github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-07-18 04:54:54 +00:00
Code Issues Projects Releases Wiki Activity
134,781 Commits 42 Branches 9,765 Tags
df66e4728bef3d5300d82fdc41afefdfbca39963
Commit Graph

134781 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
David Lynch
df66e4728b Back out "Remove image volume e2e test because CI has containerd < 2.1" 
Original commit changeset: 71ddb98ae4

user: David Lynch <davite3@protonmail.com>
 2026-01-14 12:36:03 +00:00
Kubernetes Prow Robot
62277ef5d2 Merge pull request #136199 from saschagrunert/master 
Fix credential test by setting `AlwaysVerify` policy
 2026-01-14 08:49:43 +05:30
Kubernetes Prow Robot
8bafe2cef1 Merge pull request #136198 from serathius/approver-storage 
Add serathius as approver for apiserver storage
 2026-01-14 08:49:35 +05:30
Kubernetes Prow Robot
c29a5d73a6 Merge pull request #136162 from dims/update-security-deps-jan2026 
Update security-critical authentication and protobuf dependencies
 2026-01-14 04:15:34 +05:30
Davanum Srinivas
c825d80bbf Update security-critical authentication and protobuf dependencies 
This PR updates security-critical dependencies addressing authentication
and data parsing vulnerabilities.

**Authentication Security:**
- github.com/coreos/go-oidc: v2.3.0 -> v2.5.0
  - Security fix: Now verifies token signature BEFORE validating payload
  - Prevents potential processing of tampered tokens before cryptographic
    verification

- github.com/cyphar/filepath-securejoin: v0.6.0 -> v0.6.1
  - Security fix: Fixed seccomp fallback logic - library now properly falls
    back to safer O_PATH resolver when openat2(2) is denied by seccomp-bpf
  - Fixed file descriptor leak in openat2 wrapper during RESOLVE_IN_ROOT

- cyphar.com/go-pathrs: v0.2.1 -> v0.2.2
  - Companion update to filepath-securejoin

**Protobuf Security:**
- google.golang.org/protobuf: v1.36.8 -> v1.36.11
  - Security fix: Added recursion limit check in lazy decoding validation
  - Prevents potential stack exhaustion attacks via maliciously crafted
    protobuf messages
  - Also adds support for URL chars in type URLs in text-format

These updates are critical for:
- OIDC authentication in kube-apiserver
- Container filesystem path resolution (used by container runtimes)
- Protobuf message parsing throughout the codebase

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2026-01-13 16:56:16 -05:00
Kubernetes Prow Robot
9674c06ec4 Merge pull request #135579 from Jefftree/controller-revision 
Add index on ControllerRevision OwnerReference
 2026-01-14 02:07:36 +05:30
Jefftree
2522628780 Add index for controller revision 2026-01-13 19:46:34 +00:00
Kubernetes Prow Robot
ce793bf4d6 Merge pull request #136077 from kannon92/sync-mutable-pod-mutable-scheduling-suspend-check 
sync check in batch stategy to match AllowMutableSchedulingDirectives and AllowMutablePodResources
 2026-01-14 01:11:42 +05:30
Kubernetes Prow Robot
b639540931 Merge pull request #135432 from pohly/apimachinery-featuregate-contextual-logging 
featuregate: contextual logging
 2026-01-14 01:11:35 +05:30
Kubernetes Prow Robot
c6be052768 Merge pull request #129344 from pohly/log-client-go-apimachinery-network-util 
apimachinery: contextual logging in network util code
 2026-01-13 23:07:39 +05:30
Patrick Ohly
c16a07a8b1 featuregate: contextual logging 
This is primarily useful in unit tests and therefore supported by
featuregate/testing. Without this, all warnings are emitted to stderr, with no
connection to the test which caused the warning to be emitted.

