github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-07-17 20:00:07 +00:00
Code Issues Projects Releases Wiki Activity
129,695 Commits 42 Branches 9,765 Tags
59644b2255cecb01ac1e12c8a93fc1bdbbf03a3a
Commit Graph

4449 Commits

Author SHA1 Message Date
Dejan Zele Pejchev
e47053f2fb fix: allow job startTime updates on resume from suspended state 
Signed-off-by: Dejan Zele Pejchev <pejcev.dejan@gmail.com>
 2025-11-05 09:58:11 +01:00
Jordan Liggitt
6a47dd845d Remove invalid SAN certificate construction 2025-10-14 09:37:26 -04:00
Patrick Ohly
1fde2b884c DRA node: reject static pods which reference ResourceClaims 
If someone gains the ability to create static pods, they might try to use that
ability to run code which gets access to the resources associated with some
existing claim which was previously allocated for some other pod. Such an
attempt already fails because the claim status tracks which pods are allowed to
use the claim, the static pod is not in that list, the node is not authorized
to add it, and the kubelet checks that list before starting the pod in
195803cde5/pkg/kubelet/cm/dra/manager.go (L218-L222).

Even if the pod were started, DRA drivers typically manage node-local resources
which can already be accessed via such an attack without involving DRA. DRA
drivers which manage non-node-local resources have to consider access by a
compromised node as part of their threat model.

Nonetheless, it is better to not accept static pods which reference
ResourceClaims or ResourceClaimTemplates in the first place because there
is no valid use case for it.

This is done at different levels for defense in depth:
- configuration validation in the kubelet
- admission checking of node restrictions
- API validation

Co-authored-by: Jordan Liggitt <liggitt@google.com>

Code changes by Jordan, with one small change (resourceClaims -> resourceclaims).
Unit tests by Patrick.
 2025-05-21 08:40:50 +02:00
Antonio Ojea
0266d3bcb3 Allow single-to-dual-stack reconfiguration for ServiceCIDR 
This change modifies the validation logic for ServiceCIDR updates
(`ValidateServiceCIDRUpdate`) to specifically permit upgrading a
single-stack ServiceCIDR (either IPv4 or IPv6) to a dual-stack
configuration.

This reconfiguration path is considered safe because it only involves adding
a new CIDR range without altering the existing primary CIDR. This
ensures that existing Service IP allocations are not disrupted.

Other modifications, such as:
- Downgrading from dual-stack to single-stack
- Reordering CIDRs in a dual-stack configuration
- Changing the primary CIDR during a single-to-dual-stack
  reconfiguration

remain disallowed by the validation. These operations carry a higher
risk of breaking existing Services or cluster networking
configurations. Preventing these updates automatically encourages
administrators to perform such changes manually after carefully
assessing the potential impact on their specific cluster environment.
The validation errors and controller logs provide guidance when such
disallowed changes are attempted.

