Commit Graph

121840 Commits

Author SHA1 Message Date
Patrick Ohly
2c6246c906 dra e2e: move ResourceSlice test
This should better run with multiple nodes, it's more realistic that way.
2024-03-07 22:23:03 +01:00
Patrick Ohly
0b6a0d686a dra api: rename NodeResourceSlice -> ResourceSlice
While currently those objects only get published by the kubelet for node-local
resources, this could change once we also support network-attached
resources. Dropping the "Node" prefix enables such a future extension.

The NodeName in ResourceSlice and StructuredResourceHandle then becomes
optional. The kubelet still needs to provide one and it must match its own node
name, otherwise it doesn't have permission to access ResourceSlice objects.
2024-03-07 22:22:55 +01:00
Patrick Ohly
42ee56f093 dra api: implement semver attribute value type
This adds support for semantic version comparison to the CEL support in the
"named resources" structured parameter model. For example, it can be used to
check that an instance supports a certain API level.

To minimize the risk, the new "semver" type is only defined in the CEL
environment for DRA expressions, not in the base library. See
https://github.com/kubernetes/kubernetes/pull/123664 for a PR which
adds it to the base library.

Validation of semver strings is done with the regular expression from
semver.org. The actual evaluation at runtime then uses semver/v4.
2024-03-07 22:22:13 +01:00
Patrick Ohly
234dc1f63d dra e2e: run more test scenarios with structured parameters 2024-03-07 22:22:13 +01:00
Patrick Ohly
d59676a545 dra kubelet: publish NodeResourceSlices
The information is received from the DRA driver plugin through a new gRPC
streaming interface. This is backwards compatible with old DRA driver kubelet
plugins, their gRPC server will return "not implemented" and that can be
handled by kubelet. Therefore no API break is needed.

However, DRA drivers need to be updated because the Go API changed. They can
return
    status.New(codes.Unimplemented, "no node resource support").Err()
if they don't support the new ListAndWatchResources method and
structured parameters.

The controller in kubelet then synchronizes this information from the driver
with NodeResourceSlice objects, creating, updating and deleting them as needed.
2024-03-07 22:22:13 +01:00
Patrick Ohly
5e40afca06 dra testing: add tests for structured parameters
The test driver now supports a ConfigMap (as before) and the named resources
structured parameter model. It doesn't have any instance attributes.
2024-03-07 22:22:13 +01:00
Patrick Ohly
3de376ecf6 dra controller: support structured parameters
When allocation was done by the scheduler, the controller needs to do the
deallocation because there is no control-plane controller which could react to
"DeallocationRequested".
2024-03-07 22:22:13 +01:00
Patrick Ohly
6f1ddfcd2e kubelet: support structured parameters for preparing resources
If the resource handle has data from a structured parameter model, then we need
to pass that to the DRA driver kubelet plugin. Because Kubernetes uses
gogo/protobuf, we cannot use "optional" for that new optional field and have to
resort to "repeated" with a single repetition if present.

This is a new, backwards-compatible field.

That extending the resource.k8s.io changes the checksum of a kubelet checkpoint
is unfortunate. Updating the test cases is a stop-gap measure, the actual
solution will have to be something else before beta.
2024-03-07 22:22:13 +01:00
Patrick Ohly
4ed2b3eaeb scheduler_perf: test DRA with structured parameters 2024-03-07 22:21:58 +01:00
Patrick Ohly
d4d5ade7f5 dra: add "named resources" structured parameter model
Like the current device plugin interface, a DRA driver using this model
announces a list of resource instances. In contrast to device plugins, this
list is made available to the scheduler together with attributes that can be
used to select suitable instances when they are not all alike.

Because this is the first structured parameter model, some checks that
previously were not possible, in particular "is one structured parameter field
set", now gets enabled. Adding another structured parameter model will be
similar.

