Remove mentions about admission controllers from doc comments for PodGroupTemplate.Priority and PodGroupTemplate.PriorityClassName
Kubernetes-commit: 2a419be78ae256ef719071c6ae3bd46cb39b5b81
Updates golang.org/x/net to v0.55.1-0.20260602153038-42abb857022c to pick up
the go1.27 http2 "wrap" fixes:
- CL 782940 (golang/go#79642): configureServer registers the h2 and http/1.1
ALPN protocols on s.TLSConfig.
- CL 785900 (golang/go#79778): ConfigureTransport/ConfigureTransports enable
HTTP/2 on the transport and keep TLSClientConfig non-nil.
With both, the kube-apiserver secure-serving path and the client-go / apiserver
HTTP/2 clients negotiate HTTP/2 under go1.27 with no Kubernetes-side changes;
no workaround is needed.
Gerrit: https://go-review.googlesource.com/c/net/+/782940
Gerrit: https://go-review.googlesource.com/c/net/+/785900
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
Kubernetes-commit: 544a4612cd73250f69e6a95f4b3de8b94112e594
Fixes ci-kubernetes-e2e-kind-golang-tip and ci-kubernetes-unit-golang-tip,
which started failing under Go tip identifying as go1.27 with:
vendor/google.golang.org/grpc/internal/transport/handler_server.go:271:18:
undefined: http2.TrailerPrefix
In x/net v0.54.0, TrailerPrefix was defined only in http2/server.go, which
carries `//go:build !(go1.27 && !http2legacy)` and is therefore excluded
under go1.27. Upstream golang/net commit 1efab4271a moved TrailerPrefix
(and other symbols accidentally dropped by the go1.27 server wrapper) into
common files. That fix is released in v0.55.0.
Tracked in https://github.com/kubernetes/kubernetes/issues/139257
Kubernetes-commit: d7c6b52ac4b6387d740af2fea7f1dd007d71c64c
Add a new field GenerateKey in the Config struct that allows
the user to set a custom function that would generate
a private key of their choice.
If the field is not set, the default remains:
ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
Add unit tests for this code path, with key fixtures
and function overloading to avoid additional key generation.
Enforce minimum bits on the generated keys to ensure
they are secure with the function validateKeyStrength().
For RSA the minimum key size is 2048, for ECDSA the minimum
curve bits are 256. Unit test this function too.
Kubernetes-commit: dec94de30f90f7e7e2859701ffce79ef8b137e3d
This only changes tests to drop gopkg.in/check.v1, which helps our
dependency tree a little.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Kubernetes-commit: edf0df348c217271f4ed7acee3b436c27e71df88
Updates k8s.io/kube-openapi across all staging modules and vendors the new
revision. Key changes upstream:
- builder/openapi.go, builder3/openapi.go: use common.EscapeJsonPointer()
when keying definition names into swagger.Definitions / spec.Components.Schemas,
fixing incorrect lookups for types whose names contain JSON-Pointer-reserved
characters (e.g. '/', '~').
- pkg/generators/apidefinitions/loader.go (new): LoadAPIVersion() reads an
apiversion.yaml from a source-tree directory and validates its TypeMeta,
providing a declarative way to describe API versions in-tree.
- pkg/generators/apidefinitions/types.go (new): APIVersion type that carries
the schemeGroupVersion / kindAPIVersion metadata consumed by the loader.
- pkg/generators/config.go, openapi.go, model_names.go: minor generator
improvements accompanying the apidefinitions loader addition.
- pkg/generators/rules/list_type_streaming_tags.go: streaming-tag rule fix.
- pkg/schemaconv/openapi.go, proto_models.go: schema conversion cleanups.
- pkg/validation/validate/result.go: validation result cleanup.
Previous version: v0.0.0-20260317180543-43fb72c5454a
New version: v0.0.0-20260502001324-b7f5293f4787
Kubernetes-commit: eaf347cecb168ee85fc77ffc9a5cda4eb99ce1ca
The v1.VolumeMount.MountPath doc claims the path must not contain
':', but the validator does not enforce this. The internal type in
pkg/apis/core/types.go carries no such constraint, and existing
TestValidateVolumeMounts success cases use mountPath values like "d:",
"F:", and "G:\mount".
This is a doc-only change. The validator is unchanged; the public doc
now matches what the validator actually accepts. Regenerated proto and
openapi snapshots to propagate the doc update.
