Commit Graph

134908 Commits

Author SHA1 Message Date
Lukasz Szaszkiewicz
c832203707 pkg/controller/garbagecollector/garbagecollector_test: wrap kubeClient with a client that doesn't support WatchList semantics. 2025-11-03 10:41:49 +01:00
Ed Bartosh
36510ccf56 devicemanager: fix cleanup of healthy and unhealthy devices
Correctly removed the resource from both healthy and unhealthy device
maps when resource endpoint expires.

This makes resource endpoint and devices maps consistent.
2025-11-03 10:57:58 +02:00
Kubernetes Prow Robot
5e2ad84f67 Merge pull request #134906 from carlory/fix-kubeadm-3229
kubeadm: added container runtime version check to preflight
2025-11-02 23:36:04 -08:00
Patrick Ohly
12a0c8ce17 DRA extended resource: chain event handlers
The cache and scheduler event handlers cannot be registered separately in the
informer, that leads to a race (scheduler might schedule based on event before
cache is updated). Chaining event handlers (cache first, then scheduler) avoids
this.

This also ensures that the cache is up-to-date before the scheduler
starts (HasSynced of the handler registration for the cache is checked).

Other changes:
- renamed package to avoid clash with other "cache" packages
- clarified nil handling
- feature gate check before instantiating the cache
- per-test logging
- utilruntime.HandleErrorWithLogger
- simpler cache.DeletedFinalStateUnknown

Signed-off-by: Sai Ramesh Vanka <svanka@redhat.com>
2025-11-03 12:31:17 +05:30
Sai Ramesh Vanka
d8c66ffb63 Add a global cache to support DRA's extended resource to the device
class mapping

- Add a new interface "DeviceClassResolver" in the scheduler framework
- Add a global cache of mapping between the extended resource and the
  device class
- Cache can be leveraged by the k8s api-server, controller-manager along with the scheduler
- This change helps in delegating the requests to the dynamicresource
  plugin based on the mapping during the node update events and thus
avoiding an extra scheduling cycle

Signed-off-by: Sai Ramesh Vanka <svanka@redhat.com>
2025-11-03 12:31:16 +05:30
Aditi Gupta
6d23bc4b65 kube-aggregator: Refactor OpenAPI controllers to be context-aware 2025-11-02 20:56:45 -08:00
Kubernetes Prow Robot
6822f9b0af Merge pull request #135045 from pohly/e2e-slow-priority-revert
Revert "E2E framework: start slow tests first"
2025-11-02 12:04:02 -08:00
Patrick Ohly
34021d451d Revert "E2E framework: start slow tests first"
This reverts commit cff07e7551.

The commit caused several kubeadm jobs to fail while executing all conformance
tests (including slow ones) in parallel. Sometimes execution took longer and
ran into the overall timeout, sometimes there was:

    [FAILED] Expected
        <int>: 440
    to be ==
        <int>: 400
    In [It] at: k8s.io/kubernetes/test/e2e/apimachinery/chunking.go:202

It looks like the tests are flaky and/or reveal a real bug when slow tests run
all in parallel at the same time.

This should work, but doesn't right now, so let's revert until that problem is fixed.
2025-11-02 20:09:28 +01:00
tinatingyu
59e075e8d3 Promote PodCertificateRequests to v1beta1 2025-11-02 05:33:44 +00:00
Abhijit Hoskeri
7c47b91ed2 Limit CONNECT proxy response header size
As described in https://go.dev/issue/74633 a misbehaving proxy server
can cause memory exhaustion in the client. The fix in https://go.dev/cl/698915
only covers http.Transport users. Apply the same limit here.

Limit the size of the response headers the proxy server can send us.
2025-11-01 20:47:40 -07:00
Kubernetes Prow Robot
afb2b97425 Merge pull request #135022 from sunya-ch/fix-distinct-constraint
[DRA] Fix DistinctAttributeConstraint match comparision with value
2025-11-01 09:24:02 -07:00
Kubernetes Prow Robot
cd0ddec139 Merge pull request #134881 from pohly/e2e-slow-priority
E2E: run slow tests first, using new Ginkgo
2025-11-01 06:10:02 -07:00
lukasmetzner
2be8c36dba fix: additional nil check for workqueue shutdown 2025-11-01 11:10:17 +01:00
lukasmetzner
ecbda22ea5 chore: more precise resync comment 2025-11-01 11:10:17 +01:00
lukasmetzner
a85a9e13aa chore: cleanup outdated comment 2025-11-01 11:10:17 +01:00
lukasmetzner
956964d6e5 fix: register feature gate dependencies 2025-11-01 11:10:17 +01:00
lukasmetzner
36e6b9075e chore: move golang.org/x/time to required 2025-11-01 11:10:14 +01:00
lukasmetzner
806cf9ef51 style: alphabetic ordering 2025-11-01 10:59:37 +01:00
lukasmetzner
b68fd5e533 docs: cleanup docstrings 2025-11-01 10:59:37 +01:00
lukasmetzner
abf60333ad feat: add feature gate to kube features 2025-11-01 10:59:37 +01:00
lukasmetzner
c2044c8d39 fix: feature gate min version 2025-11-01 10:59:37 +01:00
lukasmetzner
0c775eec7c fix: rate limit route reconciles 2025-11-01 10:59:37 +01:00
lukasmetzner
9af329151a feat: minimal route resync period interval 2025-11-01 10:59:37 +01:00
lukasmetzner
9e612f107a feat: update routes on resync 2025-11-01 10:59:37 +01:00
lukasmetzner
0b41218ed4 fix: missing update of feature gates 2025-11-01 10:59:37 +01:00
lukasmetzner
be7e0ddb74 fix: spelling 2025-11-01 10:59:37 +01:00
lukasmetzner
8ef9e53ce5 fix: check error of AddEventHandler 2025-11-01 10:59:37 +01:00
lukasmetzner
a5055cc407 feat(ccm): watch based route controller
Introduces a new watch based route controller for the cloud-controller-manager. This prevents the exhaustion of API rate limits through an overagressive routes controller. This is further described in #60646. The corresponding feature gate is called "CloudControllerManagerWatchBasedRoutesReconciliation".
2025-11-01 10:59:37 +01:00
Patrick Ohly
cff07e7551 E2E framework: start slow tests first
This avoids the risk of having a slow test started towards the end of a run,
which then would cause the run to take longer. When started early they can run
in parallel to other tests. In serial runs it doesn't matter.

