Merge pull request #134089 from pacoxu/bump-system-validator-v1.10.2

bump system-validators to v1.11.1

go.mod

@@ -117,7 +117,7 @@ require (
 	k8s.io/mount-utils v0.0.0
 	k8s.io/pod-security-admission v0.0.0
 	k8s.io/sample-apiserver v0.0.0
-	k8s.io/system-validators v1.10.1
+	k8s.io/system-validators v1.11.1
 	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397
 	sigs.k8s.io/knftables v0.0.17
 	sigs.k8s.io/randfill v1.0.0

go.sum

@@ -485,8 +485,8 @@ k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
 k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
-k8s.io/system-validators v1.10.1 h1:bIO3YRgxJkh/W3ghcd5ViXNPGmjwQKlHk/ySPdw6K00=
-k8s.io/system-validators v1.10.1/go.mod h1:awfSS706v9R12VC7u7K89FKfqVy44G+E0L1A0FX9Wmw=
+k8s.io/system-validators v1.11.1 h1:m/bX/WCgHTT+1YlwtTZfOFZ4NNx/LQJXPWfw3mGf+Lc=
+k8s.io/system-validators v1.11.1/go.mod h1:awfSS706v9R12VC7u7K89FKfqVy44G+E0L1A0FX9Wmw=
 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM=

vendor/k8s.io/system-validators/validators/cgroup_validator_other.go

@@ -23,6 +23,8 @@ package system
 
 var _ Validator = &CgroupsValidator{}
 
+const mountsFilePath = ""
+
 // CgroupsValidator validates cgroup configuration.
 type CgroupsValidator struct {
 	Reporter Reporter
@@ -37,3 +39,8 @@ func (c *CgroupsValidator) Validate(spec SysSpec) (warns, errs []error) {
 func (c *CgroupsValidator) Name() string {
 	return "cgroups"
 }
+
+// getUnifiedMountpoint is a no-op for non-Linux OSes.
+func getUnifiedMountpoint(path string) (string, bool, error) {
+	return "", false, nil
+}

vendor/k8s.io/system-validators/validators/kernel_validator.go

@@ -70,7 +70,8 @@ func (k *KernelValidator) Validate(spec SysSpec) ([]error, []error) {
 		warns = append(warns, warn)
 	}
 	// only validate kernel config when necessary (currently no kernel config for windows)
-	if len(spec.KernelSpec.Required) > 0 || len(spec.KernelSpec.Forbidden) > 0 || len(spec.KernelSpec.Optional) > 0 {
+	if len(spec.KernelSpec.Required) > 0 || len(spec.KernelSpec.Forbidden) > 0 || len(spec.KernelSpec.Optional) > 0 ||
+		len(spec.KernelSpec.RequiredCgroupsV1) > 0 || len(spec.KernelSpec.RequiredCgroupsV2) > 0 {
 		if err = k.validateKernelConfig(spec.KernelSpec); err != nil {
 			errs = append(errs, err)
 		}
@@ -158,6 +159,20 @@ func (k *KernelValidator) validateCachedKernelConfig(allConfig map[string]kConfi
 	for _, config := range kSpec.Required {
 		validateOpt(config, required)
 	}
+	_, isCgroupsV2, err := getUnifiedMountpoint(mountsFilePath)
+	if err != nil {
+		return fmt.Errorf("failed to get unified mountpoint: %w", err)
+	}
+	if isCgroupsV2 {
+		for _, config := range kSpec.RequiredCgroupsV2 {
+			validateOpt(config, required)
+		}
+	} else {
+		for _, config := range kSpec.RequiredCgroupsV1 {
+			validateOpt(config, required)
+		}
+	}
+
 	for _, config := range kSpec.Optional {
 		validateOpt(config, optional)
 	}

vendor/k8s.io/system-validators/validators/types.go

@@ -46,10 +46,18 @@ type KernelSpec struct {
 	VersionsNote string `json:"versionsNote,omitempty"`
 	// Required contains all kernel configurations required to be enabled
 	// (built in or as module).
+	// RequiredCgroupsV1 and RequiredCgroupsV2 are mutually exclusive.
 	Required []KernelConfig `json:"required,omitempty"`
-	// Optional contains all kernel configurations are required for optional
-	// features.
+	// RequiredCgroupsV1 contains all kernel configurations required to be enabled for cgroups v1.
+	RequiredCgroupsV1 []KernelConfig `json:"requiredCgroupsV1,omitempty"`
+	// RequiredCgroupsV2 contains all kernel configurations required to be enabled for cgroups v2.
+	RequiredCgroupsV2 []KernelConfig `json:"requiredCgroupsV2,omitempty"`
+	// Optional contains optional kernel configurations.
 	Optional []KernelConfig `json:"optional,omitempty"`
+	// OptionalCgroupsV1 contains optional kernel configurations related to cgroups v1.
+	OptionalCgroupsV1 []KernelConfig `json:"optionalCgroupsV1,omitempty"`
+	// OptionalCgroupsV2 contains optional kernel configurations related to cgroups v2.
+	OptionalCgroupsV2 []KernelConfig `json:"optionalCgroupsV2,omitempty"`
 	// Forbidden contains all kernel configurations which areforbidden (disabled
 	// or not set)
 	Forbidden []KernelConfig `json:"forbidden,omitempty"`

