Commit graph

134908 commits

Author SHA1 Message Date
ShaanveerS
d800e7e052 test/images: bump agnhost to v2.61 2026-01-18 12:57:37 +01:00
Kubernetes Prow Robot
1c9180cd45
Merge pull request #136081 from lalitc375/dv-native
Dv native support in the validation-gen framework,
2026-01-18 12:11:09 +05:30
Kubernetes Prow Robot
9bfe52e1fe
Merge pull request #136191 from saschagrunert/psi-memory-pressure-test
Skip memory pressure PSI test for CRI-O
2026-01-17 09:27:15 +05:30
Kubernetes Prow Robot
57e68a76e3
Merge pull request #135842 from liyuerich/commentstartauthentication
enable commentstart check on authentication API group
2026-01-17 08:35:22 +05:30
Kubernetes Prow Robot
751ab64d57
Merge pull request #135837 from dgrisonnet/increase-resource-limits
test/e2e: fix pod resize test flakes on CRI-O/runc environments
2026-01-17 08:35:15 +05:30
Kubernetes Prow Robot
e869f3c0d0
Merge pull request #136180 from bart0sh/PR215-migrate-kubelet_pods-to-contextual-logging
migrate kubelet_pods* to contextual logging
2026-01-17 06:59:22 +05:30
Kubernetes Prow Robot
a966be1a07
Merge pull request #136026 from KyungHwanKim-devs/fix-goroutine-leak-kubelet-pluginmanager
Fix potential goroutine leak in kubelet operation_executor_test
2026-01-17 06:59:15 +05:30
Kubernetes Prow Robot
6817bea700
Merge pull request #136274 from pohly/e2e-ginkgo-forbidigo
golangci-lint: enforce control over ginkgo.ReportBeforeSuite/ReportAfterSuite
2026-01-17 02:31:31 +05:30
Kubernetes Prow Robot
6414ab0e3d
Merge pull request #136229 from thc1006/fix/issue-136027-apiserver-error-verbosity
fix(apiserver): convert V().Error() to V().Info()
2026-01-17 02:31:24 +05:30
Kubernetes Prow Robot
49f5ecc02c
Merge pull request #135874 from mochizuki875/make_general_profile_default
kubectl debug: make general profile default
2026-01-17 02:31:16 +05:30
Kubernetes Prow Robot
ae76dd831d
Merge pull request #136168 from bart0sh/PR214-DRA-kubelet-OWNERS-update
Add pohly and bart0sh as approvers for kubelet/cm/dra
2026-01-17 01:33:24 +05:30
Kubernetes Prow Robot
9bbfe74def
Merge pull request #135744 from ali-a-a/describe-service-app-protocol
Add appProtocol to the service describe output
2026-01-17 01:33:17 +05:30
Kubernetes Prow Robot
8de4a11252
Merge pull request #136156 from pohly/dra-upgrade-downgrade-refactor-2
DRA: upgrade/downgrade refactor, II
2026-01-16 23:31:15 +05:30
Kubernetes Prow Robot
e86e7123c1
Merge pull request #136278 from AutuSnow/fix/kubelet/WaitForAllPodsUnmount
fix(kubelet):resolve loop variable capture bug in WaitForAllPodsUnmount
2026-01-16 22:21:17 +05:30
Keita Mochizuki
211e77a996
Update staging/src/k8s.io/kubectl/pkg/cmd/debug/debug.go
Co-authored-by: Maciej Szulik <soltysh@gmail.com>
2026-01-16 23:45:12 +09:00
qiuxue
aeb9002d14 fix(kubelet):resolve loop variable capture bug in WaitForAllPodsUnmount 2026-01-16 22:37:50 +08:00
Kubernetes Prow Robot
08764697f4
Merge pull request #135381 from kannon92/mutable-pod-replacement-policy
[KEP-5440]: Add integration test for MutablePodResourcesForSuspendedJobs with Pod Replacement Policy = Failed
2026-01-16 19:29:16 +05:30
Patrick Ohly
e058fbdd99 golangci-lint: enforce control over ginkgo.ReportBeforeSuite/ReportAfterSuite
https://git.k8s.io/enhancements/keps/sig-testing/5468-invariant-testing
introduced a mechanism for tests which hook into the test suite run via
ginkgo.ReportAfterSuite. Usage was limited to code in test/e2e/invariants with
stricter reviews.

