OCPBUGS-65926: UPSTREAM: <carry>: backporting fix for concurrent map iteration and write by ingvagabund · Pull Request #75 · openshift/kubernetes-apiserver

ingvagabund · 2025-11-24T13:05:01Z

Mimicking backports as in openshift/kubernetes#2443. This time for openshift-apiserver.

…d write Improve audit context handling by encapsulating event data and operations behind a structured API. Make the Audit system more robust in concurrent environments by properly isolating mutable state. The cleaner API simplifies interaction with audit events, improving maintainability. Encapsulation reduces bugs by preventing direct manipulation of audit events. Signed-off-by: Davanum Srinivas <davanum@gmail.com> Co-Authored-By: Jordan Liggitt <liggitt@google.com> Co-Authored-By: sxllwx <scottwangsxll@gmail.com> Kubernetes-commit: 75afa1e0acfb309d984be14937a06f796f220cd6

Signed-off-by: Davanum Srinivas <davanum@gmail.com> Co-Authored-By: Jordan Liggitt <liggitt@google.com> Set event level during context init Signed-off-by: Davanum Srinivas <davanum@gmail.com> Kubernetes-commit: 960a4939f2502f2a8f2b923203e9075354e4bdc0

… going to use it Signed-off-by: Davanum Srinivas <davanum@gmail.com> Kubernetes-commit: e418ee3a92ca6c670d26f775b0f669e8a5fe233c

… going to use it Signed-off-by: Davanum Srinivas <davanum@gmail.com> Kubernetes-commit: 153233c677d62c0254d54c1e7013645a081ac03d

openshift-ci-robot · 2025-11-24T13:05:09Z

@ingvagabund: This pull request references Jira Issue OCPBUGS-65926, which is invalid:

release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
expected Jira Issue OCPBUGS-65926 to depend on a bug in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Mimicking backports as in openshift/kubernetes#2443. This time for openshift-apiserver.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

ingvagabund · 2025-11-24T13:05:13Z

/hold

ingvagabund · 2025-11-24T13:21:53Z

openshift/openshift-apiserver#580 as evidence the backported commits pass the CI

ingvagabund · 2025-12-02T14:57:16Z

/hold cancel

p0lyn0mial · 2025-12-03T08:24:40Z

was it a clean pick ?
did you run into any conflicts ?

p0lyn0mial · 2025-12-03T08:27:47Z

I think that this repo is used by: openshift-apiserver, oauth-apiserver and oauth-server
we need to test/validate all servers.

also it looks like all these servers are pinned to v0.0.0-20250917144435-182485d204aa // points to openshift-apiserver-4.20-kubernetes-1.33 on the master branches:

https://github.com/openshift/openshift-apiserver/blob/main/go.mod#L197C9-L197C152
https://github.com/openshift/oauth-apiserver/blob/master/go.mod#L147
https://github.com/openshift/oauth-server/blob/master/go.mod#L122

ingvagabund · 2025-12-03T13:32:46Z

was it a clean pick ?
did you run into any conflicts ?

All clean, no conflicts.

Double checking again locally:

ingvagabund · 2025-12-03T13:41:38Z

Evidence PRs:

ingvagabund · 2025-12-03T13:41:58Z

/hold

until all evidence PRs are green

p0lyn0mial · 2025-12-03T14:17:30Z

@ingvagabund since the repos/servers are pinned to v0.0.0-20250917144435-182485d204aa // points to openshift-apiserver-4.20-kubernetes-1.33 on the master branches shouldn't we tests against the master branches ?

ingvagabund · 2025-12-03T21:39:37Z

1.34/master already have the cherry-picked/backported commits based on

https://github.com/kubernetes/apiserver/commits/release-1.34?author=sxllwx (the top commit)
and based on
https://github.com/kubernetes/apiserver/commits/release-1.34?author=dims

Once openshift-apiserver-4.21-kubernetes-1.34 gets created it will be there. So the master branches for all the serves will get tested then. I am not sure when that's going to happen.

ingvagabund · 2025-12-03T21:40:39Z

Looks like https://github.com/openshift/oauth-server has not been bumped to 1.34 yet. Also, since ocp 4.17 all the rebases have been merged into master branch only.

ingvagabund · 2025-12-03T21:56:58Z

From oauth-server:

