WIP:OCPSTRAT-3618: Rebase 1.37 - #2738
Open
jacobsee wants to merge 3495 commits into
Open
Conversation
… events" This reverts commit 03c34ed. The additional informer event handling seems to have had a performance impact (kubernetes#140877). Let's try without this optional enhancement, the code should be correct also without it.
This commit modifies the following files: - pkg/apis/core/types.go - staging/src/k8s.io/api/core/v1/types.go Other changes were auto-generated by running `make update`. This commit only adds the field definition. The implementation will be provided in a follow-up commit. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
To verify: ``` dockerd-rootless-setuptool.sh install kubetest2-kind --build --up --down --test=ginkgo -- --use-built-binaries --focus-regex='\[Feature:KubeletInUserNamespace\]' ``` Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
The 'disabled' test case asserted that the drop in memory.available after reserving 32x2Mi hugepages should be less than expectedHugepageBytes - margin (64MiB - 50MiB = 14MiB). This threshold is too strict because the cgroup-based WorkingSet for the root cgroup already reflects some of the hugepage reservation: the kernel removes hugepages from the free pool, so MemFree drops and WorkingSet rises, causing AvailableBytes (= Limit - WorkingSet) to decrease naturally even without adjustForHugePages. In the failing run the natural drop was ~47MiB, exceeding the 14MiB threshold. Change the assertion to compare against expectedHugepageBytes (64MiB) instead of expectedHugepageBytes - margin. This still distinguishes the disabled case (drop < 64MiB, natural WorkingSet increase only) from the enabled case (drop >= 64MiB - 50MiB = 14MiB, adjustForHugePages subtracts full capacity). Introduced in df35523 ('Make the eviction signal hugepages aware.'). Signed-off-by: Lukasz Wojciechowski <l.wojciechow@partner.samsung.com>
…2e-fix Update hostname.exe in busybox image to support --fqdn on Windows
Pass clear pod group cycle state in podgroup preemption
…preparation DRA: Optional Node Operations
…netes#140759) * cli-runtime: include group in resource-not-found error message Signed-off-by: Abhishek Pareek <makeittotop@users.noreply.github.com> * cli-runtime: align resource-not-found error with helpers.go pattern Per review feedback on kubernetes#140759: use a switch covering group+version, group-only, version-only. Also drops the added unit test as requested. * cli-runtime: drop stray whitespace diff in builder_test.go Per review feedback on kubernetes#140759: revert the leftover blank-line changes from the removed test so this file has no unrelated diff. --------- Signed-off-by: Abhishek Pareek <makeittotop@users.noreply.github.com> Co-authored-by: Abhishek Pareek <makeittotop@users.noreply.github.com>
…troller-informer-cache-events-revert Revert "DRA ResourceClaim controller: updated mutation cache based on events"
Introduces the `DerivedAttributes` field to `ExactDeviceRequest` and `DeviceSubRequest`, along with the `DeviceDerivedAttribute` type, to support virtual CEL-derived attributes in DRA. Registers the `DRADerivedAttributes` feature gate.
…tion for derived attributes Introduces validation logic for DerivedAttributes, ensuring unique attribute names, properly formatted fully-qualified names, and correct API transitions via conversion. Also implements compile-time CEL checks to verify that derived attributes evaluate to primitive scalars (string, integer, boolean, semver) or lists of them.
- Implement CEL evaluation runtime for derived attributes, supporting primitive scalars, lists of scalars, and semantic version types. - Refactor cel.Cache to use a private getOrCompile helper that partitions the cache keyspace using 'selector' and 'derived' scopes. - Remove the unused Check method from the cel.Cache struct.
Plumb the DRADerivedAttributes feature gate to the scheduler and the experimental structured allocator, and implement runtime evaluation and request-scoped caching of CEL-derived virtual attributes. Specifically: - Update the `allocator` struct to maintain a request-scoped cache of evaluated derived attributes (`derivedAttributesCache`), preventing leakage or interference when different requests/subrequests define conflicting CEL expressions for the same virtual attribute name. - Implement unified attribute resolution in `lookupAttribute` that first resolves and caches derived attributes via CEL compilation and evaluation, falling back to static physical attributes on failure or absence. - Refactor the `constraint` interface (`add` and `remove` methods) to receive the full `requestData` context, enabling constraints to leverage the allocator's unified request-aware attribute lookup. - Plumb the `DRADerivedAttributes` feature gate through the scheduler's feature framework down to the allocator. - Add allocator test cases covering cross-request hardware alignment (e.g. mapping `numa` and `numaNode` to a virtual shared numa node), attribute shadowing/overriding, and CEL evaluation error handling.
…tributes [KEP-6080] (alpha) Add implementation of DRA Derived Attributes
Add compatibility groups to resource.k8s.io across v1, v1beta1, v1beta2 and the internal API: the driver-declared DeviceCounterConsumption.CompatibilityGroups field (an atomic list of opaque group names, declaratively unique) and the DeviceCompatibilityGroupsMaxSize constant bounding it. All compatibility-group validation is declarative, applied directly as recommended for net-new fields, with no handwritten counterparts. Also includes the DRADeviceCompatibilityGroups feature gate (registered in the versioned feature reference list), the apiserver drop strategy, and the apiserver-side tests: create/update strategy drop tests, declarative-validation coverage, and the max-size ResourceSlice test objects (the generated declarative rules and test fixtures land with the next commit; the integration wiring that enables the feature gate lands with the implementation commit).
