Commit Graph

124363 Commits

Author SHA1 Message Date
Cici Huang
5420b2fe9a
Hot fix for panic on schema conversion. (#126167) 2024-07-22 19:43:45 -07:00
carlory
21a3226925 remove some InTreePluginXXXUnregister 2024-07-23 09:25:15 +08:00
Yuki Iwai
551931c6a8 Graduate the JobSuccessPolicy to beta
Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com>
2024-07-23 09:29:06 +09:00
Yuki Iwai
6e8dc2c250 Job: Extend the jobs_finished_total metric reason label with SuccessPolicy and CompletionsReached
Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com>
2024-07-23 09:29:02 +09:00
Kubernetes Prow Robot
04cc0a1034
Merge pull request #126187 from seans3/portforward-websockets-metrics
Adds metrics to PortForward Websockets
2024-07-22 16:53:25 -07:00
Kubernetes Prow Robot
f753a444a5
Merge pull request #126091 from seans3/ws-err-extra-info
Adds extra error information from response to bad handshake error when possible
2024-07-22 16:53:16 -07:00
Kubernetes Prow Robot
3d78fe25a7
Merge pull request #121849 from carlory/add-e2e-vac
vac add e2e test
2024-07-22 16:53:03 -07:00
Haitao Chen
1d92758ef0 implement emulated-version for kube-controller-manager 2024-07-22 16:07:18 -07:00
Kubernetes Prow Robot
3e9a73d558
Merge pull request #126058 from AnishShah/patch-2
Deflake kubernetes-node-swap-fedora-serial jobs
2024-07-22 15:48:42 -07:00
Kubernetes Prow Robot
581a073dc4
Merge pull request #125663 from saschagrunert/oci-volumesource-kubelet
[KEP-4639] Add `ImageVolumeSource` implementation
2024-07-22 15:48:33 -07:00
Dan Winship
4effb05741 bump knftables to v0.0.17 2024-07-22 17:30:32 -04:00
Kubernetes Prow Robot
233bc735b5
Merge pull request #126056 from googs1025/refactor_namespace
use ktesting.NewTestContext(t) ctx instead of context.TODO() for namespace integration
2024-07-22 14:25:56 -07:00
Kubernetes Prow Robot
6e52e705d0
Merge pull request #125374 from pwschuurman/kep-3335-stable
Promote StatefulSetStartOrdinal to stable in 1.31
2024-07-22 14:25:49 -07:00
Sean Sullivan
f387f0b69a Adds extra error information from response to bad handshake error when possible 2024-07-22 14:12:01 -07:00
Sean Sullivan
90d70ed73d Adds metrics to PortForward Websockets 2024-07-22 14:08:42 -07:00
Patrick Ohly
eaa1cad7fa resource quota: clone PVC quota evaluator for DRA 2024-07-22 21:20:08 +02:00
Kubernetes Prow Robot
d21b17264e
Merge pull request #125488 from pohly/dra-1.31
DRA for 1.31
2024-07-22 11:45:55 -07:00
Kubernetes Prow Robot
f458a749e7
Merge pull request #125277 from iholder101/swap/skip_critical_pods
[KEP-2400]: Restrict access to swap for containers in high priority Pods
2024-07-22 11:45:48 -07:00
Kubernetes Prow Robot
887def08b6
Merge pull request #126237 from cici37/promoteMetrics
Promote metrics for VAP and CRD validation rules to beta.
2024-07-22 10:17:49 -07:00
Sascha Grunert
979863d15c
Add ImageVolumeSource implementation
This patch adds the kubelet implementation of the image volume source
feature.

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
2024-07-22 18:46:46 +02:00
Dr. Stefan Schimanski
b6aebb0e4b
options/authentication: fix serviceaccount TokenGetter with ServiceAccountTokenNodeBindingValidation
Signed-off-by: Dr. Stefan Schimanski <stefan.schimanski@gmail.com>
2024-07-22 18:21:26 +02:00
Dr. Stefan Schimanski
dc0bcd62e3
options/authentication: revert extra serviceaccount TokenGetter function silently enabling serviceaccounts
Signed-off-by: Dr. Stefan Schimanski <stefan.schimanski@gmail.com>
2024-07-22 18:21:26 +02:00
Kubernetes Prow Robot
0caeba5cbe
Merge pull request #126204 from vrutkovs/unsafeRecordQueried-atomicPointer
feature_gate: avoid extra copy when queried feature is already stored, use Set instead of map
2024-07-22 09:09:42 -07:00
Patrick Ohly
d11b58efe6 DRA kubelet: refactor gRPC call timeouts
Some of the E2E node tests were flaky. Their timeout apparently was chosen
under the assumption that kubelet would retry immediately after a failed gRPC
call, with a factor of 2 as safety margin. But according to
0449cef8fd,
kubelet has a different, higher retry period of 90 seconds, which was exactly
the test timeout. The test timeout has to be higher than that.