When a single test fails, `go test` started by showing all warnings triggered by
any test, not just the failed test:

    I1121 18:50:28.112284  396950 feature_gate.go:466] feature gates: {map[DRADeviceTaintRules:true DRADeviceTaints:true]}
    ...
    I1121 18:50:29.704907  396950 feature_gate.go:466] feature gates: {map[DRADeviceTaintRules:false DRADeviceTaints:false]}
    --- FAIL: TestAll (1.58s)
        --- FAIL: TestAll/Eviction (0.02s)

This warning was actually slightly broken: it passed an atomic.Value to Infof,
not the map. This violates the "must not be copied after first use" rule
for atomic.Value (thus wasn't thread-safe) and printed the value in an awkward
way (extra {}).

Now it shows that the feature gates are modified inside TestAll (in this example):

    --- FAIL: TestAll (1.56s)
        feature_gate.go:170: I1124 17:31:27.245108] Updated featureGates={"DRADeviceTaintRules":true,"DRADeviceTaints":true}
        --- FAIL: TestAll/Eviction (0.02s)
            --- FAIL: TestAll/Eviction/initial (0.00s)
        ...

        feature_gate.go:170: I1124 17:31:28.821975] Updated featureGates={"DRADeviceTaintRules":false,"DRADeviceTaints":false}
    FAIL
    FAIL	k8s.io/kubernetes/pkg/controller/devicetainteviction	1.602s
 2026-01-13 18:20:59 +01:00
Kubernetes Prow Robot
c20e0bc541 Merge pull request #135958 from serathius/watchcache-store 
Move store to cacher subpackage.
 2026-01-13 21:41:40 +05:30
Patrick Ohly
588bba42c7 apimachinery: contextual logging in network util code 2026-01-13 16:55:36 +01:00
Kubernetes Prow Robot
58000ddd0e Merge pull request #136195 from HirazawaUi/upgrade-containerd-version 
Upgrade the COS version (upgrade containerd to version v2.1+)
 2026-01-13 19:39:38 +05:30
Sascha Grunert
1abe2c4860 Fix credential test by setting AlwaysVerify policy 
The test expects unauthorized pods to be blocked from accessing cached
private images, but the default policy (NeverVerifyPreloadedImages)
allows access to any image previously pulled by the kubelet.

Configure the kubelet to use AlwaysVerify policy for this test, which
enforces credential checks for all images regardless of pull history.

