[pull] master from kubernetes:master #838

The `k8s.io/utils/ptr` should be allowed for import within ./pkg/apis/core Signed-off-by: Jian Zeng <[email protected]>

daemonset registry: add unit test for UpdateStatus

kubelet: new kubelet config option for disabling group oom kill

Add plugin and key-cache for ExternalJWTSigner integration

Reusing types from the alpha in the beta made it possible to provide and use both versions without conversion. The downside was that removal of the alpha would have been harder, if not impossible. DRA drivers could continue to use the alpha types and provided the beta interface automatically. Now the two versions are completely separate gRPC APIs, although in practice there are no differences besides the name. Support for the alpha API in kubelet is provided via automatically generated conversion and manually written interface wrappers. Those are provided as part of the v1alpha4 package. The advantage of having all of that in a central place is that it'll be easier to remove when no longer needed.

Signed-off-by: Lan Liang <[email protected]>

…e name

…einghint add integration test for volumebinding for queueinghint

Fix flake in CEL cost stability tests

Signed-off-by: bzsuni <[email protected]>

This fixes an issue in TestSchedulerPerf/SteadyStateClusterResourceClaimTemplate: scheduler_perf.go:1542: FATAL ERROR: op 7: delete scheduled pods: client rate limiter Wait returned an error: rate: Wait(n=1) would exceed context deadline That occurs when the test is almost done, but hasn't observed all scheduled pods yet. The previous attempt to address this error wasn't actually 100% correct. It covered the case when the context has already been canceled, but not this particular "will reach deadline soon".

node-lifecycle-controller: improve processPod test-coverage

…cies-we-track Add go-spew to unwanted dependencies we track

* Add status * Add validation to check if fields are correct (Network field, device has been allocated)) * Add feature-gate * Drop field if feature-gate not set Signed-off-by: Lionel Jouin <[email protected]>

Signed-off-by: Lionel Jouin <[email protected]>

* Test feature-gate enabled/disabled for validation * Test pkg/registry/resource/resourceclaim * Add Data and NetworkData to integration test Signed-off-by: Lionel Jouin <[email protected]>

Signed-off-by: Lionel Jouin <[email protected]>

Adapat validation and tests based on these API changes Signed-off-by: Lionel Jouin <[email protected]>

Signed-off-by: Lionel Jouin <[email protected]>

* Rename HWAddress to HardwareAddress * Fix condition validation * Remove feature gate validation * Fix drop field on disabled feature gate Signed-off-by: Lionel Jouin <[email protected]>

* Add max length for InterfaceName and HardwareAddress * Prevent duplicated Addresses Signed-off-by: Lionel Jouin <[email protected]>

Signed-off-by: Lionel Jouin <[email protected]>

Signed-off-by: utam0k <[email protected]>

[Sidecar Containers] Pods comparison by maxContainerRestarts should account for sidecar containers

…text call cancel on plugin that is replaced by another plugin with the same name

Bug fix: MutatingAdmissionPolicy should default builtin types after each mutation

scheduler_perf: fix steady-state pod creation/deletion

We are still only calling NodeExpand after the volume is mounted. avoid depending on ASW from dswp.findAndAddNewPods(). It is weird to determine desired state based on actual state.

Add integration test for NodeVolumeLimits in requeueing scenarios

…elinux/v1.11.1 Dependences: update opencontainers/selinux to v1.11.1

remove csi translator from volume operation generator

Remove PodHostIPs feature gates

Add random interval to nodeStatusReport interval every time after an actual node status change

…est case

With the ClientsAllowCBOR client-go feature gate enabled, a 415 response to a CBOR-encoded REST causes all subsequent requests from the client to fall back to a JSON request encoding. This mechanism had only worked as intended when CBOR was explicitly configured in the ClientContentConfig. When both ClientsAllowCBOR and ClientsPreferCBOR are enabled, an unconfigured (empty) content type defaults to CBOR instead of JSON. Both ways of configuring a client to use the CBOR request encoding are now subject to the same fallback mechanism.

Clients must be able to use CBOR without a guarantee that all apiservers support it. The apiserver aggregation layer avoids changing in any way that would require an aggregated apiservers to be updated. This end-to-end test verifies that a client's content negotiation behaviors continue to work over time when communicating with a 1.17 sample-apiserver.