As the tests don't use the gRPC call timeout anymore, it can be made
private. While at it, the name and documentation gets updated.
2024-07-22 18:09:34 +02:00
Patrick Ohly
357a2926a1 DRA e2e: update VAP for a kubelet plugin
This fixes the message (node name and "cluster-scoped" were switched) and
simplifies the VAP:
- a single matchCondition short circuits completely unless they're a user
  we care about
- variables to extract the userNodeName and objectNodeName once
  (using optionals to gracefully turn missing claims and fields into empty strings)
- leaves very tiny concise validations

Co-authored-by: Jordan Liggitt <liggitt@google.com>
2024-07-22 18:09:34 +02:00
Patrick Ohly
9f36c8d718 DRA: add DRAControlPlaneController feature gate for "classic DRA"
In the API, the effect of the feature gate is that alpha fields get dropped on
create. They get preserved during updates if already set. The
PodSchedulingContext registration is *not* restricted by the feature gate.
This enables deleting stale PodSchedulingContext objects after disabling
the feature gate.

The scheduler checks the new feature gate before setting up an informer for
PodSchedulingContext objects and when deciding whether it can schedule a
pod. If any claim depends on a control plane controller, the scheduler bails
out, leading to:

    Status:       Pending
    ...
      Warning  FailedScheduling             73s   default-scheduler  0/1 nodes are available: resourceclaim depends on disabled DRAControlPlaneController feature. no new claims to deallocate, preemption: 0/1 nodes are available: 1 Preemption is not helpful for scheduling.

The rest of the changes prepare for testing the new feature separately from
"structured parameters". The goal is to have base "dra" jobs which just enable
and test those, then "classic-dra" jobs which add DRAControlPlaneController.
2024-07-22 18:09:34 +02:00
Patrick Ohly
599fe605f9 DRA scheduler: adapt to v1alpha3 API
The structured parameter allocation logic was written from scratch in
staging/src/k8s.io/dynamic-resource-allocation/structured where it might be
useful for out-of-tree components.

Besides the new features (amount, admin access) and API it now supports
backtracking when the initial device selection doesn't lead to a complete
allocation of all claims.

Co-authored-by: Ed Bartosh <eduard.bartosh@intel.com>
Co-authored-by: John Belamaric <jbelamaric@google.com>
2024-07-22 18:09:34 +02:00
Patrick Ohly
0fc78b9bcc DRA resource claim controller: update test
The resource claim controller is completely agnostic to the claim spec. It
doesn't care about classes or devices, therefore it needs no changes in 1.31
besides the v1alpha2 -> v1alpha3 renaming from a previous commit.
2024-07-22 18:09:34 +02:00
Patrick Ohly
c526d7796e DRA e2e: use VAP to control "admin access" permissions
The advantages of using a validation admission policy (VAP) are that no changes
are needed in Kubernetes and that admins have full flexibility if and how they
want to control which users are allowed to use "admin access" in their
requests.

The downside is that without admins taking actions, the feature is enabled
out-of-the-box in a cluster. Documentation for DRA will have to make it very
clear that something needs to be done in multi-tenant clusters.

The test/e2e/testing-manifests/dra/admin-access-policy.yaml shows how to do
this. The corresponding E2E tests ensures that it actually works as intended.

For some reason, adding the namespace to the message expression leads to a
type check errors, so it's currently commented out.
2024-07-22 18:09:34 +02:00
Patrick Ohly
0b62bfb690 DRA e2e: adapt to v1alpha3 API 2024-07-22 18:09:34 +02:00
Patrick Ohly
877829aeaa DRA kubelet: adapt to v1alpha3 API
This adds the ability to select specific requests inside a claim for a
container.

NodePrepareResources is always called, even if the claim is not used by any
container. This could be useful for drivers where that call has some effect
other than injecting CDI device IDs into containers. It also ensures that
drivers can validate configs.

The pod resource API can no longer report a class for each claim because there
is no such 1:1 relationship anymore. Instead, that API reports claim,
API devices (with driver/pool/device as ID) and CDI device IDs. The kubelet
itself doesn't extract that information from the claim. Instead, it relies on
drivers to report this information when the claim gets prepared. This isolates
the kubelet from API changes.

Because of a faulty E2E test, kubelet was told to contact the wrong driver for
a claim. This was not visible in the kubelet log output. Now changes to the
claim info cache are getting logged. While at it, naming of variables and some
existing log output gets harmonized.

