Support Dev Containers / Github Codespaces #120551

discussion: kubernetes#121118 (comment)

Add a test case of create with rv set. Signed-off-by: Siyuan Zhang <sizhang@google.com>

Signed-off-by: bzsuni <bingzhe.sun@daocloud.io>

as that seems more in line with the intention of these files Signed-off-by: Peter Hunt <pehunt@redhat.com>

Signed-off-by: Harshal Patil <harpatil@redhat.com> Co-authored-by: Ed Bartosh <eduard.bartosh@intel.com>

Signed-off-by: Liang Deng <283304489@qq.com>

Signed-off-by: Davanum Srinivas <davanum@gmail.com>

Signed-off-by: Dave Chen <dave.chen@arm.com>

Signed-off-by: Dr. Stefan Schimanski <stefan.schimanski@gmail.com>

Signed-off-by: bzsuni <bingzhe.sun@daocloud.io>

Should be "elliptic".

Will be used by changes for image pull per runtime class in KEP 4216 Signed-off-by: kiashok <kiashok@microsoft.com>

Signed-off-by: kiashok <kiashok@microsoft.com>

Signed-off-by: Siyuan Zhang <sizhang@google.com>

… ignorePreflightErrors"

…ability

…ctly

Signed-off-by: Nabarun Pal <pal.nabarun95@gmail.com>

GetFileType is meant to return the type of the given file by using os.Stat. However, os.Stat doesn't work on Windows for Unix Sockets, causing an error to occur: [2-Socket Test] unexpected error : CreateFile C:\Users\Administrator\AppData\Local\Temp\test-get-filetype-2776877299\mt.sock: The file cannot be accessed by the system. This is a known issue and we're already using a workaround for this in pkg/kubelet/util/util_windows.go. This commit fixes this issue for GetFileType on Windows.

This deals with the case that a user can configure cri-o to use /run/crio/crio.sock and get very confusing behavior. See cri-o/cri-o#7010 (comment)

This was created as alpha (off by default) but should probably have used the "Deprecated" setting. Changing it now makes it on by default and still disable-able.

… a missing secret

…119917) * Job: Handle error returned from AddEventHandler function Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com> * Use the error message the similar to CronJob Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com> * Clean up error messages Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com> * Put the tesing.T on the second place in the args for the newControllerFromClient function Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com> * Put the testing.T on the second place in the args for the newControllerFromClientWithClock function Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com> * Call t.Helper() Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com> * Put the testing.TB on the second place in the args for the createJobControllerWithSharedInformers function and call tb.Helper() there Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com> * Put the testing.TB on the second place in the args for the startJobControllerAndWaitForCaches function and call tb.Helper() there Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com> * Adapt TestFinializerCleanup to the eventhandler error Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com> --------- Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com>

… not set pod replacement policy

…st cases

… of editing existing ones

… replacement policy integration tests

…ate deprecated methods

…ests

Co-authored-by: Aldo Culquicondor <1299064+alculquicondor@users.noreply.github.com>

Signed-off-by: guangli.bao <guangli.bao@daocloud.io>

…onFromCluster

Signed-off-by: xin.li <xin.li@daocloud.io>

TestSampleAPIServer tried to validate APIService deletion, but it used an unmatched selector to delete and list APIServices, which essentially validated nothing. Signed-off-by: Quan Tian <qtian@vmware.com>

After a CRD or an APIService was deleted, the corresponding group was never unregistered. It caused a stale entry to remain in the root path and could potentially lead to memory leak as the groupDiscoveryHandler was never released and the handledGroups was never cleaned up. The commit implements the cleanup. It tracks each group's usage and unregister the a group when there is no version for this group. Signed-off-by: Quan Tian <qtian@vmware.com>

Signed-off-by: Nabarun Pal <pal.nabarun95@gmail.com>

This covers all public methods and overall test coverage is above 80% again. Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com>

Some test cases can make nodes not ready and use DeferCleanup to bring nodes back online. Checking if all nodes are online would fail in such cases as AfterEach runs before DeferCleanup. Scheduling nodes readines check to DeferCleanup should solve this issue as nodes would be brought back to a `Ready` state before the check.

…ume create"

Signed-off-by: Monis Khan <mok@microsoft.com>

…irst to avoid meaningless pod eviction

Changes the three test cases for port resolver test to a table test instead. Signed-off-by: Victor Palade <victor@cloudflavor.io>

This is not used internally, but is needed by external projects which use the old script, making this sort of a regression.

