github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-07-27 08:37:36 +00:00
Code Issues Projects Releases Wiki Activity
130,745 Commits 42 Branches 9,895 Tags
b99ca3f736014999e4792606efd99f4cf0a9270f
Commit Graph

1467 Commits

Author SHA1 Message Date
xiaoweim
8632257c93 Cleanup: Remove redundant detail messages in field.Required 2025-06-26 21:24:43 +00:00
Davanum Srinivas
03afe6471b Add a replacement for cmp.Diff using json+go-difflib 
Co-authored-by: Jordan Liggitt <jordan@liggitt.net>
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2025-06-16 17:10:42 -04:00
Kubernetes Prow Robot
158fce12ba Merge pull request #132236 from yongruilin/master_vg_ratcheting-default 
feat(validation-gen): add default validation ratcheting support
 2025-06-11 22:15:01 -07:00
Kubernetes Prow Robot
bf84dd0cc9 Merge pull request #132127 from danwinship/kep-3015-to-beta 
KEP-3015: PreferSameTrafficDistribution to Beta
 2025-06-11 22:14:54 -07:00
yongruilin
1574001a1c run update-codegen.sh 2025-06-11 23:44:52 +00:00
Dan Winship
dacafec88c KEP-3015: PreferSameTrafficDistribution to Beta 2025-06-10 08:46:34 -04:00
HirazawaUi
0ca9c380ad update all api files 2025-06-08 12:00:14 +08:00
Joe Betz
1d17ca9b7e generate code 2025-05-24 00:03:35 -04:00
Kubernetes Prow Robot
889cd833a2 Merge pull request #131844 from pohly/dra-no-static-pods 
DRA node: reject static pods which reference ResourceClaims
 2025-05-20 07:07:24 -07:00
Kubernetes Prow Robot
fbd474a286 Merge pull request #131644 from Uladzislau97/taint-time-added 
Remove misleading comment from NodeTaint TimeAdded field
 2025-05-13 15:53:26 -07:00
Vlad Vasilyeu
c4d6fcb197 Remove misleading comment from NodeTaint TimeAdded field 2025-05-13 15:35:21 +00:00
Keita Mochizuki
a3097010fa Change the implementation design of matchLabelKeys in PodTopologySpread to be aligned with PodAffinity (#129874) 
* Change the implementation design of matchLabelKeys in PodTopologySpread to be aligned with PodAffinity

* fix1
 2025-05-07 13:01:15 -07:00
Joe Betz
d2fa246b06 Update codegen 2025-05-06 09:00:38 -04:00
Joe Betz
164fefa948 Update codegen 2025-05-05 22:06:59 -04:00
Patrick Ohly
1ec7231f63 DRA node: reject static pods which reference ResourceClaims 
If someone gains the ability to create static pods, they might try to use that
ability to run code which gets access to the resources associated with some
existing claim which was previously allocated for some other pod. Such an
attempt already fails because the claim status tracks which pods are allowed to
use the claim, the static pod is not in that list, the node is not authorized
to add it, and the kubelet checks that list before starting the pod in
195803cde5/pkg/kubelet/cm/dra/manager.go (L218-L222).

Even if the pod were started, DRA drivers typically manage node-local resources
which can already be accessed via such an attack without involving DRA. DRA
drivers which manage non-node-local resources have to consider access by a
compromised node as part of their threat model.

Nonetheless, it is better to not accept static pods which reference
ResourceClaims or ResourceClaimTemplates in the first place because there
is no valid use case for it.

This is done at different levels for defense in depth:
- configuration validation in the kubelet
- admission checking of node restrictions
- API validation

