Commit Graph

49433 Commits

Author SHA1 Message Date
Patrick Ohly
3de376ecf6 dra controller: support structured parameters
When allocation was done by the scheduler, the controller needs to do the
deallocation because there is no control-plane controller which could react to
"DeallocationRequested".
2024-03-07 22:22:13 +01:00
Patrick Ohly
6f1ddfcd2e kubelet: support structured parameters for preparing resources
If the resource handle has data from a structured parameter model, then we need
to pass that to the DRA driver kubelet plugin. Because Kubernetes uses
gogo/protobuf, we cannot use "optional" for that new optional field and have to
resort to "repeated" with a single repetition if present.

This is a new, backwards-compatible field.

That extending the resource.k8s.io changes the checksum of a kubelet checkpoint
is unfortunate. Updating the test cases is a stop-gap measure, the actual
solution will have to be something else before beta.
2024-03-07 22:22:13 +01:00
Patrick Ohly
d4d5ade7f5 dra: add "named resources" structured parameter model
Like the current device plugin interface, a DRA driver using this model
announces a list of resource instances. In contrast to device plugins, this
list is made available to the scheduler together with attributes that can be
used to select suitable instances when they are not all alike.

Because this is the first structured parameter model, some checks that
previously were not possible, in particular "is one structured parameter field
set", now gets enabled. Adding another structured parameter model will be
similar.

The applyconfigs code generator assumes that all types in an API are defined in
a single package. If it wasn't for that, it would be possible to place the
"named resources" types in separate packages, which makes their names in the Go
code more natural and provides an indication of their stability level because
the package name could include a version.
2024-03-07 22:21:16 +01:00
Patrick Ohly
096e948905 dra scheduler: support structured parameters
When a claim uses structured parameters, as indicated by the resource class
flag, the scheduler is responsible for allocating it. To do this it needs to
gather information about available node resources by watching
NodeResourceSlices and then match the in-tree claim parameters against those
resources.
2024-03-07 22:21:04 +01:00
Patrick Ohly
2e34e187c9 node authorizer: lock down access for NodeResourceSlice
The kubelet running on one node should not be allowed to access
NodeResourceSlice objects belonging to some other node, as defined by the
NodeResourceSlice.NodeName field.
2024-03-07 16:15:52 +01:00
Patrick Ohly
39bbcedbca dra api: add structured parameters
NodeResourceSlice will be used by kubelet to publish resource information on
behalf of DRA drivers on the node. NodeName and DriverName in
NodeResourceSlice must be immutable. This simplifies tracking the different
objects because what they are for cannot change after creation.

The new field in ResourceClass tells scheduler and autoscaler that they are
expected to handle allocation.

ResourceClaimParameters and ResourceClassParameters are new types for telling
in-tree components how to handle claims.
2024-03-07 16:15:31 +01:00
Patrick Ohly
eb1470d60d scheduler: fix assume cache with no index
The assume cache in the volumbinding plugin can be created with no separate
index, but List then failed because it tried to use the empty index name
instead of using the store's List function.
2024-03-07 16:09:44 +01:00
Kubernetes Prow Robot
2ec63e0d28 Merge pull request #123482 from sanposhiho/hpa-containerresource-graduation
graduate HPAContainerMetrics to stable
2024-03-06 17:37:36 -08:00
Kubernetes Prow Robot
05cb0a55c8 Merge pull request #123696 from aramase/aramase/f/kep_3331_v1beta1_api
Duplicate v1alpha1 AuthenticationConfiguration to v1beta1
2024-03-06 15:35:28 -08:00
Kubernetes Prow Robot
bd25605619 Merge pull request #123435 from tallclair/apparmor-ga
AppArmor fields API
2024-03-06 15:35:14 -08:00
Tim Allclair
2d86cbf261 Separate feature-gate for AppArmor fields 2024-03-06 10:46:32 -08:00
Tim Allclair
22068e0cc7 Validate annotation & field match in PodTemplate 2024-03-06 10:46:31 -08:00
Tim Allclair
06caf32ecd Validate localhost profile max length 2024-03-06 10:46:31 -08:00
Tim Allclair
0eb5f52d06 Rename AppArmor annotation constants with Deprecated 2024-03-06 10:46:31 -08:00
Kubernetes Prow Robot
2b521e5f8e Merge pull request #123405 from cici37/vapGA
[KEP-3488]Promote ValidatingAdmissionPolicy to GA
2024-03-05 18:29:53 -08:00
Kubernetes Prow Robot
695072027d Merge pull request #123730 from pohly/dra-status-update-fix
dra api: fix status updates
2024-03-05 17:31:15 -08:00
Kubernetes Prow Robot
87f9b3891e Merge pull request #123385 from HirazawaUi/allow-special-characters
Allow almost all printable ASCII characters in environment variables
2024-03-05 17:31:06 -08:00
Kubernetes Prow Robot
5b4d97dc5a Merge pull request #122541 from aojea/headless_selector
Implement a field selector for ClusterIP on Services
2024-03-05 17:30:57 -08:00
Kubernetes Prow Robot
3686ceb5b8 Merge pull request #122745 from kannon92/swap-no-swap-default
[KEP-2400] add no swap as the default option for swap
2024-03-05 16:32:40 -08:00
cici37
5d83282823 Auto updates 2024-03-05 16:00:21 -08:00
cici37
de506ce7ac Promote ValidatingAdmissionPolicy to GA. 2024-03-05 16:00:21 -08:00
Kubernetes Prow Robot
df1eccae38 Merge pull request #123543 from jiahuif-forks/feature/validating-admission-policy/excluded-resources
ValidatingAdmissionPolicy: exclude brink-able resources.
2024-03-05 13:45:01 -08:00
Kubernetes Prow Robot
5f4a20e65d Merge pull request #120718 from gjkim42/add-restartable-init-containers-to-pod-resources-api
Make PodResources API include restartable init containers
2024-03-05 13:44:54 -08:00
Kevin Hannon
6a4e19a4ec add no swap as the default option for swap 2024-03-05 16:10:42 -05:00
Patrick Ohly
27df75c577 dra api: fix status updates
Changing object meta is not supposed to be possible via status updates. For
example, it circumvents RBAC permission checks.
2024-03-05 21:39:24 +01:00
Tim Allclair
ec325b328d Match annotations against pod AppArmor field 2024-03-05 12:22:50 -08:00
Tim Allclair
24537a9131 Stop appending AppArmor status to node ready condition 2024-03-05 12:22:50 -08:00
Tim Allclair
bf3c8464ba Implement Kubelet AppArmor field handling 2024-03-05 12:22:50 -08:00
Tim Allclair
289ec02e8b Implement version skew strategy 2024-03-05 12:22:50 -08:00
Tim Allclair
b7f620c12b Generated code 2024-03-05 12:22:50 -08:00
Tim Allclair
94927afb50 AppArmor API changes 2024-03-05 12:02:43 -08:00
Jiahui Feng
6b03166bed update to inject only the list of excluded resources. 2024-03-05 11:11:10 -08:00
Kubernetes Prow Robot
180c6bdc25 Merge pull request #122056 from dhenkel92/keep-pdb-condition
keep existing PDB conditions when updating status
2024-03-05 10:40:42 -08:00
Michał Woźniak
e568a77a93 Support for the Job managedBy field (alpha) (#123273)
* support for the managed-by label in Job

