Commit Graph

20525 Commits

Author SHA1 Message Date
Lukasz Szaszkiewicz
3ecbb4dee0 apiserver/storage/cacher: decrease of running time of TestWaitUntilWatchCacheFreshAndForceAllEvents
The individual cases can be safely run in parallel.

Before
go test -race  -run TestWaitUntilWatchCacheFreshAndForceAllEvents
ok  	k8s.io/apiserver/pkg/storage/cacher	10.787s

After:
go test -race  -run TestWaitUntilWatchCacheFreshAndForceAllEvents
ok  	k8s.io/apiserver/pkg/storage/cacher	4.857s
2024-03-12 10:56:19 +01:00
Kubernetes Prow Robot
e062f925ae Merge pull request #123732 from serathius/parallel-featureflags
Fix SetFeatureGateDuringTest handling of Parallel tests
2024-03-11 13:32:48 -07:00
Marek Siarkowicz
9fcf279e2b Fix SetFeatureGateDuringTest handling of Parallel tests
Stop using defer as parallel subtest will might result in main test
finishing before subtest.

Fatal when same flag is set twice.
2024-03-11 20:08:52 +01:00
Kubernetes Prow Robot
57c89abb45 Merge pull request #123792 from mimowo/propose-api-comments-fix
Adjust the Job field API comments and validation to the current state
2024-03-11 11:26:04 -07:00
Kubernetes Prow Robot
8f80e01467 Merge pull request #123719 from enj/enj/f/authn_config_beta
Mark StructuredAuthenticationConfiguration feature gate as beta
2024-03-09 17:09:56 -08:00
Anish Ramasekar
62ac88b9ea Add metrics for authentication config reload
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2024-03-09 14:40:22 -08:00
Kubernetes Prow Robot
77ecfb7800 Merge pull request #123525 from enj/enj/f/authn_config_reload
Add dynamic reload support for authentication configuration
2024-03-09 14:13:37 -08:00
Monis Khan
b4935d910d Add dynamic reload support for authentication configuration
Signed-off-by: Monis Khan <mok@microsoft.com>
2024-03-09 14:29:33 -05:00
Akihiro Suda
d940886d0a api: KEP-3857: Recursive Read-only (RRO) mounts
This commit modifies the following files:

- pkg/apis/core/types.go
- staging/src/k8s.io/api/core/v1/types.go

Other changes were auto-generated by running `make update`.

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2024-03-09 09:48:12 +09:00
Kubernetes Prow Robot
28c4d00c7d Merge pull request #123344 from nilekhc/svm-controller
[Storage Version Migration] feat: implements Storage Version Migration
2024-03-08 13:45:16 -08:00
Nilekh Chaudhari
9161302e7f feat: implements svm controller
Signed-off-by: Nilekh Chaudhari <1626598+nilekhc@users.noreply.github.com>
2024-03-08 19:25:10 +00:00
Monis Khan
121607e809 Require email_verified to be used when email is set as username via CEL
Signed-off-by: Monis Khan <mok@microsoft.com>
2024-03-08 12:59:05 -05:00
Michal Wozniak
79fe37537c Adjust the validation to the current state 2024-03-08 17:43:24 +01:00
Michal Wozniak
1163c7ed9c Adjust the API comments to the current state 2024-03-08 17:29:49 +01:00
Nilekh Chaudhari
91a7708cdc feat: implements Storage Version Migration API in-tree
Signed-off-by: Nilekh Chaudhari <1626598+nilekhc@users.noreply.github.com>
2024-03-08 04:18:56 +00:00
Kubernetes Prow Robot
7ea3d0245a Merge pull request #123516 from pohly/dra-structured-parameters
DRA: structured parameters
2024-03-07 19:24:48 -08:00
Kubernetes Prow Robot
9ad2aabc64 Merge pull request #123520 from haircommander/proc-mount-rely-userns-2
KEP-4265: Update Unmasked ProcMountType to fail validation without a pod level user namespace
2024-03-07 18:21:08 -08:00
Kubernetes Prow Robot
364ef335db Merge pull request #123412 from tenzen-y/add-new-jobsuccesspolicy-api
Job: Support for the SuccessPolicy
2024-03-07 14:49:20 -08:00
Patrick Ohly
6a361e1f36 dra api: enable new CEL features by faking their version
There are two approaches for making new versioned CEL features available in the
release where they get introduced:
- Always use the environment for "StoredExpressions".
- Use an older version (typically 1.0) and only bump it up later.