vendor/k8s.io/system-validators/validators/types_unix.go

@@ -41,13 +41,6 @@ var DefaultSysSpec = SysSpec{
 			{Name: "PID_NS"},
 			{Name: "IPC_NS"},
 			{Name: "UTS_NS"},
-			{Name: "CGROUPS"},
-			{Name: "CGROUP_BPF"},     // cgroups v2
-			{Name: "CGROUP_CPUACCT"}, // cgroups v1 cpuacct
-			{Name: "CGROUP_DEVICE"},
-			{Name: "CGROUP_FREEZER"}, // cgroups v1 freezer
-			{Name: "CGROUP_PIDS"},
-			{Name: "CGROUP_SCHED"}, // cgroups v1 & v2 cpu
 			{Name: "CPUSETS"},
 			{Name: "MEMCG"},
 			{Name: "INET"},
@@ -57,15 +50,34 @@ var DefaultSysSpec = SysSpec{
 			{Name: "NETFILTER_XT_MATCH_COMMENT"},
 			{Name: "FAIR_GROUP_SCHED"},
 		},
+		RequiredCgroupsV1: []KernelConfig{
+			{Name: "CGROUPS", Description: "Required for cgroups."},
+			{Name: "CGROUP_CPUACCT", Description: "Required for cpuacct controller, used in simple CPU accounting controller."},
+			{Name: "CGROUP_DEVICE", Description: "Required for device controller."},
+			{Name: "CGROUP_FREEZER", Description: "Required for freezer controller."},
+			{Name: "CGROUP_PIDS", Description: "Required for PIDs controller."},
+			{Name: "CGROUP_SCHED", Description: "Required for CPU controller."},
+		},
+		RequiredCgroupsV2: []KernelConfig{
+			{Name: "CGROUPS", Description: "Required for cgroups."},
+			{Name: "CGROUP_BPF", Description: "Required for eBPF programs attached to cgroups, used in device controller."},
+			{Name: "CGROUP_PIDS", Description: "Required for PIDs controller."},
+			{Name: "CGROUP_SCHED", Description: "Required for CPU controller."},
+		},
 		Optional: []KernelConfig{
 			{Name: "OVERLAY_FS", Aliases: []string{"OVERLAYFS_FS"}, Description: "Required for overlayfs."},
 			{Name: "AUFS_FS", Description: "Required for aufs."},
 			{Name: "BLK_DEV_DM", Description: "Required for devicemapper."},
 			{Name: "CFS_BANDWIDTH", Description: "Required for CPU quota."},
-			{Name: "CGROUP_HUGETLB", Description: "Required for hugetlb cgroup."},
 			{Name: "SECCOMP", Description: "Required for seccomp."},
 			{Name: "SECCOMP_FILTER", Description: "Required for seccomp mode 2."},
 		},
+		OptionalCgroupsV1: []KernelConfig{
+			{Name: "CGROUP_HUGETLB", Description: "Required for hugetlb cgroup."},
+		},
+		OptionalCgroupsV2: []KernelConfig{
+			{Name: "CGROUP_HUGETLB", Description: "Required for hugetlb cgroup."},
+		},
 		Forbidden: []KernelConfig{},
 	},
 	Cgroups: []string{"cpu", "cpuacct", "cpuset", "devices", "freezer", "memory", "pids"},

vendor/modules.txt

@@ -1162,7 +1162,7 @@ k8s.io/kube-openapi/pkg/validation/validate
 ## explicit; go 1.25.0
 # k8s.io/sample-apiserver v0.0.0 => ./staging/src/k8s.io/sample-apiserver
 ## explicit; go 1.25.0
-# k8s.io/system-validators v1.10.1
+# k8s.io/system-validators v1.11.1
 ## explicit; go 1.16
 k8s.io/system-validators/validators
 # k8s.io/utils v0.0.0-20250604170112-4c0f3b243397