +726,18 @@ func (kl *Kubelet) RunSyncLoop(updateChannel <-chan manifestUpdate, handler Sync
> >  		case <-time.After(kl.SyncFrequency):
> >  		}
> >
> > -		manifests := []api.ContainerManifest{}
> > -		for _, m := range last {
> > -			manifests = append(manifests, m...)
> > +		allManifests := []api.ContainerManifest{}
> > +		for src, manifests := range last {
> > +			for _, m := range manifests {
> > +				if err := api.ValidateManifest(&m); err != nil {
>
> I'd lean towards doing it in the update chan as it's the common point of
> ingestion to the kubelet vs doing it on every single sync pass.
>
> We should also run validate in the master -- but that's more so we can
> propagate reasonable errors back to a client/user.
>
> --
> Reply to this email directly or view it on GitHub
> <https://github.com/GoogleCloudPlatform/kubernetes/pull/280/files#r14322917>
> .
>