From d7a2793fa658844c3cc5c157ba1a27e48ab244a8 Mon Sep 17 00:00:00 2001 From: Paco Xu Date: Tue, 16 Sep 2025 23:06:52 +0800 Subject: [PATCH] bump system-validators to v1.11.1 --- go.mod | 2 +- go.sum | 4 +-- .../validators/cgroup_validator_other.go | 7 +++++ .../validators/kernel_validator.go | 17 ++++++++++- .../system-validators/validators/types.go | 12 ++++++-- .../validators/types_unix.go | 28 +++++++++++++------ vendor/modules.txt | 2 +- 7 files changed, 57 insertions(+), 15 deletions(-) diff --git a/go.mod b/go.mod index 2f690a41ede..e448bef0689 100644 --- a/go.mod +++ b/go.mod @@ -117,7 +117,7 @@ require ( k8s.io/mount-utils v0.0.0 k8s.io/pod-security-admission v0.0.0 k8s.io/sample-apiserver v0.0.0 - k8s.io/system-validators v1.10.1 + k8s.io/system-validators v1.11.1 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 sigs.k8s.io/knftables v0.0.17 sigs.k8s.io/randfill v1.0.0 diff --git a/go.sum b/go.sum index 762437f46ae..d10e8bfe68f 100644 --- a/go.sum +++ b/go.sum @@ -485,8 +485,8 @@ k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk= k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE= k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ= -k8s.io/system-validators v1.10.1 h1:bIO3YRgxJkh/W3ghcd5ViXNPGmjwQKlHk/ySPdw6K00= -k8s.io/system-validators v1.10.1/go.mod h1:awfSS706v9R12VC7u7K89FKfqVy44G+E0L1A0FX9Wmw= +k8s.io/system-validators v1.11.1 h1:m/bX/WCgHTT+1YlwtTZfOFZ4NNx/LQJXPWfw3mGf+Lc= +k8s.io/system-validators v1.11.1/go.mod h1:awfSS706v9R12VC7u7K89FKfqVy44G+E0L1A0FX9Wmw= k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y= k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM= diff --git a/vendor/k8s.io/system-validators/validators/cgroup_validator_other.go b/vendor/k8s.io/system-validators/validators/cgroup_validator_other.go index 9d74a7ba917..1486756c1f5 100644 --- a/vendor/k8s.io/system-validators/validators/cgroup_validator_other.go +++ b/vendor/k8s.io/system-validators/validators/cgroup_validator_other.go @@ -23,6 +23,8 @@ package system var _ Validator = &CgroupsValidator{} +const mountsFilePath = "" + // CgroupsValidator validates cgroup configuration. type CgroupsValidator struct { Reporter Reporter @@ -37,3 +39,8 @@ func (c *CgroupsValidator) Validate(spec SysSpec) (warns, errs []error) { func (c *CgroupsValidator) Name() string { return "cgroups" } + +// getUnifiedMountpoint is a no-op for non-Linux OSes. +func getUnifiedMountpoint(path string) (string, bool, error) { + return "", false, nil +} diff --git a/vendor/k8s.io/system-validators/validators/kernel_validator.go b/vendor/k8s.io/system-validators/validators/kernel_validator.go index ffad14994a6..0b37396b806 100644 --- a/vendor/k8s.io/system-validators/validators/kernel_validator.go +++ b/vendor/k8s.io/system-validators/validators/kernel_validator.go @@ -70,7 +70,8 @@ func (k *KernelValidator) Validate(spec SysSpec) ([]error, []error) { warns = append(warns, warn) } // only validate kernel config when necessary (currently no kernel config for windows) - if len(spec.KernelSpec.Required) > 0 || len(spec.KernelSpec.Forbidden) > 0 || len(spec.KernelSpec.Optional) > 0 { + if len(spec.KernelSpec.Required) > 0 || len(spec.KernelSpec.Forbidden) > 0 || len(spec.KernelSpec.Optional) > 0 || + len(spec.KernelSpec.RequiredCgroupsV1) > 0 || len(spec.KernelSpec.RequiredCgroupsV2) > 0 { if err = k.validateKernelConfig(spec.KernelSpec); err != nil { errs = append(errs, err) } @@ -158,6 +159,20 @@ func (k *KernelValidator) validateCachedKernelConfig(allConfig map[string]kConfi for _, config := range kSpec.Required { validateOpt(config, required) } + _, isCgroupsV2, err := getUnifiedMountpoint(mountsFilePath) + if err != nil { + return fmt.Errorf("failed to get unified mountpoint: %w", err) + } + if isCgroupsV2 { + for _, config := range kSpec.RequiredCgroupsV2 { + validateOpt(config, required) + } + } else { + for _, config := range kSpec.RequiredCgroupsV1 { + validateOpt(config, required) + } + } + for _, config := range kSpec.Optional { validateOpt(config, optional) } diff --git a/vendor/k8s.io/system-validators/validators/types.go b/vendor/k8s.io/system-validators/validators/types.go index eee7e81762a..6256c37fb3e 100644 --- a/vendor/k8s.io/system-validators/validators/types.go +++ b/vendor/k8s.io/system-validators/validators/types.go @@ -46,10 +46,18 @@ type KernelSpec