Signed-off-by: Kimon N. <nkimon00@gmail.com>
Kubernetes-commit: 6691ecaf2f5ce3076f3c61eca5355cc99535d1bd
Bump go-openapi dependencies to latest versions:
- github.com/go-openapi/jsonpointer v0.21.0 → v0.22.4
- github.com/go-openapi/jsonreference v0.20.2 → v0.21.4
- github.com/go-openapi/swag v0.23.0 → v0.25.4
The new swag version has been restructured into a multi-module monorepo
with submodules (cmdutils, conv, fileutils, jsonname, jsonutils, loading,
mangling, netutils, stringutils, typeutils, yamlutils). As a result:
- mailru/easyjson and josharian/intern are no longer transitive deps
and have been removed from vendor
- go-openapi/jsonpointer and go-openapi/swag no longer reference
unwanted deps davecgh/go-spew, mailru/easyjson, or gopkg.in/yaml.v3
- Updated hack/unwanted-dependencies.json accordingly
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
Kubernetes-commit: 693dc57f5753ce69f7d3f49f26bfefc9554e47e6
Fixes CVE-2026-33814 (golang/go#78476): HTTP/2 Transport hangs
indefinitely when a peer sends a SETTINGS frame with MaxFrameSize=0.
This is reachable from kube-apiserver's OIDC, admission webhook,
and aggregated API client paths.
Kubernetes-commit: 12a2470693d86f63f4614048ffdd43dc393dd7e0
Add a separate AnnotatedEventRecorder interface with an AnnotatedEventf
method that allows attaching annotations to events at creation time.
Implement it in recorderImpl, FakeRecorder, and EventRecorderAdapter.
Add a Verbose option to FakeRecorder that optionally includes action,
object kind/apiVersion, and annotations in event output. The default
format is unchanged.
Signed-off-by: Adrian Fernandez De La Torre <adri1197@gmail.com>
Kubernetes-commit: 31fe350b2b2065b49752adb4f68f1ea1c282058e
When CEL expressions access non-existent map keys, add a helpful hint
suggesting optional chaining (.? followed by orValue()) or has() macro.
Kubernetes-commit: 5e2d5b9a621109bd89f2dbc4092e0123ab500c85
clean up and update the OWNERS files under client-go so people that
is no longer active is moved to emeritus.
Kubernetes-commit: d4913ecba2f3c426257515c1de6c668d21ea7079
Introduce the ResourcePoolStatusRequest resource type in the
resource.k8s.io/v1alpha3 API group, gated behind the
DRAResourcePoolStatus feature gate. This includes external and internal
type definitions, protobuf/OpenAPI generated code, client-go typed
clients, informers, listers, apply configurations, deepcopy, defaults,
conversion, fuzzer, declarative validation tags, and API discovery
metadata.
Kubernetes-commit: 29601b8628ac8ea512960bc373511ae46888e502
Bump k8s.io/kube-openapi to pick up kubernetes/kube-openapi#579 which
moved the last ginkgo/gomega tests to stdlib testing and ran go mod
tidy, removing ginkgo/gomega from kube-openapi's go.mod.
This drops ginkgo/gomega as indirect deps from apimachinery. It also
prunes Masterminds/semver, google/pprof, and golang.org/x/tools from
client-go and other staging modules where they were only needed
through kube-openapi's ginkgo/gomega chain.
Contributes to kubernetes/kubernetes#127888
Kubernetes-commit: 56cd74d879f1ba11aadcff95326f17a1cc2c82ef
KEP-5732: Add SchedulingConstraints to PodGroup API and use them in TopologyPlacement plugin
Kubernetes-commit: 299ab0d68a9d70b3c39d63210de47ac01d18e74b
The "Failed to update lease optimistically, falling back to slow path"
message was logged at Error level, but this is expected behavior during
normal leader election when the optimistic update encounters a conflict.
The system gracefully falls back to the slow path (Get + Update), so
this is not a real error. Downgrade to V(2) Info to reduce log noise.
Kubernetes-commit: 04977a0ea4592bfaa70d5095a4cfe99dd4b847e1
Add plugin to generate placements based on scheduling constraints
Co-authored-by: Antoni Zawodny <zawodny@google.com>
Kubernetes-commit: d9da8c7c4a25cee553720737fdec07006e063da1
cri streaming option a hardcut - add new staging repositories `streaming` and `cri-streaming`
Kubernetes-commit: 2bd6c7fe3cb8663804dc6e7672ff01aeebc97274
* Drop WorkloadRef field and introduce SchedulingGroup field in Pod API
* Introduce v1alpha2 Workload and PodGroup APIs, drop v1alpha1 Workload API
Co-authored-by: yongruilin <yongrlin@outlook.com>
* Run hack/update-codegen.sh
* Adjust kube-scheduler code and integration tests to v1alpha2 API
* Drop v1alpha1 scheduling API group and run make update
---------
Co-authored-by: yongruilin <yongrlin@outlook.com>
Kubernetes-commit: 3f094dc228318b89f1fef313543b960e35ca6e3e
klog hasn't been updated in Kubernetes for a few releases. Several
enhancements have accumulated that are worth having.
