Commit graph

10673 commits

Author SHA1 Message Date
Kubernetes Prow Robot
a41a5c35d3
Merge pull request #135106 from bkhadars/enable-commentstart1
enable commentstart check on admissionregistration API group
2026-01-28 20:39:53 +05:30
Kubernetes Prow Robot
437184c055
Merge pull request #136292 from atombrella/feature/modernize_plusbuild
Remove obsolete `// +build` instruction.
2026-01-26 19:05:59 +05:30
amigo-nishant
b56c322f24 cleanup: improve darwin error messages 2026-01-23 09:30:07 +05:30
Kubernetes Prow Robot
b3f3cb88e8
Merge pull request #136419 from pacoxu/add-google-btree-unwanted
Add github.com/google/btree to unwanted dependencies
2026-01-22 19:17:28 +05:30
Paco Xu
be68191231 Add github.com/google/btree to unwanted dependencies
Mark github.com/google/btree as unwanted due to being unmaintained
and in archive mode. The module is currently referenced by:
- go.etcd.io/etcd/server/v3
- k8s.io/apiserver
2026-01-22 16:56:57 +08:00
Basheer
aecc4135cc enable commentstart check on admissionregistration API group 2026-01-22 10:05:23 +05:30
Kubernetes Prow Robot
69eb15ee58
Merge pull request #136362 from dims/update-opentelemetry-v1.39.0
Update OpenTelemetry dependencies to latest versions
2026-01-22 02:23:25 +05:30
Kubernetes Prow Robot
6010707b8a
Merge pull request #135470 from Ignoramuss/optionalorrequired-scheduling
api: add +required markers to scheduling API
2026-01-21 21:21:28 +05:30
Davanum Srinivas
c40ea60b9f
Update OpenTelemetry dependencies to latest versions
Core packages (opentelemetry-go):
- go.opentelemetry.io/otel: v1.38.0 → v1.39.0
- go.opentelemetry.io/otel/metric: v1.38.0 → v1.39.0
- go.opentelemetry.io/otel/trace: v1.38.0 → v1.39.0
- go.opentelemetry.io/otel/sdk: v1.38.0 → v1.39.0

Exporters:
- go.opentelemetry.io/otel/exporters/otlp/otlptrace: v1.34.0 → v1.39.0
- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc: v1.34.0 → v1.39.0

Contrib instrumentation (opentelemetry-go-contrib):
- go.opentelemetry.io/contrib/.../otelhttp: v0.61.0 → v0.64.0
- go.opentelemetry.io/contrib/.../otelrestful: v0.44.0 → v0.64.0

Protocol definitions (opentelemetry-proto-go):
- go.opentelemetry.io/proto/otlp: v1.5.0 → v1.9.0

Notable changes:
- Go 1.24 is now the minimum required version (Go 1.23 support dropped) for OTEL components
- Performance: ~4x improvement in histogram concurrent operations; xxhash
  replaces fnv for attribute hashing
- Fixed goroutine leak in span processors when context is canceled
- otelrestful migrated semantic conventions from v1.20.0 to v1.34.0
  (e.g., http.method → http.request.method)
- Partial OTLP export errors now surfaced instead of being silently dropped
- otelrestful no longer depends on json-iterator/go, modern-go/concurrent,
  or modern-go/reflect2; unwanted-dependencies.json updated accordingly

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2026-01-20 18:24:44 -05:00
Kubernetes Prow Robot
8f76dbf79b
Merge pull request #136227 from dims/update-grpc-ecosystem-deps-jan2026
Update gRPC ecosystem dependencies
2026-01-20 22:41:26 +05:30
Mads Jensen
f38fc5d064 Enforce plusbuild rule with golangci-lint 2026-01-19 20:27:56 +01:00
Davanum Srinivas
9dda58194a
Update agnhost to 2.61 and etcd to 3.6.7-0 in test manifests
Update outdated image versions across test manifests and add tracking
to build/dependencies.yaml for version drift detection via zeitgeist:

