From c764de03dc6e7779bc20bc183f89db153219d749 Mon Sep 17 00:00:00 2001 From: "Lubomir I. Ivanov" Date: Tue, 21 Oct 2025 13:25:11 +0200 Subject: [PATCH] vendor: update system-validators to v1.12.1 Includes an update to the cgroups validator to throw an error if v1 is detected on the host. Also includes a KubeletVersion field to determine to show a warning or an error. --- go.mod | 2 +- go.sum | 4 +- .../validators/cgroup_validator_linux.go | 43 ++++++++++++++++++- .../validators/cgroup_validator_other.go | 3 +- vendor/modules.txt | 2 +- 5 files changed, 47 insertions(+), 7 deletions(-) diff --git a/go.mod b/go.mod index af3a60bbe09..eca3bd5c813 100644 --- a/go.mod +++ b/go.mod @@ -115,7 +115,7 @@ require ( k8s.io/mount-utils v0.0.0 k8s.io/pod-security-admission v0.0.0 k8s.io/sample-apiserver v0.0.0 - k8s.io/system-validators v1.11.1 + k8s.io/system-validators v1.12.1 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 sigs.k8s.io/knftables v0.0.17 diff --git a/go.sum b/go.sum index 09e4f40b5d3..66edfe7280d 100644 --- a/go.sum +++ b/go.sum @@ -485,8 +485,8 @@ k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk= k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE= k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ= -k8s.io/system-validators v1.11.1 h1:m/bX/WCgHTT+1YlwtTZfOFZ4NNx/LQJXPWfw3mGf+Lc= -k8s.io/system-validators v1.11.1/go.mod h1:awfSS706v9R12VC7u7K89FKfqVy44G+E0L1A0FX9Wmw= +k8s.io/system-validators v1.12.1 h1:AY1+COTLJN/Sj0w9QzH1H0yvyF3Kl6CguMnh32WlcUU= +k8s.io/system-validators v1.12.1/go.mod h1:awfSS706v9R12VC7u7K89FKfqVy44G+E0L1A0FX9Wmw= k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y= k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 h1:jpcvIRr3GLoUoEKRkHKSmGjxb6lWwrBlJsXc+eUYQHM= diff --git a/vendor/k8s.io/system-validators/validators/cgroup_validator_linux.go b/vendor/k8s.io/system-validators/validators/cgroup_validator_linux.go index ce93e7bc1b7..e8075cd98df 100644 --- a/vendor/k8s.io/system-validators/validators/cgroup_validator_linux.go +++ b/vendor/k8s.io/system-validators/validators/cgroup_validator_linux.go @@ -26,13 +26,16 @@ import ( "os" "path/filepath" "strings" + + "github.com/blang/semver/v4" ) var _ Validator = &CgroupsValidator{} // CgroupsValidator validates cgroup configuration. type CgroupsValidator struct { - Reporter Reporter + Reporter Reporter + KubeletVersion string } // Name is part of the system.Validator interface. @@ -114,7 +117,22 @@ func (c *CgroupsValidator) Validate(spec SysSpec) (warns, errs []error) { requiredCgroupSpec = spec.CgroupsV2 optionalCgroupSpec = spec.CgroupsV2Optional } else { - warns = append(warns, errors.New("cgroups v1 support is in maintenance mode, please migrate to cgroups v2")) + v1DisabledInKubelet, err := c.isCgroupsV1DisabledInKubelet() + if err != nil { + return nil, []error{err} + } + + v1Error := errors.New("cgroups v1 support is deprecated and will be removed in a future release. " + + "Please migrate to cgroups v2. To explicitly enable cgroups v1 support for kubelet v1.35 or newer, " + + "you must set the kubelet configuration option 'FailCgroupV1' to 'false'. You must also explicitly " + + "skip this validation. For more information, see https://git.k8s.io/enhancements/keps/sig-node/5573-remove-cgroup-v1") + + if v1DisabledInKubelet { + errs = append(errs, v1Error) + } else { + warns = append(warns, v1Error) + } + subsystems, err = c.getCgroupV1Subsystems() if err != nil { return nil, []error{fmt.Errorf("failed to get cgroups v1 subsystems: %w", err)} @@ -229,3 +247,24 @@ func checkCgroupV2Freeze(unifiedMountpoint string) (isCgroupfs bool, warn error) isCgroupfs = true return } + +// isCgroupsV1DisabledInKubelet checks the KubeletVersion and determines if that version +// disabled cgroups v1 support by default: +// - If the version is newer than 1.35 pre-release, return true. +// - If the version is not defined or older than pre-release 1.35, return false. +func (c *CgroupsValidator) isCgroupsV1DisabledInKubelet() (bool, error) { + if c.KubeletVersion == "" { + return false, nil + } + + kv, err := semver.Parse(c.KubeletVersion) + if err != nil { + return false, fmt.Errorf("malformed KubeletVersion in CgroupsValidator: %w", err) + } + + if kv.Compare(semver.MustParse("1.35.0-0")) > -1 { + return true, nil + } + + return false, nil +} diff --git a/vendor/k8s.io/system-validators/validators/cgroup_validator_other.go b/vendor/k8s.io/system-validators/validators/cgroup_validator_other.go index 1486756c1f5..9a2b2430706 100644 --- a/vendor/k8s.io/system-validators/validators/cgroup_validator_other.go +++ b/vendor/k8s.io/system-validators/validators/cgroup_validator_other.go @@ -27,7 +27,8 @@ const mountsFilePath = "" // CgroupsValidator validates cgroup configuration. type CgroupsValidator struct { - Reporter Reporter + Reporter Reporter + KubeletVersion string } // Validate is part of the system.Validator interface. diff --git a/vendor/modules.txt b/vendor/modules.txt index 6431038b0f7..1abb78d8d4b 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1163,7 +1163,7 @@ k8s.io/kube-openapi/pkg/validation/validate ## explicit; go 1.25.0 # k8s.io/sample-apiserver v0.0.0 => ./staging/src/k8s.io/sample-apiserver ## explicit; go 1.25.0 -# k8s.io/system-validators v1.11.1 +# k8s.io/system-validators v1.12.1 ## explicit; go 1.16 k8s.io/system-validators/validators # k8s.io/utils v0.0.0-20250604170112-4c0f3b243397