Kubernetes-commit: 56e0565c113107bdea398b075aba5bdef43489ed
Update google.golang.org/protobuf to v1.36.12-0.20260120151049-f2248ac996af to prevent file size explosion in go 1.26
Kubernetes-commit: 77c013637cb40e1b5d2b26664dc7b297f1ff2693
When watch.Broadcaster.Shutdown() is called it drains all queued events
then calls closeAll(), which closes every watcher's result channel.
eventBroadcasterImpl.Shutdown() calls Broadcaster.Shutdown() first,
then calls the cancellation context's cancel() function. Between those
two steps there is a window in which the result channel is closed while
the cancellation context is still live.
Without the two-value channel receive the goroutine in StartEventWatcher
would spin on the already-closed channel: each select iteration
immediately receives the zero-value watch.Event, the type assertion
fails (nil interface, ok == false), and the loop continues burning CPU
until the select scheduler eventually picks the cancelationCtx.Done()
case.
Guard against this by reading the ok boolean from the channel receive:
case watchEvent, ok := <-watcher.ResultChan():
if !ok {
return
}
This is the correct and idiomatic Go pattern for a channel that may be
closed by its producer. Note that when this return path is taken the
broadcaster has already delivered every queued event (Broadcaster.Shutdown
blocks until the distribute loop exits before closeAll runs), so no
events are silently dropped.
Add a regression test (TestStartEventWatcherExitsOnDirectShutdown) that
creates a broadcaster without an external context so Shutdown() is
fully synchronous, starts a watcher, and verifies the goroutine exits
cleanly via goleak.VerifyNone.
Signed-off-by: Rajneesh180 <rajneeshrehsaan48@gmail.com>
Kubernetes-commit: 95c15b54069922b0a66c198a064577ea0a160694
[Declarative Validation] Bring `k8s:maxLength` tag in line with OpenAPI `maxLength` validation semantics
Kubernetes-commit: e08e598df07bc929679ef046418992a8205da18f
* Promote MutableCSINodeAllocatableCount to GA
Signed-off-by: Eddie Torres <torredil@amazon.com>
* Lock MutableCSINodeAllocatableCount feature gate to default
Signed-off-by: Eddie Torres <torredil@amazon.com>
---------
Signed-off-by: Eddie Torres <torredil@amazon.com>
Kubernetes-commit: 41bb4b6a8b4e0f15ab7ffcc6369c68bc599fb957
The change introduced in 59cd1d0b3bb378f40a639e21b615f4df1d4a5a14
causes PollUntilContextTimeout to call the condition function even when
the context is canceled already. This is unnecessary in our case and
only leads to one extra loop of processing and extra error messages.
This change makes the renew loop behave like it did before the change.
Kubernetes-commit: aa494f8174d745c3d9842f3d48272a3c2d6dcbcc
In practice, TimeAdded is managed by the API server. When admins used
DeviceTaintRule to simulate eviction, then change the effect to really evict,
it is useful to calculate tolerations based on the time when that second
update happened. Therefore the TimeAdded field gets bumped automatically
when changing the effect.
Kubernetes-commit: f28dc4139208e64fe2882cd44d548c25020f2e3a
The error returned from Until() is solely from context cancellation
which is expected behavior when the reflector is stopped. Logging
this as an error (or even at V(4)) creates unnecessary noise.
Kubernetes-commit: cc483208aa306b8c4078d4118cf78a10e58481ec
It's GA now. To regenerate the files I did:
make WHAT=cmd/kube-apiserver
make update
While we are there, remove the reference that the field is alpha.
Signed-off-by: Rodrigo Campos <rodrigo@amutable.com>
Kubernetes-commit: 8db51091e82490bccc0018763ba7e05ffb8ab458
This is just a sed to remove the old data from the text fixtures too.
While two files are clearly test data given that they include testdata
in their name, these two is not so obvious but are also test data:
* openapi/swagger-with-shared-parameters.json: is referenced in "staging/src/k8s.io/cli-runtime/pkg/resource/query_param_verifier_test.go",
in particular in this part: ´filepath.Join("..", "..", "artifacts", "openapi", "swagger-with-shared-parameters.json")´
* batch.k8s.io_v1.json: is in
`staging/src/k8s.io/kubectl/pkg/explain/v2/templates/plaintext_test.go`,
in a "//go:embed batch.k8s.io_v1.json".
