Add tests for Union, DiscriminatedUnion, and ZeroOrOneOfUnion
validating that nil oldObj (new map entry or newly-set pointer
field during update) does not skip validation via ratcheting.
When oldObj is nil (e.g. new map entry added during update), union
ratcheting incorrectly treats nil old and empty new as unchanged
membership, skipping validation entirely. Fix by checking
reflect.ValueOf(oldObj).IsNil() and disabling ratcheting when
oldObj is nil, so the new value is fully validated.
This affects Union, DiscriminatedUnion, and ZeroOrOneOfUnion
(via unionValidate).
Promote DRADeviceBindingConditions feature gate from Alpha to Beta
in v1.36 with default enabled.
- Update feature gate definition to set default=true for v1.36 Beta
- Update API documentation comments from "alpha field" to "beta field"
across all resource API versions (v1, v1beta1, v1beta2)
Signed-off-by: Tsubasa Watanabe <w.tsubasa@fujitsu.com>
Add a Node-Exclusive ResourceSlices section to `kubectl describe node`
that displays DRA ResourceSlices assigned exclusively to the node.
Key design decisions per reviewer feedback:
1. Uses indexed field selector (spec.nodeName) for O(1) query performance
instead of fetching all slices cluster-wide. This is critical for
large clusters with thousands of ResourceSlices.
2. Shows only node-exclusive slices (where spec.NodeName == thisNode).
Does NOT show AllNodes, NodeSelector, or PerDeviceNodeSelection slices
as these could number in the thousands and aren't node-specific.
3. Aggregates by driver/pool instead of listing individual slices:
- Shows: Driver, Pool, Slices count, Devices count
- More concise and useful output
4. Caps output at 10 pools with "...and X more pools" message,
following the existing formatEndpointSlices pattern.
Example output:
Node-Exclusive ResourceSlices:
Driver Pool Slices Devices
------ ---- ------ -------
nvidia.com/gpu gpu-pool 2 8
intel.com/qat qat-pool 1 4
Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>
Thread externalDocs and example fields through the structural schema
so they flow to published OpenAPI specs. Previously, both were
intentionally dropped during JSONSchemaProps to Structural conversion,
making them unavailable to clients like kubectl explain.
This change reduces allocations by:
- Replacing cryptobyte.Builder with manual length-prefix encoding into []byte
- Replacing fmt.Sprintf with hex.Encode/hex.AppendEncode
- Using unsafe.String for safe []byte to string conversions
Signed-off-by: Monis Khan <mok@microsoft.com>
Add MemoryReservationPolicy (None/HardReservation) controls memory.min. This allows
independently of memory.min protection, providing operators more
granular control over memoryQoS behavior.
Signed-off-by: Qi Wang <qiwan@redhat.com>
* Add more unit tests for constrained impersonation
test cases for large number of groups/extra
test cases for system:masters constrained impersonation is not allowed
Signed-off-by: Jian Qiu <jqiu@redhat.com>
* Validate each authz request in the constrained impersonation unit test
Signed-off-by: Jian Qiu <jqiu@redhat.com>
---------
Signed-off-by: Jian Qiu <jqiu@redhat.com>
TestEvictDuringNamespaceTerminating intentionally exercises the retry path
but only allows 10ms of total time. The production loop sleeps, refreshes
state, and retries under that same deadline, so a single retry plus
scheduler jitter is enough to exhaust the budget under -race or on busy
CI workers.
Keep the retry interval small so the test still covers the retry behavior,
but widen the overall timeout so the assertion measures semantics instead
of machine speed.
Tested:
go test -race ./staging/src/k8s.io/kubectl/pkg/drain -run TestEvictDuringNamespaceTerminating -count=100
