Mask and stop services that compete with apt operations or are not
needed for Kubernetes nodes:
- apt-news.service/timer: fetches APT news, holds apt lock
- esm-cache.service: Ubuntu Pro cache updates
- snapd.service/socket: Snap package manager
- lxd-installer.socket: LXD container helper
- ubuntu-advantage.service: Ubuntu Pro auto-attach
- unattended-upgrades.service: automatic security updates
- motd-news.timer: MOTD news fetching
- update-notifier-motd.timer: "new Ubuntu version" checks
- update-notifier-download.timer: failed package retry
This addresses CI timeouts where apt-news.service running concurrently
with apt-get update caused the master node to take ~5 minutes for
package index downloads (vs ~5-9 seconds on worker nodes).
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
when both UBUNTU_INSTALL_CONTAINERD_VERSION and UBUNTU_INSTALL_RUNC_VERSION
are set, skip apt entirely and download binaries directly from GitHub.
this avoids installing apt packages that get immediately overwritten.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
so that configured liveness probes will fail
if the loopback certificate has expired,
forcing a restart.
Signed-off-by: Bryce Palmer <bpalmer@redhat.com>
The verbs parameter slice might be shared between different rule instances and
gets sorted (= written), so we have to make a copy or (even better) also
de-duplicate as in pkg/apis/rbac/helpers.go.
More specifically, plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go
shares the Read and ReadWrite slices, causing:
WARNING: DATA RACE
Read at 0x000008e5e5b0 by goroutine 124:
slices.insertionSortOrdered[go.shape.string]()
/home/prow/go/src/k8s.io/kubernetes/_output/local/go/cache/mod/golang.org/toolchain@v0.0.1-go1.25.6.linux-amd64/src/slices/zsortordered.go:14 +0x126
slices.pdqsortOrdered[go.shape.string]()
/home/prow/go/src/k8s.io/kubernetes/_output/local/go/cache/mod/golang.org/toolchain@v0.0.1-go1.25.6.linux-amd64/src/slices/zsortordered.go:75 +0x6c4
slices.Sort[go.shape.[]string,go.shape.string]()
/home/prow/go/src/k8s.io/kubernetes/_output/local/go/cache/mod/golang.org/toolchain@v0.0.1-go1.25.6.linux-amd64/src/slices/sort.go:18 +0x64
sort.Strings()
/home/prow/go/src/k8s.io/kubernetes/_output/local/go/cache/mod/golang.org/toolchain@v0.0.1-go1.25.6.linux-amd64/src/sort/sort.go:181 +0xe
k8s.io/kubernetes/pkg/apis/rbac/v1.(*PolicyRuleBuilder).Rule()
/home/prow/go/src/k8s.io/kubernetes/pkg/apis/rbac/v1/helpers.go:98 +0x2c9
k8s.io/kubernetes/pkg/apis/rbac/v1.(*PolicyRuleBuilder).RuleOrDie()
/home/prow/go/src/k8s.io/kubernetes/pkg/apis/rbac/v1/helpers.go:65 +0x2f44
k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy.ClusterRoles()
/home/prow/go/src/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go:404 +0x2c13
...
Previous write at 0x000008e5e5b0 by goroutine 123:
slices.insertionSortOrdered[go.shape.string]()
/home/prow/go/src/k8s.io/kubernetes/_output/local/go/cache/mod/golang.org/toolchain@v0.0.1-go1.25.6.linux-amd64/src/slices/zsortordered.go:15 +0x2f9
slices.pdqsortOrdered[go.shape.string]()
/home/prow/go/src/k8s.io/kubernetes/_output/local/go/cache/mod/golang.org/toolchain@v0.0.1-go1.25.6.linux-amd64/src/slices/zsortordered.go:75 +0x6c4
slices.Sort[go.shape.[]string,go.shape.string]()
/home/prow/go/src/k8s.io/kubernetes/_output/local/go/cache/mod/golang.org/toolchain@v0.0.1-go1.25.6.linux-amd64/src/slices/sort.go:18 +0x64
sort.Strings()
/home/prow/go/src/k8s.io/kubernetes/_output/local/go/cache/mod/golang.org/toolchain@v0.0.1-go1.25.6.linux-amd64/src/sort/sort.go:181 +0xe
k8s.io/kubernetes/pkg/apis/rbac/v1.(*PolicyRuleBuilder).Rule()
/home/prow/go/src/k8s.io/kubernetes/pkg/apis/rbac/v1/helpers.go:98 +0x2c9
k8s.io/kubernetes/pkg/apis/rbac/v1.(*PolicyRuleBuilder).RuleOrDie()
/home/prow/go/src/k8s.io/kubernetes/pkg/apis/rbac/v1/helpers.go:65 +0x2f44
k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy.ClusterRoles()
/home/prow/go/src/k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go:404 +0x2c13
Seen in test/integration/apiserver/oidc.
there are recent changes in k8s e2e test for image pull test to switch
to use fake registry server,
https://github.com/kubernetes/kubernetes/pull/133272https://github.com/kubernetes/kubernetes/pull/134453
Unfortunately, this does not take into account of windows node. so the
corresonding test on windows node strat to break
The try to address this issue, by
(1): update the agnhost windows image to include the fake registery server
functionality as well
(2): update the (common) pull image test to include windows node, will require
(a): deploy the agnhost faker register server as a HPC pod
(b): update the comanndline/options for the windows container specific
When running with race detection enabled several tests have suffered from
timeouts recently, with no obvious commit which could be blamed for this.
Let's use a common constant and make it larger.