The second approach was used before, so this is now also done here.
2024-03-07 22:26:20 +01:00
Patrick Ohly
0b6a0d686a dra api: rename NodeResourceSlice -> ResourceSlice
While currently those objects only get published by the kubelet for node-local
resources, this could change once we also support network-attached
resources. Dropping the "Node" prefix enables such a future extension.

The NodeName in ResourceSlice and StructuredResourceHandle then becomes
optional. The kubelet still needs to provide one and it must match its own node
name, otherwise it doesn't have permission to access ResourceSlice objects.
2024-03-07 22:22:55 +01:00
Patrick Ohly
42ee56f093 dra api: implement semver attribute value type
This adds support for semantic version comparison to the CEL support in the
"named resources" structured parameter model. For example, it can be used to
check that an instance supports a certain API level.

To minimize the risk, the new "semver" type is only defined in the CEL
environment for DRA expressions, not in the base library. See
https://github.com/kubernetes/kubernetes/pull/123664 for a PR which
adds it to the base library.

Validation of semver strings is done with the regular expression from
semver.org. The actual evaluation at runtime then uses semver/v4.
2024-03-07 22:22:13 +01:00
Patrick Ohly
d59676a545 dra kubelet: publish NodeResourceSlices
The information is received from the DRA driver plugin through a new gRPC
streaming interface. This is backwards compatible with old DRA driver kubelet
plugins, their gRPC server will return "not implemented" and that can be
handled by kubelet. Therefore no API break is needed.

However, DRA drivers need to be updated because the Go API changed. They can
return
    status.New(codes.Unimplemented, "no node resource support").Err()
if they don't support the new ListAndWatchResources method and
structured parameters.

The controller in kubelet then synchronizes this information from the driver
with NodeResourceSlice objects, creating, updating and deleting them as needed.
2024-03-07 22:22:13 +01:00
Patrick Ohly
6f1ddfcd2e kubelet: support structured parameters for preparing resources
If the resource handle has data from a structured parameter model, then we need
to pass that to the DRA driver kubelet plugin. Because Kubernetes uses
gogo/protobuf, we cannot use "optional" for that new optional field and have to
resort to "repeated" with a single repetition if present.

This is a new, backwards-compatible field.

That extending the resource.k8s.io changes the checksum of a kubelet checkpoint
is unfortunate. Updating the test cases is a stop-gap measure, the actual
solution will have to be something else before beta.
2024-03-07 22:22:13 +01:00
Patrick Ohly
d4d5ade7f5 dra: add "named resources" structured parameter model
Like the current device plugin interface, a DRA driver using this model
announces a list of resource instances. In contrast to device plugins, this
list is made available to the scheduler together with attributes that can be
used to select suitable instances when they are not all alike.

Because this is the first structured parameter model, some checks that
previously were not possible, in particular "is one structured parameter field
set", now gets enabled. Adding another structured parameter model will be
similar.

The applyconfigs code generator assumes that all types in an API are defined in
a single package. If it wasn't for that, it would be possible to place the
"named resources" types in separate packages, which makes their names in the Go
code more natural and provides an indication of their stability level because
the package name could include a version.
2024-03-07 22:21:16 +01:00
Patrick Ohly
096e948905 dra scheduler: support structured parameters
When a claim uses structured parameters, as indicated by the resource class
flag, the scheduler is responsible for allocating it. To do this it needs to
gather information about available node resources by watching
NodeResourceSlices and then match the in-tree claim parameters against those
resources.
2024-03-07 22:21:04 +01:00
Peter Hunt
1f9c271c8c PSA: update procmount tests to have hostUsers
Signed-off-by: Peter Hunt <pehunt@redhat.com>
2024-03-07 15:56:06 -05:00
Yuki Iwai
e216742672 Job: Support for the JobSuccessPolicy (alpha)
Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com>
2024-03-08 05:49:09 +09:00
Kubernetes Prow Robot
46f017a90b Merge pull request #123770 from Jefftree/go-restful
fix aggregator path filtering to include /
2024-03-07 10:21:53 -08:00
HirazawaUi
2867be47b3 followup to allow special characters 2024-03-08 00:08:43 +08:00
Patrick Ohly
39bbcedbca dra api: add structured parameters
NodeResourceSlice will be used by kubelet to publish resource information on
behalf of DRA drivers on the node. NodeName and DriverName in
NodeResourceSlice must be immutable. This simplifies tracking the different
objects because what they are for cannot change after creation.