Change-Id: I41dc09dfddb05f277925da2262f8114d6accbd1d
 2025-04-14 17:05:44 +00:00
Filip Křepinský
8db1426554 rename DeploymentPodReplacementPolicy FG to DeploymentReplicaSetTerminatingReplicas 2025-03-27 20:27:44 +01:00
Kubernetes Prow Robot
070f0ad3bd Merge pull request #129970 from mortent/AddResourceV1beta2API 
Add resource v1beta2 API
 2025-03-26 09:10:47 -07:00
Morten Torkildsen
e761be47a4 Run make update 2025-03-26 14:52:36 +00:00
Morten Torkildsen
39507d911f Add resource v1beta2 API 2025-03-26 14:41:09 +00:00
Kubernetes Prow Robot
ff25881bc1 Merge pull request #130556 from sreeram-venkitesh/kep-4960-container-stop-signals 
KEP 4960: Container Stop Signals
 2025-03-24 16:36:32 -07:00
Sreeram
d6d9a354d7 Generated files 2025-03-25 02:06:29 +05:30
Sreeram
0380f2c41c Validation 2025-03-25 01:58:04 +05:30
Sreeram
70540c9f43 API changes 2025-03-25 01:56:45 +05:30
Jean-Marc François
ac107137ce Refresh autogenerated files following the configurable tolerance updates. 2025-03-21 18:48:38 -04:00
Jean-Marc François
dc1696d807 Fix API doc and tolerance field handling when gate is flipped. 2025-03-21 18:48:37 -04:00
Jean-Marc François
a41284d9fa Add the HorizontalPodAutoscaler tolerance field. 
Includes v2beta2 HPA round-trip conversion, defaulting, and validation.
 2025-03-21 18:48:37 -04:00
Kubernetes Prow Robot
838f3c0852 Merge pull request #130577 from KevinTMtz/pod-level-hugepages 
[PodLevelResources] Pod Level Hugepage Resources
 2025-03-20 15:34:38 -07:00
Kubernetes Prow Robot
451d032915 Merge pull request #130210 from everpeace/KEP-3619-promote-SupplementalGroupsPolicy-to-Beta 
KEP-3619: Promote SupplementalGroupsPolicy feature to Beta
 2025-03-20 11:24:37 -07:00
Kevin Torres
b9e0d4ad66 Unit tests for pod level hugepage resources 2025-03-20 17:54:39 +00:00
Kevin Torres
aa17082a16 Default pod level hugepage limits 2025-03-20 17:54:39 +00:00
Kubernetes Prow Robot
41dd679fee Merge pull request #130920 from kerthcet/feat/promote-to-ga 
KEP-3094: Promote NodeInclusionPolicyInPodTopologySpread to Stable
 2025-03-20 07:52:32 -07:00
kerthcet
1a34095f75 KEP-3094 Promote NodeInclusionPolicyInPodTopologySpread to Stable 
Signed-off-by: kerthcet <kerthcet@gmail.com>
 2025-03-20 14:54:42 +08:00
Shingo Omura
eda274ed7e KEP-3619: merge SupplementalGroupsPolicy dedicated validation tests into standard ones 2025-03-20 13:45:22 +09:00
Shingo Omura
64a4e34989 KEP-3619: fix field path in validating ContainerUsers in PodStatusUpdate 2025-03-20 13:45:22 +09:00
Cici Huang
ea2f888109 Auto gen 2025-03-19 22:10:48 +00:00
Cici Huang
ece1d76e80 API manual changes 
Co-authored-by: Morten Torkildsen <mortent@google.com>
 2025-03-19 22:10:48 +00:00
Kubernetes Prow Robot
68ba091fca Merge pull request #130844 from danwinship/improved-traffic-distribution 
KEP-3015 PreferSameZone/PreferSameNode traffic distribution
 2025-03-19 13:00:48 -07:00
Kubernetes Prow Robot
ab3cec0701 Merge pull request #130447 from pohly/dra-device-taints 
device taints and tolerations (KEP 5055)
 2025-03-19 13:00:32 -07:00
Kubernetes Prow Robot
2b79593ece Merge pull request #130225 from ritazh/dra-admin-access-namespace 
DRA: AdminAccess validate based on namespace label
 2025-03-19 10:18:50 -07:00
Kubernetes Prow Robot
f1c634f93e Merge pull request #130463 from sanposhiho/ga-mlk 
feat: graduate MatchLabelKeysInPodAffinity to GA
 2025-03-19 09:06:31 -07:00
Kensei Nakada
10c6a4258f feat: graduate MatchLabelKeysInPodAffinity to GA 2025-03-19 23:06:04 +09:00
Dan Winship
af3584778e update generate docs for PreferSameTrafficDistribution 2025-03-19 08:39:13 -04:00
Dan Winship
4435ead24a Add PreferSameTrafficDistribution feature gate and associated API. 2025-03-19 08:39:13 -04:00
Dan Winship
6ca82f9c16 Update the use of sets in EndpointSlice validation 
Don't use sets for validating port name and zone hint uniqueness,
since constructing a new set each time is likely to be less efficient
than just doing a linear search.