$ make
go build -mod=vendor -trimpath -ldflags "-X github.com/openshift/oauth-server/pkg/version.versionFromGit="v0.0.0-alpha.0-230-g5161935" -X github.com/openshift/oauth-server/pkg/version.commitFromGit="51619356" -X github.com/openshift/oauth-server/pkg/version.gitTreeState="clean" -X github.com/openshift/oauth-server/pkg/version.buildDate="2025-12-03T21:44:31Z" " github.com/openshift/oauth-server/cmd/oauth-server
# github.com/openshift/oauth-server/pkg/oauth/handlers
pkg/oauth/handlers/default_auth_handler.go:118:17: undefined: audit.AuditEventFrom
make: *** [vendor/github.com/openshift/build-machinery-go/make/targets/golang/build.mk:16: build] Error 1

A valid error since AuditEventFrom got removed.

ingvagabund · 2025-12-03T22:01:44Z

AuditEventFrom partially restored via kubernetes/kubernetes#133765

EDIT: mimicking the code changes from https://github.com/kubernetes/kubernetes/pull/129472/files#diff-4ff3580afd7cb271bca442e8bed618441aca39c8a257e45a5cf329d63e620068R50-R52.

openshift-bot · 2026-03-05T01:00:52Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

openshift-bot · 2026-04-04T08:30:53Z

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

openshift-bot · 2026-05-05T00:00:37Z

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close not-planned

openshift-ci · 2026-05-05T00:01:32Z

@openshift-bot: PRs cannot be closed as Not Planned.

Details

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

sxllwx and others added 4 commits November 24, 2025 13:56

UPSTREAM: 131725: Avoid encoding in LogResponseObject when we are not…

550c6e4

… going to use it Signed-off-by: Davanum Srinivas <davanum@gmail.com> Kubernetes-commit: e418ee3a92ca6c670d26f775b0f669e8a5fe233c

UPSTREAM: 131725: Avoid encoding in LogResponseObject when we are not…

7bc3c99

… going to use it Signed-off-by: Davanum Srinivas <davanum@gmail.com> Kubernetes-commit: 153233c677d62c0254d54c1e7013645a081ac03d

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 24, 2025

openshift-ci Bot requested review from deads2k and tkashem November 24, 2025 13:09

ingvagabund mentioned this pull request Nov 24, 2025

OCPBUGS-65926: chore: sync with o/kubernetes-apiserver openshift-apiserver-4.20-kubernetes-1.33 openshift/openshift-apiserver#580

Open

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 2, 2025

This was referenced Dec 3, 2025

OCPBUGS-65926: chore: sync with o/kubernetes-apiserver openshift-apiserver-4.20-kubernetes-1.33 openshift/oauth-apiserver#159

Open

OCPBUGS-65926: chore: sync with o/kubernetes-apiserver openshift-apiserver-4.20-kubernetes-1.33 openshift/oauth-server#204

Open

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Dec 3, 2025

openshift-ci Bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Mar 5, 2026

openshift-ci Bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Apr 4, 2026

Conversation

ingvagabund commented Nov 24, 2025

Uh oh!

openshift-ci-robot commented Nov 24, 2025

Uh oh!

ingvagabund commented Nov 24, 2025

Uh oh!

ingvagabund commented Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ingvagabund commented Dec 2, 2025

Uh oh!

p0lyn0mial commented Dec 3, 2025

Uh oh!

p0lyn0mial commented Dec 3, 2025

Uh oh!

ingvagabund commented Dec 3, 2025

Uh oh!

ingvagabund commented Dec 3, 2025

Uh oh!

ingvagabund commented Dec 3, 2025

Uh oh!

p0lyn0mial commented Dec 3, 2025

Uh oh!

ingvagabund commented Dec 3, 2025

Uh oh!

ingvagabund commented Dec 3, 2025

Uh oh!

ingvagabund commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ingvagabund commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-bot commented Mar 5, 2026

Uh oh!

openshift-bot commented Apr 4, 2026

Uh oh!

openshift-bot commented May 5, 2026

Uh oh!

openshift-ci Bot commented May 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

ingvagabund commented Nov 24, 2025 •

edited

Loading

ingvagabund commented Dec 3, 2025 •

edited

Loading

ingvagabund commented Dec 3, 2025 •

edited

Loading