Co-authored-by: Jordan Liggitt <liggitt@google.com>

Code changes by Jordan, with one small change (resourceClaims -> resourceclaims).
Unit tests by Patrick.
 2025-05-05 14:21:25 +02:00
Kubernetes Prow Robot
595516a149 Merge pull request #130468 from jingyuanliang/PodAntiAffinity 
fix: comment on preferred PodAntiAffinity
 2025-04-24 12:00:34 -07:00
carlory
88fbccd698 Fix the allocatedResourceStatuses Field name mismatch in PVC status validation 2025-04-09 16:21:38 +08:00
Sreeram
d6d9a354d7 Generated files 2025-03-25 02:06:29 +05:30
Sreeram
0380f2c41c Validation 2025-03-25 01:58:04 +05:30
Sreeram
70540c9f43 API changes 2025-03-25 01:56:45 +05:30
Kubernetes Prow Robot
838f3c0852 Merge pull request #130577 from KevinTMtz/pod-level-hugepages 
[PodLevelResources] Pod Level Hugepage Resources
 2025-03-20 15:34:38 -07:00
Kubernetes Prow Robot
451d032915 Merge pull request #130210 from everpeace/KEP-3619-promote-SupplementalGroupsPolicy-to-Beta 
KEP-3619: Promote SupplementalGroupsPolicy feature to Beta
 2025-03-20 11:24:37 -07:00
Kevin Torres
b9e0d4ad66 Unit tests for pod level hugepage resources 2025-03-20 17:54:39 +00:00
Kevin Torres
aa17082a16 Default pod level hugepage limits 2025-03-20 17:54:39 +00:00
kerthcet
1a34095f75 KEP-3094 Promote NodeInclusionPolicyInPodTopologySpread to Stable 
Signed-off-by: kerthcet <kerthcet@gmail.com>
 2025-03-20 14:54:42 +08:00
Shingo Omura
eda274ed7e KEP-3619: merge SupplementalGroupsPolicy dedicated validation tests into standard ones 2025-03-20 13:45:22 +09:00
Shingo Omura
64a4e34989 KEP-3619: fix field path in validating ContainerUsers in PodStatusUpdate 2025-03-20 13:45:22 +09:00
Kubernetes Prow Robot
68ba091fca Merge pull request #130844 from danwinship/improved-traffic-distribution 
KEP-3015 PreferSameZone/PreferSameNode traffic distribution
 2025-03-19 13:00:48 -07:00
Kubernetes Prow Robot
f1c634f93e Merge pull request #130463 from sanposhiho/ga-mlk 
feat: graduate MatchLabelKeysInPodAffinity to GA
 2025-03-19 09:06:31 -07:00
Jingyuan Liang
356e148045 fix: comment on preferred PodAntiAffinity 2025-03-19 15:46:30 +00:00
Kensei Nakada
10c6a4258f feat: graduate MatchLabelKeysInPodAffinity to GA 2025-03-19 23:06:04 +09:00
Dan Winship
4435ead24a Add PreferSameTrafficDistribution feature gate and associated API. 2025-03-19 08:39:13 -04:00
Kubernetes Prow Robot
2499a2c0a0 Merge pull request #129954 from iholder101/swap/capacity-on-node-sys-info 
[KEP-2400] Report swap capacity as part of node.status.nodeSystemInfo
 2025-03-17 19:17:48 -07:00
Natasha Sarkar
a15520fbea Move pod resize status to pod conditions 2025-03-17 22:01:05 +00:00
Itamar Holder
1ae091e718 Add validation for the NodeSwapStatus field 
Signed-off-by: Itamar Holder <iholder@redhat.com>
 2025-03-16 11:59:29 +02:00
Itamar Holder
4bdaf6cbbd add auto-generated files: ./hack/update-codegen.sh 
Signed-off-by: Itamar Holder <iholder@redhat.com>
 2025-03-16 11:59:28 +02:00
Itamar Holder
a53a517022 Add the Swap field to NodeSystemInfo 
Signed-off-by: Itamar Holder <iholder@redhat.com>
 2025-03-16 11:59:28 +02:00
Tim Hockin
311e589534 Emit comments before validation code 2025-03-14 08:17:34 -07:00
Joe Betz
177193ed19 Mark RC.Spec.MinReadySeconds as k8s:optional 
+k8s:optional should be used everywhere +optional is.
This does not change the vailidation of the field, but it
is a good practice, and code generator recognizes the fields
tags and outputs this comment above the field validation
as a result: "optional value-type fields with zero-value
defaults are purely documentation".
 2025-03-13 21:26:17 -04:00
Tim Hockin
1059dbdee1 Declaratively validate minimum value of RC.Spec.MinReadySeconds 
# Conflicts:
#	staging/src/k8s.io/api/core/v1/types.go
 2025-03-13 21:24:50 -04:00
Tim Hockin
0f4786536f Declaratively validate RC.Spec.Replicas optionality 
The existing test run both declarative and manual validation and it
still passes.
 2025-03-13 21:24:50 -04:00
Tim Hockin
21b3da7e5a Add declarative default for RC.Spec.Replicas 
Remove manual default:

```
$ git diff
diff --git a/pkg/apis/core/v1/defaults.go b/pkg/apis/core/v1/defaults.go
index e66de8bb432..1dd28dd35fb 100644
--- a/pkg/apis/core/v1/defaults.go
+++ b/pkg/apis/core/v1/defaults.go
@@ -60,10 +60,6 @@ func SetDefaults_ReplicationController(obj *v1.ReplicationController) {
                        obj.Labels = labels
                }
        }
-       if obj.Spec.Replicas == nil {
-               obj.Spec.Replicas = new(int32)
-               *obj.Spec.Replicas = 1
-       }
 }
 func SetDefaults_Volume(obj *v1.Volume) {
        if ptr.AllPtrFieldsNil(&obj.VolumeSource) {
```

