From 4cdfcfbd79262ec937da5480816aebedea9c5856 Mon Sep 17 00:00:00 2001
From: Maciej Szulik <maszulik@redhat.com>
Date: Wed, 26 Oct 2016 12:11:44 +0200
Subject: [PATCH] UPSTREAM: 35608: Update PodAntiAffinity to ignore calls to
 subresources

---
 .../pkg/admission/antiaffinity/admission.go   |  3 +-
 .../admission/antiaffinity/admission_test.go  | 58 +++++++++++++++++++
 2 files changed, 60 insertions(+), 1 deletion(-)

diff --git a/vendor/k8s.io/kubernetes/plugin/pkg/admission/antiaffinity/admission.go b/vendor/k8s.io/kubernetes/plugin/pkg/admission/antiaffinity/admission.go
index 50cb5a5f8cb1..7088126c1b2b 100644
--- a/vendor/k8s.io/kubernetes/plugin/pkg/admission/antiaffinity/admission.go
+++ b/vendor/k8s.io/kubernetes/plugin/pkg/admission/antiaffinity/admission.go
@@ -51,7 +51,8 @@ func NewInterPodAntiAffinity(client clientset.Interface) admission.Interface {
 // Admit will deny any pod that defines AntiAffinity topology key other than unversioned.LabelHostname i.e. "kubernetes.io/hostname"
 // in  requiredDuringSchedulingRequiredDuringExecution and requiredDuringSchedulingIgnoredDuringExecution.
 func (p *plugin) Admit(attributes admission.Attributes) (err error) {
-	if attributes.GetResource().GroupResource() != api.Resource("pods") {
+	// Ignore all calls to subresources or resources other than pods.
+	if len(attributes.GetSubresource()) != 0 || attributes.GetResource().GroupResource() != api.Resource("pods") {
 		return nil
 	}
 	pod, ok := attributes.GetObject().(*api.Pod)
diff --git a/vendor/k8s.io/kubernetes/plugin/pkg/admission/antiaffinity/admission_test.go b/vendor/k8s.io/kubernetes/plugin/pkg/admission/antiaffinity/admission_test.go
index 3c8d2b9e550c..e391faa89116 100644
--- a/vendor/k8s.io/kubernetes/plugin/pkg/admission/antiaffinity/admission_test.go
+++ b/vendor/k8s.io/kubernetes/plugin/pkg/admission/antiaffinity/admission_test.go
@@ -22,6 +22,7 @@ import (
 	"k8s.io/kubernetes/pkg/admission"
 	"k8s.io/kubernetes/pkg/api"
 	"k8s.io/kubernetes/pkg/api/unversioned"
+	"k8s.io/kubernetes/pkg/runtime"
 )
 
 // ensures the hard PodAntiAffinity is denied if it defines TopologyKey other than kubernetes.io/hostname.
@@ -239,3 +240,60 @@ func TestHandles(t *testing.T) {
 		}
 	}
 }
+
+// TestOtherResources ensures that this admission controller is a no-op for other resources,
+// subresources, and non-pods.
+func TestOtherResources(t *testing.T) {
+	namespace := "testnamespace"
+	name := "testname"
+	pod := &api.Pod{
+		ObjectMeta: api.ObjectMeta{Name: name, Namespace: namespace},
+	}
+	tests := []struct {
+		name        string
+		kind        string
+		resource    string
+		subresource string
+		object      runtime.Object
+		expectError bool
+	}{
+		{
+			name:     "non-pod resource",
+			kind:     "Foo",
+			resource: "foos",
+			object:   pod,
+		},
+		{
+			name:        "pod subresource",
+			kind:        "Pod",
+			resource:    "pods",
+			subresource: "eviction",
+			object:      pod,
+		},
+		{
+			name:        "non-pod object",
+			kind:        "Pod",
+			resource:    "pods",
+			object:      &api.Service{},
+			expectError: true,
+		},
+	}
+
+	for _, tc := range tests {
+		handler := &plugin{}
+
+		err := handler.Admit(admission.NewAttributesRecord(tc.object, nil, api.Kind(tc.kind).WithVersion("version"), namespace, name, api.Resource(tc.resource).WithVersion("version"), tc.subresource, admission.Create, nil))
+
+		if tc.expectError {
+			if err == nil {
+				t.Errorf("%s: unexpected nil error", tc.name)
+			}
+			continue
+		}
+
+		if err != nil {
+			t.Errorf("%s: unexpected error: %v", tc.name, err)
+			continue
+		}
+	}
+}