Signed-off-by: Yuki Iwai <[email protected]>

* Replace PollImmediate with PollUntilContextTimeout Signed-off-by: Omer Aplatony <[email protected]> * Add context to RetryErrorCondition function Signed-off-by: Omer Aplatony <[email protected]> * lint: fix error comparison in scale package Signed-off-by: Omer Aplatony <[email protected]> * Fix RetryErrorCondition function signature Signed-off-by: Omer Aplatony <[email protected]> * revert to if err statement Signed-off-by: Omer Aplatony <[email protected]> --------- Signed-off-by: Omer Aplatony <[email protected]>

refresh probed plugins on init to avoid probe race/erroneous unmounts

DRA kubelet: separate beta and alpha gRPC APIs

Since the GA graduation of memory manager in #128517 we are sharing the initial container map across managers. The intention of this sharing was not to actually share a data structure, but 1. save the relatively expensive relisting from runtime 2. have all the managers share a consistent view - even though the chance for misalignement tend to be tiny. The unwanted side effect though is now all the managers race to modify a data shared, not thread safe data structure. The fix is to clone (deepcopy) the computed map when passing it to each manager. This restores the old semantic of the code. This issue brings the topic of possibly managers go out of sync since each of them maintain a private view of the world. This risk is real, yet this is how the code worked for most of the lifetime, so the plan is to look at this and evaluate possible improvements later on. Signed-off-by: Francesco Romani <[email protected]>

remove loggedDeprecationWarnings from VolumePluginMgr

feat: graduate SchedulerQueueingHints to beta

…erLeaseMultiCombined flake(TestReconcilerAPIServerLeaseMultiCombined): fix TestReconcilerAPIServerLeaseMultiCombined flake

mark the status of fake node as NotReady

…atic topology policy New gate "InPlacePodVerticalScalingExclusiveCPUs" is off by default, but can be enabled to unblock development of Static CPU management alongside InPlacePodVerticalScaling.

…s the timeout issue

…mment Job: Add evaluation step comments in the syncJob

KEP-4222: Fix JSON fallback for clients using default content-type and add E2E client test.

clustertrustbundles: extend alpha for 2 more releases

Signed-off-by: Laura Lorenz <[email protected]>

…ver-side API: add a new `Stream` field to `PodLogOptions`

feature(KEP-4832): asynchronous preemption

[FG:InPlacePodVerticalScaling] PLEG watch conditions: rapid polling for expected changes

kubelet: don't check for mounted before update dsw PV size

…anagers node: cm: don't share containerMap instances between managers

- add a new boolean field IgnoreStoreReadErrorWithClusterBreakingPotential to meta/v1 DeleteOptions - add validation for the new delete option add validation for the new field in the delete options ignoreStoreReadErrorWithClusterBreakingPotential - prevent the pod eviction handler from issuing an unsafe pod delete prevent the pod eviction handler from enabling the 'ignoreStoreReadErrorWithClusterBreakingPotential' delete option

Signed-off-by: Nic <[email protected]>

This commit introduces: 1. Cleanups in port-forwarding error handling code, which ensures that we only compare lowercased text always. 2. E2E verifying that when a pod is removed a port-forward is stopped. Signed-off-by: Maciej Szulik <[email protected]>

runc/libcontainer/cgroups.ParseCgroupFile is a universal function; for cgroup v2 it returns path to unified in a map with "" as a key. Let's use it here, dropping cgroups dependency entirely. Amends commit e86d02b. Signed-off-by: Kir Kolyshkin <[email protected]>

Kubelet: Remove runonce mode

fix the issue of losing the pending phase after a node restart.

trustbundles: add a new kube-apiserver-serving signer

fix: move the queueing integration tests to another package to address the timeout issue

Update staging docs to add externaljwt

This was added to Go 1.21, and makes the code simpler. (Best reviewed ignoring changes in amount of whitespace). Signed-off-by: Kir Kolyshkin <[email protected]>

Signed-off-by: Lionel Jouin <[email protected]>

Promote StatefulSetAutoDeletePVC to stable in 1.32

…10minuterecoverythreshold KEP-4603: Maintain current 10 minute recovery threshold for container backoff regardless of changes to the maximum duration

Move broadcast of key updates into sync, fixup of externaljwt generation / test

run 'make update' to code gen for changes in meta/v1 DeleteOptions

- implement unsafe deletion, and wire it - aggregate corrupt object error(s) from the storage LIST operation - extend storage error: a) add a new type ErrCodeCorruptObj to represent a corrupt object: b) add a new member 'InnerErr error' to StorageError to hold the inner error - add API status error

- add an integration test that exercises the unsafe delete flow - extend newTransformTest to enable RBAC - add integration test to verify that LIST returns corrupt object keys

add access control check to ensure that the user has permission to do 'unsafe-delete-ignore-read-error' on the resource being deleted