struct { VersionsNote string `json:"versionsNote,omitempty"` // Required contains all kernel configurations required to be enabled // (built in or as module). + // RequiredCgroupsV1 and RequiredCgroupsV2 are mutually exclusive. Required []KernelConfig `json:"required,omitempty"` - // Optional contains all kernel configurations are required for optional - // features. + // RequiredCgroupsV1 contains all kernel configurations required to be enabled for cgroups v1. + RequiredCgroupsV1 []KernelConfig `json:"requiredCgroupsV1,omitempty"` + // RequiredCgroupsV2 contains all kernel configurations required to be enabled for cgroups v2. + RequiredCgroupsV2 []KernelConfig `json:"requiredCgroupsV2,omitempty"` + // Optional contains optional kernel configurations. Optional []KernelConfig `json:"optional,omitempty"` + // OptionalCgroupsV1 contains optional kernel configurations related to cgroups v1. + OptionalCgroupsV1 []KernelConfig `json:"optionalCgroupsV1,omitempty"` + // OptionalCgroupsV2 contains optional kernel configurations related to cgroups v2. + OptionalCgroupsV2 []KernelConfig `json:"optionalCgroupsV2,omitempty"` // Forbidden contains all kernel configurations which areforbidden (disabled // or not set) Forbidden []KernelConfig `json:"forbidden,omitempty"` diff --git a/vendor/k8s.io/system-validators/validators/types_unix.go b/vendor/k8s.io/system-validators/validators/types_unix.go index 28eb1d38ba8..1edd0ecb03c 100644 --- a/vendor/k8s.io/system-validators/validators/types_unix.go +++ b/vendor/k8s.io/system-validators/validators/types_unix.go @@ -41,13 +41,6 @@ var DefaultSysSpec = SysSpec{ {Name: "PID_NS"}, {Name: "IPC_NS"}, {Name: "UTS_NS"}, - {Name: "CGROUPS"}, - {Name: "CGROUP_BPF"}, // cgroups v2 - {Name: "CGROUP_CPUACCT"}, // cgroups v1 cpuacct - {Name: "CGROUP_DEVICE"}, - {Name: "CGROUP_FREEZER"}, // cgroups v1 freezer - {Name: "CGROUP_PIDS"}, - {Name: "CGROUP_SCHED"}, // cgroups v1 & v2 cpu {Name: "CPUSETS"}, {Name: "MEMCG"}, {Name: "INET"}, @@ -57,15 +50,34 @@ var DefaultSysSpec = SysSpec{ {Name: "NETFILTER_XT_MATCH_COMMENT"}, {Name: "FAIR_GROUP_SCHED"}, }, + RequiredCgroupsV1: []KernelConfig{ + {Name: "CGROUPS", Description: "Required for cgroups."}, + {Name: "CGROUP_CPUACCT", Description: "Required for cpuacct controller, used in simple CPU accounting controller."}, + {Name: "CGROUP_DEVICE", Description: "Required for device controller."}, + {Name: "CGROUP_FREEZER", Description: "Required for freezer controller."}, + {Name: "CGROUP_PIDS", Description: "Required for PIDs controller."}, + {Name: "CGROUP_SCHED", Description: "Required for CPU controller."}, + }, + RequiredCgroupsV2: []KernelConfig{ + {Name: "CGROUPS", Description: "Required for cgroups."}, + {Name: "CGROUP_BPF", Description: "Required for eBPF programs attached to cgroups, used in device controller."}, + {Name: "CGROUP_PIDS", Description: "Required for PIDs controller."}, + {Name: "CGROUP_SCHED", Description: "Required for CPU controller."}, + }, Optional: []KernelConfig{ {Name: "OVERLAY_FS", Aliases: []string{"OVERLAYFS_FS"}, Description: "Required for overlayfs."}, {Name: "AUFS_FS", Description: "Required for aufs."}, {Name: "BLK_DEV_DM", Description: "Required for devicemapper."}, {Name: "CFS_BANDWIDTH", Description: "Required for CPU quota."}, - {Name: "CGROUP_HUGETLB", Description: "Required for hugetlb cgroup."}, {Name: "SECCOMP", Description: "Required for seccomp."}, {Name: "SECCOMP_FILTER", Description: "Required for seccomp mode 2."}, }, + OptionalCgroupsV1: []KernelConfig{ + {Name: "CGROUP_HUGETLB", Description: "Required for hugetlb cgroup."}, + }, + OptionalCgroupsV2: []KernelConfig{ + {Name: "CGROUP_HUGETLB", Description: "Required for hugetlb cgroup."}, + }, Forbidden: []KernelConfig{}, }, Cgroups: []string{"cpu", "cpuacct", "cpuset", "devices", "freezer", "memory", "pids"}, diff --git a/vendor/modules.txt b/vendor/modules.txt index ec368848a4a..46643b32b15 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1162,7 +1162,7 @@ k8s.io/kube-openapi/pkg/validation/validate ## explicit; go 1.25.0 # k8s.io/sample-apiserver v0.0.0 => ./staging/src/k8s.io/sample-apiserver ## explicit; go 1.25.0 -# k8s.io/system-validators v1.10.1 +# k8s.io/system-validators v1.11.1 ## explicit; go 1.16 k8s.io/system-validators/validators # k8s.io/utils v0.0.0-20250604170112-4c0f3b243397