Keep the sets for supportedAddressTypes and supportedPortProtocols
(since they're only constructed once) but switch to the generic set
API.
 2025-03-19 08:39:13 -04:00
Rita Zhang
0301e5a9f8 DRA: AdminAccess validate based on namespace label 
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>
 2025-03-18 22:56:54 -07:00
Patrick Ohly
99dbd85c45 DRA: generated files for device taints API 2025-03-18 20:52:54 +01:00
Patrick Ohly
797475e113 DRA: add device taints API 
This adds the "DeviceTaint" top-level type to v1alpha3 and related fields to
ResourceSlice and ResourceClaim. It's complete enough bring up an API server
and generate files.
 2025-03-18 20:52:54 +01:00
Eddie Torres
c766a52356 Implement KEP 4876 Mutable CSINode (#130007) 
* Implement KEP-4876 Mutable CSINode Allocatable Count

Signed-off-by: torredil <torredil@amazon.com>

* Update TestGetNodeAllocatableUpdatePeriod

Signed-off-by: torredil <torredil@amazon.com>

* Implement CSINodeUpdater

Signed-off-by: torredil <torredil@amazon.com>

* Use sync.Once in csiNodeUpdater

Signed-off-by: torredil <torredil@amazon.com>

* ImVerify driver is installed before running periodic updates

Signed-off-by: torredil <torredil@amazon.com>

* Update NodeAllocatableUpdatePeriodSeconds type comment

Signed-off-by: torredil <torredil@amazon.com>

* Leverage apivalidation.ValidateImmutableField in ValidateCSINodeUpdate

Signed-off-by: torredil <torredil@amazon.com>

* Update strategy functions

Signed-off-by: torredil <torredil@amazon.com>

* Run hack/update-openapi-spec.sh

Signed-off-by: torredil <torredil@amazon.com>

* Update VolumeError.ErrorCode field

Signed-off-by: torredil <torredil@amazon.com>

* CSINodeUpdater improvements

Signed-off-by: torredil <torredil@amazon.com>

* Iron out concurrency in syncDriverUpdater

Signed-off-by: torredil <torredil@amazon.com>

* Run hack/update-openapi-spec.sh

Signed-off-by: torredil <torredil@amazon.com>

* Revise logging

Signed-off-by: torredil <torredil@amazon.com>

* Revise log in VerifyExhaustedResource

Signed-off-by: torredil <torredil@amazon.com>

* Update API validation

Signed-off-by: torredil <torredil@amazon.com>

* Add more code coverage

Signed-off-by: torredil <torredil@amazon.com>

* Fix pull-kubernetes-linter-hints

Signed-off-by: torredil <torredil@amazon.com>

* Update API types documentation

Signed-off-by: torredil <torredil@amazon.com>

* Update strategy and validation for new errorCode field

Signed-off-by: torredil <torredil@amazon.com>

* Update validation tests after strategy changes

Signed-off-by: torredil <torredil@amazon.com>

* Update VA status strategy

Signed-off-by: torredil <torredil@amazon.com>

---------

Signed-off-by: torredil <torredil@amazon.com>
 2025-03-18 12:45:49 -07:00
Kubernetes Prow Robot
16ef87e1b8 Merge pull request #128622 from jpbetz/admission-policy-generalize-api-docs 
Clean up API docs shared by ValidatingAdmissionPolicy and MutatingAdmissionPolicy
 2025-03-17 20:27:48 -07:00
Kubernetes Prow Robot
2499a2c0a0 Merge pull request #129954 from iholder101/swap/capacity-on-node-sys-info 
[KEP-2400] Report swap capacity as part of node.status.nodeSystemInfo
 2025-03-17 19:17:48 -07:00
Natasha Sarkar
a15520fbea Move pod resize status to pod conditions 2025-03-17 22:01:05 +00:00
Itamar Holder
1ae091e718 Add validation for the NodeSwapStatus field 
Signed-off-by: Itamar Holder <iholder@redhat.com>
 2025-03-16 11:59:29 +02:00
Itamar Holder
4bdaf6cbbd add auto-generated files: ./hack/update-codegen.sh 
Signed-off-by: Itamar Holder <iholder@redhat.com>
 2025-03-16 11:59:28 +02:00
Itamar Holder
a53a517022 Add the Swap field to NodeSystemInfo 
Signed-off-by: Itamar Holder <iholder@redhat.com>
 2025-03-16 11:59:28 +02:00
Tim Hockin
311e589534 Emit comments before validation code 2025-03-14 08:17:34 -07:00
Joe Betz
177193ed19 Mark RC.Spec.MinReadySeconds as k8s:optional 
+k8s:optional should be used everywhere +optional is.
This does not change the vailidation of the field, but it
is a good practice, and code generator recognizes the fields
tags and outputs this comment above the field validation
as a result: "optional value-type fields with zero-value
defaults are purely documentation".
 2025-03-13 21:26:17 -04:00
Tim Hockin
1059dbdee1 Declaratively validate minimum value of RC.Spec.MinReadySeconds 
# Conflicts:
#	staging/src/k8s.io/api/core/v1/types.go
 2025-03-13 21:24:50 -04:00
Tim Hockin
0f4786536f Declaratively validate RC.Spec.Replicas optionality 
The existing test run both declarative and manual validation and it
still passes.
 2025-03-13 21:24:50 -04:00
Tim Hockin
21b3da7e5a Add declarative default for RC.Spec.Replicas 
Remove manual default:

```
$ git diff
diff --git a/pkg/apis/core/v1/defaults.go b/pkg/apis/core/v1/defaults.go
index e66de8bb432..1dd28dd35fb 100644
--- a/pkg/apis/core/v1/defaults.go
+++ b/pkg/apis/core/v1/defaults.go
@@ -60,10 +60,6 @@ func SetDefaults_ReplicationController(obj *v1.ReplicationController) {
                        obj.Labels = labels
                }
        }
-       if obj.Spec.Replicas == nil {
-               obj.Spec.Replicas = new(int32)
-               *obj.Spec.Replicas = 1
-       }
 }
 func SetDefaults_Volume(obj *v1.Volume) {
        if ptr.AllPtrFieldsNil(&obj.VolumeSource) {
```