The test fails:

```
$ go test ./pkg/apis/core/v1 | grep -v gate | grep -v SetEmulationVersion
--- FAIL: TestSetDefaultReplicationControllerReplicas (0.00s)
    defaults_test.go:1608: expected: 1 replicas, got: 0
FAIL
FAIL	k8s.io/kubernetes/pkg/apis/core/v1	0.269s
FAIL
```

Declare the default, update codegen and re-run the test:

```
$ git diff
diff --git a/staging/src/k8s.io/api/core/v1/types.go b/staging/src/k8s.io/api/core/v1/types.go
index 406ab56a002..7e5136fe9f6 100644
--- a/staging/src/k8s.io/api/core/v1/types.go
+++ b/staging/src/k8s.io/api/core/v1/types.go
@@ -5101,6 +5101,7 @@ type ReplicationControllerSpec struct {
        // Defaults to 1.
        // More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#what-is-a-replicationcontroller
        // +optional
+       // +default=1
        // +k8s:minimum=0
        Replicas *int32 `json:"replicas,omitempty" protobuf:"varint,1,opt,name=replicas"`

$ ./hack/update-codegen.sh default
+++ [1219 08:58:43] Generating defaulter code for 102 targets

$ git diff
diff --git a/pkg/apis/core/v1/zz_generated.defaults.go b/pkg/apis/core/v1/zz_generated.defaults.go
index 3b6eb4f0a93..567c49053aa 100644
--- a/pkg/apis/core/v1/zz_generated.defaults.go
+++ b/pkg/apis/core/v1/zz_generated.defaults.go
@@ -878,6 +878,10 @@ func SetObjectDefaults_PodTemplateList(in *corev1.PodTemplateList) {

 func SetObjectDefaults_ReplicationController(in *corev1.ReplicationController) {
        SetDefaults_ReplicationController(in)
+       if in.Spec.Replicas == nil {
+               var ptrVar1 int32 = 1
+               in.Spec.Replicas = &ptrVar1
+       }
        if in.Spec.Template != nil {
                SetDefaults_PodSpec(&in.Spec.Template.Spec)
                for i := range in.Spec.Template.Spec.Volumes {

$ go test ./pkg/apis/core/v1 | grep -v gate | grep -v SetEmulationVersion
ok  	k8s.io/kubernetes/pkg/apis/core/v1	(cached)
```
 2025-03-13 21:24:48 -04:00
Tim Hockin
e08bbf254c Declaratively validate minimum value of RC.Spec.Replicas 2025-03-13 21:23:18 -04:00
Kubernetes Prow Robot
32d8e0ce4f Merge pull request #130732 from thockin/master_replicationcontroller_replicas_pointer 
Change internal-version RC.Spec.Relicas to a ptr
 2025-03-13 16:05:46 -07:00
Kubernetes Prow Robot
e22153d9e1 Merge pull request #130662 from tenzen-y/fix-incorrect-union-marker 
chore: Fix incorrect AppArmorProfile.Type marker
 2025-03-13 10:13:48 -07:00
Tim Hockin
7315d0a687 Change internal-version RC.Spec.Replicas to a ptr 
This is needed to make declaratve validation clean.  Past me thought
this was clever (pointer versioned, non-pointer internal) but it is just
confusing.
 2025-03-13 08:47:19 -07:00
Kubernetes Prow Robot
68899f8e6d Merge pull request #124360 from carlory/kep-3751-quota-2 
Add quota support for PVC with VolumeAttributesClass
 2025-03-13 07:35:48 -07:00
carlory
27706a0b54 Add quota support for PVC with VolumeAttributesClass 
Signed-off-by: carlory <baofa.fan@daocloud.io>
 2025-03-13 13:50:44 +08:00
Kubernetes Prow Robot
9acdca64e0 Merge pull request #130724 from jpbetz/replication-controller-to-declarative 
Enable Declarative Validation for ReplicationController
 2025-03-12 22:41:53 -07:00
Kubernetes Prow Robot
7b6c56e5fb Merge pull request #130135 from saschagrunert/image-volume-beta 
[KEP-4639] Graduate image volume sources to beta
 2025-03-12 18:03:58 -07:00