Signed-off-by: Rodrigo Campos <rodrigo@amutable.com>
Kubernetes-commit: 8d0f80e4ed87658c0e05b9db0690927547be6ad5
Replace all imports of k8s.io/apimachinery/pkg/util/dump with
k8s.io/utils/dump across the repo. The apimachinery dump package
now contains deprecated wrapper functions that delegate to
k8s.io/utils/dump for backwards compatibility.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
Kubernetes-commit: 550cc8645bedcc8b187e0ebeb52ead29d5631a32
Move backoff documentation comments to var block for better discoverability.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Kubernetes-commit: 33ebd41b2c1abdc03beabd9ccff3428a8fd46473
Passing a context to StartWithContext enables context-aware reflector
logging. This is the main remaining source of log spam (output to stderr
instead of per-test logger) in controller unit tests.
WaitForCacheSynceWithContext takes advantage of the new cache.WaitFor +
NamedHasSynced functionality to finish "immediately" (= no virtual time
passed) in a synctest bubble. While at it, the return type gets improved so
that a failure is easier to handle.
Kubernetes-commit: 5ff323de791df88880f6e065f5de4b445e5c90ed
The main advantage is that waiting on channels creates a causal relationship
between goroutines which is visible to synctest. When a controller in a
synctest bubble does a WaitFor in a test's background goroutine for the
controller, the test can use synctest.Wait to wait for completion of cache
sync, without requiring any test specific "has controller synced" API. Without
this, the test had to poll or otherwise wait for the controller.
The polling in WaitForCacheSync moved the virtual clock forward by a random
amount, depending on how often it had to check in wait.Poll. Now tests can be
written such that all events during a test happen at a predictable time. This
will be demonstrated in a separate commit for the
pkg/controller/devicetainteviction unit test.
The benefit for normal production is immediate continuation when the last
informer is synced (not really a problem, but still...) and more important,
nicer logging thanks to the names associated with the thing that is being
waited for. The caller decides whether logging is enabled or disabled and
describes what is being waited for (typically informer caches, but maybe also
event handlers or even something else entirely as long as it implements the
DoneChecker interface).
Before:
Waiting for caches to sync
Caches are synced
After:
Waiting for="cache and event handler sync"
Done waiting for="cache and event handler sync" instance="SharedIndexInformer *v1.Pod"
Done waiting for="cache and event handler sync" instance="SharedIndexInformer *v1.ResourceClaim"
Done waiting for="cache and event handler sync" instance="SharedIndexInformer *v1.ResourceSlice"
Done waiting for="cache and event handler sync" instance="SharedIndexInformer *v1.DeviceClass"
Done waiting for="cache and event handler sync" instance="SharedIndexInformer *v1alpha3.DeviceTaintRule"
Done waiting for="cache and event handler sync" instance="SharedIndexInformer *v1.ResourceClaim + event handler k8s.io/kubernetes/pkg/controller/devicetainteviction.(*Controller).Run"
Done waiting for="cache and event handler sync" instance="SharedIndexInformer *v1.Pod + event handler k8s.io/kubernetes/pkg/controller/devicetainteviction.(*Controller).Run"
Done waiting for="cache and event handler sync" instance="SharedIndexInformer *v1alpha3.DeviceTaintRule + event handler k8s.io/kubernetes/pkg/controller/devicetainteviction.(*Controller).Run"
Done waiting for="cache and event handler sync" instance="SharedIndexInformer *v1.ResourceSlice + event handler k8s.io/kubernetes/pkg/controller/devicetainteviction.(*Controller).Run"
The "SharedIndexInformer *v1.Pod" is also how this appears in metrics.
Kubernetes-commit: fdcbb6cba9a04c028b158bf66d505df7431f63fe
This improves logging and enables more informative waiting for cache sync in a
following commit. It addresses one klog.TODO in the Reflector.
The RealFIFOOptions and InformerOptions structs get extended the same way as
DeltaFIFOOptions before: a logger may be set, but it's not required. This is
not an API break.
That the name has to be passed separately is a bit annoying at first glance
because it could also be set directly on the logger through WithName, but
keeping it separate is better:
- name can be set without providing a logger
- name can be defaulted
- less code in the caller when passing through a logger and adding
the name only in the field
- last but not least, extracting the name is not supported in a portable
manner by logr
All in-tree references in production code get updated.
While at it, logging in the fifos gets updated to follow best practices: if
some code encounters an abnormal situation and then continues, it should use
utilruntime.HandleErrorWithLogger instead of normal error logging.
Existing "logger" fields get moved to the top because that is a more common
place for such a read-only field.
Kubernetes-commit: 45251e5f654e6c052659d110cd721f9fbe185191
NewSimpleClientset was marked as deprecated when NewClientset was
introduced. This has caused some confusion:
- Not all packages have NewClientset (https://github.com/kubernetes/kubernetes/issues/135980).
- Tests that work with NewSimpleClientset fail when
switched to NewClientset (https://github.com/kubernetes/kubernetes/issues/136327)
because of missing CRD support (https://github.com/kubernetes/kubernetes/issues/126850).
