Commit Graph

134908 Commits

Author SHA1 Message Date
Davanum Srinivas
d3d78ce0dd Add tmpfs detection to mounttest and unit tests
Refactor fsType() to use a platform-specific formatFsType() helper that
translates filesystem magic numbers to human-readable names. On Linux,
tmpfs filesystems now display as "tmpfs" instead of the raw magic number.

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2026-01-15 12:02:56 -05:00
Kubernetes Prow Robot
8392659d3c Merge pull request #136143 from pohly/client-go-fake-list-and-watch-fix
client-go testing: fix List+Watch support
2026-01-15 21:35:36 +05:30
Michael Zappa
b651f2f34d delete dead code 2026-01-15 09:00:40 -07:00
Davanum Srinivas
050c786014 Update vendored dependencies: cadvisor, containerd, runtime-spec, selinux
Update the following vendored dependencies:

- github.com/google/cadvisor: v0.55.1 -> v0.56.0
- github.com/containerd/containerd/api: v1.9.0 -> v1.10.0
- github.com/opencontainers/runtime-spec: v1.2.1 -> v1.3.0
- github.com/opencontainers/selinux: v1.13.0 -> v1.13.1

cadvisor v0.56.0 changes:
- Add s390x (IBM Z/mainframe) CPU topology support with NumBooks and
  NumDrawers fields in MachineInfo
- Add new Prometheus metrics: machine_cpu_books and machine_cpu_drawers
- Add standard deviation (Std) field to Percentiles for resource statistics
- Add sysfs constants CPUBookID and CPUDrawerID for s390x topology detection

containerd/api v1.10.0 changes:
- Add ActiveMount message type for tracking mounts with timestamps
- Add ActivationInfo message for mount management and lifecycle tracking

runtime-spec v1.3.0 changes (from ChangeLog):
- Add FreeBSD platform support with new Spec.FreeBSD field
- Add netDevices object for moving network devices to container namespaces
- Add memoryPolicy object for NUMA memory policy configuration
- Add hwConfig object for VM-based containers (vcpus, memory, device-tree)
- Add iomems for hardware I/O memory page access in VMs
- Add intelRdt.schemata and intelRdt.enableMonitoring fields
- Change LinuxPids.Limit to pointer type for optional handling
- Clarify intelRdt configuration and pids cgroup settings

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2026-01-15 10:26:13 -05:00
Patrick Ohly
3783a720e7 client-go testing: start ResourceVersion at 1 for empty set
List should never return "0", that has a special meaning in queries.
2026-01-15 16:08:23 +01:00
Patrick Ohly
359aff0552 client-go testing: include event handler in List+Watch unit test
The event handler must receive both object (the initial one from List, the
newer one from Watch) and it must be considered synced.
2026-01-15 16:08:23 +01:00
Patrick Ohly
6bfa727bee client-go testing: fix List+Watch support
5644850607 added support for List+Watch to a fake client-go instance.
However, that support was not quite working yet as seen when analyzing a test
flake:

- List returned early when there were no objects, without adding the
  ResourceVersion. The ResourceVersion should have been "0" instead.
- When encountering "" as ResourceVersion, Watch didn't deliver
  any objects. That was meant to preserve compatibility with clients
  which don't expect objects from a Watch, but the right semantic of
  "" is "Start at most recent", which includes delivering existing
  objects.

Tests which meddle with the List implementation via a reactor (like
clustertrustbundlepublisher) have to be aware that Watch now may
return objects when given an empty ResourceVersion.
2026-01-15 16:08:23 +01:00
Kubernetes Prow Robot
2c677fe034 Merge pull request #135563 from yangjunmyfm192085/fixkubectl
When using kubectl to delete multiple sts pods simultaneously, it gets stuck and won't exit
2026-01-15 20:15:35 +05:30
Kubernetes Prow Robot
3fe167e586 Merge pull request #136245 from soltysh/clarify_scaling
Eliminate duplicate scale methods deployment controller in favor of a parameter
2026-01-15 19:13:40 +05:30
Maciej Szulik
5f21c6c709 Eliminate duplicate scale methods deployment controller in favor of a parameter
This initially was attempted in 5f083e3b9f
but it caused e2e failing heavily (see
https://github.com/kubernetes/kubernetes/issues/135222 for more details).
The changes proposed in e6641cd290
clarified the naming of the two existing scale methods but they still
leave both of them as is.

This change goes a step further by combining both into a single method
with a parameter `forceUpdate` which is responsible for driving the mode
of execution between lazy update and a forced update.

