This wasn't possible at the time of implementing the Device Taints API, at
least not completely, because it depended on prioritized list being merged
first, to cover the "FirstAvailable" field introduced together with that
feature.
That the device taints PR got merged despite this gap was an oversight. The
confusing TODO probably didn't help: the entire implementation was missing (or
got lost due to a bad merge conflict resolution, not sure anymore) and it
referenced the wrong other feature (partitionable devices doesn't affect
ResourceClaim).
For some reason, ResourceClaimTemplate update testing was less complete than
the update testing of ResourceClaim. Fixed by copying the entire
TestStrategyUpdate over and switching it to testing ResourceClaimTemplates.
Golang allows to call methods on a nil object, as long as the methods
don't dereference the nil object. This is what we do here.
This makes all the userns configurations (idsPerPod or mapping configs
in /etc/subuid or /etc/subgid) to be ignored if the feature is off.
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
The first UID used for userns mappings needs to be at least the
idsPerPod. When idsPerPod is extended to be 65536*2, for example, then
the default UID of 65536 doesn't work.
While this can be configured by the user, let's just improve the default
first UID to be the same as idsPerPod. This makes the default first UID
work out of the box if the user just wants to tune that.
This also simplifies testing, as we don't need to create a system user
and /etc/subuid and /etc/subgid files to test the idsPerPod setting.
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
The idsPerPod where completely ignored since they were introduced in PR:
https://github.com/kubernetes/kubernetes/pull/130028
The problem was the following:
1. The userns manager (as well as all managers) is created
before the config is copied to the kubelet object[1]
2. The userns manager on creation is calling the kubelet_getter
GetUserNamespacesIDsPerPod to get the idsPerPod
3. The getter checks the configuration stored in the kubelet
object, which hasn't been set at that point.
4. As the config is nil (unset), it returns the default value.
Therefore, the value was ignored.
To solve this, let's just pass the idsPerPod as a parameter to
MakeUserNsManager(). This is the common pattern already used in the
kubelet initialization.
[1]: 461ba83084/pkg/kubelet/kubelet.go (L1078-L1087)
[2]: 461ba83084/pkg/kubelet/kubelet_getters.go (L145)
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
unit tests for the policy options add test options to the
global state without proper cleanup; this is done only in tests
so it has limited room for doing damage, but still weakens
the test signal. Let's avoid that adding proper cleanup.
Signed-off-by: Francesco Romani <fromani@redhat.com>
Fixes TestConnectionHandling/no-wipe-on-reconnect which was failing with
"Only one usage of each socket address is normally permitted" because the
teardown function wasn't waiting for the gRPC server to fully shut down
before returning, causing socket cleanup issues in subsequent test runs.
The fix ensures proper synchronization during server shutdown so that the
Unix socket is fully released before the teardown completes. This prevents
socket binding conflicts when tests run in sequence.