It doesn't seem burdensome to keep NewSimpleClientset around forever. Some unit
tests may even prefer to use it when they don't need server-side apply (less
overhead). Therefore there is no need to deprecate it.
This avoids churn in the eco system because contributors no longer create PRs
"because the linter complains about the usage of a deprecated function".
Kubernetes-commit: e80da21868059f789c90105a00481fa8cef169e1
The google/btree package is deprecated, so switch to the maintained
fork in k8s.io/utils/third_party/forked/golang/btree.
API differences:
- NewG -> New
- BTreeG[T] -> BTree[T]
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
Kubernetes-commit: a328ca88ad662119bbf129cd1107fabd8dd9f539
While time.Sleep is what the test needs, maybe an arbitrary hook invocation is
more acceptable in the production code because it is more general.
Kubernetes-commit: 2ec0305d728bf5ce8f8df314a18e71aa120a00cf
In the unlikely situation that sharedProcessor.distribute was triggered by a
resync before sharedProcessor.run had a chance to start the listeners, the
sharedProcessor deadlocked: sharedProcessor.distribute held a read/write lock
on listenersLock while being blocked on the write to the listener's
channel. The listeners who would have read from those weren't get started
because sharedProcessor.run was blocked trying to get a read lock for
listenersLock.
This gets fixed by releasing the read/write lock in sharedProcessor.distribute
while waiting for all listeners to be started. Because either all or no
listeners are started, the existing global listenersStarted boolean is
sufficient.
The TestListenerResyncPeriods tests now runs twice, with and without the
artificial delay. It gets converted to a synctest, so it executes quickly
despite the time.Sleep calls and timing is deterministic. The enhanced log
output confirms that with the delay, the initial sync completes later:
=== RUN TestListenerResyncPeriods
shared_informer_test.go:236: 0s: listener3: handle: pod1
shared_informer_test.go:236: 0s: listener3: handle: pod2
shared_informer_test.go:236: 0s: listener1: handle: pod1
shared_informer_test.go:236: 0s: listener1: handle: pod2
shared_informer_test.go:236: 0s: listener2: handle: pod1
shared_informer_test.go:236: 0s: listener2: handle: pod2
shared_informer_test.go:236: 2s: listener2: handle: pod1
shared_informer_test.go:236: 2s: listener2: handle: pod2
shared_informer_test.go:236: 3s: listener3: handle: pod1
shared_informer_test.go:236: 3s: listener3: handle: pod2
--- PASS: TestListenerResyncPeriods (0.00s)
=== RUN TestListenerResyncPeriodsDelayed
shared_informer_test.go:236: 1s: listener1: handle: pod1
shared_informer_test.go:236: 1s: listener1: handle: pod2
shared_informer_test.go:236: 1s: listener2: handle: pod1
shared_informer_test.go:236: 1s: listener2: handle: pod2
shared_informer_test.go:236: 1s: listener3: handle: pod1
shared_informer_test.go:236: 1s: listener3: handle: pod2
shared_informer_test.go:236: 2s: listener2: handle: pod1
shared_informer_test.go:236: 2s: listener2: handle: pod2
shared_informer_test.go:236: 3s: listener3: handle: pod1
shared_informer_test.go:236: 3s: listener3: handle: pod2
--- PASS: TestListenerResyncPeriodsDelayed (0.00s)
Kubernetes-commit: e6ef79b2f6bb05205652e4fe48ffa523d9e3a1ec
The event handler must receive both object (the initial one from List, the
newer one from Watch) and it must be considered synced.
Kubernetes-commit: 359aff0552ed3b60d544158e5edf33d28492f01a
56448506075c3db1d added support for List+Watch to a fake client-go instance.
However, that support was not quite working yet as seen when analyzing a test
flake:
- List returned early when there were no objects, without adding the
ResourceVersion. The ResourceVersion should have been "0" instead.
- When encountering "" as ResourceVersion, Watch didn't deliver
any objects. That was meant to preserve compatibility with clients
which don't expect objects from a Watch, but the right semantic of
"" is "Start at most recent", which includes delivering existing
objects.
Tests which meddle with the List implementation via a reactor (like
clustertrustbundlepublisher) have to be aware that Watch now may
return objects when given an empty ResourceVersion.
Kubernetes-commit: 6bfa727bee264f5d7e4471066c1b48a28d0c1929
Latest release of both. The CurrentTreeConstructionNodeReport fix
is needed before being able to use it in the E2E framework.
Kubernetes-commit: f8a0c80ed81711f6add7a765d22b56d2d41ac522
We need to lock on observedTime reads to avoid races, before we were
only locking to read the observed record.
Use a RW lock since there are much more reads that writes.