[FG:InPlacePodVerticalScaling] Fix backoff problem when quickly reverting resize patch

Fix OIDC flags

Client go port forward reset, error handling and tests

Add statusz endpoint for apiserver

add warnings for cases one of projected volume types get overwritten by service account token

…ize-delay [FG:InPlacePodVerticalScaling] bug(quota): handle resources changed on resource quota filter

[FG:InPlacePodVerticalScaling] kubelet: Propagate error in doPodResizeAction() to the caller

KEP-3926: unsafe deletion of corrupt objects

…-vertical-scaling-version-skew Updated version skew strategy for InPlacePodVerticalScaling

DRA: Implementation of ResourceClaim.Status.Devices (KEP-4817)

kubelet/kuberuntime: switch to runc/libct

Fix error check

Refactor: Move IsRestartableInitContainer to common utility package

Signed-off-by: Bo Wang <[email protected]>

1. Add Resources struct to PodSpec struct in both external and internal API packages 2. Adding feature gate and logic for dropping disabled fields for Pod Level Resources KEP: enhancements/keps/sig-node/2837-pod-level-resource-spec

1. Add support for pod level resources in kubectl 2. Reuse the existing method to describe container resources and generalize it to describe both pod and container level resources

1. If pod-level limit is set, pod-level request is unset and container-level request is set: derive pod-level request from container-level requests 2. If pod-level limit is set, pod-level request is unset and container-level request is unset: set pod-level request equal to pod-level limit

1. The effective container requests cannot be greater than pod-level requests 2. Inidividual container limits cannot be greater than pod-level limits 3. Only CPU & Memory are supported at pod-level 4. Inplace container resources updates are not supported if pod-level resources are set Note: effective container requests cannot be greater than pod-level limits is supported by transitivity. Effective container requests <= pod-level requests && pod-level requests <= pod-level limits; Therefore effective container requests <= pod-level limits Signed-off-by: ndixita <[email protected]>

1. Use pod-level resource when feature is enabled and resources are set at pod-level 2. Edge case handling: When a pod defines only CPU or memory limits at pod-level (but not both), and container-level requests/limits are unset, the pod-level requests stay empty for the resource without a pod-limit. The container's request for that resource is then set to the default request value from schedutil.

1. Pod cgrooup configured to use resources from pod spec if feature is enabled and resources are set at pod-level 2. Container cgroup limits defaulted to pod-level limits is container limits are not set

…urces into account Signed-off-by: ndixita <[email protected]>

Signed-off-by: ndixita <[email protected]>

…core

…rces are not set Signed-off-by: ndixita <[email protected]>

Add flagz endpoint for apiserver

[FG:InPlacePodVerticalScaling] Fix AllocatedResources feature gate annotation

[FG:InPlacePodVerticalScaling] Gate Disallow in-place resize for guaranteed pods on nodes with a static topology policy

[FG:InPlacePodVerticalScaling] Handle edge cases around CPU MinShares

Add missing comments in k8s.io/api/core/v1

The extra-dirs input is no longer in use. The extra-dirs flag, however, is still present even though it is not wired in conversion code. As a result, any extra dirs inputs are provided via extra-dirs flag are not taken in consideration for conversion-gen. This flag should be removed from args options to avoid confusion. Signed-off-by: Vu Dinh <[email protected]>

…PodResizeAction() to the caller"

Coordinated Leader Election add v1alpha2

[PodLevelResources] Pod Level Resources Feature Alpha

This adds a generic implementation of a fake clientset, and uses it to replace the template code in generated fake clientsets for the default methods. The templates are preserved as-is (or as close as they can be) for use in extensions, whether for resources or subresources. Fake clientsets with no extensions are reduced to their main getter, their specific struct, and their constructor. All method implementations are provided by the generic implementation. The dedicated struct is preserved to allow extensions and expansions to be defined where necessary. Instead of handling the variants (with/without list, apply) with a complex sequence of if statements, build up an index into an array containing the various declarations. Similarly, instead of calling different action constructors for namespaced and non-namespaced clientsets, assume the current behaviour of non-namespaced action creation (equivalent to creating a namespaced action with an empty namespace) and document that assumption in the action implementation. Signed-off-by: Stephen Kitt <[email protected]>

Signed-off-by: Stephen Kitt <[email protected]>

[FG:InPlacePodVerticalScaling] Disallow removing requests & limits for Burstable pods.

