Skip to content

Endpoints write permissions removed in OCP 4.21 #642

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mnovak merged 2 commits into from
Apr 16, 2026
Merged

Endpoints write permissions removed in OCP 4.21 #642

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
da3fca4
Endpoints write permissions removed in OCP 4.21
kanovotn Apr 2, 2026
7c7c8d8
Deprecation of EndpointBuilder
kanovotn Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions builder/src/main/java/cz/xtf/builder/OpenShiftApplication.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,6 @@
import cz.xtf.core.openshift.OpenShifts;
import cz.xtf.core.waiting.failfast.FailFastCheck;
import io.fabric8.kubernetes.api.model.ConfigMap;
import io.fabric8.kubernetes.api.model.Endpoints;
import io.fabric8.kubernetes.api.model.PersistentVolumeClaim;
import io.fabric8.kubernetes.api.model.Secret;
import io.fabric8.kubernetes.api.model.Service;
Expand All @@ -37,7 +36,6 @@ public class OpenShiftApplication {
private List<PersistentVolumeClaim> persistentVolumeClaims = new LinkedList<>();
private List<DeploymentConfig> deploymentConfigs = new LinkedList<>();
private List<Service> services = new LinkedList<>();
private List<Endpoints> endpoints = new LinkedList<>();
private List<Route> routes = new LinkedList<>();
private List<ConfigMap> configMaps = new LinkedList<>();
private List<HorizontalPodAutoscaler> autoScalers = new LinkedList<>();
Expand Down Expand Up @@ -120,7 +118,6 @@ private void createResources() {
.filter(x -> !x.getMetadata().getLabels().containsKey(DeploymentConfigBuilder.SYNCHRONOUS_LABEL))
.map(openShift::createDeploymentConfig).collect(Collectors.toList());
deploymentConfigs.addAll(syncDeployments);
endpoints = endpoints.stream().map(openShift::createEndpoint).collect(Collectors.toList());
routes = routes.stream().map(openShift::createRoute).collect(Collectors.toList());
configMaps = configMaps.stream().map(openShift::createConfigMap).collect(Collectors.toList());
autoScalers = autoScalers.stream().map(openShift::createHorizontalPodAutoscaler).collect(Collectors.toList());
Expand Down
8 changes: 8 additions & 0 deletions builder/src/main/java/cz/xtf/builder/builders/EndpointBuilder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,14 @@
import lombok.AllArgsConstructor;
import lombok.Getter;

/**
* @deprecated since v1.1. This class is scheduled for removal in v2.0
* Endpoints were deprecated in Kubernetes v1.33.
* <p>
* Use {@link io.fabric8.kubernetes.api.model.discovery.v1.EndpointSlice}
* @see <a href=https://kubernetes.io/docs/reference/access-authn-authz/rbac/#write-access-for-endpoints>Write access for
* endpoints</a>
*/
public class EndpointBuilder extends AbstractBuilder<Endpoints, EndpointBuilder> {
private final List<String> endpointIPs = new ArrayList<>();
private final List<Port> ports = new ArrayList<>();
Expand Down
20 changes: 17 additions & 3 deletions core/src/main/java/cz/xtf/core/openshift/OpenShift.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -558,7 +558,7 @@ public Pod getAnyPod(String key, String value) {

/**
* Returns random pod with specified labels
*
*
* @param labels labels to be used for filtering
* @return random pod with specified labels
* @throws RuntimeException if no pod is found
Expand Down Expand Up @@ -673,6 +673,14 @@ public boolean deleteService(Service service) {
}

// Endpoints
/**
* Needs a role with write permissions see
* <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#write-access-for-endpoints">Endpoint write
* access</a>
*
* @param endpoint
* @return Endpoints created
*/
public Endpoints createEndpoint(Endpoints endpoint) {
return endpoints().resource(endpoint).create();
}
Comment on lines 684 to 686
Copy link
Copy Markdown

@sourcery-ai sourcery-ai Bot Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion: Consider deprecating the OpenShift endpoint helpers to align with EndpointBuilder and Kubernetes Endpoints deprecation.