However, this was not enforced mechanically. With forbidigo we can be sure that
nothing slips through.

ginkgo.ReportBeforeSuite has similar restrictions.
2026-01-16 13:32:05 +01:00
Kubernetes Prow Robot
f4ed7b3e28
Merge pull request #135951 from droach282/cronjob-schedule-dv
Adding declarative validations to CronJob Schedule field
2026-01-16 17:18:49 +05:30
Kubernetes Prow Robot
a94970c0c5
Merge pull request #136212 from dims/update-security-deps-jan2026-v2
Update security and stability dependencies
2026-01-16 15:38:41 +05:30
Sascha Grunert
19e1f9cce2
Skip memory pressure PSI test for CRI-O
Skip the memory pressure PSI test when running with CRI-O until automatic
memory.high configuration is available in the runtime. The test fails on
Fedora CoreOS due to different page cache reclaim behavior, and CRI-O is
implementing a fix to automatically set memory.high to 95% of memory.max
for cgroup v2 containers.

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
2026-01-16 09:03:01 +01:00
Patrick Ohly
1847d5b1a2 DRA e2e+integration: test ResourceSlice controller
The "create 100 slices" E2E sometimes flaked with timeouts (e.g. 95 out of 100
slices created). It created too much load for an E2E test.

The same test now uses ktesting as API, which makes it possible to run it as
integration test with the original 100 slices and with more moderate 10 slices
as E2E test.

(cherry picked from commit c47ad64820)
2026-01-16 08:10:37 +01:00
Patrick Ohly
11dcfc6c15 ktesting: replace Begin/End with TContext.Step
Manually pairing Being with End is too error prone to be useful. It had the
advantage of keeping variables created between them visible to the following
code, but that doesn't justify using those calls.

By using a callback we can achieve a few things:

- Code using it automatically shadows the parent tCtx, thus enforcing
  that within a code block the tCtx with step is used consistently.
- The code block is clearly delineated with curly braces.
- When the code block ends, the unmodified parent tCtx is automatically
  in scope again.

Downsides:

- Extra boilerplate for the anonymous function.
  Python's `with tCtx.Step(...) as tCtx: ` would be nicer.
  As an approximation of that `for tCtx := range tCtx.Step(...)` was
  tried with `Step` returning an iterator, but that wasn't very idiomatic.
- Variables created inside the code block are not visible outside of it.

(cherry picked from commit 047682908d)
2026-01-16 08:10:36 +01:00
Patrick Ohly
d44d0281eb DRA upgrade/downgrade: rewrite as Go unit test
tCtx.Run and sub-tests make it much simpler to separate the different steps
than with Ginkgo because unless a test runs tCtx.Parallel (which we don't do
here), everything runs sequentially in a deterministic order.

Right now we get:

    ...
        localupcluster.go:285: I1210 12:24:22.067524] bring up v1.34: stopping kubelet
        localupcluster.go:285: I1210 12:24:22.067548] bring up v1.34: stopping kube-scheduler
        localupcluster.go:285: I1210 12:24:22.067570] bring up v1.34: stopping kube-controller-manager
        localupcluster.go:285: I1210 12:24:22.067589] bring up v1.34: stopping kube-apiserver
    --- PASS: TestUpgradeDowngrade (94.78s)
        --- PASS: TestUpgradeDowngrade/after-cluster-creation (2.07s)
            --- PASS: TestUpgradeDowngrade/after-cluster-creation/core_DRA (2.05s)
            --- PASS: TestUpgradeDowngrade/after-cluster-creation/ResourceClaim_device_status (0.02s)
        --- PASS: TestUpgradeDowngrade/after-cluster-upgrade (4.10s)
            --- PASS: TestUpgradeDowngrade/after-cluster-upgrade/core_DRA (4.09s)
            --- PASS: TestUpgradeDowngrade/after-cluster-upgrade/ResourceClaim_device_status (0.01s)
        --- PASS: TestUpgradeDowngrade/after-cluster-downgrade (1.24s)
            --- PASS: TestUpgradeDowngrade/after-cluster-downgrade/core_DRA (1.21s)
            --- PASS: TestUpgradeDowngrade/after-cluster-downgrade/ResourceClaim_device_status (0.02s)
    PASS

It's even possible to use `-failfast` and
e.g. `-run=TestUpgradeDowngrade/after-cluster-creation/core_DRA`: `go test` then
runs everything up to that sub-test or any failing sub-test, then stops and
cleans up.

