github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-07-21 00:33:15 +00:00
Code Issues Projects Releases Wiki Activity
126,406 Commits 42 Branches 9,765 Tags
d7daa688c9e282cebf4cd5201f0397a340faeb01
Commit Graph

51161 Commits

Author SHA1 Message Date
Jan Safranek
d7daa688c9 Collect SELinux options only when needed 
Remove feature gate check from GetPodVolumeNames and collect SELinux
options only when it's really needed.
 2024-11-01 12:46:39 +01:00
Jan Safranek
6e4504685f Fix access mode evaluation 
Now that SELinuxMount can support volumes with any access modes, length of
the access modes does not need to be 1. That was requirement for RWOP
volumes only.
 2024-11-01 12:46:39 +01:00
Jan Safranek
97b03e29b9 Document getSELinuxLabel function 2024-11-01 12:46:39 +01:00
Jan Safranek
53e5335d3c Add SELinuxMount tests 2024-11-01 12:46:39 +01:00
Jan Safranek
89da53cdeb Add SELinuxChangePolicy tests 2024-11-01 12:46:38 +01:00
Jan Safranek
db353e0485 Refactor AddPodToVolume unit tests with multiple pods 
Refactor existing tests that run AddPodToVolume with multiple pods
to a table.
 2024-11-01 12:46:38 +01:00
Jan Safranek
db3d995c2a Refactor AddPodToVolume unit tests with a single pod 
Refactor existing tests that run AddPodToVolume with a single pod / volume
to a table. And add few extra tests, covering existing ReadWriteOncePod
functionality.
 2024-11-01 12:46:38 +01:00
Jan Safranek
e4eedfe105 Refactor getSELinuxLabel 
Return early and reduce indentation
 2024-11-01 12:46:38 +01:00
Jan Safranek
8a400124f9 Use SELinuxChangePolicy 2024-11-01 12:46:38 +01:00
Jan Safranek
6ca7b959e4 Add SELinuxChangePolicy validation 2024-11-01 12:46:34 +01:00
Jan Safranek
3867cb40ad Regenerated API 2024-11-01 12:45:56 +01:00
Jan Safranek
c73308e90a Introduce SELinuxChangePolicy 
Feature gate + the API
 2024-11-01 12:45:56 +01:00
Kubernetes Prow Robot
d87bf75c29 Merge pull request #128439 from oxxenix/migrate-security-components-to-contextual-logging 
clustertrustbundle, token_manager: migrate to contextual logging
 2024-11-01 11:17:25 +00:00
Kubernetes Prow Robot
223ac36b50 Merge pull request #128399 from JesseStutler/dra 
Refactor the dynamicResources struct to DynamicResources
 2024-11-01 00:33:27 +00:00
Kubernetes Prow Robot
74b9204b6a Merge pull request #128473 from dims/copy-ParseCgroupFileUnified-and-drop-rest-of-containerd-cgroups 
Copy ParseCgroupFileUnified and Drop rest of containerd/cgroups
 2024-10-31 21:57:33 +00:00
Kubernetes Prow Robot
f68a0371f1 Merge pull request #128433 from pohly/dra-admin-access-in-status 
DRA API: check "AdminAccess in use" only once
 2024-10-31 20:25:33 +00:00
Kubernetes Prow Robot
b337f048db Merge pull request #127094 from sreeram-venkitesh/4818-allow-zero-for-prestop-hook 
KEP-4818: Relaxed validation for allowing zero in PreStop hook sleep action
 2024-10-31 20:25:26 +00:00
Davanum Srinivas
e86d02b60c Copy ParseCgroupFileUnified and Drop rest of containerd/cgroups 
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2024-10-31 13:42:39 -04:00
Kubernetes Prow Robot
8233d1edc8 Merge pull request #127164 from cici37/correctGoDoc 
Correct go doc for admissionregistration resources
 2024-10-31 15:21:26 +00:00
Kubernetes Prow Robot
ff5cb3791a Merge pull request #127903 from soltysh/test_daemonset 
Add unit tests verifying the update touches old, unhealthy pods first, and only after new pods
 2024-10-31 13:53:26 +00:00
Kubernetes Prow Robot
c19ffb7e72 Merge pull request #128464 from sanposhiho/flaky-sched-one 
fix: flake TestSchedulerScheduleOne
 2024-10-31 12:13:33 +00:00
Kubernetes Prow Robot
ac25b64847 Merge pull request #128450 from liggitt/revert-127669 
Revert "Merge pull request #127669 from olyazavr/fix-probe-race"
 2024-10-31 12:13:26 +00:00
Kubernetes Prow Robot
ce6396175b Merge pull request #127318 from aroradaman/conntrack-reconciler 
proxy/conntrack: reconciler
 2024-10-31 10:21:33 +00:00
Maciej Szulik