Signed-off-by: Maciej Szulik <soltysh@gmail.com>
2026-01-15 13:50:39 +01:00
Kubernetes Prow Robot
14d67d489c Merge pull request #135981 from vshkrabkov/fix/unschedulable_pods_broke_while_preenqueue
Fix unschedulable pods metric broke while preenqueue
2026-01-15 18:11:35 +05:30
Ed Bartosh
eb2cf5ad04 migrate kubelet_pods* to contextual logging 2026-01-15 12:30:24 +02:00
Kubernetes Prow Robot
0ba578f91f Merge pull request #135393 from tosi3k/parallel-prebind
Run PreBind plugins in parallel
2026-01-15 12:39:34 +05:30
Kubernetes Prow Robot
8b1496ac62 Merge pull request #136184 from yongruilin/master_dependenttag
feat(kube-api-linter): add dependenttags linter for k8s:unionMember
2026-01-15 11:09:45 +05:30
Kubernetes Prow Robot
b40830cca7 Merge pull request #135794 from AutuSnow/master
kubelet: resolve data race in WaitForAllPodsUnmount when collecting errors(#134083)
2026-01-15 11:09:37 +05:30
Kubernetes Prow Robot
e79df94fc8 Merge pull request #136064 from coillteoir/master
testing: reintegrate volume image e2e test
2026-01-15 07:27:34 +05:30
Kubernetes Prow Robot
8322d26d1f Merge pull request #135462 from michaelasp/atomicReplace
Add atomic replace in client-go
2026-01-15 03:35:37 +05:30
Kubernetes Prow Robot
3ad38f3885 Merge pull request #132120 from flpanbin/fix-requestedToCapacityRatio-nil-pointer
fix the noderesourcefit plugin's nil pointer by validating RequestedToCapacityRatio config
2026-01-15 02:35:37 +05:30
yongruilin
49be15534e feat: Enforce +k8s:optional on +k8s:unionMember fields via dependenttag linter 2026-01-14 20:08:59 +00:00
yongruilin
37e05b74c7 update sigs.k8s.io/kube-api-linter to latest 2026-01-14 20:02:30 +00:00
Kubernetes Prow Robot
285222e92e Merge pull request #136192 from dnaeon/fix/defaulter-gen-leftover
code-generator/defaulter-gen: remove a leftover
2026-01-15 01:29:35 +05:30
Michael Aspinwall
3d585f1c50 Add support for ReplacedAll delta handling 2026-01-14 19:00:32 +00:00
Michael Aspinwall
022fec7ba8 Plumb AtomicFIFO options into controller/store construction 2026-01-14 19:00:32 +00:00
Michael Aspinwall
9e25c19199 Add AtomicFIFO feature gate 2026-01-14 19:00:32 +00:00
Michael Aspinwall
64f780c1ec Guard against unexpected delta types in batch processing 2026-01-14 19:00:32 +00:00
Michael Aspinwall
b8470beda4 Make PopBatch process a single-item batch identically to Pop 2026-01-14 19:00:32 +00:00
Michael Aspinwall
1c29ee7e7b Expand controller unit test coverage 2026-01-14 19:00:32 +00:00
Michael Aspinwall
4171c8cff8 Plumb keyFunc to informer/controller/delta handling 2026-01-14 19:00:31 +00:00
Michael Aspinwall
b94e610244 Refactor RealFIFO#Replace delete/update handling to reconcileReplacement 2026-01-14 19:00:31 +00:00
Michael Aspinwall
ebd6959b12 Fix Replaced delta documentation 2026-01-14 19:00:31 +00:00
Michael Aspinwall
2dad39751d Refactor delta addition/clearing 2026-01-14 19:00:31 +00:00
Kubernetes Prow Robot
cd8fc957c7 Merge pull request #135303 from vikasbolla/fix_pcr_flake
Fix context deadline exceeded in PodCertificate test
2026-01-15 00:27:46 +05:30
Kubernetes Prow Robot
616fff8247 Merge pull request #131317 from bitoku/fix-static-init
Fix:Static pod status is always Init:0/1 if unable to get init container status
2026-01-15 00:27:38 +05:30
thc1006
97bbd4246c fix(apiserver): convert V().Error() to V().Info() for verbosity-aware logging
The go-logr/logr package ignores verbosity levels when using the Error
method. This means logger.V(1).Error() will always log regardless of
the verbosity setting, which contradicts the developer's intent.

This commit converts V(1).Error(err, "msg") to V(1).Info("msg", "err", err)
in the authorizeUnsafeDelete function to properly respect the verbosity
level.

