Reset SELinuxChangePolicy of Pods that have no SELinux label set to
Recursive. Kubelet cannot mount with `-o context=<label>`, if the label is
not known.
This fixes the e2e test error revealed by the previous commit - it changed the
e2e test to check for events when no events are expected and it found a
warning about a Pod with no label, but MountOption policy.
When a Pod reaches its final state (Succeeded or Failed), its volumes are
getting unmounted and therefore their SELinux mount option will not
conflict with any other pod.
Let the SELinux controller monitor "pod updated" events to see the pod is
finished
The metricIdentifier function in pkg/registry/rest/validate.go has been updated to consistently use for determining the resource kind. This change ensures that the identifier is derived from the scheme, which is the authoritative source for API type information.
Corresponding unit tests in pkg/registry/rest/validate_test.go have been updated to align with this new behavior, explicitly passing the scheme in test cases where kind resolution is expected and verifying the correct unknown_resource fallback when the scheme or object is not sufficient to determine the kind.
When a resource exists on the server, kubectl apply --dry-run=client
was outputting the unchanged server state instead of showing what
would result from applying the manifest.
Fix by computing the three-way merge patch (same as real apply) and
then applying it locally to the current server state.
This commit fixes the image credential pulls test by ensuring GetImageRef
and PullImage return the same digest reference format for credential validation.
The test was failing because:
1. PullImage returns a digest reference (e.g., localhost:5000/pause@sha256:abc...)
2. Pull records were stored under this digest
3. GetImageRef returned Image.Id (config hash) instead of a digest reference
4. Credential validation failed due to the lookup mismatch
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
In local.go there are a couple of flags that changed their
format for etcd > 3.6.0. kubeadm 1.36 no longer supports
deploying a k8s version that maps to etcd < 3.6.0, thus
the branching and the deprecated flags can be removed.
The kubekins image got updated from containerd 1.7 to 2.2, which broke
local-up-cluster.sh in the CI because more recent containerd uses single
quotation marks around strings instead of double quotation marks as before. The
search/replaced with sed no longer matched, causing containerd to fail mounting
overlayfs on the default /var/lib/containerd. We have to use the emptyDir host
mount under /docker-graph.
The fix is to relax the search term slightly so that it accepts both kinds of
quotation marks.
The pod resize e2e tests use memory limits as low as 20Mi for Guaranteed
QoS pods. On OpenShift/CRI-O, the container runtime (runc) runs inside
the pod's cgroup and requires ~20-22MB of memory during container
creation and restart operations. This causes intermittent OOM kills
when the pod's memory limit is at or below runc's memory footprint.
This issue does not occur on containerd-based clusters because
containerd's shim runs outside the pod's cgroup by default (ShimCgroup=""),
so runc's memory is not charged against the pod's limit.
Increase memory limits to provide sufficient headroom for runc:
- originalMem: 20Mi -> 35Mi
- reducedMem: 15Mi -> 30Mi
- increasedMem: 25Mi -> 40Mi
The test validates resize behavior, not minimal memory limits, so
larger values do not reduce test coverage.
Signed-off-by: Damien Grisonnet <dgrisonn@redhat.com>
The introduction of dynamic keys in the etcd version
map in constants.go introduced a couple of problems:
1. The size of the map could no longer be unit tested
because at UT runtime there was only one key "0".
2. Once a new k8s release branch is cut the version map
has mismatched versions. The latest k8s version mapped to the
future prerelease alpha (placeholder), the previous was the current
WIP release version and the oldest version in the map is the
current stable. This introduces a undesider shift of versions
where we are applying the wrong version to the current WIP
release unless an contrubutor PRs it.
The old static approach on the other hand is safer because
it hardcodes the versions, and the utility function
EtcdSupportedVersion() ensures that we get a relevant etcd
version even if the input k8s MINOR key is out of bonds for the map.
- Revert to using static version in the map.
- Revert the unit test TestEtcdSupportedVersionLength.
- Add additional comments over the map.
Implement the robust, multi-stage PowerShell Get-Volume logic to accurately
determine the filesystem size of volumes mounted in Windows E2E tests. This
solution replaces the unreliable fsutil utility and resolves persistent
failures (including in CAPZ) caused by fragile parsing and directory mounts.
This PR adds missing OpenAPI vendor extension documentation for the following:
x-kubernetes-list-map-keys
The provided documentation includes simple additions to api/openapi-spec/README.md with similar format to present documentation.
Fixes issue #131724
Using `t` instead of `tCtx` is subtly wrong: the failure is attributed to the
parent test, not the sub-test. Using a separate function with tCtx as
parameter ensures that t is not in scope of the code and thus this mistake
cannot happen. The number of lines is the same, it's just a bit more code.
For TestRetry another advantage is the reduced indention.
It's worth calling out that the same cannot be done for benchmarks:
- They need methods (Loop) or fields (N) which are not exposed by TContext.
- The `for b.Loop()` pattern only works if the for loop is written exactly
like that.
It needs to run as [Serial], so it accidentally does not evict other Pods.
Consider this scenario on a busy clusters, with all nodes at their attachment limit.
1. pod1 of the preemption test runs, pod2 is created.
2. The scheduler evicts pod1. That frees the RWOP volume and it also frees the last attachment slot on the node.
3. Some other e2e tests creates a Pod and scheduler puts it on a node, taking the last attachment slot.
4. The scheduler schedules pod2 agaian and it sees there is no node with a free attachment slot -> new round of eviction, now evicting a pod of unrelated e2e tests. The unrelated test will fail.