174288d751 Add unit tests verifying the update touches old, unhealthy pods first, and only after new pods. 
Signed-off-by: Maciej Szulik <soltysh@gmail.com>
 2024-10-31 11:13:01 +01:00
Patrick Ohly
d1f0d24ef9 DRA API: check "AdminAccess in use" only once 
This is simpler and an opportunity to explain the concept.
 2024-10-31 09:42:18 +01:00
Kensei Nakada
bd8e9dd021 fix: flake TestSchedulerScheduleOne 2024-10-31 17:13:50 +09:00
Kubernetes Prow Robot
7c56aa5a58 Merge pull request #128353 from sanposhiho/patch-13 
fix: register ResourceSlice to allResources
 2024-10-31 04:41:25 +00:00
Oksana Baranova
49b88f1d8a kubelet: migrate clustertrustbundle, token to contextual logging 
Signed-off-by: Oksana Baranova <oksana.baranova@intel.com>
 2024-10-30 17:31:11 +02:00
Jordan Liggitt
43fa7c638b Revert "Merge pull request #127669 from olyazavr/fix-probe-race" 
This reverts commit 3d00d6e421, reversing
changes made to a7fcc89ac0.
 2024-10-30 11:16:47 -04:00
Kubernetes Prow Robot
d001d5684e Merge pull request #128417 from tenzen-y/self-nominate-job-controller-reviewer 
Self nominate tenzen-y as a reviewer for the Job controller
 2024-10-30 11:21:39 +00:00
Kubernetes Prow Robot
a18b50e7e4 Merge pull request #128373 from mimowo/job-cover-negative-codes 
Job Pod Failure policy - cover testing of negative exit codes
 2024-10-30 11:21:31 +00:00
Kubernetes Prow Robot
daef8c2419 Merge pull request #127266 from pohly/dra-admin-access-in-status 
DRA API: AdminAccess in DeviceRequestAllocationResult + DRAAdminAccess feature gate
 2024-10-30 03:41:25 +00:00
Kubernetes Prow Robot
a93e3e7ae1 Merge pull request #127483 from nokia/strict-cpu-reservation-core 
KEP-4540: Add CPUManager policy option to restrict reservedSystemCPUs to system daemons and interrupt processing
 2024-10-30 01:21:47 +00:00
Kubernetes Prow Robot
d702d265c7 Merge pull request #127291 from zhifei92/fix-apiserver-unexpected-panic 
[FG:InPlacePodVerticalScaling] Fixed the apiserver panic issue that occurred when adding a container during pod updates in the InPlacePodVerticalScaling scenario.
 2024-10-30 01:21:40 +00:00
Kubernetes Prow Robot
6737352b03 Merge pull request #125708 from hshiina/dopodresizeaction-error 
[FG:InPlacePodVerticalScaling] Fix order of resizing pod cgroups in doPodResizeAction()
 2024-10-30 01:21:25 +00:00
Kubernetes Prow Robot
a339a36a36 Merge pull request #127506 from ffromani/cpu-pool-size-metrics 
node: metrics: add metrics about cpu pool sizes
 2024-10-30 00:17:24 +00:00
Kubernetes Prow Robot
988769933e Merge pull request #128307 from NoicFank/bugfix-scheduler-preemption 
bugfix(scheduler): preemption picks wrong victim node with higher priority pod on it
 2024-10-29 19:05:02 +00:00
Kubernetes Prow Robot
a12a32cd12 Merge pull request #127146 from bart0sh/PR156-DRA-Kubelet-latency 
Kubelet: add DRA latency metrics
 2024-10-29 19:04:55 +00:00
Yuki Iwai
eca7ee877a Self nominate tenzen-y as a reviewer for the Job controller 
Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com>
 2024-10-30 01:14:47 +09:00
Kubernetes Prow Robot
b8e20b74dd Merge pull request #128382 from carlory/rm-vac 
remove unused vac code
 2024-10-29 15:25:05 +00:00
Kubernetes Prow Robot
c5ccf59974 Merge pull request #128379 from pohly/dra-owners-wg-label 
DRA: add wg/device-management label automatically
 2024-10-29 15:24:57 +00:00
Kubernetes Prow Robot
d09d98e07c Merge pull request #128022 from googs1025/cleanup/ut/preemption 
chore(scheduler): add unit test for framework preemption part
 2024-10-29 13:16:55 +00:00
NoicFank
68f7a7c682 bugfix(scheduler): preemption picks wrong victim node with higher priority pod on it. 
Introducing pdb to preemption had disrupted the orderliness of pods in the victims,
which would leads picking wrong victim node with higher priority pod on it.
 2024-10-29 19:50:55 +08:00
Patrick Ohly
4419568259 DRA: treat AdminAccess as a new feature gated field 
Using the "normal" logic for a feature gated field simplifies the
implementation of the feature gate.

