this feature gate was meant to be ephemeral, and only was used for guaranteeing a
cluster admin didn't accidentally relax PSA policies before the kubelet would deny a pod
was created if it didn't support user namespaces. As of kube 1.33, the supported apiserver version
skew of n-3 guarantees that all supported kubelets are of 1.30 or later, meaning they do this.
Now, we can unconditionally relax PSA policy if a pod is in a user namespace.
This PR reserves older policies default behavior by never relaxing
Signed-off-by: Peter Hunt <pehunt@redhat.com>
We want to fix and enhance lanes which exercise
the podresources API tests. The first step is to clarify
the label and made it specific to podresources API,
minimzing the clash and the ambiguity with the "PodLevelResources"
feature.
Note we change the label names, but the label name is backward
compatible (filtering for "Feature:PodResources" will still
get the tests). This turns out to be not a problem because
these tests are no longer called out explicitly in the lane
definitions. We want to change this ASAP.
The new name is more specific and allows us to clearly
call out tests for this feature in the lane definitions.
Signed-off-by: Francesco Romani <fromani@redhat.com>
With OrderedNamespaceDeletion enabled by default, the namespace
controller now deletes resources before deleting the namespace itself.
At the same time, some existing tests create many resources. When
those tests finish around the same time, the namespace controller can
become overloaded. As a result, it may take longer to start deleting
resources created by this test.
Initially, this patch increased the test timeout to account for that
delay. However, the test still flaked in 1 out of 10 jobs, which
suggests increasing the timeouts isn't enough.
Once the test was made serial, no flakes were observed.
We only need one special "DynamicResourceAllocation" feature for the optional
node support of DRA (plugin registration, CDI support in the container
runtime). For individual features, the automatic labeling through
WithFeatureGate is sufficient.
To find DRA-related tests in a label filter, instead of plain-text "DRA" a
"DRA" label now gets added.
This change depends on an update of the DRA jobs.
Conditionally skip instead of failing when nfacct test when the required
metric is not present. The only case when the metric will not be registered
by kube-proxy is when nfacct subsystem is not supported on the node, we
skip the test in that case.
Signed-off-by: Daman Arora <aroradaman@gmail.com>