- agnhost: 2.32/2.53/2.54/2.57 → 2.61 (latest)
- etcd: 3.2.24 → 3.6.7-0
- kitten/nautilus BASEIMAGE: agnhost 2.57 → 2.61

and added etcd statefulset reference to existing etcd entry.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2026-01-18 20:39:57 -05:00
Kubernetes Prow Robot
57e68a76e3
Merge pull request #135842 from liyuerich/commentstartauthentication
enable commentstart check on authentication API group
2026-01-17 08:35:22 +05:30
Kubernetes Prow Robot
6817bea700
Merge pull request #136274 from pohly/e2e-ginkgo-forbidigo
golangci-lint: enforce control over ginkgo.ReportBeforeSuite/ReportAfterSuite
2026-01-17 02:31:31 +05:30
Patrick Ohly
e058fbdd99 golangci-lint: enforce control over ginkgo.ReportBeforeSuite/ReportAfterSuite
https://git.k8s.io/enhancements/keps/sig-testing/5468-invariant-testing
introduced a mechanism for tests which hook into the test suite run via
ginkgo.ReportAfterSuite. Usage was limited to code in test/e2e/invariants with
stricter reviews.

However, this was not enforced mechanically. With forbidigo we can be sure that
nothing slips through.

ginkgo.ReportBeforeSuite has similar restrictions.
2026-01-16 13:32:05 +01:00
Davanum Srinivas
f727e938dc
Update gRPC ecosystem dependencies
Update the gRPC ecosystem to pick up performance improvements,
bug fixes, and maintain compatibility with the latest protobuf
and OpenTelemetry releases.

Notable changes in grpc v1.78.0:
- mem.Reader interface changed to struct
- Legacy pick_first load balancer policy removed (pickfirstleaf)
- Improved connection state management

Updated dependencies:
- grpc-gateway/v2: v2.27.4 (2025-12-26)
- go-grpc-middleware/v2: v2.3.3 (2025-11-04)
- go-grpc-middleware/providers/prometheus: v1.1.0 (2025-06-16)
- google.golang.org/grpc: v1.78.0 (2025-12-23)
- genproto/googleapis/api: v0.0.0-20260112192933-99fd39fd28a9 (2026-01-12)
- genproto/googleapis/rpc: v0.0.0-20260112192933-99fd39fd28a9 (2026-01-12)

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2026-01-16 07:20:17 -05:00
Davanum Srinivas
5b478645cd
Update security and stability dependencies
This PR updates several dependencies addressing security vulnerabilities,
stability fixes, and authentication improvements.

- golang.org/x/crypto: v0.46.0 -> v0.47.0
  - Includes latest X509 root certificate bundle updates
  - Security hardening for cryptographic operations
  - Foundation dependency for TLS and authentication

- github.com/golang-jwt/jwt/v5: v5.2.2 -> v5.3.0
  - IMPORTANT: v5.2.2 patched vulnerability GHSA-mh63-6h87-95cp (token
    validation security issue) - this update ensures we have the fix
  - Adds multiple audience validation support for JWT tokens
  - Go 1.21 minimum requirement (code modernization)
  - Replaced legacy interface{} with modern any keyword

- golang.org/x/net: v0.48.0 -> v0.49.0
  - HTTP/2 priority scheduler improvements (RFC 9218)
  - WebSocket security enhancements
  - Network layer stability fixes

- go.uber.org/zap: v1.27.0 -> v1.27.1
  - Fix: Prevent Object from panicking on nils (PR #1501)
  - Fix: Race condition in WithLazy (PR #1511)
  - Both fixes improve logging stability in concurrent scenarios

- github.com/godbus/dbus/v5: v5.2.0 -> v5.2.2
  - Security: Disabled SHA1 authentication by default on non-Windows
    platforms (v5.2.0 change now inherited)
  - Performance: Multiple optimizations reducing memory allocations
  - Fix: Alignment issues in decoder operations
  - Fix: Allow more than 32 containers/struct fields in a signature

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2026-01-15 19:57:11 -05:00
Davanum Srinivas
050c786014
Update vendored dependencies: cadvisor, containerd, runtime-spec, selinux
Update the following vendored dependencies:

- github.com/google/cadvisor: v0.55.1 -> v0.56.0
- github.com/containerd/containerd/api: v1.9.0 -> v1.10.0
- github.com/opencontainers/runtime-spec: v1.2.1 -> v1.3.0
- github.com/opencontainers/selinux: v1.13.0 -> v1.13.1

cadvisor v0.56.0 changes:
- Add s390x (IBM Z/mainframe) CPU topology support with NumBooks and
  NumDrawers fields in MachineInfo
- Add new Prometheus metrics: machine_cpu_books and machine_cpu_drawers
- Add standard deviation (Std) field to Percentiles for resource statistics
- Add sysfs constants CPUBookID and CPUDrawerID for s390x topology detection

