Jordan Liggitt

Packing for #kubecon, excited to see folks next week and talk designs, APIs, bugs, or just catch up. I'll also have a few of these with me to give away. If you want one, or want to talk about the life-changing good news in it, find me next week and let me know.

@dims @kubernetesio @CloudNativeFdn What does it look like I'm doing!?!

Open Source Maintainers every day!! @kubernetesio @CloudNativeFdn

@stefanprodan Ah. That sounds like a bug on their side then. Using the toolchain directive that way would be correct. Using the go.mod version that way is not (that's only a minimum)

@liggitt The issue is not with the Go toolchain but with the GitHub Action which reads the version and if a full semver is specified, then it will install on the CI runner that exact version.

If your app imports client-go, once you update to #Kubernetes 1.30, it will change the Go version of your go.mod to 1.22.0 from 1.22, and the app binaries will be affected by Go stdlib CVEs 💥 You need to modify your GitHub Actions workflows and set the Go version to 1.22.x

@stefanprodan However, the patch version of dependencies should be treated as a minimum, seems like a go bug for it to downgrade you … mind filing a Go issue for that?

@stefanprodan Various go commands put the patch version there automatically, and complain when it isn't present. Was an oversight to not bump that 1.22.2, we'll fix that up asap.

@ibuildthecloud @originalavalamp @dims Original API server wasn't structured that way, but deads2k did a massive series of refactors in 2016-2017 as part of admission and custom resource additions that shifted to that structure. And yes, he was a Java developer in a former life.

Ok, so I do want to clear this one up. First "utils" and saying its java was not directly related, more of a "hey orignal k8s was not idiomatic." Also, I don't really care that much about people using "utils." This kind of got blown out of proportion. And k8s uses util, which is totally different :) But the core api server had some very java-ism built into it. And I want to know if my observations were true. Specifically I believe the admission controllers. There was a dependency injection style to that code. You can tell it was written as though it would become this extensible framework (which never really materialized because extensions went external to k8s). The kubelet never looked like java, just garbage :) So my observation was whoever did the a lot of the original api server stuff had to had been a java developer. The controllers and scheduler, in my opinion, were the least offensive code.

glad we are all new comers in k8s !! Don't feel bad folks.

@the_sttts Gems from that thread: ConfigBucket, ConfigBlob, ConfigDatasNamespacer, ConfigBundle, ConfigInfo, Properties "pluralizing plural things is complicated" "by that precedent Secret should be SecretMap" "Secretmap also sounds like there is treasure to be found"

@the_sttts Config was proposed → ConfigData in #discussion_r32959359" target="_blank" rel="nofollow noopener">github.com/kubernetes/kub… → ConfigMap in #issuecomment-161403620" target="_blank" rel="nofollow noopener">github.com/kubernetes/kub… based on discussion in kubernetes.slack.com/archives/C09R2…

Why ConfigMap, but Secret? Why not Config or SecretMap? Am curious about the history.

@dims @BenTheElder First contribution: work-in-progress PR closed after 5 months without merging 😂

top 2 are probably @BenTheElder and @liggitt !!

@the_sttts "Gonna go WIP this into shape"

Working on some prototype. Git history 🤷‍♂️

@thockin @TitPetric ew, no :)

@TitPetric It's just not aggressive enough about vertical whitespace. Like: { // Stuff }, { // Other stuff } Should be { // Stuff }, { // Other stuff }

PR of the day: net -4K LOC just cleaning up whitespace in tests. gofmt really should do this by default.

@stefanprodan @fluxcd There is no built-in conversion webhook, so I'm confused as well. A reproducer would be super helpful in tracking down the issue. The timing of github.com/fluxcd/flux2/i… looks like this isn't specific to 1.27

@liggitt @fluxcd In Flux we don’t have any webhooks. This error seems to be caused by the Kubernetes builtin conversion webhook. I can’t figure out why it even runs for CRDs that have the conversion strategy set to none.

For @fluxcd users: you may want to delay the upgrade to Kubernetes v1.27.0. Based on our tests, Kubernetes server-side apply sometimes fails with a mysterious conversion error. Running apply in a loop, 1/3 are failing with missing metadata.

@MayaKaczorowski corollary: work on kubernetes, write "etcd" every time you mean "etc" forever

work on containers for like 2 years, write "container" every time you mean "contain" forever

@mauilion @lorenc_dan

@lorenc_dan This leads to one of my favorite questions. “How did this ever work”

As a developer, what's scarier to see? Something that...

@caarlos0 evergreen tweet twitter.com/liggitt/status…

This is your gently reminder that, in YAML, 1.20 == 1.2, so if you want to use go 1.20, you'll need to put it between quotes. #golang #yaml #github

@cveiche @kubernetesio I tagged the group that handles reports into github.com/kubernetes/kub… and made sure they saw it. You should hear back shortly … sorry the wires got crossed.

does anyone know how to reach someone from @kubernetesio security? it's been ~2mo since we've reported something, and we had no ack twitter dm, email, slack, and github issue have all been sent.

@thockin "All I want is a secure system where it's easy to do anything I want. Is that so much to ask?" - xkcd

How it's going...

@lizrice @thockin FYI, the special-case list kubectl uses to format is at #L358" target="_blank" rel="nofollow noopener">github.com/kubernetes/kub… … not sure if I'd recommend trying to chase cases we find or dropping the formatting entirely

@BenTheElder @kubernetesio Little did everyone know Ben had the $3M in his backpack THE WHOLE TIME

Fun fact, which I only just discovered today: This particular post about Google recommitting to funding the @kubernetesio project infrastructure has an interesting cover photo ... That's actually me, that's my bag, at KubeCon San Diego 😂 cncf.io/google-cloud-r…