(cherry picked from commit de47714879)
2026-01-16 07:54:51 +01:00
Patrick Ohly
06d52b7702 CSI: revert introduction of context with cancellation
The traditional behavior of PodIO was to ignore the context. Changing that to
use the canceled context was risky because maybe some cleanup operation after
cancellation of the context wouldn't run anymore when it previously did.

However, this is theoretical. Tests all seemed to pass fine even without this
change.
2026-01-16 07:53:00 +01:00
Patrick Ohly
4a3d822689 DRA e2e: make driver deployment possible in Go unit tests
This leverages ktesting as wrapper around Ginkgo and testing.T to make all
helper code that is needed to deploy a DRA driver available to Go unit
tests and thus integration tests.

How to proceed with unifying helper code for integration and E2E testing is
open. This is just a minimal first step in that direction. Ideally, such
code should be in separate packages where usage of Ginkgo, e2e/framework
and gomega.Expect/Eventually/Consistently are forbidden.

While at it, the builder gets extended to make cleanup optional.
This will be needed for upgrade/downgrade testing with sub-tests.

(cherry picked from commit 7c7b1e1018)
2026-01-16 07:53:00 +01:00
Patrick Ohly
db36339d03 e2e framework: avoid memory overhead of ginkgo.GinkgoT
It turned out that ginkgo.GinkgoT() wasn't as cheap as it should have been (fix
coming in Ginkgo 2.27.5). When instantiated once for each framework.Framework
instance during init by all workers at the same time, the resulting spike in
overall memory usage within the container caused OOM killing of workers in Prow
jobs like ci-kubernetes-e2e-gci-gce with very tight memory limits.

Even with the upcoming fix in Ginkgo it makes sense to set the TB field only
while it really is needed, i.e. while a test runs. This is conceptually similar
to setting and unsetting the test namespace. It may help to flush out incorrect
usage of TB outside of tests.
2026-01-16 07:53:00 +01:00
Patrick Ohly
0d64cbff49 e2e framework: support creating TContext
This makes it possible to call helper packages which expect a TContext from E2E
tests.

The implementation uses GinkgoT as TB and supports registering cleanup
callbacks which expect a context. These callbacks then run with a context that
comes from ginkgo.DeferCleanup, just as if they had called that directly.

(cherry picked from commit 47b613eded)
2026-01-16 07:53:00 +01:00
Patrick Ohly
4864f45cc3 DRA upgrade/downgrade: split out individual test steps
This approach with collecting results from callbacks in a main ginkgo.It and
using them as failures in separate ginkgo.It callbacks might be the best that
can be done with Ginkgo.

A better solution is probably Go unit tests with sub-tests.

(cherry picked from commit 65ef31973c)
2026-01-16 07:52:55 +01:00
Patrick Ohly
7421eea877 ktesting: install signal handler on demand
The ktesting package is meant to be usable in E2E suites and then must not
affect signal handling in Ginkgo.
2026-01-16 07:51:29 +01:00
Kubernetes Prow Robot
81383b249f
Merge pull request #135164 from helayoty/helayoty/workload-declarative-validation
KEP-4671: Add Declarative Validation to Workload API
2026-01-16 12:13:11 +05:30
Kubernetes Prow Robot
1d45fecf9a
Merge pull request #135685 from chaochn47/master-fix-audit-log
Bugfix: calculate request latency properly in audit log filter
2026-01-16 09:25:12 +05:30
Kubernetes Prow Robot
e777bba0b2
Merge pull request #136243 from dims/mounttest-tmpfs-detection
Add tmpfs detection to mounttest and unit tests
2026-01-16 07:07:11 +05:30
Davanum Srinivas
5b478645cd
Update security and stability dependencies
This PR updates several dependencies addressing security vulnerabilities,
stability fixes, and authentication improvements.