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
 2026-01-13 13:52:43 +01:00
Marek Siarkowicz
eb35b0a657 Add serathius as approver for apiserver storage 2026-01-13 13:22:05 +01:00
HirazawaUi
3164b73d28 upgrade containerd version to v2.1+ 2026-01-13 18:13:52 +08:00
Kubernetes Prow Robot
9f6977db54 Merge pull request #136086 from richabanker/graduate-watch_list_duration_seconds-BETA 
Graduate watch_list_duration_seconds to BETA
 2026-01-13 15:29:37 +05:30
Kubernetes Prow Robot
6b541e0b58 Merge pull request #135977 from pohly/test-parallel-fix 
make test: fix support for PARALLEL
 2026-01-13 09:51:41 +05:30
Kubernetes Prow Robot
e0464327ce Merge pull request #135770 from dnaeon/code-generator/defaulter-gen 
code-generator/defaulter-gen: generate defaults only if required tags are present
 2026-01-13 08:33:36 +05:30
Kubernetes Prow Robot
fa8340b207 Merge pull request #136117 from lalitc375/dv-strategy 
Add utilities to allow strategy.go files to enable DV native validations
 2026-01-13 07:43:43 +05:30
Kubernetes Prow Robot
d68d48073f Merge pull request #136112 from danwinship/network-1.36-cleanup 
Drop TopologyAwareHints and ServiceTraficDistribution feature gates
 2026-01-13 07:43:36 +05:30
Kubernetes Prow Robot
31cdb5de61 Merge pull request #136183 from aramase/aramase/i/fix_kms_test_136181 
test: fix kind local registry config for kms ci jobs
 2026-01-13 05:25:38 +05:30
Lalit Chauhan
42b8ceee21 Address feedbacks 2026-01-12 22:09:50 +00:00
Kubernetes Prow Robot
1c894014eb Merge pull request #136161 from dims/update-golang-x-deps-jan2026 
Update golang.org/x dependencies to latest versions
 2026-01-13 03:05:37 +05:30
Anish Ramasekar
900a8030f3 test: fix kind local registry config for kms ci jobs 
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
 2026-01-12 12:59:14 -08:00
Kubernetes Prow Robot
477b99a8d8 Merge pull request #135759 from Abhigyan-Shekhar/fix-cel-race-condition 
FIX: Deep copy MapType in CEL composition to prevent data race
 2026-01-13 02:15:08 +05:30
Kubernetes Prow Robot
f2143d70db Merge pull request #135597 from alvaroaleman/plumb-context 
Service account controller: Wire through context
 2026-01-13 02:15:00 +05:30
Kevin Hannon
986020d6bd sync check in batch stategy to match AllowMutableSchedulingDirectives and AllowMutablePodResources 2026-01-12 15:40:34 -05:00
Omer Aplatony
6cbb58349d HPA: Enable DV support for MaxReplicas (#135412) 
Signed-off-by: Omer Aplatony <omerap12@gmail.com>
 2026-01-13 00:54:09 +05:30
Kubernetes Prow Robot
19d344fbee Merge pull request #135887 from ErikJiang/fix/log-validation-messages 
fix log validation messages
 2026-01-13 00:00:17 +05:30
Kubernetes Prow Robot
f366ba158a Merge pull request #135668 from yliaog/implicit 
added unit test case to ensure implicit DRA extended resource is handled properly during pod admission at kubelet
 2026-01-13 00:00:09 +05:30
Kubernetes Prow Robot
4a29c352ce Merge pull request #135949 from lalitc375/stability-tag-promotion 
Promote validation-gen tags to Stable
 2026-01-12 22:24:29 +05:30
Kubernetes Prow Robot
210881f0f0 Merge pull request #135485 from saschagrunert/fix-device-plugin-termination-grace-period 
Fix device plugin admission failure after container restart
 2026-01-12 22:24:22 +05:30
Kubernetes Prow Robot
af6c58193c Merge pull request #135369 from saschagrunert/serial-tests 
test: Fix image credential pulls test node scheduling
 2026-01-12 22:24:13 +05:30
Kubernetes Prow Robot
b9e2575a54 Merge pull request #135992 from bart0sh/PR212-migrate-remaining-kubelet-subdirs-to-contextual-logging 
Migrate remaining kubelet subdirs to contextual logging
 2026-01-12 19:58:41 +05:30
Kubernetes Prow Robot
b89a81cfcb Merge pull request #136167 from Karthik-K-N/update-funcs 
DRA: remove deprecated test method usage, fix linter hints
 2026-01-12 18:04:39 +05:30
Sascha Grunert
172a65c71d Fix device plugin admission failure after container restart 
When a container restarts before kubelet restarts, containerMap has
multiple entries (old exited + new running). GetContainerID() may
return the exited container, causing the running check to fail. Fixed
by checking if ANY container for the pod/name is running.

Also filter terminal pods from podresources since they no longer
consume resources, and fix test error handling to avoid exiting
Eventually immediately on transient errors.