The implementation maps the Slow label to the new ginkgo.SpecPriority. The
default is 0. Tests with priority 1 run first.
2025-11-01 09:52:09 +01:00
Patrick Ohly
6034321603 dependencies: ginkgo v2.27.2, gomega v1.38.2
Specifically the new AddTreeConstructionNodeArgsTransformer and SpecPriority in
Ginkgo will be useful.

Gomega gets updated to keep up-to-date.
2025-11-01 09:52:09 +01:00
Yuan Wang
308a53dfa6 Add validation options for static pod 2025-11-01 07:41:53 +00:00
Omer Aplatony
264eab46db Remove unused delete reactor
Signed-off-by: Omer Aplatony <omerap12@gmail.com>
2025-11-01 06:13:40 +00:00
Humble Devassy Chirammal
902c652ccb Record proper orphaned pod cleanup error based on the system call
The code actually calls os.Remove(), not rmdir(). The error message
should accurately reflect the operation being performed.
os.Remove() can remove both files and directories, while rmdir()
only removes directories

Signed-off-by: Humble Devassy Chirammal <humble.devassy@gmail.com>
2025-11-01 11:35:27 +05:30
HirazawaUi
acdf891478 add e2e tests 2025-11-01 12:55:01 +08:00
Sunyanan Choochotkaew
c99145805f [DRA] Fix DistinctAttributeConstraint match comparision with value
Signed-off-by: Sunyanan Choochotkaew <sunyanan.choochotkaew1@ibm.com>
2025-11-01 08:43:57 +09:00
Kubernetes Prow Robot
d2e1e3b6bc Merge pull request #135021 from aramase/aramase/c/cleanup_jwks_metric_comment
oidc: fix jwks metric name in comment
2025-10-31 15:34:05 -07:00
Anish Ramasekar
97587e951b oidc: fix jwks metric name in comment
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2025-10-31 14:28:14 -07:00
Benjamin Elder
2b0bfbfb8e removed unused functionality from run_group_snapshot.sh and prepare for kubeadm v1beta4 config 2025-10-31 14:19:43 -07:00
Benjamin Elder
a3ce49a11e prepare kms kind config for kubeadm v1beta4 2025-10-31 14:19:43 -07:00
Hemant Kumar
a1ce4bb468 Check for CSIDriver object before stopping pod scheduling 2025-10-31 16:06:37 -04:00
Benjamin Elder
d17ed9be17 prepare DRA kind config for kubeadm v1beta4 2025-10-31 13:04:56 -07:00
Hemant Kumar
2f0a84af1a Add csidriver lister to CSI scheduler plugin 2025-10-31 15:36:25 -04:00
Kubernetes Prow Robot
1b6d0c7c03 Merge pull request #134965 from tsj-30/fix-dra-devicebindingconditions-flake
test: fix flake in DRA DeviceBindingCondition
2025-10-31 12:26:03 -07:00
Hemant Kumar
85d7626d2d Do not schedule pods if CSI driver is not ready 2025-10-31 15:09:03 -04:00
Kubernetes Prow Robot
72e06a7516 Merge pull request #134982 from natasha41575/ippr-tests
[InPlacePodVerticalScaling] Reformat a couple of e2e tests
2025-10-31 11:34:13 -07:00
Kubernetes Prow Robot
0d40757969 Merge pull request #133051 from rata/userns-record-pod-error
kubelet/userns: Print podUID on errors
2025-10-31 11:34:06 -07:00
Peter Hunt
8b2babcbff PSA: fix lint with older policies
Signed-off-by: Peter Hunt <pehunt@redhat.com>
2025-10-31 14:08:21 -04:00
Jordan Liggitt
d9ddd5c59b Allow PSA pass scenarios to be informed by the policy level
As well as fix procMount restricted test
2025-10-31 14:08:21 -04:00
Peter Hunt
e8bd3f629d drop UserNamespacesPodSecurityStandards feature gate
this feature gate was meant to be ephemeral, and only was used for guaranteeing a
cluster admin didn't accidentally relax PSA policies before the kubelet would deny a pod
was created if it didn't support user namespaces. As of kube 1.33, the supported apiserver version
skew of n-3 guarantees that all supported kubelets are of 1.30 or later, meaning they do this.

Now, we can unconditionally relax PSA policy if a pod is in a user namespace.

This PR reserves older policies default behavior by never relaxing

Signed-off-by: Peter Hunt <pehunt@redhat.com>
2025-10-31 14:08:21 -04:00
Swati Sehgal
f2d075ea65 Address review comments
Signed-off-by: Swati Sehgal <swsehgal@redhat.com>
2025-10-31 17:41:34 +00:00