The applyconfigs code generator assumes that all types in an API are defined in
a single package. If it wasn't for that, it would be possible to place the
"named resources" types in separate packages, which makes their names in the Go
code more natural and provides an indication of their stability level because
the package name could include a version.
2024-03-07 22:21:16 +01:00
Patrick Ohly
096e948905 dra scheduler: support structured parameters
When a claim uses structured parameters, as indicated by the resource class
flag, the scheduler is responsible for allocating it. To do this it needs to
gather information about available node resources by watching
NodeResourceSlices and then match the in-tree claim parameters against those
resources.
2024-03-07 22:21:04 +01:00
Peter Hunt
49ee96eed4 pod security test: add user namespaces feature
Signed-off-by: Peter Hunt <pehunt@redhat.com>
2024-03-07 15:56:06 -05:00
Peter Hunt
1f9c271c8c PSA: update procmount tests to have hostUsers
Signed-off-by: Peter Hunt <pehunt@redhat.com>
2024-03-07 15:56:06 -05:00
Peter Hunt
23706cb90c api validation: validate proc mount against user namespace
fail if container uses proc mount unmasked but pod does not use user namespace

Signed-off-by: Peter Hunt <pehunt@redhat.com>
2024-03-07 15:56:06 -05:00
Yuki Iwai
e216742672 Job: Support for the JobSuccessPolicy (alpha)
Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com>
2024-03-08 05:49:09 +09:00
Kubernetes Prow Robot
cc6d9b3037
Merge pull request #123789 from tallclair/apparmor-warnings
Warn on deprecated AppArmor annotation use
2024-03-07 11:53:54 -08:00
Kubernetes Prow Robot
46f017a90b
Merge pull request #123770 from Jefftree/go-restful
fix aggregator path filtering to include /
2024-03-07 10:21:53 -08:00
Tim Allclair
7bd78b06e9 Warn on deprecated AppArmor annotation use 2024-03-07 09:51:48 -08:00
Davanum Srinivas
b1341c8795
Revert portion of the GPU testcase
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2024-03-07 12:39:04 -05:00
Kubernetes Prow Robot
ebf4ca686a
Merge pull request #123801 from HirazawaUi/followup-allow-special-characters
Follow-up on unresolved question in PR #123385
2024-03-07 09:18:17 -08:00
Michal Wozniak
194009fac9 Add integration test for managedBy and cleanup of finalizers 2024-03-07 17:54:16 +01:00
HirazawaUi
2867be47b3 followup to allow special characters 2024-03-08 00:08:43 +08:00
Kubernetes Prow Robot
246e678acc
Merge pull request #123751 from mimowo/job-update-conformance-test
Update Job conformance test for job status updates
2024-03-07 07:49:24 -08:00
Patrick Ohly
a92d2a4cea noderestriction admission: lock down create of NodeResourceSlice
The proper value of NodeName must be checked here for create because
the node authorizer cannot do it.
2024-03-07 16:15:52 +01:00
Patrick Ohly
2e34e187c9 node authorizer: lock down access for NodeResourceSlice
The kubelet running on one node should not be allowed to access
NodeResourceSlice objects belonging to some other node, as defined by the
NodeResourceSlice.NodeName field.
2024-03-07 16:15:52 +01:00
Patrick Ohly
39bbcedbca dra api: add structured parameters
NodeResourceSlice will be used by kubelet to publish resource information on
behalf of DRA drivers on the node. NodeName and DriverName in
NodeResourceSlice must be immutable. This simplifies tracking the different
objects because what they are for cannot change after creation.

The new field in ResourceClass tells scheduler and autoscaler that they are
expected to handle allocation.

