Fix forceLiveLookupCache key in namespace lifecycle admission (k8s 1.37.0 update) #4522

What exists today

In the kcp Kubernetes fork update to 1.37.0 (kcp-dev/kubernetes#198), the namespace lifecycle admission plugin builds one key and uses it for both the store and the lookup of forceLiveLookupCache:

staging/src/k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle/admission.go (head 5ec79958933dfa6999e77eab9e90b691e26fbcd5)

• line 93: namespaceKey := kcpcache.ToClusterAwareKey(clusterName.String(), "", a.GetName())
• line 101: on a Namespace delete, l.forceLiveLookupCache.Add(namespaceKey, true, forceLiveLookupTTL). Here a.GetName() is the namespace name, so this is correct.
• line 160: l.forceLiveLookupCache.Get(namespaceKey). On this path a is the namespaced object being created (e.g. a Pod), so a.GetName() is the object name, not the namespace name.

The lookup key is cluster|<objectname> but the stored key is cluster|<namespacename>, so the lookup effectively never matches. Upstream reads a.GetNamespace() here.

Impact

The "recently deleted namespace, force a live lookup" guard never fires. When the informer cache is stale (the namespace is still Active locally after a delete), creates into a terminating namespace can be admitted. A match is only possible by accident, when an object's name equals the deleted namespace's name.

What should replace it

Use a separate key for the lookup, built from the object's namespace:

liveKey := kcpcache.ToClusterAwareKey(clusterName.String(), "", a.GetNamespace())
if _, ok := l.forceLiveLookupCache.Get(liveKey); ok {

Keep namespaceKey (from a.GetName()) for the Namespace-delete store at line 101.

Checklist

• Split the key: keep a.GetName() for the store at line 101 and use a.GetNamespace() for the read at line 160.
• Add a unit test in the lifecycle plugin: delete namespace foo in a cluster, keep the lister showing foo as Active, then create a Pod named bar in foo. The create must go through the live lookup and be rejected once foo is Terminating.
• Cover cluster scoping in that test: a delete in cluster A must not force a live lookup in cluster B.
• Update the kcp patch in patches for 1.37 kubernetes-patches#2 and the 1.37.0 branch accordingly.

References

• PR: Update to 1.37.0 kubernetes#198
• Requested in: Update to 1.37.0 kubernetes#198 (comment)
• Original finding: Update to 1.37.0 kubernetes#198 (comment)