Kubernetes-commit: d5ac0e408a0a1e50197e1b599b9b8b2e505bfe46
Quite a lot of unit tests set up informers with a fake client, do
informerFactory.WaitForCacheSync, then create or modify objects. Such tests
suffered from a race: because the fake client only delivered objects to the
watch after the watch has been created, creating an object too early caused
that object to not get delivered to the informer.
Usually the timing worked out okay because WaitForCacheSync typically slept a
bit while polling, giving the Watch call time to complete, but this race has
also gone wrong occasionally. Now with WaitForCacheSync returning more promptly
without polling (work in progress), the race goes wrong more often.
Instead of working around this in unit tests it's better to improve the fake
client such that List+Watch works reliably, regardless of the timing. The fake
client has traditionally not touched ResourceVersion in stored objects and
doing so now might break unit tests, so the added support for ResourceVersion
is intentionally limited to List+Watch.
The test simulates "real" usage of informers. It runs in a synctest bubble and
completes quickly:
go test -v .
=== RUN TestListAndWatch
listandwatch_test.go:67: I0101 01:00:00.000000] Listed configMaps="&ConfigMapList{ListMeta:{ 1 <nil>},Items:[]ConfigMap{ConfigMap{ObjectMeta:{cm1 default 0 0001-01-01 00:00:00 +0000 UTC <nil> <nil> map[] map[] [] [] []},Data:map[string]string{},BinaryData:map[string][]byte{},Immutable:nil,},},}" err=null
listandwatch_test.go:79: I0101 01:00:00.000000] Delaying Watch...
listandwatch_test.go:90: I0101 01:00:00.100000] Caches synced
listandwatch_test.go:107: I0101 01:00:00.100000] Created second ConfigMap
listandwatch_test.go:81: I0101 01:00:00.100000] Continuing Watch...
--- PASS: TestListAndWatch (0.00s)
PASS
ok k8s.io/client-go/testing/internal 0.009s
Some users of the fake client need to be updated to avoid test failures:
- ListMeta comparisons have to be updated.
- Optional: pass ListOptions into tracker.Watch. It's optional because
the implementation behaves as before when options are missing,
but the List+Watch race fix only works when options are passed.
Kubernetes-commit: 56448506075c3db1d16b5bbf0c581b833a4646f1
This uses the new generic fixed ring implementation in k8s.io/utils.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Kubernetes-commit: 3653ae2b9a7768da89e47ef84d503ae9cf0b910b
This fixes some issues found in Kubernetes (data race in ginkgo CLI, gomega
formatting) and helps with diagnosing OOM killing in CI jobs (exit status of
processes).
The modified gomega formatting shows up in some of the output tests for the E2E
framework. They get updated accordingly.
Kubernetes-commit: db841afdbb193ea7d612472c7cc4c7b3f58eb676
Embed proper interface in TransformingStore to ensure DeltaFIFO and RealFIFO are implementing it
Kubernetes-commit: 04e8064bccebd04981ee0094457550c9de4f92e3
Update leaderelection package to use contextual logging variants:
- Replace wait.JitterUntil with wait.JitterUntilWithContext
- Replace wait.Until with wait.UntilWithContext
This enables proper contextual logging support as part of the
structured logging migration.
Ref #126379
Kubernetes-commit: c5b64ebf2ef8619fb96c35f3a613b1b945ebe0f2
The call to `fmt.Sprintf` does virtually the same as concatenating the
strings, but incurs in minor overhead from having to call a function,
and performs an additional allocation.
I've made a small benchmark for this and when run against current
`master` and this branch, the results are significant for this
function:
goos: darwin
goarch: arm64
pkg: k8s.io/client-go/transport
cpu: Apple M1 Pro
│ bart.base.log │ bart.concat.log │
│ sec/op │ sec/op vs base │
BearerAuthRoundTripper-10 361.3n ± 31% 295.5n ± 11% -18.21% (p=0.000 n=20)
│ bart.base.log │ bart.concat.log │
│ B/op │ B/op vs base │
BearerAuthRoundTripper-10 768.0 ± 0% 752.0 ± 0% -2.08% (p=0.000 n=20)
│ bart.base.log │ bart.concat.log │
│ allocs/op │ allocs/op vs base │
BearerAuthRoundTripper-10 6.000 ± 0% 5.000 ± 0% -16.67% (p=0.000 n=20)
Considering this method is likely used in many installations, the
gains, while small, adds up to bigger savings
Kubernetes-commit: 92a0e422df2d0d36c25f0b5c829c571b93250600
The API for the package already had a context, so all that was missing was to
extract and use the logger from that.
Kubernetes-commit: 1620b2707623036f5133cf8045da89411d2c4345
The client-go feature gates implementation logs information about feature
states at V(1). Changing that would imply changing the Enabled method, which is
very intrusive because there are many callers which are not expected to log and
thus don't have access to a contextual logger.