"Real" clients use objectWithMeta to enforce support for meta.Object; strictly speaking, fakes don't need this, but it's best to align them with the real clients to ensure that fakes don't end up allowing types that can't be used with the real clients. Signed-off-by: Stephen Kitt <[email protected]>

Make fake node as ready but unschedulable

Appending a semicolon after some text is unnecessary if it's the last entry. This led to visually distracting extra semicolons in Spyglass which looked like a bug in Spyglass. Now the code checks if a semicolon is necessary before inserting it.

Remove deadcode in pkg/util/node

Remove deprecated extra-dirs flag

Use generics to share code in fake client-go implementations

prune-junit-xml: avoid appending semicolon

…tion Revert "[FG:InPlacePodVerticalScaling] kubelet: Propagate error in doPodResizeAction() to the caller"

…second (#128374) * Add feature gate, API, and conflict validation tests for enablecrashloopbackoffmax Signed-off-by: Laura Lorenz <[email protected]> * Handle when current base is longer than node max Signed-off-by: Laura Lorenz <[email protected]> * Update pkg/features/kube_features.go Co-authored-by: Tsubasa Nagasawa <[email protected]> * Fix indentation Signed-off-by: Laura Lorenz <[email protected]> * Follow convention for success test Signed-off-by: Laura Lorenz <[email protected]> * Normalize casing, and change field to Duration Signed-off-by: Laura Lorenz <[email protected]> * Fix json name and some other casing errors Signed-off-by: Laura Lorenz <[email protected]> * Another one I missed before Signed-off-by: Laura Lorenz <[email protected]> * Don't clobber global max function Signed-off-by: Laura Lorenz <[email protected]> * Change to flat value in defaults.go Signed-off-by: Laura Lorenz <[email protected]> * Streamline validation and defaults Signed-off-by: Laura Lorenz <[email protected]> * Fix typecheck Signed-off-by: Laura Lorenz <[email protected]> * Lint Signed-off-by: Laura Lorenz <[email protected]> * Tighten up validation for subsecond values Signed-off-by: Laura Lorenz <[email protected]> * Rename field from MaxBackOffPeriod to MaxContainerRestartPeriod Signed-off-by: Laura Lorenz <[email protected]> * A few missed references to renames Signed-off-by: Laura Lorenz <[email protected]> * Only compare flags in flags test Signed-off-by: Laura Lorenz <[email protected]> * Don't mess with SetDefault signature Nobody messes with SetDefault signature Signed-off-by: Laura Lorenz <[email protected]> * Fix stale signature change, and update test data Signed-off-by: Laura Lorenz <[email protected]> * Inspect current feature gates at defaulting time Signed-off-by: Laura Lorenz <[email protected]> * Don't use the global feature gate for temp usage Signed-off-by: Laura Lorenz <[email protected]> * Expose default error, and some comments Signed-off-by: Laura Lorenz <[email protected]> * Hint fuzzer for less arbitrary values to FeatureGates Signed-off-by: Laura Lorenz <[email protected]> --------- Signed-off-by: Laura Lorenz <[email protected]> Co-authored-by: Tsubasa Nagasawa <[email protected]>

fix PodLogsQuerySplitStream if feature is enabled and using defaults

…tDeletion switched on Signed-off-by: Davanum Srinivas <[email protected]>

…reaking-tests Fix for alpha CI jobs failing with AllowUnsafeMalformedObjectDeletion switched on

fix: flaky TestPrepareCandidate

Signed-off-by: Laura Lorenz <[email protected]>

Promote ServiceAccount e2e test to Conformance

[FG:InPlacePodVerticalScaling] Enable resizing containers without limits

[FG:InPlacePodVerticalScaling] Emit events for Deferred and Infeasible statuses

Signed-off-by: Laura Lorenz <[email protected]>

…of sidecar containers

Signed-off-by: Laura Lorenz <[email protected]>

structed texts in the description. We should find a way to both relign line breaks and not break these kind of texts. Signed-off-by: ah8ad3 <[email protected]>

…gpodupdate_scheduler_perf_test_case Fix pod scale down failure in EventHandlingPodUpdate scheduler_perf test

As mentioned in https://protobuf.dev/programming-guides/style, package names "should be unique". For generated API pb files, Kubernetes uses "k8s.io.api.<api group>.<version>". The same approach is now used for the kubelet DRA v1beta1 API. This can be changed without a breaking change because the API is still unreleased. This avoids a conflict between the DevicePlugin and the DRA API when both get used by kubelet: 2024/11/10 12:51:40 proto: duplicate proto type registered: v1beta1.Device The exact impact of that conflict is unknown but it seems better to pro-actively avoid the problem.

