Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Cron: malformed tenant annotation can stop scheduled actions of other tenants

Cerrado
  • ¿Algo no está bien?
#275 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
20/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Estancado
Stack tecnológico
kubernetes, python
Área
backend, cloud

Línea de trabajo

The proposed fix is in openserverless-operator for branch 0.9.0, and PR #144 is already open. Read that pull request and its regression test for two tenants with valid recurring and one-shot actions; done means malformed annotations are rejected and do not prevent other scheduled actions from running.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug

The OpenServerless 0.9.0 Cron scheduler processes scheduled actions from all namespaces in one batch. An authenticated tenant can persist a malformed cron annotation on an action in its own namespace. The scheduler passes that value to the cron parser without checking its type; an uncaught exception can stop the batch before later tenants' actions are processed. The annotation persists, so subsequent scheduled runs can be affected as well.

Impact: cross-tenant availability of scheduled actions when the Cron component is enabled. This requires a normal tenant credential. We found no anonymous entry point, cross-tenant invocation, or credential disclosure in this path.

Proposed change in openserverless-operator for branch 0.9.0: reject non-string, empty, and excessively long cron expressions before parsing; isolate errors while processing each action so one malformed action cannot stop the remaining batch; add a regression test covering two tenants and valid recurring/one-shot actions.

Validation: the regression reproduced the failure before the fix in a local harness and passed afterward with the pinned croniter 1.4.1. In an isolated K3s lab, Alpha and Beta each produced two fresh scheduled heartbeats while a malformed Alpha action existed. A scheduler job logged the malformed Alpha annotation before successfully dispatching Beta's heartbeat action. The malformed action was removed after the test, and the baseline CronJob image was restored.

Proposed fix: https://github.com/apache/openserverless-operator/pull/144 (target branch 0.9.0).

Lenguaje dominante
Python
Estrellas
577
Forks
29
Merge medio
3 d 17 h
PR fusionados (30 d)
4

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de apache/openserverless

Todos los issues de apache/openserverless

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.