The code is not active in Kubernetes components, those use the clientAdapter to
make client-go use the normal feature gate implementation, which doesn't log
anything. Therefore the code doesn't get changed and only annotated so that
logcheck won't complain.
Kubernetes-commit: ee9d998d6e0c89bcf2b39fc011bfbc916060d451
The client-go feature gates implementation logs information about feature
states at V(1). Changing that would imply changing the Enabled method, which is
very intrusive because there are many callers which are not expected to log and
thus don't have access to a contextual logger.
The code is not active in Kubernetes components, those use the clientAdapter to
make client-go use the normal feature gate implementation, which doesn't log
anything. Therefore the code doesn't get changed and only annotated so that
logcheck won't complain.
Kubernetes-commit: e47b186e6ba3cbc9c732409ef9037e883ea80da1
No API changes are needed. In one case, a context is passed in via the
http.Request. In others there is simply no need to change the calls.
Kubernetes-commit: 4f241c04af7a86970aeab0a3e0198df807a04b86
The API for the package already had a context, so all that was missing was to
extract and use the logger from that.
Kubernetes-commit: 0690af4710a5b322163564d82b95b90417ae3644
The only log output is for error messages which should normally not occur. It's
also likely that users expect to see exactly those messages, so it's better to
not touch them.
Kubernetes-commit: 8701f481ff6e24257021f07afcec67df2aef27dc
The only log output is for error messages which should normally not occur. It's
also likely that users expect to see exactly those messages, so it's better to
not touch them.
Kubernetes-commit: 1ec1248a6555be7ca7a0827061cdd3ef162f6c45
When debugging, it helps to keep output from different connections
separate. This can be done with contextual logging and using different loggers
for each connection.
Cancellation is handled separately for requests. Therefore the new APIs only
add support for passing a logger instance.
Kubernetes-commit: a325a4223395dfa71005b8e5dd8ea60bd91d9329
When debugging, it helps to keep output from different connections
separate. This can be done with contextual logging and using different loggers
for each connection.
Cancellation is handled separately for requests. Therefore the new APIs only
add support for passing a logger instance.
Kubernetes-commit: dfdf07bb531aa8a397f3c74e5eec851130325971
The main purpose is to replace context.TODO with a context provided by the
caller. A secondary purpose is to enable contextual logging.
Modifying the existing interfaces and APIs would have a big impact on the
ecosystem. This is a no-go. Instead, the following approach was taken:
- All interfaces get duplicated in a *WithContext variant where the methods
also have a *WithContext suffix and the ctx parameter. All methods are
treated this way except for obvious local get methods (like RESTClient)
because it cannot be ruled out entirely that some implementation may
need a context.
- Implementations of these interfaces implement both method variants
which is possible because the method names are different.
The old methods are implemented as thin wrappers around the updated
code which is now the body of the new methods or shared helpers.
In some cases there is additional overhead (type checks, potentially
additional allocations) when using the old methods.
- To*WithContext helpers bridge from the old to the new interfaces. They
try a type cast first. Because the in-tree implementations implement
both, they can be used directly. For other implementations wrappers
are used.
- All old APIs and interfaces are marked as deprecated. There is no
intent to ever remove them, but consumers should be made aware
that there are now better alternatives. Implementations also
get marked this way even if nothing ever calls them directly
because it shows which code, at least theoretically, could get
removed.
- Existing unit tests do not get updated to the new APIs. This gives
us unit test coverage of the old and new API because the old
APIs call the new ones.
- In-tree consumers will be updated in follow-up PRs. This is likely
to be a longer process. Because of the deprecation comment,
`hack/golangci-lint.sh -n` can be used to find code which needs
to be updated.
Kubernetes-commit: 025b844bcabe0212c4dd56395ee18481602d7c65
I wasn't entirely sure whether this should return a value or a pointer to
satisfy the interface. Both works, so I benchmarked it elsewhere (REST
mapper). Mem allocs are the same (one alloc/call), but returning a value is 10%
slower when calling one method.
What I then benchmarked is whether pointer vs value receiver in the wrapper
makes a difference. Converting from value receiver (what I had before) to
pointer receiver reduced call overhead by 6%. That's because with a value
receiver, Go has to auto-generate a variant with pointer receiver and calls the
value receiver through that.
That can be seen in a debugger (call stack) and when setting breakpoints:
(dlv) b restMapperWrapper.KindForWithContext
Command failed: Location "restMapperWrapper.KindForWithContext" ambiguous: k8s.io/apimachinery/pkg/api/meta.restMapperWrapper.KindForWithContext, k8s.io/apimachinery/pkg/api/meta.(*restMapperWrapper).KindForWithContext…
Conventional wisdom is to define types with value receiver because those can be
called also on unmutable instances, making them more flexible.
But for types which will only ever be used via a pointer, I think pointer
receiver is better for the reasons above (small performance difference, easier
to debug).
