github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-07-18 04:54:54 +00:00
Code Issues Projects Releases Wiki Activity
134,808 Commits 42 Branches 9,765 Tags
e79df94fc88ff304544245d2b262f40c7b4f82ef
Commit Graph

134808 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Kubernetes Prow Robot
e79df94fc8 Merge pull request #136064 from coillteoir/master 
testing: reintegrate volume image e2e test
 2026-01-15 07:27:34 +05:30
Kubernetes Prow Robot
8322d26d1f Merge pull request #135462 from michaelasp/atomicReplace 
Add atomic replace in client-go
 2026-01-15 03:35:37 +05:30
Kubernetes Prow Robot
3ad38f3885 Merge pull request #132120 from flpanbin/fix-requestedToCapacityRatio-nil-pointer 
fix the noderesourcefit plugin's nil pointer by validating RequestedToCapacityRatio config
 2026-01-15 02:35:37 +05:30
Kubernetes Prow Robot
285222e92e Merge pull request #136192 from dnaeon/fix/defaulter-gen-leftover 
code-generator/defaulter-gen: remove a leftover
 2026-01-15 01:29:35 +05:30
Michael Aspinwall
3d585f1c50 Add support for ReplacedAll delta handling 2026-01-14 19:00:32 +00:00
Michael Aspinwall
022fec7ba8 Plumb AtomicFIFO options into controller/store construction 2026-01-14 19:00:32 +00:00
Michael Aspinwall
9e25c19199 Add AtomicFIFO feature gate 2026-01-14 19:00:32 +00:00
Michael Aspinwall
64f780c1ec Guard against unexpected delta types in batch processing 2026-01-14 19:00:32 +00:00
Michael Aspinwall
b8470beda4 Make PopBatch process a single-item batch identically to Pop 2026-01-14 19:00:32 +00:00
Michael Aspinwall
1c29ee7e7b Expand controller unit test coverage 2026-01-14 19:00:32 +00:00
Michael Aspinwall
4171c8cff8 Plumb keyFunc to informer/controller/delta handling 2026-01-14 19:00:31 +00:00
Michael Aspinwall
b94e610244 Refactor RealFIFO#Replace delete/update handling to reconcileReplacement 2026-01-14 19:00:31 +00:00
Michael Aspinwall
ebd6959b12 Fix Replaced delta documentation 2026-01-14 19:00:31 +00:00
Michael Aspinwall
2dad39751d Refactor delta addition/clearing 2026-01-14 19:00:31 +00:00
Kubernetes Prow Robot
cd8fc957c7 Merge pull request #135303 from vikasbolla/fix_pcr_flake 
Fix context deadline exceeded in PodCertificate test
 2026-01-15 00:27:46 +05:30
Kubernetes Prow Robot
616fff8247 Merge pull request #131317 from bitoku/fix-static-init 
Fix:Static pod status is always Init:0/1 if unable to get init container status
 2026-01-15 00:27:38 +05:30
Kubernetes Prow Robot
cc55e34478 Merge pull request #135567 from aviralgarg05/fix-flaky-test-apply-crd-during-finalization 
Fix flaky TestApplyCRDuringCRDFinalization test
 2026-01-14 19:51:46 +05:30
Kubernetes Prow Robot
c086a712b1 Merge pull request #136197 from bart0sh/PR217-use-benchtime-1x-in-scheduler_perf-doc 
scheduler_perf: use -benchtime=1x in the test examples
 2026-01-14 19:01:38 +05:30
David Lynch
df66e4728b Back out "Remove image volume e2e test because CI has containerd < 2.1" 
Original commit changeset: 71ddb98ae4

user: David Lynch <davite3@protonmail.com>
 2026-01-14 12:36:03 +00:00
Ed Bartosh
d966d9b89d scheduler_perf: use -benchtime=1x in the test examples 
Update scheduler performance test examples to use `-benchtime=1x`
instead of `-benchtime=1ns` for explicitly running each benchmark
exactly once. This makes the intent clearer and aligns the examples
with recommended Go benchmark usage.

