On platforms with many OS-visible NUMA nodes that carry no devices
(e.g. NVIDIA GB200 with 36 NUMA nodes, only 1–2 hosting GPUs),
IterateBitMasks enumerates O(2^n) combinations and stalls the
kubelet for minutes.
Introduce deviceNUMANodes(), which collects the NUMA node IDs from
all registered devices for a resource regardless of allocation state.
generateDeviceTopologyHints() now iterates only over those nodes,
reducing n from 34 to 1–2 on affected hardware.
This fix uses allDevices ensures minAffinitySize and Preferred flags
are computed identically for behavior-preserving, making safe for
backport.
deviceNUMANodes() has a explicit runtime subset guard to guarantee to
return a subset of cadvisor-reported NUMA topology, regardless what
device-plugins report.
Kubernetes-bug: https://github.com/kubernetes/kubernetes/issues/135541
Signed-off-by: Fan Zhang <fanzhang@nvidia.com>
go run k8s.io/publishing-bot/cmd/update-rules@latest -branch=release-1.36 --rules=./staging/publishing/rules.yaml -o ./staging/publishing/rules.yaml
then manually re-add the comments (TODO: make this tool preserve comments)
* Adds polling for HPA reconciliation_duration unit test
Signed-off-by: Omer Aplatony <omerap12@gmail.com>
* using struct name
Signed-off-by: Omer Aplatony <omerap12@gmail.com>
---------
Signed-off-by: Omer Aplatony <omerap12@gmail.com>
As it can be seen in build/pause/CHANGELOG.md the PATCH
level version for pause was introduced due to requirements
from the pause image for Windows. This however invalidated
our build/depedencies.yaml validation as it only accounted for
the MAJOR.MINOR version of pause (e.g. 3.10, not 3.10.1).
Enforce full SemVer validation for the pause image dependents.
The latest pause version is 3.10.2 but due to the introduction
of the PATCH level version to the pause image (previously was
only MAJOR.MINOR), various files have remained on an older
version. Either 3.10 or 3.10.1. Our validation with
build/dependencies.yaml ./hack/verify-external-dependencies.sh
did not account for that.
The Memory Manager Metrics BeforeEach asserts that zero pods are
running on the node after a kubelet config update. This hard assertion
flakes when a preceding serial test's namespace deletion hasn't
completed yet — framework namespace cleanup is async and the kubelet
restart in updateKubeletConfig can delay in-flight pod termination.
CI logs show leftover pods from MemoryQoS tests (memqos-burstable,
memqos-no-limit, etc.), Probe Stress tests (50-container pods), and
Summary API PSI tests (memory-pressure-pod), all still Running when
the assertion fires 4-7ms after the previous test finishes.
Replace the immediate Expect(count).To(BeZero()) with an Eventually
poll (2 minute timeout, 5 second interval) that gives pods time to
drain after the kubelet restart. The existing printAllPodsOnNode
diagnostic output is preserved inside the poll for debugging.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
This commit introduces the DRAResourceClaimGranularStatusAuthorization
feature gate (Beta in 1.36) to enforce fine-grained authorization checks
on ResourceClaim status updates.
Previously, 'update' permission on 'resourceclaims/status' allowed modifying
the entire status. To enforce the principle of least privilege for DRA
drivers and the scheduler, this change introduces synthetic subresources and
verb prefixes:
- 'resourceclaims/binding': Required to update 'status.allocation' and
'status.reservedFor'.
- 'resourceclaims/driver': Required to update 'status.devices'. Evaluated
on a per-driver basis using 'associated-node:<verb>' (for node-local
ServiceAccounts) or 'arbitrary-node:<verb>' (for cluster-wide controllers).