containerd/api v1.10.0 changes:
- Add ActiveMount message type for tracking mounts with timestamps
- Add ActivationInfo message for mount management and lifecycle tracking

runtime-spec v1.3.0 changes (from ChangeLog):
- Add FreeBSD platform support with new Spec.FreeBSD field
- Add netDevices object for moving network devices to container namespaces
- Add memoryPolicy object for NUMA memory policy configuration
- Add hwConfig object for VM-based containers (vcpus, memory, device-tree)
- Add iomems for hardware I/O memory page access in VMs
- Add intelRdt.schemata and intelRdt.enableMonitoring fields
- Change LinuxPids.Limit to pointer type for optional handling
- Clarify intelRdt configuration and pids cgroup settings

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2026-01-15 10:26:13 -05:00
Kubernetes Prow Robot
8b1496ac62
Merge pull request #136184 from yongruilin/master_dependenttag
feat(kube-api-linter): add dependenttags linter for k8s:unionMember
2026-01-15 11:09:45 +05:30
yongruilin
49be15534e feat: Enforce +k8s:optional on +k8s:unionMember fields via dependenttag linter 2026-01-14 20:08:59 +00:00
yongruilin
37e05b74c7 update sigs.k8s.io/kube-api-linter to latest 2026-01-14 20:02:30 +00:00
Kubernetes Prow Robot
b639540931
Merge pull request #135432 from pohly/apimachinery-featuregate-contextual-logging
featuregate: contextual logging
2026-01-14 01:11:35 +05:30
Patrick Ohly
c16a07a8b1 featuregate: contextual logging
This is primarily useful in unit tests and therefore supported by
featuregate/testing. Without this, all warnings are emitted to stderr, with no
connection to the test which caused the warning to be emitted.

When a single test fails, `go test` started by showing all warnings triggered by
any test, not just the failed test:

    I1121 18:50:28.112284  396950 feature_gate.go:466] feature gates: {map[DRADeviceTaintRules:true DRADeviceTaints:true]}
    ...
    I1121 18:50:29.704907  396950 feature_gate.go:466] feature gates: {map[DRADeviceTaintRules:false DRADeviceTaints:false]}
    --- FAIL: TestAll (1.58s)
        --- FAIL: TestAll/Eviction (0.02s)

This warning was actually slightly broken: it passed an atomic.Value to Infof,
not the map. This violates the "must not be copied after first use" rule
for atomic.Value (thus wasn't thread-safe) and printed the value in an awkward
way (extra {}).

Now it shows that the feature gates are modified inside TestAll (in this example):

    --- FAIL: TestAll (1.56s)
        feature_gate.go:170: I1124 17:31:27.245108] Updated featureGates={"DRADeviceTaintRules":true,"DRADeviceTaints":true}
        --- FAIL: TestAll/Eviction (0.02s)
            --- FAIL: TestAll/Eviction/initial (0.00s)
        ...

        feature_gate.go:170: I1124 17:31:28.821975] Updated featureGates={"DRADeviceTaintRules":false,"DRADeviceTaints":false}
    FAIL
    FAIL	k8s.io/kubernetes/pkg/controller/devicetainteviction	1.602s
2026-01-13 18:20:59 +01:00
Kubernetes Prow Robot
6b541e0b58
Merge pull request #135977 from pohly/test-parallel-fix
make test: fix support for PARALLEL
2026-01-13 09:51:41 +05:30
Ignoramuss
687eb7cf5d api: regenerate openapi and lint config for scheduling changes 2026-01-12 09:08:13 -08:00
Kubernetes Prow Robot
b9e2575a54
Merge pull request #135992 from bart0sh/PR212-migrate-remaining-kubelet-subdirs-to-contextual-logging
Migrate remaining kubelet subdirs to contextual logging
2026-01-12 19:58:41 +05:30
Ed Bartosh
0dc83930de logcheck: move all kubelet subdirs to contextual logging 2026-01-12 12:36:59 +02:00
Ed Bartosh
1c48267565 migrate pkg/kubelet/events to contextual logging 2026-01-12 12:36:59 +02:00
Ed Bartosh
597c20d050 migrate kubelet/stats to contextual logging 2026-01-12 12:36:59 +02:00
Ed Bartosh
152c2e5d1c migrate kubelet/images/pullmanager to contextual logging 2026-01-12 12:36:53 +02:00
Kubernetes Prow Robot
3ad5f1b8a9
Merge pull request #134681 from JoelSpeed/enable-kal-nonullable
Enable nonullable rule for Kube API Linter
2026-01-10 05:47:40 +05:30
Kubernetes Prow Robot
c71eec3c3f
Merge pull request #135687 from yashsingh74/cni-bump
Update CNI plugins to v1.9.0
2026-01-10 04:57:41 +05:30
Joel Speed
a64e802673
Enable nonullable rule for Kube API Linter 2026-01-09 10:38:15 +00:00
MohammedMutee
53d94b06b9 Fix flaky typecheck: enforce serial execution to prevent OOM 2026-01-09 10:40:43 +05:30
Kubernetes Prow Robot
26fd963327
Merge pull request #135664 from pohly/dra-upgrade-downgrade-refactor
DRA e2e: upgrade/downgrade refactor
2026-01-08 19:31:47 +05:30
Patrick Ohly
d17aaf5e29 e2e: suppress or ignore init log output
klog calls during init are becoming a problem because now test/e2e/framework
depends in test/utils/ktesting which bumps up the default verbosity during init
to make test output more complete when there is no argument parsing.