This issue was identified in PR #136190 which adds a logcheck linter
rule to detect this pattern.
2026-01-14 16:13:26 +00:00
Kubernetes Prow Robot
cc55e34478 Merge pull request #135567 from aviralgarg05/fix-flaky-test-apply-crd-during-finalization
Fix flaky TestApplyCRDuringCRDFinalization test
2026-01-14 19:51:46 +05:30
Kubernetes Prow Robot
c086a712b1 Merge pull request #136197 from bart0sh/PR217-use-benchtime-1x-in-scheduler_perf-doc
scheduler_perf: use -benchtime=1x in the test examples
2026-01-14 19:01:38 +05:30
David Lynch
df66e4728b Back out "Remove image volume e2e test because CI has containerd < 2.1"
Original commit changeset: 71ddb98ae4

user: David Lynch <davite3@protonmail.com>
2026-01-14 12:36:03 +00:00
Ed Bartosh
d966d9b89d scheduler_perf: use -benchtime=1x in the test examples
Update scheduler performance test examples to use `-benchtime=1x`
instead of `-benchtime=1ns` for explicitly running each benchmark
exactly once. This makes the intent clearer and aligns the examples
with recommended Go benchmark usage.

Co-authored-by: Patrick Ohly <patrick.ohly@intel.com>
2026-01-14 11:07:32 +02:00
Kubernetes Prow Robot
62277ef5d2 Merge pull request #136199 from saschagrunert/master
Fix credential test by setting `AlwaysVerify` policy
2026-01-14 08:49:43 +05:30
Kubernetes Prow Robot
8bafe2cef1 Merge pull request #136198 from serathius/approver-storage
Add serathius as approver for apiserver storage
2026-01-14 08:49:35 +05:30
Heba Elayoty
7ca8d8154c Update codegen for validation
Signed-off-by: Heba Elayoty <heelayot@microsoft.com>
2026-01-13 15:10:21 -08:00
Kubernetes Prow Robot
c29a5d73a6 Merge pull request #136162 from dims/update-security-deps-jan2026
Update security-critical authentication and protobuf dependencies
2026-01-14 04:15:34 +05:30
Heba Elayoty
63708d84dc Add comment for the reason behind not checking empty or too-long names
Signed-off-by: Heba Elayoty <heelayot@microsoft.com>
2026-01-13 14:37:38 -08:00
Davanum Srinivas
c825d80bbf Update security-critical authentication and protobuf dependencies
This PR updates security-critical dependencies addressing authentication
and data parsing vulnerabilities.

**Authentication Security:**
- github.com/coreos/go-oidc: v2.3.0 -> v2.5.0
  - Security fix: Now verifies token signature BEFORE validating payload
  - Prevents potential processing of tampered tokens before cryptographic
    verification

- github.com/cyphar/filepath-securejoin: v0.6.0 -> v0.6.1
  - Security fix: Fixed seccomp fallback logic - library now properly falls
    back to safer O_PATH resolver when openat2(2) is denied by seccomp-bpf
  - Fixed file descriptor leak in openat2 wrapper during RESOLVE_IN_ROOT

- cyphar.com/go-pathrs: v0.2.1 -> v0.2.2
  - Companion update to filepath-securejoin

**Protobuf Security:**
- google.golang.org/protobuf: v1.36.8 -> v1.36.11
  - Security fix: Added recursion limit check in lazy decoding validation
  - Prevents potential stack exhaustion attacks via maliciously crafted
    protobuf messages
  - Also adds support for URL chars in type URLs in text-format

These updates are critical for:
- OIDC authentication in kube-apiserver
- Container filesystem path resolution (used by container runtimes)
- Protobuf message parsing throughout the codebase

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2026-01-13 16:56:16 -05:00
Heba Elayoty
24c161307f Add tweak functions and enhance code readability
Signed-off-by: Heba Elayoty <heelayot@microsoft.com>
2026-01-13 13:42:55 -08:00
Heba Elayoty
36f5750042 Move path-segment validation to pkg content
This is where all the scrubbed validation helpers are going.

Note: This does NOT check for  or too-long inputs, and changing it now
would be a breaking change.

Co-authored-by: Tim Hockin <thockin@google.com>
Signed-off-by: Heba Elayoty <heelayot@microsoft.com>
2026-01-13 13:27:41 -08:00
Kubernetes Prow Robot
9674c06ec4 Merge pull request #135579 from Jefftree/controller-revision
Add index on ControllerRevision OwnerReference
2026-01-14 02:07:36 +05:30
Jefftree
2522628780 Add index for controller revision 2026-01-13 19:46:34 +00:00
Kubernetes Prow Robot
ce793bf4d6 Merge pull request #136077 from kannon92/sync-mutable-pod-mutable-scheduling-suspend-check
sync check in batch stategy to match AllowMutableSchedulingDirectives and AllowMutablePodResources
2026-01-14 01:11:42 +05:30
Kubernetes Prow Robot
b639540931 Merge pull request #135432 from pohly/apimachinery-featuregate-contextual-logging
featuregate: contextual logging
2026-01-14 01:11:35 +05:30