[FG:InPlacePodVerticalScaling] Graduate to Beta

Signed-off-by: Laura Lorenz <[email protected]>

Add AllowSidecarResizePolicy to relax resize policy validation check of sidecar containers

Signed-off-by: Laura Lorenz <[email protected]>

Focused too much on the container restart one in commit that fixed that Signed-off-by: Laura Lorenz <[email protected]>

DRA kubelet: use unique protobuf package name

Revert PR #126533 and add a test case for broken case

[FG:InPlacePodVerticalScaling] Equate CPU limits below the minimum effective limit (10m)

…terface correctly

kubeadm: fix a bug where upgrade dryrun can not select the network interface correctly

…imagepullbackoff-e2enodecriproxytest E2E Node tests for image pull backoff and crashloopbackoff behavior

Addressed review comments

Fixed failing UT TestWriteKubeletConfigFiles by removing privilege check and adding proper error handling

fix: split TestCoreResourceEnqueue to deal with the timeout issue

Update metrics docs for v1.32 release(Note this must be committed after the code freeze)

After removing a pod in port-forward test we wait for an error from POST request. Since the POST doesn't have a timeout it hangs indefinitely, so instead we're hitting a DefaultPodDeletionTimeout. To make sure the POST fails this adds a timeout to ensure we'll always get that expected error, rather than nil. Signed-off-by: Maciej Szulik <[email protected]>

Add timeout for port-forward test

The "disabled by label filter" message for benchmarks printed the pointer to the filter string, not the filter string itself. This mistake gets avoided and the code becomes simpler when not using pointers.

Because Go does not a "pass" action for benchmarks (golang/go#66825 (comment)), gotestsum reports a successful benchmark run as failed (gotestyourself/gotestsum#413 (comment)). We can work around that in each benchmark and sub-benchmark by emitting the output line that `go test` expects on stdout from the test binary for success.

Pruning of tests to the top-level test was added for jobs like pull-kubernetes-unit which run many tests. For other, more focused jobs like scheduler-perf benchmarking it would be nice to keep the more detailed information, in particular because it includes the duration per test case.

…tables Signed-off-by: cpanato <[email protected]>

Vendoring changes for new hnslib v0.0.8.

skip if cri proxy is disabled/undefined

Revert "[FG:InPlacePodVerticalScaling] Graduate to Beta"

scheduler_perf: fix and enhance reporting

Previously, ValidateNodeSelector did not check that labels are valid. Now it does for resource.k8s.io, regardless whether an object already was created with invalid labels in an earlier Kubernetes release. Theoretically this is a breaking change and could cause problems during an upgrade, but that is highly unlikely in practice. In contrast to node affinity, DRA does not ignore parse errors (= uses NewNodeSelector, not NewLazyErrorNodeSelector), so invalid labels would have been found instead of being silently ignored. Even if some object has invalid labels, this only affects an alpha -> beta upgrade which isn't guaranteed to work seamlessly.

[go] Bump images, dependencies and versions to go 1.23.3 and distroless iptables

DRA API: validate node selector labels

Wait for updated keys to be observed

``` update-rules --branch release-1.32 --rules staging/publishing/rules.yaml --o staging/publishing/rules.yaml ``` Signed-off-by: Davanum Srinivas <[email protected]>

fix: mount-utils IsLikelyNotMountPoint relative path issue

…release-1.32 staging/publishing: add release-1.32 branch

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[pull] master from kubernetes:master #838

[pull] master from kubernetes:master #838

Commits on Nov 7, 2024

Commits on Nov 8, 2024

Commits on Nov 9, 2024

Commits on Nov 11, 2024

Commits on Nov 12, 2024

Commits on Nov 13, 2024

Commits on Nov 14, 2024

Commits on Nov 15, 2024

Commits on Nov 18, 2024

Commits on Nov 19, 2024

Commits on Nov 20, 2024

Commits on Nov 21, 2024

Commits on Nov 22, 2024

Commits on Nov 25, 2024

Commits on Nov 26, 2024

Commits on Nov 27, 2024

[pull] master from kubernetes:master #838

Are you sure you want to change the base?

[pull] master from kubernetes:master #838

Commits on Nov 7, 2024

Commits on Nov 8, 2024

Commits on Nov 9, 2024

Commits on Nov 11, 2024

Commits on Nov 12, 2024

Commits on Nov 13, 2024

Commits on Nov 14, 2024

Commits on Nov 15, 2024

Commits on Nov 18, 2024

Commits on Nov 19, 2024

Commits on Nov 20, 2024

Commits on Nov 21, 2024

Commits on Nov 22, 2024

Commits on Nov 25, 2024

Commits on Nov 26, 2024

Commits on Nov 27, 2024