There is one (entirely theoretic!) problem with updating from 1.31: if a claim
was allocated in 1.31 with admin access, the status field was not set because
it didn't exist yet. If a driver now follows the current definition of "unset =
off", then it will not grant admin access even though it should. This is
theoretic because drivers are starting to support admin access with 1.32, so
there shouldn't be any claim where this problem could occur.
 2024-10-29 10:22:31 +01:00
Patrick Ohly
9a7e4ccab2 DRA admin access: add feature gate 
The new DRAAdminAccess feature gate has the following effects:
- If disabled in the apiserver, the spec.devices.requests[*].adminAccess
  field gets cleared. Same in the status. In both cases the scenario
  that it was already set and a claim or claim template get updated
  is special: in those cases, the field is not cleared.

  Also, allocating a claim with admin access is allowed regardless of the
  feature gate and the field is not cleared. In practice, the scheduler
  will not do that.
- If disabled in the resource claim controller, creating ResourceClaims
  with the field set gets rejected. This prevents running workloads
  which depend on admin access.
- If disabled in the scheduler, claims with admin access don't get
  allocated. The effect is the same.

The alternative would have been to ignore the fields in claim controller and
scheduler. This is bad because a monitoring workload then runs, blocking
resources that probably were meant for production workloads.
 2024-10-29 09:50:11 +01:00
Patrick Ohly
f3fef01e79 DRA API: AdminAccess in DeviceRequestAllocationResult 
Drivers need to know that because admin access may also grant additional
permissions. The allocator needs to ignore such results when determining which
devices are considered as allocated.

In both cases it is conceptually cleaner to not rely on the content of the
ClaimSpec.
 2024-10-29 09:50:07 +01:00
Kubernetes Prow Robot
5f594f4215 Merge pull request #128401 from tenzen-y/use-same-receiver-name 
Job: Consistentely use the same reveiver name in the controller
 2024-10-29 08:16:55 +00:00
Yuki Iwai
d4959d8d29 Job: Consistentely use the same reveiver name in the controller 
Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com>
 2024-10-29 14:11:10 +09:00
Yuki Iwai
a23e7a42d3 Job: Refactor uncountedTerminatedPods to avoid casting everywhere 
Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com>
 2024-10-29 13:12:35 +09:00
jessestutler
f7003c76b4 Refactor the dynamicResources struct to DynamicResources 2024-10-29 11:44:42 +08:00