This change introduces the TokenRequestServiceAccountUIDValidation feature
gate and implements feature-gated service account UID validation for the
TokenRequest API. When enabled, the API validates that the service account
UID in token requests matches the actual service account UID, preventing
token requests for recreated service accounts with the same name but
different UIDs.
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
It's been a long time since Kubernetes stopped to use Docker
as a runtime. Modified script to stop Docker as Kubelet is using
containerd directly. Removed Docker-specific logic and variables,
adjusted comments and configuration.
Store logs in a temporary subdirectory under the artifacts directory
when running in CI. This ensures logs are available in the prow
web UI for easier access and debugging.
Configure and start containerd before starting Docker, ensuring that
Docker detects and uses the running containerd instance instead of
launching its own. This allows us to customize containerd’s
configuration, such as enabling CDI support, which is not possible when
Docker manages containerd itself.
Set root and state paths for containerd to make it working the same way
as when Docker runs it.
- Don't reinstall docker, containerd and runc as kubekins image
already has their recent versions.
- Avoid breaking dependencies when installing nfttables and kmod.
- Install only packages that don't exist in the image.
This may be useful during manual invocations to see what commands would be
executed and with which parameters, without actually running them.
But the main purpose is to use this mode in automated upgrade/downgrade testing
where the caller parses the output to execute those commands under its own
control. Such a caller can then replaced individual component binaries with
those from other releases.
Some ports (apiserver, one kubelet port) were already configurable.
Several others were not.
Primarily this is done to document the ports which are in used by the different
components.
There was one flake:
expected pod to be pod is scheduled, got instead:
...
status:
conditions:
- lastProbeTime: null
lastTransitionTime: "2025-07-06T12:08:54Z"
message: 'running "DynamicResources" filter plugin: pool network-attached is invalid:
duplicate device name dev-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx0000'
The root cause was that the test produced device names which were unique within
their slice, but not within the pool. This didn't matter for the test itself,
but for tests running concurrently of after it, because those slices were also
not cleaned up properly.
Timing in pull-kubernetes-e2e-gce also was different.