Regenerate deepcopy, conversions, declarative validations, protobuf (.pb.go and .proto), swagger docs, openapi (generated code and published api/openapi-spec files), model names, client-go apply-configurations, the k8s.io/api serialization-compatibility fixtures, and the generated declarative-validation test fixtures for the new compatibility-groups field.
KEP-2033: promote KubeletInUserNamespace feature to beta (v1.37)
…d e2e tests Implement compatibility-group-aware allocation in the structured allocator (experimental, incubating, and stable channels) and the scheduler DRA plugin, and teach the resourceslice controller DroppedFieldsError.DisabledFeatures to report the DRADeviceCompatibilityGroups gate. Add allocator and controller unit tests, integration tests (core, scheduler_perf), and e2e tests including the feature-gate-cycle test. The compatibility-groups-taint-rollback regression test is by thc1006, who found the candidate-rollback gap in review and provided the test case. Co-authored-by: thc1006 <hctsai@linux.com>
…sybox 1.38.0-1 These Windows test images use busybox as their base image. Re-point their Windows BASEIMAGE entries at busybox:1.38.0-1 (which adds --fqdn support to hostname.exe) and bump each image version so the rebuilt images are published and consumed by e2e: agnhost 2.66.0 -> 2.66.1 nginx 1.27.0-1 -> 1.27.0-2 nginx-new 1.28.0-1 -> 1.28.0-2 glibc-dns-testing 2.1.0 -> 2.1.1
The gate-off skip derived its grouped-counter-set map eagerly over every device of every slice at each NewAllocator call, scanning AllocatedSharedDeviceIDs per device. At consumable-capacity scale this made every pod-scheduling attempt pay O(devices x shared allocations) even in clusters that use no compatibility groups at all, collapsing scheduling throughput (pull-kubernetes-scheduler-perf, ConsumableCapacity/full_1000nodes). Replace it with groupedCounterSetsForPool: computed lazily the first time the version-skew skip touches a pool and then cached, mirroring availableCounters. Pools whose devices never reach the skip - including every pool in a cluster without compatibility groups - never pay for the walk, and pools that do pay only for their own slices.
…ister gives no hint in batching
The set is produced from and probed with UniqueString counter-set names, so keep it in that domain instead of converting to plain strings on both sides: handle comparisons replace byte-string hashing, matching how the counter accounting already indexes by CounterSet directly.
…on on events Add PreQueueingHintFn that plugins implement to return targeted pod keys per event, narrowing which pods are evaluated on cluster events and avoiding thundering herd on the scheduling queue. The DRA plugin implements this for ResourceClaimTemplate-based workloads, falling back to evaluating all pods for deallocation or errors. Per-plugin narrowing ensures each plugin\047s QueueingHintFn is only called for pods that plugin\047s PreQueueingHintFn identified. Feature gate: SchedulerPreQueueingHints (beta, default=true) KEP: kubernetes/enhancements#6132
|
/test e2e-metal-ipi-ovn-ipv6 |
…e validation Upstream kubernetes#136886 migrated Secret.Type immutability validation to declarative validation, adding Origin and CoveredByDeclarative metadata to the field error. Update the expected errors in the OpenShift patch test to match. Signed-off-by: jubittajohn <jujohn@redhat.com>
…alidation Upstream 1.37 added declarative validation to ValidateSelfSubjectAccessReviewCreate, which requires a populated scheme and requestInfo in the context. The sibling subjectaccessreview/rest_test.go was updated but this OpenShift-carry test was missed. Signed-off-by: jubittajohn <jujohn@redhat.com>
…ted podcertificate test The mTLS server container runs under a Restricted security context (non-root with all capabilities dropped). In environments where Linux enforces net.ipv4.ip_unprivileged_port_start (default 1024), binding privileged port 443 fails with permission denied. Bump the container listen port to unprivileged port 8443 and configure the Service targetPort to 8443, retaining Service port 443 for callers.
…ting the test name The 1.37 test framework adds [Provider:gce,local] to the Flexvolumes test names. Update the GCE exclusion to match the provider-qualified names so the SSH-based tests remain skipped on OpenShift clusters without node SSH access. Signed-off-by: jubittajohn <jujohn@redhat.com>
jacobsee
force-pushed
the
rebase-1.37
branch
from
September 3, 2026 23:29
8bf47a1 to
836ca09
Compare
Member
Author
|
/pipeline required |
|
Scheduling required tests: Scheduling tests matching the |
Member
Author
|
/retest |
|
/test e2e-aws-ovn-serial-1of2 |
OVN-Kubernetes does not implement localhost nodeport proxying. The upstream tests added in 1.37 for [Feature:LocalhostNodePorts] fail on all -ovn CI lanes because nothing is listening on 127.0.0.1:<NodePort>. Skip them only on OVN-K so they can still run on kube-proxy iptables/nftables/cilium backends. Signed-off-by: jubittajohn <jujohn@redhat.com>
Member
Author
|
/retest |
1 similar comment
Member
Author
|
/retest |
|
/pipeline required |
|
Scheduling required tests: Scheduling tests matching the |
|
/retest-required |
|
@jacobsee: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
ehearne-redhat
added a commit
to ehearne-redhat/kubernetes
that referenced
this pull request
Sep 7, 2026
This change bumps otel to v1.44.0 across the kubernetes repo. It also updates transient dependencies where necessary. See https://pkg.go.dev/vuln/GO-2026-5158 for reference. Keeping this change in release-5.0 to respect 1.37 kube rebase to land in master and release-5.1. See openshift#2738 for reference. Also see kubernetes#139380 for reference. Since release-5.0 is pinned to kube 1.36, this change is necessary as only 1.37+ kubernetes will get this patch for free.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.