Co-authored-by: Patrick Ohly <patrick.ohly@intel.com>
 2026-01-14 11:07:32 +02:00
Kubernetes Prow Robot
62277ef5d2 Merge pull request #136199 from saschagrunert/master 
Fix credential test by setting `AlwaysVerify` policy
 2026-01-14 08:49:43 +05:30
Kubernetes Prow Robot
8bafe2cef1 Merge pull request #136198 from serathius/approver-storage 
Add serathius as approver for apiserver storage
 2026-01-14 08:49:35 +05:30
Kubernetes Prow Robot
c29a5d73a6 Merge pull request #136162 from dims/update-security-deps-jan2026 
Update security-critical authentication and protobuf dependencies
 2026-01-14 04:15:34 +05:30
Davanum Srinivas
c825d80bbf Update security-critical authentication and protobuf dependencies 
This PR updates security-critical dependencies addressing authentication
and data parsing vulnerabilities.

**Authentication Security:**
- github.com/coreos/go-oidc: v2.3.0 -> v2.5.0
  - Security fix: Now verifies token signature BEFORE validating payload
  - Prevents potential processing of tampered tokens before cryptographic
    verification

- github.com/cyphar/filepath-securejoin: v0.6.0 -> v0.6.1
  - Security fix: Fixed seccomp fallback logic - library now properly falls
    back to safer O_PATH resolver when openat2(2) is denied by seccomp-bpf
  - Fixed file descriptor leak in openat2 wrapper during RESOLVE_IN_ROOT

- cyphar.com/go-pathrs: v0.2.1 -> v0.2.2
  - Companion update to filepath-securejoin

**Protobuf Security:**
- google.golang.org/protobuf: v1.36.8 -> v1.36.11
  - Security fix: Added recursion limit check in lazy decoding validation
  - Prevents potential stack exhaustion attacks via maliciously crafted
    protobuf messages
  - Also adds support for URL chars in type URLs in text-format

These updates are critical for:
- OIDC authentication in kube-apiserver
- Container filesystem path resolution (used by container runtimes)
- Protobuf message parsing throughout the codebase

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2026-01-13 16:56:16 -05:00
Kubernetes Prow Robot
9674c06ec4 Merge pull request #135579 from Jefftree/controller-revision 
Add index on ControllerRevision OwnerReference
 2026-01-14 02:07:36 +05:30
Jefftree
2522628780 Add index for controller revision 2026-01-13 19:46:34 +00:00
Kubernetes Prow Robot
ce793bf4d6 Merge pull request #136077 from kannon92/sync-mutable-pod-mutable-scheduling-suspend-check 
sync check in batch stategy to match AllowMutableSchedulingDirectives and AllowMutablePodResources
 2026-01-14 01:11:42 +05:30
Kubernetes Prow Robot
b639540931 Merge pull request #135432 from pohly/apimachinery-featuregate-contextual-logging 
featuregate: contextual logging
 2026-01-14 01:11:35 +05:30
aviralgarg05
6264b559c9 Fix flaky TestApplyCRDuringCRDFinalization test 
This PR fixes the flaky TestApplyCRDuringCRDFinalization test that was failing
intermittently on slower systems (s390x architecture, race detector builds).

The root cause was a race condition where the test would attempt to apply a CR
immediately after requesting CRD deletion, without waiting for the CRD to
actually enter the terminating state. The fix explicitly waits for the CRD
to have the Terminating condition set to True before attempting the apply.
 2026-01-14 00:41:39 +05:30
Kubernetes Prow Robot
c6be052768 Merge pull request #129344 from pohly/log-client-go-apimachinery-network-util 
apimachinery: contextual logging in network util code
 2026-01-13 23:07:39 +05:30
Patrick Ohly
c16a07a8b1 featuregate: contextual logging 
This is primarily useful in unit tests and therefore supported by
featuregate/testing. Without this, all warnings are emitted to stderr, with no
connection to the test which caused the warning to be emitted.

When a single test fails, `go test` started by showing all warnings triggered by
any test, not just the failed test:

    I1121 18:50:28.112284  396950 feature_gate.go:466] feature gates: {map[DRADeviceTaintRules:true DRADeviceTaints:true]}
    ...
    I1121 18:50:29.704907  396950 feature_gate.go:466] feature gates: {map[DRADeviceTaintRules:false DRADeviceTaints:false]}
    --- FAIL: TestAll (1.58s)
        --- FAIL: TestAll/Eviction (0.02s)

This warning was actually slightly broken: it passed an atomic.Value to Infof,
not the map. This violates the "must not be copied after first use" rule
for atomic.Value (thus wasn't thread-safe) and printed the value in an awkward
way (extra {}).