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
 2026-01-12 11:55:25 +01:00
Kubernetes Prow Robot
6df7e09ad9 Merge pull request #135911 from ShaanveerS/add-udp-agnhost 
Add UDP and explicit TCP support to agnhost porter
 2026-01-12 16:16:06 +05:30
Karthik Bhat
8962f08815 Remove deprecated test methods 2026-01-12 16:15:04 +05:30
Ed Bartosh
0dc83930de logcheck: move all kubelet subdirs to contextual logging 2026-01-12 12:36:59 +02:00
Ed Bartosh
1c48267565 migrate pkg/kubelet/events to contextual logging 2026-01-12 12:36:59 +02:00
Ed Bartosh
597c20d050 migrate kubelet/stats to contextual logging 2026-01-12 12:36:59 +02:00
Ed Bartosh
1fa4951dd5 migrate kubelet/podcertificate to contextual logging 2026-01-12 12:36:58 +02:00
Ed Bartosh
152c2e5d1c migrate kubelet/images/pullmanager to contextual logging 2026-01-12 12:36:53 +02:00
Kubernetes Prow Robot
997ca903d8 Merge pull request #136127 from carlory/fix-3279 
kubeadm: fix a bug where kubeadm upgrade is failed if the content of the `kubeadm-flags.env` file is `KUBELET_KUBEADM_ARGS=""`
 2026-01-12 15:24:10 +05:30
carlory
f96472556c kubeadm: fix a bug where kubeadm upgrade is failed if the content of the kubeadm-flags.env file is KUBELET_KUBEADM_ARGS="" 
Signed-off-by: carlory <baofa.fan@daocloud.io>
 2026-01-12 10:09:05 +08:00
Davanum Srinivas
0e67c56a8f Update golang.org/x dependencies to latest versions 
updates the golang.org/x package family to newer releases:

- golang.org/x/crypto: v0.45.0 -> v0.46.0
- golang.org/x/net: v0.47.0 -> v0.48.0
- golang.org/x/sys: v0.38.0 -> v0.40.0
- golang.org/x/time: v0.9.0 -> v0.14.0
- golang.org/x/oauth2: v0.30.0 -> v0.34.0
- golang.org/x/text: v0.31.0 -> v0.33.0
- golang.org/x/term: v0.37.0 -> v0.39.0
- golang.org/x/sync: v0.18.0 -> v0.19.0
- golang.org/x/mod: v0.29.0 -> v0.32.0
- golang.org/x/tools: v0.38.0 -> v0.40.0
- golang.org/x/exp: 8a7402abbf56 -> 944ab1f22d93

Security & Stability:
- x/crypto: Updated X509 root certificate bundle
- x/net: HTTP/2 PING optimization to reduce DoS detection triggers,
  data race fix in trace RenderEvents
- x/sys: Fixed out-of-bounds memory access in sockaddrIUCVToAny
- x/time: Fixed rate limiter overflow when using very low rates that
  could cause the limiter to jam open

Performance:
- x/time: ~19% improvement in Sometimes.Do when no interval configured

Maintenance:
- Various vet diagnostic fixes for Go 1.26 compatibility
- Dependency updates across the golang.org/x ecosystem

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2026-01-11 16:26:07 -05:00
Kubernetes Prow Robot
036cd9fc6e Merge pull request #136151 from pohly/e2e-ktesting-revert 
testing: partial revert of E2E + DRA upgrade/downgrade
 2026-01-11 17:29:57 +05:30
Patrick Ohly
e999d595b1 testing: partial revert of E2E + DRA upgrade/downgrade 
Refactoring the DRA upgrade/downgrade testing such that it runs as Go test
depended on supporting ktesting in the E2E framework. That change worked during
presubmit testing, but broke some periodic jobs. Therefore the relevant commits
from https://github.com/kubernetes/kubernetes/pull/135664/commits get reverted:

c47ad64820 DRA e2e+integration: test ResourceSlice controller
047682908d ktesting: replace Begin/End with TContext.Step
de47714879 DRA upgrade/downgrade: rewrite as Go unit test
7c7b1e1018 DRA e2e: make driver deployment possible in Go unit tests
65ef31973c DRA upgrade/downgrade: split out individual test steps
47b613eded e2e framework: support creating TContext

The last one is what must have caused the problem, but the other commits depend
on it.
 2026-01-11 09:55:17 +01:00