The new field in ResourceClass tells scheduler and autoscaler that they are
expected to handle allocation.

ResourceClaimParameters and ResourceClassParameters are new types for telling
in-tree components how to handle claims.
2024-03-07 16:15:31 +01:00
cpanato
48daa91857 Update publishing-bot rules to Go 1.21.8
Signed-off-by: cpanato <ctadeu@gmail.com>
2024-03-07 06:32:51 -05:00
Kubernetes Prow Robot
a31a465405 Merge pull request #123735 from thockin/master
Don't embed plural exceptions in tools
2024-03-07 02:08:27 -08:00
Kubernetes Prow Robot
c726b2b3a3 Merge pull request #123431 from aramase/aramase/f/kep_3331_multiple_jwt_authenticator
Support multiple JWT authenticators with structured authn config
2024-03-06 17:37:29 -08:00
Kubernetes Prow Robot
05cb0a55c8 Merge pull request #123696 from aramase/aramase/f/kep_3331_v1beta1_api
Duplicate v1alpha1 AuthenticationConfiguration to v1beta1
2024-03-06 15:35:28 -08:00
Kubernetes Prow Robot
bd25605619 Merge pull request #123435 from tallclair/apparmor-ga
AppArmor fields API
2024-03-06 15:35:14 -08:00
Tim Hockin
df7f5fca27 Don't embed plural exceptions in tools 2024-03-06 14:57:46 -08:00
Anish Ramasekar
39e1c9108c Support multiple JWT authenticators with structured authn config
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2024-03-06 14:42:32 -08:00
Tim Allclair
0eb5f52d06 Rename AppArmor annotation constants with Deprecated 2024-03-06 10:46:31 -08:00
Jefftree
8373f3035a fix aggregator path filtering to include / 2024-03-06 13:33:33 -05:00
cpanato
70221e8405 [go] Bump images, dependencies and versions to go 1.22.1 and distroless iptables
Signed-off-by: cpanato <ctadeu@gmail.com>
2024-03-06 13:09:17 -05:00
Jordan Liggitt
c6673d2346 Bump github.com/golang/protobuf v1.5.4, google.golang.org/protobuf v1.33.0 2024-03-06 09:47:28 -05:00
Kubernetes Prow Robot
2b521e5f8e Merge pull request #123405 from cici37/vapGA
[KEP-3488]Promote ValidatingAdmissionPolicy to GA
2024-03-05 18:29:53 -08:00
Kubernetes Prow Robot
87f9b3891e Merge pull request #123385 from HirazawaUi/allow-special-characters
Allow almost all printable ASCII characters in environment variables
2024-03-05 17:31:06 -08:00
Kubernetes Prow Robot
3686ceb5b8 Merge pull request #122745 from kannon92/swap-no-swap-default
[KEP-2400] add no swap as the default option for swap
2024-03-05 16:32:40 -08:00
cici37
5d83282823 Auto updates 2024-03-05 16:00:21 -08:00
cici37
de506ce7ac Promote ValidatingAdmissionPolicy to GA. 2024-03-05 16:00:21 -08:00
Kubernetes Prow Robot
262399065d Merge pull request #123729 from seans3/streaming-owners
Adds OWNERS files to client-go streaming dirs
2024-03-05 14:46:02 -08:00
Kubernetes Prow Robot
751e3e9745 Merge pull request #123713 from aojea/missing_providerid
node-controller require providerID to initialize a node
2024-03-05 14:45:53 -08:00
Kubernetes Prow Robot
df1eccae38 Merge pull request #123543 from jiahuif-forks/feature/validating-admission-policy/excluded-resources
ValidatingAdmissionPolicy: exclude brink-able resources.
2024-03-05 13:45:01 -08:00
Kevin Hannon
6a4e19a4ec add no swap as the default option for swap 2024-03-05 16:10:42 -05:00