diff --git a/pkg/api/validation/validation.go b/pkg/api/validation/validation.go index 5770adcac6..9eebfd268a 100644 --- a/pkg/api/validation/validation.go +++ b/pkg/api/validation/validation.go @@ -29,6 +29,8 @@ import ( "github.com/golang/glog" + "math" + apiequality "k8s.io/apimachinery/pkg/api/equality" "k8s.io/apimachinery/pkg/api/resource" apimachineryvalidation "k8s.io/apimachinery/pkg/api/validation" @@ -2188,8 +2190,11 @@ func ValidatePodSpec(spec *api.PodSpec, fldPath *field.Path) field.ErrorList { } if spec.ActiveDeadlineSeconds != nil { - if *spec.ActiveDeadlineSeconds <= 0 { - allErrs = append(allErrs, field.Invalid(fldPath.Child("activeDeadlineSeconds"), spec.ActiveDeadlineSeconds, "must be greater than 0")) + if spec.ActiveDeadlineSeconds != nil { + value := *spec.ActiveDeadlineSeconds + if value < 1 || value > math.MaxUint32 { + allErrs = append(allErrs, field.Invalid(fldPath.Child("activeDeadlineSeconds"), value, validation.InclusiveRangeError(1, math.MaxUint32))) + } } } @@ -2575,8 +2580,8 @@ func ValidatePodUpdate(newPod, oldPod *api.Pod) field.ErrorList { // 2. from a positive value to a lesser, non-negative value if newPod.Spec.ActiveDeadlineSeconds != nil { newActiveDeadlineSeconds := *newPod.Spec.ActiveDeadlineSeconds - if newActiveDeadlineSeconds < 0 { - allErrs = append(allErrs, field.Invalid(specPath.Child("activeDeadlineSeconds"), newActiveDeadlineSeconds, isNegativeErrorMsg)) + if newActiveDeadlineSeconds < 0 || newActiveDeadlineSeconds > math.MaxUint32 { + allErrs = append(allErrs, field.Invalid(specPath.Child("activeDeadlineSeconds"), newActiveDeadlineSeconds, validation.InclusiveRangeError(0, math.MaxUint32))) return allErrs } if oldPod.Spec.ActiveDeadlineSeconds != nil { diff --git a/pkg/api/validation/validation_test.go b/pkg/api/validation/validation_test.go index 1d8044debb..671e2de5f8 100644 --- a/pkg/api/validation/validation_test.go +++ b/pkg/api/validation/validation_test.go @@ -17,6 +17,7 @@ limitations under the License. package validation import ( + "math" "reflect" "strings" "testing" @@ -3442,6 +3443,7 @@ func TestValidateDNSPolicy(t *testing.T) { func TestValidatePodSpec(t *testing.T) { activeDeadlineSeconds := int64(30) + activeDeadlineSecondsMax := int64(math.MaxUint32) minUserID := types.UnixUserID(0) maxUserID := types.UnixUserID(2147483647) @@ -3470,6 +3472,21 @@ func TestValidatePodSpec(t *testing.T) { ActiveDeadlineSeconds: &activeDeadlineSeconds, ServiceAccountName: "acct", }, + { // Populate all fields with larger active deadline. + Volumes: []api.Volume{ + {Name: "vol", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}}, + }, + Containers: []api.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}}, + InitContainers: []api.Container{{Name: "ictr", Image: "iimage", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}}, + RestartPolicy: api.RestartPolicyAlways, + NodeSelector: map[string]string{ + "key": "value", + }, + NodeName: "foobar", + DNSPolicy: api.DNSClusterFirst, + ActiveDeadlineSeconds: &activeDeadlineSecondsMax, + ServiceAccountName: "acct", + }, { // Populate HostNetwork. Containers: []api.Container{ {Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File", @@ -3542,6 +3559,7 @@ func TestValidatePodSpec(t *testing.T) { } activeDeadlineSeconds = int64(0) + activeDeadlineSecondsTooLarge := int64(math.MaxUint32 + 1) minUserID = types.UnixUserID(-1) maxUserID = types.UnixUserID(2147483648) @@ -3683,6 +3701,19 @@ func TestValidatePodSpec(t *testing.T) { DNSPolicy: api.DNSClusterFirst, ActiveDeadlineSeconds: &activeDeadlineSeconds, }, + "active-deadline-seconds-too-large": { + Volumes: []api.Volume{ + {Name: "vol", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}}, + }, + Containers: []api.Container{{Name: "ctr", Image: "image", ImagePullPolicy: "IfNotPresent", TerminationMessagePolicy: "File"}}, + RestartPolicy: api.RestartPolicyAlways, + NodeSelector: map[string]string{ + "key": "value", + }, + NodeName: "foobar", + DNSPolicy: api.DNSClusterFirst, + ActiveDeadlineSeconds: &activeDeadlineSecondsTooLarge, + }, "bad nodeName": { NodeName: "node name", Volumes: []api.Volume{{Name: "vol", VolumeSource: api.VolumeSource{EmptyDir: &api.EmptyDirVolumeSource{}}}},