Co-authored-by: Oksana Baranova <oksana.baranova@intel.com>
Co-authored-by: Ed Bartosh <eduard.bartosh@intel.com>
2024-07-22 18:09:34 +02:00
Patrick Ohly
20f98f3a2f DRA: update helper packages
Publishing ResourceSlices now supports network-attached devices and the new
v1alpha3 API.  The logic for splitting up across different slices is missing.
2024-07-22 18:09:34 +02:00
Patrick Ohly
91d7882e86 DRA: new API for 1.31
This is a complete revamp of the original API. Some of the key
differences:
- refocused on structured parameters and allocating devices
- support for constraints across devices
- support for allocating "all" or a fixed amount
  of similar devices in a single request
- no class for ResourceClaims, instead individual
  device requests are associated with a mandatory
  DeviceClass

For the sake of simplicity, optional basic types (ints, strings) where the null
value is the default are represented as values in the API types. This makes Go
code simpler because it doesn't have to check for nil (consumers) and values
can be set directly (producers). The effect is that in protobuf, these fields
always get encoded because `opt` only has an effect for pointers.

The roundtrip test data for v1.29.0 and v1.30.0 changes because of the new
"request" field. This is considered acceptable because the entire `claims`
field in the pod spec is still alpha.

The implementation is complete enough to bring up the apiserver.
Adapting other components follows.
2024-07-22 18:09:34 +02:00
Kubernetes Prow Robot
af71138323
Merge pull request #124837 from carlory/rm-FindCreatablePluginBySpec
remove unused FindCreatablePluginBySpec
2024-07-22 08:01:54 -07:00
Kubernetes Prow Robot
3f933ef262
Merge pull request #124053 from PichuChen/patch-1
Fix a typo
2024-07-22 08:01:40 -07:00
Itamar Holder
a6df16af85 node e2e test: exclude critical pods from swapping
Signed-off-by: Itamar Holder <iholder@redhat.com>
2024-07-22 17:56:52 +03:00
Itamar Holder
6c1f14c468 unit tests: exclude critical pods from swapping
Signed-off-by: Itamar Holder <iholder@redhat.com>
2024-07-22 17:56:52 +03:00
Itamar Holder
532cd5f84c Exclude critical pods from having swap access
Signed-off-by: Itamar Holder <iholder@redhat.com>
2024-07-22 17:56:52 +03:00
Peter Hunt
0979ba9cb8 kubelet/stats: verify there is at least one process in each container
0 processes is too low a bar to be meaningfully testing that the process
stats are being reported.

Signed-off-by: Peter Hunt <pehunt@redhat.com>
2024-07-22 10:54:42 -04:00
Peter Hunt
5fd7219cf4 kubelet/stats: fix pid stats for cadvisor stats provider
the process stats aren't correct coming from only the pod stats.
They need to be summed for all of the containers, as cadvisor
is only reading per pid (per container process)

Signed-off-by: Peter Hunt <pehunt@redhat.com>
2024-07-22 10:54:42 -04:00
Kevin Hannon
7d8ba7849b priority pid tests should match on processes
pids 0
process should not be nonzero
2024-07-22 10:54:42 -04:00
David Porter
6e6b2b76a3 test: Update summary test to check for process count
The process count is expected to always be >= 1 for pods in the test.

Let's check it's >= 1, so we can catch issues if the proecss count is
not reported.

Signed-off-by: David Porter <david@porter.me>
Signed-off-by: Paco Xu <paco.xu@daocloud.io>
2024-07-22 10:54:42 -04:00
David Porter
f58b46cb97 fix process stats
Signed-off-by: David Porter <david@porter.me>
2024-07-22 10:54:42 -04:00
Hemant Kumar
f7f1a6c81a Address review comments and return nicer errors 2024-07-22 10:43:38 -04:00
PannagaRamamanohara
7df640d197 Promote FSQuotaMonitoring flag to beta 2024-07-22 10:18:21 -04:00
Kubernetes Prow Robot
8b8f84c6a7
Merge pull request #125862 from sanposhiho/cleanup-nominated
cleanup: remove duplicated AddNominatedPod
2024-07-22 06:50:03 -07:00
Kubernetes Prow Robot
1f436e0fba
Merge pull request #124108 from carlory/update-test-InTreePluginXXXUnregister
update unit test for adc to test volume migration
2024-07-22 06:49:49 -07:00
PannagaRamamanohara
d16fd6a915 pkg/volume: Use QuotaMonitoring in UserNamespace
Enable LocalStorageCapacityIsolationFSQuotaMonitoring
only when hostUsers in PodSpec is set to false.
Modify unit tests and e2e tests to verify

Signed-off-by: PannagaRamamanohara <pbhojara@redhat.com>
2024-07-22 09:43:57 -04:00
Kensei Nakada
2a51bd81fa fix: async metric recording 2024-07-22 21:32:19 +09:00
Yuki Iwai
594490fd77 Job: Add the CompletionsReached reason to the SuccessCriteriaMet condition
Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com>
2024-07-22 21:24:52 +09:00