You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "Dennis-Mircea (via GitHub)" <gi...@apache.org> on 2026/08/18 15:42:33 UTC

[PR] [FLINK-40414] Autoscaler state ConfigMap is treated as trusted input [flink-kubernetes-operator]

Dennis-Mircea opened a new pull request, #1184:
URL: https://github.com/apache/flink-kubernetes-operator/pull/1184

   ## What is the purpose of the change
   
   The autoscaler persists its state in a per-resource ConfigMap that is writable by any workload in the namespace (the Flink job Role grants configmaps write for Kubernetes HA), and the operator reads it back and acts on it every cycle. Two gaps let a poisoned entry affect the operator: the read paths are not uniformly fail-closed (one throws into the reconcile loop, one never discards the bad entry), and config overrides are applied to `spec.flinkConfiguration` without filtering, so a crafted entry could inject arbitrary Flink configuration (for example `env.java.opts` or a pod template) into a managed deployment when memory tuning is enabled. This hardens the whole state read boundary and filters config overrides on apply. It complements FLINK-40400 (artifact fetch SSRF) and FLINK-40401 (decompression bomb on the compressed state fields).
   
   ## Brief change log
   
     - `KubernetesAutoScalerStateStore`: all six state reads now route through a single `readState` wrapper that treats the stored value as untrusted and fails closed, discarding the offending entry and returning empty on any deserialization error. This fixes `getConfigChanges` (previously fell back to empty but left the poisoned entry to be re-read every cycle) and `getParallelismOverrides` (previously had no error handling, so a malformed value threw into the reconcile loop).
     - Added positive-integer value sanity for parallelism overrides: entries whose value is not a positive integer are dropped and logged.
     - `deserializeConfigOverrides` now propagates on bad input instead of catching and returning null, so the wrapper discards it uniformly with the other fields.
     - `MemoryTuning.TUNABLE_CONFIG_KEYS`: the allowlist of keys memory tuning is allowed to set, built from the 10 `taskmanager.memory.*` options it emits plus their fallback keys.
     - `JobAutoScalerImpl.dropNonTunableKeys`: filters both overrides and removals of the config changes read from the ConfigMap against that allowlist before `realizeConfigOverrides`, so only memory-tuning keys reach the deployment spec. Dropped keys are logged at WARN.
     - The compressed-field decompress path is intentionally untouched (owned by FLINK-40401). The compressed getters are only rerouted through the wrapper, which additionally turns the existing oversize fallback into a deliberate discard.
   
   ## Verifying this change
   
   This change added tests and can be verified as follows:
   
     - `KubernetesAutoScalerStateStoreTest#testDiscardMalformedConfigOverrides`: a poisoned config-overrides entry is discarded (removed), not silently re-read.
     - `KubernetesAutoScalerStateStoreTest#testParallelismOverridesFailClosedAndSanitized`: a malformed value returns empty instead of throwing, and a valid map keeps only positive-integer entries.
     - `JobAutoScalerImplTest#testConfigOverridesDropNonTunableKeys`: an injected `env.java.opts.all` override and a pod-template removal are dropped while the memory-tuning override is kept.
     - `MemoryTuningTest`: a drift guard asserting every key real tuning emits is contained in `TUNABLE_CONFIG_KEYS`, so the allowlist cannot silently fall behind the tuning logic.
     - Each new test was confirmed to fail when its corresponding fix is reverted in isolation. The full `flink-autoscaler` suite (290 tests) and the operator autoscaler package (40 tests) pass with checkstyle and spotless.
   
   ## Does this pull request potentially affect one of the following parts:
   
     - Dependencies (does it add or upgrade a dependency): no
     - The public API, i.e., is any changes to the `CustomResourceDescriptors`: no
     - Core observer or reconciler logic that is regularly executed: yes, the autoscaler state read path and the config-override apply path run on every scaling cycle
   
   ## Documentation
   
     - Does this pull request introduce a new feature? no
     - If yes, how is the feature documented? not applicable
   
   ---
   
   ##### Was generative AI tooling used to co-author this PR?
   
   <!--
   If generative AI tooling has been used in the process of authoring this PR, please
   change the checkbox below to `[X]` followed by the name of the tool, and uncomment the
   "Generated-by" line. See the ASF Generative Tooling Guidance for details:
   https://www.apache.org/legal/generative-tooling.html
   
   You are responsible for the quality and correctness of every change in this PR
   regardless of the tooling used. Low-effort AI-generated PRs will be closed. See
   AGENTS.md for the full guidance.
   -->
   
   - [ ] Yes (please specify the tool below)
   
   <!--
   Generated-by: [Tool Name and Version]
   -->
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-40414] Autoscaler state ConfigMap is treated as trusted input [flink-kubernetes-operator]

Posted by "gyfora (via GitHub)" <gi...@apache.org>.
gyfora merged PR #1184:
URL: https://github.com/apache/flink-kubernetes-operator/pull/1184


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-40414] Autoscaler state ConfigMap is treated as trusted input [flink-kubernetes-operator]

Posted by "Dennis-Mircea (via GitHub)" <gi...@apache.org>.
Dennis-Mircea commented on PR #1184:
URL: https://github.com/apache/flink-kubernetes-operator/pull/1184#issuecomment-5338866524

   > @Dennis-Mircea can you rebase please
   
   Done!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [FLINK-40414] Autoscaler state ConfigMap is treated as trusted input [flink-kubernetes-operator]

Posted by "gyfora (via GitHub)" <gi...@apache.org>.
gyfora commented on PR #1184:
URL: https://github.com/apache/flink-kubernetes-operator/pull/1184#issuecomment-5338523250

   @Dennis-Mircea can you rebase please
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org