kubernetes: Failed test operation in JSON Patch should return 4xx, not 500 Internal Server Error

Is this a BUG REPORT or FEATURE REQUEST?:

/kind bug

What happened: Making a PATCH request to a resource (e.g. deployment) with an RFC6902 JSON Patch that contains a test operation that is false results in a 500 Internal Server Error with response body

{
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Failure",
    "message": "Testing value /resourceVersion failed",
    "code": 500
}

What you expected to happen: The server should not apply the patch and return a 4xx status code so the client can react (e.g. update local state, retry). A test is commonly used as safe guard to ensure the resource is in the state it is expected to be when applying the patch (imagine updating an array index - if the resource changed in the meantime and the indexes were shifted the patch could have catastrophic consequences). Clients need to be able to react to this.

The most appropriate status code for this seems 409 Conflict, see https://tools.ietf.org/html/rfc5789#section-2.2

Conflicting state: Can be specified with a 409 (Conflict) status code when the request cannot be applied given the state of the resource. For example, if the client attempted to apply a structural modification and the structures assumed to exist did not exist (with XML, a patch might specify changing element ‘foo’ to element ‘bar’ but element ‘foo’ might not exist).

How to reproduce it (as minimally and precisely as possible): Make a PATCH request to a deployment with the content

[{"op": "test", "path": "/metadata/resourceVersion", "value": "nottheresourceversion"}]

and Content-Type application/json-patch+json.

Anything else we need to know?:

Environment:

  • Kubernetes version (use kubectl version): v1.10.3
  • Cloud provider or hardware configuration: Docker for desktop
  • OS (e.g. from /etc/os-release): macOS
  • Kernel (e.g. uname -a):
  • Install tools:
  • Others:

Related: https://github.com/kubernetes/kubernetes/issues/54423

About this issue

  • Original URL
  • State: closed
  • Created 6 years ago
  • Comments: 15 (7 by maintainers)

Most upvoted comments

These should probably return 409 conflict errors.