The test fails:

```
$ go test ./pkg/apis/core/v1 | grep -v gate | grep -v SetEmulationVersion
--- FAIL: TestSetDefaultReplicationControllerReplicas (0.00s)
    defaults_test.go:1608: expected: 1 replicas, got: 0
FAIL
FAIL	k8s.io/kubernetes/pkg/apis/core/v1	0.269s
FAIL
```

Declare the default, update codegen and re-run the test:

```
$ git diff
diff --git a/staging/src/k8s.io/api/core/v1/types.go b/staging/src/k8s.io/api/core/v1/types.go
index 406ab56a002..7e5136fe9f6 100644
--- a/staging/src/k8s.io/api/core/v1/types.go
+++ b/staging/src/k8s.io/api/core/v1/types.go
@@ -5101,6 +5101,7 @@ type ReplicationControllerSpec struct {
        // Defaults to 1.
        // More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#what-is-a-replicationcontroller
        // +optional
+       // +default=1
        // +k8s:minimum=0
        Replicas *int32 `json:"replicas,omitempty" protobuf:"varint,1,opt,name=replicas"`

$ ./hack/update-codegen.sh default
+++ [1219 08:58:43] Generating defaulter code for 102 targets

$ git diff
diff --git a/pkg/apis/core/v1/zz_generated.defaults.go b/pkg/apis/core/v1/zz_generated.defaults.go
index 3b6eb4f0a93..567c49053aa 100644
--- a/pkg/apis/core/v1/zz_generated.defaults.go
+++ b/pkg/apis/core/v1/zz_generated.defaults.go
@@ -878,6 +878,10 @@ func SetObjectDefaults_PodTemplateList(in *corev1.PodTemplateList) {

 func SetObjectDefaults_ReplicationController(in *corev1.ReplicationController) {
        SetDefaults_ReplicationController(in)
+       if in.Spec.Replicas == nil {
+               var ptrVar1 int32 = 1
+               in.Spec.Replicas = &ptrVar1
+       }
        if in.Spec.Template != nil {
                SetDefaults_PodSpec(&in.Spec.Template.Spec)
                for i := range in.Spec.Template.Spec.Volumes {

$ go test ./pkg/apis/core/v1 | grep -v gate | grep -v SetEmulationVersion
ok  	k8s.io/kubernetes/pkg/apis/core/v1	(cached)
```
 2025-03-13 21:24:48 -04:00
Tim Hockin
e08bbf254c Declaratively validate minimum value of RC.Spec.Replicas 2025-03-13 21:23:18 -04:00
Kubernetes Prow Robot
32d8e0ce4f Merge pull request #130732 from thockin/master_replicationcontroller_replicas_pointer 
Change internal-version RC.Spec.Relicas to a ptr
 2025-03-13 16:05:46 -07:00