For cadvisor, an upstream fix is
needed (https://github.com/google/cadvisor/pull/3778). For kubectl we can make
it silently accept the valid (!) LC_ALL=C.
2026-01-07 14:11:33 +01:00
Ignoramuss
610ca77fc9 api: enable optionalorrequired linter for scheduling API
Enable the optionalorrequired linter rule and add exception patterns
for all other API groups except scheduling. This ensures the scheduling
API group is validated for proper +optional/+required markers.

Part of #134671
2026-01-06 16:24:47 -08:00
Matteo Fari
a1d638ea11
Enable nomaps rule for Kube API Linter (#134852)
* tested how many errors

* added exceptions

* added scoped exceptions per API group

* added struct.field specification

* improved regex match and included core and resources with the new struct.field format

* condensed exceptions using regex as requested

* fixed the scope kal nomaps exceptions to match existing fields
2026-01-06 23:59:39 +05:30
Kubernetes Prow Robot
4c5746c0bc
Merge pull request #134680 from JoelSpeed/enable-kal-integers
Enable integers rule for Kube API Linter
2026-01-06 22:39:39 +05:30
Patrick Ohly
e0514f6656 lint: don't ignore go vet printf
Our current code does not have any such issues related to printf and
we want to keep it that way.
2026-01-05 13:44:57 +01:00
liyuerich
dfef76d018 enable commentstart check on authentication API group
Signed-off-by: liyuerich <yue.li@daocloud.io>
2026-01-04 16:58:51 +08:00
Patrick Ohly
817e8cd898 make test: fix support for PARALLEL
There was an env variable PARALLEL and a -p command line flag,
but the value then wasn't passed on to "go test".

The new default is to not set any explicit parallelism, which
matches the prior (accidental?) behavior of ignoring PARALLEL.
2025-12-30 12:22:13 +01:00
Kubernetes Prow Robot
dd838ccf07
Merge pull request #135954 from pohly/hack-test-features-script-removal
hack: remove list-feature-tests.sh
2025-12-28 23:54:33 +05:30
Patrick Ohly
57b65a2509 hack: remove list-feature-tests.sh
The script is broken because it relies on grepping the source code.
This has always been fragile (currently it finds the search term
in comments) and stopped working years ago when changing how tests
are labeled.

Instead of fixing the script let's remove it because it's clearly unused.
2025-12-27 11:15:24 +01:00
Patrick Ohly
ad012f63f7 hack/verify-featuregates.sh: print failure information to stderr
Verify scripts are run such that stderr is captured and included in the JUnit
files. Stdout is not. Therefore the instructions in case of a failure where
only visible by searching the entire job log file, but not in the Prow summary.
2025-12-26 10:37:10 +01:00
Kubernetes Prow Robot
9bd81471eb
Merge pull request #135805 from humblec/etcd-3.6.7
etcd: Update etcd to v3.6.7
2025-12-22 16:28:39 -08:00
Davanum Srinivas
13f7fbd04c
Pin versions of dbus and otelgrpc to avoid breakage
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2025-12-20 15:03:27 -05:00
Joel Speed
b75c2ed9cc
Enable integers rule for Kube API Linter 2025-12-19 17:46:24 +00:00
Joel Speed
aa1dfd0ab8
Update NoTimestamp exceptions for qualified names 2025-12-19 14:57:24 +00:00
Joel Speed
456c13b409
Update Kube API Linter 2025-12-19 14:57:23 +00:00