From 0d8ce8406d1f6f66cff621626ff8d3775ea18f33 Mon Sep 17 00:00:00 2001 From: Arunesh Dwivedi Date: Sat, 29 Aug 2026 09:19:53 +0000 Subject: [PATCH 1/2] fix(yurttunnel): avoid reusing pooled bufio.Reader in getResponse The getResponse function reads HTTP response headers into a bufio.Reader and returns the parsed *http.Response whose Body still reads from the underlying reader. Using a pooled reader and returning it to the pool via defer before the response body is fully consumed causes a data race when another goroutine reuses the same pooled reader. Create a fresh bufio.Reader instead of using the pool to eliminate the race condition. Signed-off-by: Arunesh Dwivedi --- pkg/yurttunnel/server/interceptor.go | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/pkg/yurttunnel/server/interceptor.go b/pkg/yurttunnel/server/interceptor.go index d121bafabce..7fe8473945c 100644 --- a/pkg/yurttunnel/server/interceptor.go +++ b/pkg/yurttunnel/server/interceptor.go @@ -171,8 +171,7 @@ func (ri *RequestInterceptor) ServeHTTP(w http.ResponseWriter, r *http.Request) func getResponse(r io.Reader) (*http.Response, []byte, error) { rawResponse := bytes.NewBuffer(make([]byte, 0, 256)) // Save the bytes read while reading the response headers into the rawResponse buffer - br := newBufioReader(io.TeeReader(r, rawResponse)) - defer putBufioReader(br) + br := bufio.NewReader(io.TeeReader(r, rawResponse)) resp, err := http.ReadResponse(br, nil) if err != nil { return nil, nil, err @@ -272,7 +271,6 @@ func isChunked(response *http.Response) bool { // serverRequest serves the normal requests, e.g., kubectl logs func serveRequest(tunnelConn net.Conn, w http.ResponseWriter, r *http.Request) { br := newBufioReader(tunnelConn) - defer putBufioReader(br) tunnelHTTPResp, err := http.ReadResponse(br, r) if err != nil { klogAndHTTPError(w, http.StatusServiceUnavailable, "could not read response from the tunnel: %v", err) From dd6deda406b529950fb802eb3499778ee23ad133 Mon Sep 17 00:00:00 2001 From: Arunesh Dwivedi Date: Sat, 29 Aug 2026 09:25:23 +0000 Subject: [PATCH 2/2] fix(yurtappset): add StatefulSet watch to reconcile StatefulSet-based workloads The YurtAppSet controller supports StatefulSetTemplate workloads but was missing a Watch for appsv1.StatefulSet objects in add(). This meant reconciler was not notified of StatefulSet mutations and would have stale workload state. Add a Watch for appsv1.StatefulSet with the same OnlyControllerOwner predicate as the existing Deployment watch. Signed-off-by: Arunesh Dwivedi --- .../yurtappset/yurt_app_set_controller.go | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/pkg/yurtmanager/controller/yurtappset/yurt_app_set_controller.go b/pkg/yurtmanager/controller/yurtappset/yurt_app_set_controller.go index be1ee852c25..6fe001158fd 100644 --- a/pkg/yurtmanager/controller/yurtappset/yurt_app_set_controller.go +++ b/pkg/yurtmanager/controller/yurtappset/yurt_app_set_controller.go @@ -194,6 +194,20 @@ func add(mgr manager.Manager, cfg *config.CompletedConfig, r reconcile.Reconcile return err } + err = c.Watch(source.Kind[client.Object]( + mgr.GetCache(), + &appsv1.StatefulSet{}, + handler.EnqueueRequestForOwner( + mgr.GetScheme(), + mgr.GetRESTMapper(), + &unitv1beta1.YurtAppSet{}, + handler.OnlyControllerOwner(), + ), + )) + if err != nil { + return err + } + return nil }