From 663719fa1cb025427aea8dc93753f6149bcc20cc Mon Sep 17 00:00:00 2001 From: Jan Wozniak Date: Fri, 27 Sep 2024 13:09:59 +0200 Subject: [PATCH 1/2] webhook: cache miss fallback to direct client for ScaledObject Signed-off-by: Jan Wozniak --- content/docs/2.16/operate/admission-webhooks.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/content/docs/2.16/operate/admission-webhooks.md b/content/docs/2.16/operate/admission-webhooks.md index 7974df0ed..ea94d1318 100644 --- a/content/docs/2.16/operate/admission-webhooks.md +++ b/content/docs/2.16/operate/admission-webhooks.md @@ -10,6 +10,15 @@ By default, the admission webhooks are registered with `failurePolicy: Ignore`, In particular, the admission webhooks for HPA ownership validation can be skipped by setting the annotation `validations.keda.sh/hpa-ownership` to `"false"`. Be cautious when doing so as it exposes the system to potential risks. +### Cache Miss with Fallback to Direct Client for ScaledObject + +When validation enforcement is enabled, it's possible to run into a race condition when `ScaledObject` is part of the same deployment artifact as the `scaleTargetRef` (see also issue: [#5973](https://github.com/kedacore/keda/issues/5973)). For this purpose it's possible to configure additional argument for the webhook `Deployment`: +``` +--cache-miss-to-direct-client=true +``` +This will ensure that if getting the `scaleTargetRef` from the cached client returns `IsNotFound` error, webhook will attempt to getting the object directly from Kubernetes API. + + ## Custom Validations using Kubernetes ValidatingAdmissionPolicy > ⚠️ FEATURE STATE: Kubernetes v1.30 [stable] From 74027b617edd5efdc03e7cb48101997f3881f229 Mon Sep 17 00:00:00 2001 From: Jan Wozniak Date: Mon, 30 Sep 2024 09:35:54 +0200 Subject: [PATCH 2/2] Update content/docs/2.16/operate/admission-webhooks.md Signed-off-by: Jan Wozniak --- content/docs/2.16/operate/admission-webhooks.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/docs/2.16/operate/admission-webhooks.md b/content/docs/2.16/operate/admission-webhooks.md index ea94d1318..74545b8c7 100644 --- a/content/docs/2.16/operate/admission-webhooks.md +++ b/content/docs/2.16/operate/admission-webhooks.md @@ -16,7 +16,7 @@ When validation enforcement is enabled, it's possible to run into a race conditi ``` --cache-miss-to-direct-client=true ``` -This will ensure that if getting the `scaleTargetRef` from the cached client returns `IsNotFound` error, webhook will attempt to getting the object directly from Kubernetes API. +This will ensure that if getting the `scaleTargetRef` from the cached client returns `IsNotFound` error, the webhook will attempt to get the object directly from Kubernetes API. ## Custom Validations using Kubernetes ValidatingAdmissionPolicy