- golang.org/x/crypto: v0.46.0 -> v0.47.0
  - Includes latest X509 root certificate bundle updates
  - Security hardening for cryptographic operations
  - Foundation dependency for TLS and authentication

- github.com/golang-jwt/jwt/v5: v5.2.2 -> v5.3.0
  - IMPORTANT: v5.2.2 patched vulnerability GHSA-mh63-6h87-95cp (token
    validation security issue) - this update ensures we have the fix
  - Adds multiple audience validation support for JWT tokens
  - Go 1.21 minimum requirement (code modernization)
  - Replaced legacy interface{} with modern any keyword

- golang.org/x/net: v0.48.0 -> v0.49.0
  - HTTP/2 priority scheduler improvements (RFC 9218)
  - WebSocket security enhancements
  - Network layer stability fixes

- go.uber.org/zap: v1.27.0 -> v1.27.1
  - Fix: Prevent Object from panicking on nils (PR #1501)
  - Fix: Race condition in WithLazy (PR #1511)
  - Both fixes improve logging stability in concurrent scenarios

- github.com/godbus/dbus/v5: v5.2.0 -> v5.2.2
  - Security: Disabled SHA1 authentication by default on non-Windows
    platforms (v5.2.0 change now inherited)
  - Performance: Multiple optimizations reducing memory allocations
  - Fix: Alignment issues in decoder operations
  - Fix: Allow more than 32 containers/struct fields in a signature

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2026-01-15 19:57:11 -05:00
Kubernetes Prow Robot
c6ba23521c
Merge pull request #136257 from BenTheElder/go125.6
upgrade core binaries to go to 1.25.6 for CVE fixes
2026-01-16 05:53:11 +05:30
Kubernetes Prow Robot
a9af774b23
Merge pull request #136259 from BenTheElder/rip-logicalhan
emeritus logicalhan, rest in peace
2026-01-16 05:01:27 +05:30
Kubernetes Prow Robot
7de6160456
Merge pull request #136253 from lalitc375/testing-utils
Make sure errors present in declarative validation test files are DV …
2026-01-16 05:01:19 +05:30
Kubernetes Prow Robot
b82b03b924
Merge pull request #136008 from michaelasp/atomicResync
Add atomic resync operation for real fifo
2026-01-16 05:01:11 +05:30
Heba Elayoty
5d7208e48f
Add udpate and immutable tags on Workload API
Co-Author: Lalit Chauhan <lalitc375@gmail.com>

Signed-off-by: Heba Elayoty <heelayot@microsoft.com>
2026-01-15 14:26:40 -08:00
Chao Chen
f82471dee9 Bugfix: calculate request latency properly in audit log filter
Signed-off-by: Chao Chen <chaochn@amazon.com>
2026-01-15 22:07:25 +00:00
Kubernetes Prow Robot
f4f3e5f92c
Merge pull request #136247 from MikeZappa87/mzappa/deletedeadcode
Delete mistakenly added file
2026-01-16 03:05:13 +05:30
Michael Aspinwall
6fbaebc054 Add atomic resync and remove usage of store in FIFO 2026-01-15 21:18:25 +00:00
Dan Roach
5b5cc2d498 Adding declarative validations to CronJob 2026-01-15 14:05:15 -07:00
Lalit Chauhan
6e54b85d23 Remove non existent tags 2026-01-15 21:04:06 +00:00
Benjamin Elder
4c37109787 clone dep-approvers list to dep-reviewers to avoid warning about empty alias
we could remove the alias everywhere instead, but that's higher-churn, and the distinction may be useful in the future with onboarding new reviewer => approvers
2026-01-15 12:19:49 -08:00
Benjamin Elder
a60d114402 emeritus logicalhan, rest in peace
https://github.com/cncf/memorials/blob/main/han-kang.md
2026-01-15 12:18:02 -08:00
Benjamin Elder
9e27ee8042 bump go to 1.25.6 for CVE fixes 2026-01-15 11:25:15 -08:00
Kubernetes Prow Robot
fd41228d1a
Merge pull request #136246 from dims/update-vendor-deps-cadvisor-containerd-oci
Update vendored dependencies: cadvisor, containerd, runtime-spec, selinux
2026-01-15 23:53:38 +05:30
Lalit Chauhan
c3fecccd3e Make sure errors present in declarative validation test files are DV errors 2026-01-15 17:42:02 +00:00
Kubernetes Prow Robot
1dde6f3475
Merge pull request #135584 from pohly/dra-upgrade-downgrade-tests
DRA testing: upgrade/downgrade preparation for 1.35
2026-01-15 22:41:40 +05:30