Now it shows that the feature gates are modified inside TestAll (in this example):

    --- FAIL: TestAll (1.56s)
        feature_gate.go:170: I1124 17:31:27.245108] Updated featureGates={"DRADeviceTaintRules":true,"DRADeviceTaints":true}
        --- FAIL: TestAll/Eviction (0.02s)
            --- FAIL: TestAll/Eviction/initial (0.00s)
        ...

        feature_gate.go:170: I1124 17:31:28.821975] Updated featureGates={"DRADeviceTaintRules":false,"DRADeviceTaints":false}
    FAIL
    FAIL	k8s.io/kubernetes/pkg/controller/devicetainteviction	1.602s
 2026-01-13 18:20:59 +01:00
Kubernetes Prow Robot
c20e0bc541 Merge pull request #135958 from serathius/watchcache-store 
Move store to cacher subpackage.
 2026-01-13 21:41:40 +05:30
Patrick Ohly
588bba42c7 apimachinery: contextual logging in network util code 2026-01-13 16:55:36 +01:00
Kubernetes Prow Robot
58000ddd0e Merge pull request #136195 from HirazawaUi/upgrade-containerd-version 
Upgrade the COS version (upgrade containerd to version v2.1+)
 2026-01-13 19:39:38 +05:30
Sascha Grunert
1abe2c4860 Fix credential test by setting AlwaysVerify policy 
The test expects unauthorized pods to be blocked from accessing cached
private images, but the default policy (NeverVerifyPreloadedImages)
allows access to any image previously pulled by the kubelet.

Configure the kubelet to use AlwaysVerify policy for this test, which
enforces credential checks for all images regardless of pull history.

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
 2026-01-13 13:52:43 +01:00
Marek Siarkowicz
eb35b0a657 Add serathius as approver for apiserver storage 2026-01-13 13:22:05 +01:00
HirazawaUi
3164b73d28 upgrade containerd version to v2.1+ 2026-01-13 18:13:52 +08:00
Kubernetes Prow Robot
9f6977db54 Merge pull request #136086 from richabanker/graduate-watch_list_duration_seconds-BETA 
Graduate watch_list_duration_seconds to BETA
 2026-01-13 15:29:37 +05:30
Marin Atanasov Nikolov
73a0b5f08d code-generator/defaulter-gen: remove a leftover 2026-01-13 11:12:07 +02:00
Kubernetes Prow Robot
6b541e0b58 Merge pull request #135977 from pohly/test-parallel-fix 
make test: fix support for PARALLEL
 2026-01-13 09:51:41 +05:30
Kubernetes Prow Robot
e0464327ce Merge pull request #135770 from dnaeon/code-generator/defaulter-gen 
code-generator/defaulter-gen: generate defaults only if required tags are present
 2026-01-13 08:33:36 +05:30
Kubernetes Prow Robot
fa8340b207 Merge pull request #136117 from lalitc375/dv-strategy 
Add utilities to allow strategy.go files to enable DV native validations
 2026-01-13 07:43:43 +05:30
Kubernetes Prow Robot
d68d48073f Merge pull request #136112 from danwinship/network-1.36-cleanup 
Drop TopologyAwareHints and ServiceTraficDistribution feature gates
 2026-01-13 07:43:36 +05:30
Kubernetes Prow Robot
31cdb5de61 Merge pull request #136183 from aramase/aramase/i/fix_kms_test_136181 
test: fix kind local registry config for kms ci jobs
 2026-01-13 05:25:38 +05:30
Lalit Chauhan
42b8ceee21 Address feedbacks 2026-01-12 22:09:50 +00:00
Kubernetes Prow Robot
1c894014eb Merge pull request #136161 from dims/update-golang-x-deps-jan2026 
Update golang.org/x dependencies to latest versions
 2026-01-13 03:05:37 +05:30
Anish Ramasekar
900a8030f3 test: fix kind local registry config for kms ci jobs 
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
 2026-01-12 12:59:14 -08:00
Kubernetes Prow Robot
477b99a8d8 Merge pull request #135759 from Abhigyan-Shekhar/fix-cel-race-condition 
FIX: Deep copy MapType in CEL composition to prevent data race
 2026-01-13 02:15:08 +05:30
Kubernetes Prow Robot
f2143d70db Merge pull request #135597 from alvaroaleman/plumb-context 
Service account controller: Wire through context
 2026-01-13 02:15:00 +05:30
Kevin Hannon
986020d6bd sync check in batch stategy to match AllowMutableSchedulingDirectives and AllowMutablePodResources 2026-01-12 15:40:34 -05:00