Kubernetes-commit: b21dcbcaa1ccf4995bf486afc37dc0321c5bdf0b
2025-02-13 11:53:16 +01:00
713 changed files with 19893 additions and 11389 deletions
// CEL expressions have access to the types needed to create JSON patches and objects:
//
// - 'JSONPatch' - CEL type of JSON Patch operations. JSONPatch has the fields 'op', 'from', 'path' and 'value'.
// See [JSON patch](https://jsonpatch.com/) for more details. The 'value' field may be set to any of: string,
// integer, array, map or object. If set, the 'path' and 'from' fields must be set to a
// [JSON pointer](https://datatracker.ietf.org/doc/html/rfc6901/) string, where the 'jsonpatch.escapeKey()' CEL
// function may be used to escape path keys containing '/' and '~'.
// - 'Object' - CEL type of the resource object.
// - 'Object.<fieldName>' - CEL type of object field (such as 'Object.spec')
// - 'Object.<fieldName1>.<fieldName2>...<fieldNameN>` - CEL type of nested field (such as 'Object.spec.containers')
//
// CEL expressions have access to the contents of the API request, organized into CEL variables as well as some other useful variables:
//
// - 'object' - The object from the incoming request. The value is null for DELETE requests.
// - 'oldObject' - The existing object. The value is null for CREATE requests.
// - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).
// - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.
// - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.
// - 'variables' - Map of composited variables, from its name to its lazily evaluated value.
// For example, a variable named 'foo' can be accessed as 'variables.foo'.
// - 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
// See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
// - 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
// request resource.
//
// CEL expressions have access to [Kubernetes CEL function libraries](https://kubernetes.io/docs/reference/using-api/cel/#cel-options-language-features-and-libraries)
// as well as:
//
// - 'jsonpatch.escapeKey' - Performs JSONPatch key escaping. '~' and '/' are escaped as '~0' and `~1' respectively).
//
// Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.
// Required.
Expression*string`json:"expression,omitempty"`
}
// JSONPatchApplyConfiguration constructs a declarative configuration of the JSONPatch type for use with
// apply.
funcJSONPatch()*JSONPatchApplyConfiguration{
return&JSONPatchApplyConfiguration{}
}
// WithExpression sets the Expression field in the declarative configuration to the given value
// and returns the receiver, so that objects can be built by chaining "With" function invocations.
// If called multiple times, the Expression field is set to the value of the last call.
// policyName references a MutatingAdmissionPolicy name which the MutatingAdmissionPolicyBinding binds to.
// If the referenced resource does not exist, this binding is considered invalid and will be ignored
// Required.
PolicyName*string`json:"policyName,omitempty"`
// paramRef specifies the parameter resource used to configure the admission control policy.
// It should point to a resource of the type specified in spec.ParamKind of the bound MutatingAdmissionPolicy.
// If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the MutatingAdmissionPolicy applied.
// If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.
// MutatingAdmissionPolicyBindingSpecApplyConfiguration constructs a declarative configuration of the MutatingAdmissionPolicyBindingSpec type for use with
// PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
// policyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
// If the referenced resource does not exist, this binding is considered invalid and will be ignored
// Required.
PolicyName*string`json:"policyName,omitempty"`
@@ -36,7 +36,7 @@ type ValidatingAdmissionPolicyBindingSpecApplyConfiguration struct {
// If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied.
// If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.
// MatchResources declares what resources match this binding and will be validated by it.
// matchResources declares what resources match this binding and will be validated by it.
// Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this.
// If this is unset, all resources matched by the policy are validated by this binding
// When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated.
// PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
// policyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
// If the referenced resource does not exist, this binding is considered invalid and will be ignored
// Required.
PolicyName*string`json:"policyName,omitempty"`
@@ -36,7 +36,7 @@ type ValidatingAdmissionPolicyBindingSpecApplyConfiguration struct {
// If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied.
// If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.
// MatchResources declares what resources match this binding and will be validated by it.
// matchResources declares what resources match this binding and will be validated by it.
// Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this.
// If this is unset, all resources matched by the policy are validated by this binding
// When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated.
// PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
// policyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to.
// If the referenced resource does not exist, this binding is considered invalid and will be ignored
// Required.
PolicyName*string`json:"policyName,omitempty"`
@@ -36,7 +36,7 @@ type ValidatingAdmissionPolicyBindingSpecApplyConfiguration struct {
// If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied.
// If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.
// MatchResources declares what resources match this binding and will be validated by it.
// matchResources declares what resources match this binding and will be validated by it.
// Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this.
// If this is unset, all resources matched by the policy are validated by this binding
// When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated.
// spec defines the behaviour of autoscaler. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
// spec defines the behavior of the scale. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.