ResourceClaimParameters and ResourceClassParameters are new types for telling
in-tree components how to handle claims.
2024-03-07 16:15:31 +01:00
Patrick Ohly
eb1470d60d scheduler: fix assume cache with no index
The assume cache in the volumbinding plugin can be created with no separate
index, but List then failed because it tried to use the empty index name
instead of using the store's List function.
2024-03-07 16:09:44 +01:00
Kubernetes Prow Robot
bf7fcfdc7f
Merge pull request #123776 from dims/adjust-gpu-test-to-work-with-latest-nvidia-daemonset
Adjust GPU test to work with latest nvidia daemonset on AWS/ec2
2024-03-07 06:30:55 -08:00
Kubernetes Prow Robot
a035f5b19e
Merge pull request #123774 from cici37/vapGA
Enabled conformance test for GA feature.
2024-03-07 06:30:48 -08:00
Kubernetes Prow Robot
fb1d8b015d
Merge pull request #123798 from cpanato/update-bot
Update publishing-bot rules to Go 1.21.8
2024-03-07 05:24:39 -08:00
cpanato
48daa91857
Update publishing-bot rules to Go 1.21.8
Signed-off-by: cpanato <ctadeu@gmail.com>
2024-03-07 06:32:51 -05:00
Kubernetes Prow Robot
a31a465405
Merge pull request #123735 from thockin/master
Don't embed plural exceptions in tools
2024-03-07 02:08:27 -08:00
Davanum Srinivas
30857658e4
Adjust GPU test to work with latest nvidia daemonset
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2024-03-06 21:42:21 -05:00
Kubernetes Prow Robot
2ec63e0d28
Merge pull request #123482 from sanposhiho/hpa-containerresource-graduation
graduate HPAContainerMetrics to stable
2024-03-06 17:37:36 -08:00
Kubernetes Prow Robot
c726b2b3a3
Merge pull request #123431 from aramase/aramase/f/kep_3331_multiple_jwt_authenticator
Support multiple JWT authenticators with structured authn config
2024-03-06 17:37:29 -08:00
cici37
758dc53510 Enabled conformance test for VAP which is GAed. 2024-03-06 23:53:20 +00:00
Kubernetes Prow Robot
05cb0a55c8
Merge pull request #123696 from aramase/aramase/f/kep_3331_v1beta1_api
Duplicate v1alpha1 AuthenticationConfiguration to v1beta1
2024-03-06 15:35:28 -08:00
Kubernetes Prow Robot
bd25605619
Merge pull request #123435 from tallclair/apparmor-ga
AppArmor fields API
2024-03-06 15:35:14 -08:00
Tim Hockin
df7f5fca27
Don't embed plural exceptions in tools 2024-03-06 14:57:46 -08:00
Anish Ramasekar
39e1c9108c
Support multiple JWT authenticators with structured authn config
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2024-03-06 14:42:32 -08:00
Kubernetes Prow Robot
e0621034be
Merge pull request #123750 from cpanato/update-go
[go] Bump images, dependencies and versions to go 1.22.1 and distroless iptables
2024-03-06 12:35:50 -08:00
Tim Allclair
2d86cbf261 Separate feature-gate for AppArmor fields 2024-03-06 10:46:32 -08:00
Tim Allclair
22068e0cc7 Validate annotation & field match in PodTemplate 2024-03-06 10:46:31 -08:00
Tim Allclair
06caf32ecd Validate localhost profile max length 2024-03-06 10:46:31 -08:00
Tim Allclair
0eb5f52d06 Rename AppArmor annotation constants with Deprecated 2024-03-06 10:46:31 -08:00
Jefftree
8373f3035a fix aggregator path filtering to include / 2024-03-06 13:33:33 -05:00
cpanato
70221e8405
[go] Bump images, dependencies and versions to go 1.22.1 and distroless iptables
Signed-off-by: cpanato <ctadeu@gmail.com>
2024-03-06 13:09:17 -05:00
Kubernetes Prow Robot
5f2c9e73c0
Merge pull request #123759 from liggitt/update-workspace
Avoid clearing go version in go.work update script
2024-03-06 10:07:23 -08:00
Kubernetes Prow Robot
a5f5f44157
Merge pull request #123758 from liggitt/protobump
[CVE-2024-24786] Bump github.com/golang/protobuf v1.5.4, google.golang.org/protobuf v1.33.0
2024-03-06 07:49:01 -08:00
Jordan Liggitt
6f2842c08c
Avoid clearing go version in go.work update script 2024-03-06 10:04:49 -05:00