handleSchedulingFailure can refresh podInfo from the informer before AddUnschedulableIfNotPresent. A delete and recreate with the same name may change the Pod UID while inFlightPods still tracks the UID from Pop, so Done and queueing-hint lookups must use that in-flight UID.
Add an explicit in-flight UID parameter, thread it through queueing-hint lookups, cover the same-name recreation case with a regression test, and check the returned error in updated test call sites.
On platforms with many OS-visible NUMA nodes that carry no devices
(e.g. NVIDIA GB200 with 36 NUMA nodes, only 1–2 hosting GPUs),
IterateBitMasks enumerates O(2^n) combinations and stalls the
kubelet for minutes.
Introduce deviceNUMANodes(), which collects the NUMA node IDs from
all registered devices for a resource regardless of allocation state.
generateDeviceTopologyHints() now iterates only over those nodes,
reducing n from 34 to 1–2 on affected hardware.
This fix uses allDevices ensures minAffinitySize and Preferred flags
are computed identically for behavior-preserving, making safe for
backport.
deviceNUMANodes() has a explicit runtime subset guard to guarantee to
return a subset of cadvisor-reported NUMA topology, regardless what
device-plugins report.
Kubernetes-bug: https://github.com/kubernetes/kubernetes/issues/135541
Signed-off-by: Fan Zhang <fanzhang@nvidia.com>
* Adds polling for HPA reconciliation_duration unit test
Signed-off-by: Omer Aplatony <omerap12@gmail.com>
* using struct name
Signed-off-by: Omer Aplatony <omerap12@gmail.com>
---------
Signed-off-by: Omer Aplatony <omerap12@gmail.com>
This commit introduces the DRAResourceClaimGranularStatusAuthorization
feature gate (Beta in 1.36) to enforce fine-grained authorization checks
on ResourceClaim status updates.
Previously, 'update' permission on 'resourceclaims/status' allowed modifying
the entire status. To enforce the principle of least privilege for DRA
drivers and the scheduler, this change introduces synthetic subresources and
verb prefixes:
- 'resourceclaims/binding': Required to update 'status.allocation' and
'status.reservedFor'.
- 'resourceclaims/driver': Required to update 'status.devices'. Evaluated
on a per-driver basis using 'associated-node:<verb>' (for node-local
ServiceAccounts) or 'arbitrary-node:<verb>' (for cluster-wide controllers).
The kubelet status manager was not preserving the
pod.status.nodeAllocatableResourceClaimStatuses field set by the
scheduler during pod status merges. This caused the information to the
to be destroyed by the kubelet's next status sync, making the field
always appear empty.
Add the same preservation pattern already used for
ResourceClaimStatuses and ExtendedResourceClaimStatus to both
mergePodStatus() and isPodStatusByKubeletEqual().
Signed-off-by: Antti Kervinen <antti.kervinen@intel.com>
