go run k8s.io/publishing-bot/cmd/update-rules@latest -branch=release-1.36 --rules=./staging/publishing/rules.yaml -o ./staging/publishing/rules.yaml
then manually re-add the comments (TODO: make this tool preserve comments)
The latest pause version is 3.10.2 but due to the introduction
of the PATCH level version to the pause image (previously was
only MAJOR.MINOR), various files have remained on an older
version. Either 3.10 or 3.10.1. Our validation with
build/dependencies.yaml ./hack/verify-external-dependencies.sh
did not account for that.
This commit introduces the DRAResourceClaimGranularStatusAuthorization
feature gate (Beta in 1.36) to enforce fine-grained authorization checks
on ResourceClaim status updates.
Previously, 'update' permission on 'resourceclaims/status' allowed modifying
the entire status. To enforce the principle of least privilege for DRA
drivers and the scheduler, this change introduces synthetic subresources and
verb prefixes:
- 'resourceclaims/binding': Required to update 'status.allocation' and
'status.reservedFor'.
- 'resourceclaims/driver': Required to update 'status.devices'. Evaluated
on a per-driver basis using 'associated-node:<verb>' (for node-local
ServiceAccounts) or 'arbitrary-node:<verb>' (for cluster-wide controllers).
gRPC defaults to the DNS resolver for bare targets passed to
NewClient. For CRI socket endpoints, GetAddressAndDialer returns a
socket path plus a custom dialer, but handing the bare path to
grpc.NewClient still lets gRPC resolve the target first.
That breaks unix socket clients with errors like "name resolver error:
produced zero addresses" before the custom dialer ever sees the raw
path. Use the passthrough resolver for socket-style addresses so the
runtime and image clients hand the original endpoint directly to the
custom dialer.
Add a regression test for unix sockets, Windows named pipes, and TCP
addresses.
Precedent:
https://github.com/etcd-io/etcd/blob/v3.3.27/clientv3/client.go#L266-L270https://github.com/grpc/grpc-go/blob/v1.72.2/dialoptions.go#L448-L451
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
Replace plain bool with sync/atomic.Bool for the useStreaming field
in remoteRuntimeService and remoteImageService to eliminate a data
race when multiple goroutines concurrently read/write the field
during Unimplemented fallback.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Introduce the ResourcePoolStatusRequest resource type in the
resource.k8s.io/v1alpha3 API group, gated behind the
DRAResourcePoolStatus feature gate. This includes external and internal
type definitions, protobuf/OpenAPI generated code, client-go typed
clients, informers, listers, apply configurations, deepcopy, defaults,
conversion, fuzzer, declarative validation tags, and API discovery
metadata.
* Add etcd_bookmark_total counter metric and deprecate etcd_bookmark_counts
* Update docs using scripts
* Add test for etcd_bookmark_total and run gofmt
* gofmt