Since EndpointBuilder and Kubernetes Endpoints are now deprecated, consider annotating createEndpoint/deleteEndpoint with @Deprecated and referencing the preferred alternative (e.g., EndpointSlice-based flows) so callers don’t add new usage of a phased-out API.

Suggested implementation:

    // Endpoints
    /**
     * Needs a role with write permissions see
     * <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#write-access-for-endpoints">Endpoint write
     * access</a>
     *
     * @param endpoint
     * @return Endpoints created
     * @deprecated Use EndpointSlice-based flows instead of Endpoints. This helper is deprecated to align with
     *             {@code EndpointBuilder} and Kubernetes {@code Endpoints} deprecation.
     */
    @Deprecated
    public Endpoints createEndpoint(Endpoints endpoint) {
        return endpoints().resource(endpoint).create();
    }

You should similarly deprecate the deleteEndpoint helper in the same class. For the deleteEndpoint method:

  1. Add a Javadoc @deprecated tag explaining that callers should migrate to EndpointSlice-based flows (and, if you have a specific replacement API in this project, reference it explicitly).
  2. Add the @Deprecated annotation to the method declaration.

For example, if it currently looks like:

    /**
     * Deletes an Endpoints resource.
     *
     * @param name name of the Endpoints resource
     */
    public void deleteEndpoint(String name) {
        endpoints().withName(name).delete();
    }

update it to:

    /**
     * Deletes an Endpoints resource.
     *
     * @param name name of the Endpoints resource
     * @deprecated Use EndpointSlice-based flows instead of Endpoints. This helper is deprecated to align with
     *             {@code EndpointBuilder} and Kubernetes {@code Endpoints} deprecation.
     */
    @Deprecated
    public void deleteEndpoint(String name) {
        endpoints().withName(name).delete();
    }

Adjust the SEARCH portion of the edit block to match the exact existing Javadoc/method signature in your file.

Expand All @@ -685,6 +693,14 @@ public List<Endpoints> getEndpoints() {
return endpoints().list().getItems();
}

/**
* Needs a role with write permissions see
* <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#write-access-for-endpoints">Endpoint write
* access</a>
*
* @param endpoint
* @return True if Endpoint was deleted
*/
public boolean deleteEndpoint(Endpoints endpoint) {
return !endpoints().resource(endpoint).delete().isEmpty();
}
Expand Down Expand Up @@ -1314,7 +1330,6 @@ public Waiter clean() {
replicationControllers().withLabelNotIn(KEEP_LABEL, "", "true").delete();
buildConfigs().withLabelNotIn(KEEP_LABEL, "", "true").delete();
imageStreams().withLabelNotIn(KEEP_LABEL, "", "true").delete();
endpoints().withLabelNotIn(KEEP_LABEL, "", "true").delete();
services().withLabelNotIn(KEEP_LABEL, "", "true").delete();
builds().withLabelNotIn(KEEP_LABEL, "", "true").delete();
routes().withLabelNotIn(KEEP_LABEL, "", "true").delete();
Expand Down Expand Up @@ -1350,7 +1365,6 @@ List<HasMetadata> listRemovableResources() {
removables.addAll(replicationControllers().withLabelNotIn(OpenShift.KEEP_LABEL, "", "true").list().getItems());
removables.addAll(buildConfigs().withLabelNotIn(OpenShift.KEEP_LABEL, "", "true").list().getItems());
removables.addAll(imageStreams().withLabelNotIn(OpenShift.KEEP_LABEL, "", "true").list().getItems());
removables.addAll(endpoints().withLabelNotIn(OpenShift.KEEP_LABEL, "", "true").list().getItems());
removables.addAll(services().withLabelNotIn(OpenShift.KEEP_LABEL, "", "true").list().getItems());
removables.addAll(builds().withLabelNotIn(OpenShift.KEEP_LABEL, "", "true").list().getItems());
removables.addAll(routes().withLabelNotIn(OpenShift.KEEP_LABEL, "", "true").list().getItems());
Expand Down
Loading