* Use managedBy field instead of managed-by label

* Additional review remarks

* Review remarks 2

* review remarks 3

* Skip cleanup of finalizers for job with custom managedBy

* Drop the performance optimization

* imrpove logs
2024-03-05 09:25:15 -08:00
Kubernetes Prow Robot
a81411594a Merge pull request #123226 from ivanvc/add-suspend-to-jobs-table
printers: Add Job status to jobs table
2024-03-05 09:25:06 -08:00
Antonio Ojea
5122fe0732 don't watch headless services on kubelet
The kubelet watches services only to generate the environment variables
inside a pod, but headless services are not needed for this.

Change-Id: I22ee2b3352f8fe71cddfafa6f09b768c0a0e26b4
2024-03-05 17:16:48 +00:00
Antonio Ojea
0595ec7942 implement field selector for clusterIP on services
This will allow components that don't need to watch headless services
(heavily used on ai/ml workloads) to filter them server side.

Specially useful for kubelet and kube-proxy

Co-authored-by: Jianbo Ma <sakuranlbj@gmail.com>

Change-Id: I6434d2c8c77aaf725ec5c07acbcda14311f24bfa

Change-Id: Iba9e25afb90712facfb3dee25c500bbe08ef38fc
2024-03-05 17:16:42 +00:00
Anish Ramasekar
b502aa6f31 Duplicate v1alpha1 AuthenticationConfiguration to v1beta1
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2024-03-05 09:10:34 -08:00
Kubernetes Prow Robot
bc00c9eef0 Merge pull request #123366 from kerthcet/feat/support-initcontainer
Consider initContainer images in pod scheduling
2024-03-05 08:24:30 -08:00
Kubernetes Prow Robot
13f40e9759 Merge pull request #123686 from kerthcet/fix/flaky-test-on-multi-profile
[Scheduler] Fix flaky test on multi profiles waitingPods
2024-03-05 04:41:09 -08:00
HirazawaUi
fa3c101439 relax validation pod envfrom 2024-03-05 17:09:15 +08:00
HirazawaUi
e56240b2e1 add validation method at the top level 2024-03-05 17:09:10 +08:00
kerthcet
5b072a59a2 Fix flaky test on multi profiles waiting pod
Signed-off-by: kerthcet <kerthcet@gmail.com>
2024-03-05 14:54:33 +08:00
Kubernetes Prow Robot
dc3f5ec6cc Merge pull request #112957 from mxpv/log-dir
Allow changing pod log directory
2024-03-04 21:07:06 -08:00
Kubernetes Prow Robot
26600b17ab Merge pull request #123561 from enj/enj/i/validate_jwt_sa_iss
Prevent conflicts between service account and jwt issuers
2024-03-04 20:07:24 -08:00
Kubernetes Prow Robot
a76a3e031f Merge pull request #123487 from gauravkghildiyal/kep-4444
Introduce trafficDistribution field for Kubernetes Services
2024-03-04 20:07:15 -08:00
Kubernetes Prow Robot
229ebabc0a Merge pull request #123336 from HyunSu1768/hyunsu1768/use-switch-cases
Refactoring to encourage use of switch case
2024-03-04 20:07:06 -08:00
Kubernetes Prow Robot
699984f25a Merge pull request #123641 from liggitt/authz-config-beta-gate
Promote StructuredAuthorizationConfiguration feature gate to beta
2024-03-04 18:38:23 -08:00
Kubernetes Prow Robot
5b6d8a4293 Merge pull request #123532 from serathius/separate-rpc
Move cacher watch to separate rpc preventing starvation
2024-03-04 18:38:14 -08:00
Kubernetes Prow Robot
439f7df65b Merge pull request #122320 from armstrongli/master
allow service NodePort to be updated to 0 in case AllocateLoadBalance…
2024-03-04 18:38:05 -08:00