This change enables structured logging and cancellation in the service
account controller by replacing the usage of context.TODO with an actual
context.
If the pod network reuses a pod IP while the old pod is still
terminating, then we may temporarily see two Endpoints for that IP. In
that case, prefer the non-terminating one.
The code was assuming that if an Endpoint got moved from one slice to
another, and one is "local" but the other isn't, then we should prefer
the local one. But this doesn't make sense; if it's actually the same
Endpoint (i.e., same targetRef) then both copies will have the same
Hostname. And if it's not the same Endpoint, then one of the two
Endpoints is wrong, but there's no reason to assume it's the non-local
one.
All version up to and including x.y.z-alpha.0 are treated as if we were
still the previous minor version x.(y-1). There are two reason for this:
- During code freeze around (at?) -rc.0, the master branch already
identfies itself as the next release with -alpha.0. Without this
special case, we would change the version skew testing from what
has been tested and been known to work to something else, which
can and at least once did break.
- Early in the next cycle the differences compared to the previous
release are small, so it's more interesting to go back further.
Truncating the kube-controller-manager log output at the end when waiting for
"Caches are synced" fails isn't useful because it doesn't show how far the
controller got (might be stuck). This can be solved by implementing
GomegaStringer with truncation in the middle.
The ipallocator was blindly assuming that all errors are retryable, that
causes that the allocator tries to exhaust all the possibilities to
allocate an IP address.
If the error is not retryable this means the allocator will generate as
many API calls as existing available IPs are in the allocator, causing
CPU exhaustion since this requests are coming from inside the apiserver.
In addition to handle the error correctly, this patch also interpret the
error to return the right status code depending on the error type.
Co-authored-by: carlory <baofa.fan@daocloud.io>
Previously, we created a separate filter for each stale flow,
resulting in O(n^2) complexity when deleting flows because the
netlink llibrary iterates over all filters for each flow.
This change introduces a new filter backed by a `sets.Set` for O(1) lookup per flow.
This reduces the overall complexity of cleaning up stale entries to O(n).
When a Mutating Admission Policy (MAP) using ApplyConfiguration was applied to an existing object containing duplicate items in a list (e.g., duplicate environment variables), the operation would fail with a conversion error from Structured Merge Diff.
This change updates the `ApplyStructuredMergeDiff` function to use `typed.AllowDuplicates` when converting the `originalObject`. This allows MAP to process existing objects that may have technically invalid (duplicate) entries but are permitted by legacy validation.
New patches generated by the policy are still strictly validated and cannot introduce new duplicates.
Tests have been added to verify:
1. MAP can process an object with duplicate env vars.
2. MAP can modify an existing env var in an object with duplicates (which has the side effect of deduplicating the entry).
