Skip to content

Conversation

@SherlockShemol
Copy link

Previously, when a ConfChange proposal was rejected (e.g., due to an existing pending config change), the proposal was silently converted to a no-op entry without returning any error. This silent failure could lead to security issues where administrators believe a configuration change succeeded when it was actually ignored.

This commit adds error notification while preserving the original behavior of appending a no-op entry for log consistency:

  1. When a ConfChange is rejected, it is still converted to a no-op (maintaining backward compatibility and log consistency)
  2. BUT now returns ErrProposalDropped to notify the caller

This allows callers to:

  • Detect when their ConfChange was rejected
  • Take appropriate action (e.g., wait and retry)
  • Log warnings or alerts

The fix is conservative: it maintains full backward compatibility with existing log structures while adding explicit error notification.

#354

@k8s-ci-robot
Copy link

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: SherlockShemol
Once this PR has been reviewed and has the lgtm label, please assign serathius for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot
Copy link

Hi @SherlockShemol. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@SherlockShemol SherlockShemol force-pushed the fix/confchange-silent-failure branch from 009daef to b438a7c Compare November 30, 2025 07:16
Previously, when a ConfChange proposal was rejected (e.g., due to an
existing pending config change), the proposal was silently converted
to a no-op entry without returning any error. This silent failure could
lead to security issues where administrators believe a configuration
change succeeded when it was actually ignored.

This commit adds error notification while preserving the original
behavior of appending a no-op entry for log consistency:

1. When a ConfChange is rejected, it is still converted to a no-op
   (maintaining backward compatibility and log consistency)
2. BUT now returns ErrProposalDropped to notify the caller

This allows callers to:
- Detect when their ConfChange was rejected
- Take appropriate action (e.g., wait and retry)
- Log warnings or alerts

The fix is conservative: it maintains full backward compatibility
with existing log structures while adding explicit error notification.

Signed-off-by: SherlockShemol <[email protected]>
@SherlockShemol SherlockShemol force-pushed the fix/confchange-silent-failure branch from b438a7c to dc771c5 Compare November 30, 2025 07:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants