Commit Graph

49698 Commits

Author SHA1 Message Date
HirazawaUi
2867be47b3 followup to allow special characters 2024-03-08 00:08:43 +08:00
Patrick Ohly
2e34e187c9 node authorizer: lock down access for NodeResourceSlice
The kubelet running on one node should not be allowed to access
NodeResourceSlice objects belonging to some other node, as defined by the
NodeResourceSlice.NodeName field.
2024-03-07 16:15:52 +01:00
Patrick Ohly
39bbcedbca dra api: add structured parameters
NodeResourceSlice will be used by kubelet to publish resource information on
behalf of DRA drivers on the node. NodeName and DriverName in
NodeResourceSlice must be immutable. This simplifies tracking the different
objects because what they are for cannot change after creation.

The new field in ResourceClass tells scheduler and autoscaler that they are
expected to handle allocation.

ResourceClaimParameters and ResourceClassParameters are new types for telling
in-tree components how to handle claims.
2024-03-07 16:15:31 +01:00
Patrick Ohly
eb1470d60d scheduler: fix assume cache with no index
The assume cache in the volumbinding plugin can be created with no separate
index, but List then failed because it tried to use the empty index name
instead of using the store's List function.
2024-03-07 16:09:44 +01:00
Sascha Grunert
51199deaa0 Decouple kubelet/cri/remote package from kubelet/metrics
Importing the `k8s.io/kubernetes/pkg/kubelet/metrics` package in the
remote runtime implementation makes it harder to separate the
functionalities at some later point in time. We now decouple both
packages by extending the CRI API services to allow a callback on
`GetContainerEvents`. This callback can be used to do additional work if
the connection got established, because `GetContainerEvents` will go
into blocking mode after that.

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
2024-03-07 11:46:06 +01:00
Stephen Kitt
6bf667af06 Switch from golang/mock to uber-go/mock
See https://github.com/golang/mock#gomock: golang/mock is no longer
maintained, and should be replaced by go.uber.org/mock.

This allows golang/mock to be dropped from the status and vendored
fields in unwanted-dependencies.json.

Signed-off-by: Stephen Kitt <skitt@redhat.com>
2024-03-07 09:12:16 +01:00
Kubernetes Prow Robot
2ec63e0d28 Merge pull request #123482 from sanposhiho/hpa-containerresource-graduation
graduate HPAContainerMetrics to stable
2024-03-06 17:37:36 -08:00
Kubernetes Prow Robot
05cb0a55c8 Merge pull request #123696 from aramase/aramase/f/kep_3331_v1beta1_api
Duplicate v1alpha1 AuthenticationConfiguration to v1beta1
2024-03-06 15:35:28 -08:00
Kubernetes Prow Robot
bd25605619 Merge pull request #123435 from tallclair/apparmor-ga
AppArmor fields API
2024-03-06 15:35:14 -08:00
Tim Allclair
2d86cbf261 Separate feature-gate for AppArmor fields 2024-03-06 10:46:32 -08:00
Tim Allclair
22068e0cc7 Validate annotation & field match in PodTemplate 2024-03-06 10:46:31 -08:00
Tim Allclair
06caf32ecd Validate localhost profile max length 2024-03-06 10:46:31 -08:00
Tim Allclair
0eb5f52d06 Rename AppArmor annotation constants with Deprecated 2024-03-06 10:46:31 -08:00
Sascha Grunert
38c5497e48 Sync cri-api approvers with kubelet cri package
We now move the SIG Node (and CRI) approvers to be able to approve
`pkg/kubelet/cri/remote` PRs.

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
2024-03-06 14:55:23 +01:00
Itamar Holder
f6e537d7a1 Avoid logging that swap cgroup controller is missing for every container
Signed-off-by: Itamar Holder <iholder@redhat.com>
2024-03-06 13:53:55 +02:00
John Mcgrath
edb0287cb1 DisableServiceLinks admission controller 2024-03-06 00:39:23 -06:00
Tim Hockin
ca0d2e27e6 Comment some manual conversions
Explain why seemingly-useless manual conversions are needed.  This is
deeply unfortunate, but better to document it than not.
2024-03-05 21:46:42 -08:00
Tim Hockin
c4ba1b990e Remove manual admissionregistration.Rule conversions 2024-03-05 21:46:30 -08:00
Tim Hockin
b4f14ce00b Remove manual Volume conversions 2024-03-05 21:45:02 -08:00
Tim Hockin
2f853b8eb8 Remove manual LoadBalancerStatus conversions
These are not needed.
2024-03-05 21:45:01 -08:00
Kubernetes Prow Robot
2b521e5f8e Merge pull request #123405 from cici37/vapGA
[KEP-3488]Promote ValidatingAdmissionPolicy to GA
2024-03-05 18:29:53 -08:00
Kubernetes Prow Robot
695072027d Merge pull request #123730 from pohly/dra-status-update-fix
dra api: fix status updates
2024-03-05 17:31:15 -08:00
Kubernetes Prow Robot
87f9b3891e Merge pull request #123385 from HirazawaUi/allow-special-characters
Allow almost all printable ASCII characters in environment variables
2024-03-05 17:31:06 -08:00
Kubernetes Prow Robot
5b4d97dc5a Merge pull request #122541 from aojea/headless_selector
Implement a field selector for ClusterIP on Services
2024-03-05 17:30:57 -08:00
Kubernetes Prow Robot
3686ceb5b8 Merge pull request #122745 from kannon92/swap-no-swap-default
[KEP-2400] add no swap as the default option for swap
2024-03-05 16:32:40 -08:00
cici37
5d83282823 Auto updates 2024-03-05 16:00:21 -08:00
cici37
de506ce7ac Promote ValidatingAdmissionPolicy to GA. 2024-03-05 16:00:21 -08:00
Kubernetes Prow Robot
df1eccae38 Merge pull request #123543 from jiahuif-forks/feature/validating-admission-policy/excluded-resources
ValidatingAdmissionPolicy: exclude brink-able resources.
2024-03-05 13:45:01 -08:00
Kubernetes Prow Robot
5f4a20e65d Merge pull request #120718 from gjkim42/add-restartable-init-containers-to-pod-resources-api
Make PodResources API include restartable init containers
2024-03-05 13:44:54 -08:00
Kevin Hannon
6a4e19a4ec add no swap as the default option for swap 2024-03-05 16:10:42 -05:00
Patrick Ohly
27df75c577 dra api: fix status updates
Changing object meta is not supposed to be possible via status updates. For
example, it circumvents RBAC permission checks.
2024-03-05 21:39:24 +01:00
Tim Allclair
ec325b328d Match annotations against pod AppArmor field 2024-03-05 12:22:50 -08:00
Tim Allclair
24537a9131 Stop appending AppArmor status to node ready condition 2024-03-05 12:22:50 -08:00
Tim Allclair
bf3c8464ba Implement Kubelet AppArmor field handling 2024-03-05 12:22:50 -08:00
Tim Allclair
289ec02e8b Implement version skew strategy 2024-03-05 12:22:50 -08:00
Tim Allclair
b7f620c12b Generated code 2024-03-05 12:22:50 -08:00
Tim Allclair
94927afb50 AppArmor API changes 2024-03-05 12:02:43 -08:00
Jiahui Feng
6b03166bed update to inject only the list of excluded resources. 2024-03-05 11:11:10 -08:00
Kubernetes Prow Robot
180c6bdc25 Merge pull request #122056 from dhenkel92/keep-pdb-condition
keep existing PDB conditions when updating status
2024-03-05 10:40:42 -08:00
MirrorShih
62f89972b6 Fix infinite loop and replace channel with queue 2024-03-05 17:32:11 +00:00
Michał Woźniak
e568a77a93 Support for the Job managedBy field (alpha) (#123273)
* support for the managed-by label in Job

* Use managedBy field instead of managed-by label

* Additional review remarks

* Review remarks 2

* review remarks 3

* Skip cleanup of finalizers for job with custom managedBy

* Drop the performance optimization

* imrpove logs
2024-03-05 09:25:15 -08:00
Kubernetes Prow Robot
a81411594a Merge pull request #123226 from ivanvc/add-suspend-to-jobs-table
printers: Add Job status to jobs table
2024-03-05 09:25:06 -08:00
Antonio Ojea
5122fe0732 don't watch headless services on kubelet
The kubelet watches services only to generate the environment variables
inside a pod, but headless services are not needed for this.

Change-Id: I22ee2b3352f8fe71cddfafa6f09b768c0a0e26b4
2024-03-05 17:16:48 +00:00
Antonio Ojea
0595ec7942 implement field selector for clusterIP on services
This will allow components that don't need to watch headless services
(heavily used on ai/ml workloads) to filter them server side.

Specially useful for kubelet and kube-proxy

Co-authored-by: Jianbo Ma <sakuranlbj@gmail.com>

Change-Id: I6434d2c8c77aaf725ec5c07acbcda14311f24bfa

Change-Id: Iba9e25afb90712facfb3dee25c500bbe08ef38fc
2024-03-05 17:16:42 +00:00
Anish Ramasekar
b502aa6f31 Duplicate v1alpha1 AuthenticationConfiguration to v1beta1
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2024-03-05 09:10:34 -08:00
Monis Khan
bc7aa13bf7 Mark StructuredAuthenticationConfiguration feature gate as beta
Signed-off-by: Monis Khan <mok@microsoft.com>
2024-03-05 11:34:30 -05:00
Kubernetes Prow Robot
bc00c9eef0 Merge pull request #123366 from kerthcet/feat/support-initcontainer
Consider initContainer images in pod scheduling
2024-03-05 08:24:30 -08:00
Kubernetes Prow Robot
13f40e9759 Merge pull request #123686 from kerthcet/fix/flaky-test-on-multi-profile
[Scheduler] Fix flaky test on multi profiles waitingPods
2024-03-05 04:41:09 -08:00
HirazawaUi
fa3c101439 relax validation pod envfrom 2024-03-05 17:09:15 +08:00
HirazawaUi
e56240b2e1 add validation method at the top level 2024-03-05 17:09:10 +08:00