Usually we just log the error but since it's used by the GC we now populate it up the call stack. Signed-off-by: Sascha Grunert <sgrunert@redhat.com>

Signed-off-by: guangli.bao <guangli.bao@daocloud.io>

Rate limitter.go file is a generic file implementing grpc Limiter interface. This file can be reuse by other gRPC API not only by podresource. Change-Id: I905a46b5b605fbb175eb9ad6c15019ffdc7f2563

Co-authored-by: Kensei Nakada <handbomusic@gmail.com>

Fixes kubernetes#120941 GetNewerThan() call isn't blocking until the pod status/cache is updated and returning the empty pod status. Hence, whenever the `SyncLoop ADD/UPDATE/RECONCILE` functions are called multiple times in a very less time interval, Kubelet calls multiple `CreateContainer` CRI api that results in the creation of duplicate containers within a given pod. The initially created conainer keeps `Running` and the later container keeps `Exiting` and hence resulting the pod in `CrashLoopBackOff` state forever Signed-off-by: Sai Ramesh Vanka <svanka@redhat.com>

(cd staging/src/k8s.io/api/ && env UPDATE_COMPATIBILITY_FIXTURE_DATA=true go test)

Using the feature gate has the advantage that the stability tag gets added automatically and no changes are needed when graduating it. Once it reaches GA, the tag needs to be removed together with the feature gate. In fact, the current `[ALPHA]` is already wrong: the feature has already graduated to beta...

Signed-off-by: bzsuni <bingzhe.sun@daocloud.io>

…safe sysctls

Bumping golang.org/grpc in light of CVE-2023-44487. Signed-off-by: Jonathan Gonzalez V <jonathan.abdiel@gmail.com>

…ions There are some tests which want to insert a tag before the main Describe text, for example: sigDescribe("[Feature:Windows] Cpu Resources [Serial]", skipUnlessWindows(func() { ... }) In order to support this without change existing test names, it must be possible to do this instead: sigDescribe(feature.Windows, "Cpu Resources", framework.WithSerial(), skipUnlessWindows(func() { ... }) There are similar examples for the other functions. While at it, replace one left-over panic with ReportBug and add the missing `NodeFeature:` prefix.

Signed-off-by: Dr. Stefan Schimanski <stefan.schimanski@gmail.com>

logic is the same. sets us up for another refactor

…mas from CRD strategy

In issue: 115107 we added an environment variable to control the registration of sample device plugin to kubelet. The intent of this patch is to ensure that the default behaviour of the plugin is to register to kubelet (in case no environment variable is specified). In addition to that, we want to ensure that the plugin registers itself not just once. It should re-register itself to kubelet in case of node reboot or kubelet restarts. Signed-off-by: Swati Sehgal <swsehgal@redhat.com>

In case `REGISTER_CONTROL_FILE` is specified, we want to ensure that the registration is triggered by deletion of the control file. This is applicable both when the registration happens for the first time and subsequent ones because of kubelet restarts. Signed-off-by: Swati Sehgal <swsehgal@redhat.com>

If the user specifies the intent to control registration process, we rely on registration triggers (deletion of control file) to prompt registration. This behvaiour is expected to be consistent across kubelet restarts and therefore across the watch calls where we watch for changes to the unix socket so we make this part of Stub object instead of a parameter. Co-authored-by: Francesco Romani <fromani@redhat.com> Signed-off-by: Swati Sehgal <swsehgal@redhat.com>

Setting a reasonable default in case `PLUGIN_SOCK_DIR` environment variable is not specified. Signed-off-by: Swati Sehgal <swsehgal@redhat.com>

Add kubeletSocket file to fsnotify instead of polling and waiting for deletion of device plugin unix socket as a way of detecting kubelet restart. We need to ensure that the device plugin re-registers itself after kubelet restart depending on the configured registration mode (auto-registration or controller registration). Signed-off-by: Swati Sehgal <swsehgal@redhat.com>

Add retry mechanism to handle cases where after kubelet restarts, the device plugin unix socket(s) were created but not ready to serve yet. Signed-off-by: Swati Sehgal <swsehgal@redhat.com>

* Promote plugin resolution to beta * Not use plugin for kubectl create -f command execution `kubectl create -f` is legitimate command execution and we shouldn't search plugins if user invokes this. * Add integration test for plugin resolution for create command * Reintroduce feature flag to ability to disable it explicitly

…atch-list feature. checkWatchListConsistencyIfRequested performs a data consistency check only when the KUBE_WATCHLIST_INCONSISTENCY_DETECTOR environment variable was set during a binary startup. The consistency check is meant to be enforced only in the CI, not in production. The check ensures that data retrieved by the watch-list api call is exactly the same as data received by the standard list api call. Note that this function will panic when data inconsistency is detected. This is intentional because we want to catch it in the CI.

…ure flags

This is to prevent the enablement of new data formats (CBOR) in the early stages of phased implementation.

…tiAffinity

Signed-off-by: qingwave <isguory@gmail.com>

The sysctl tests have to be skipped when the node components are running in UserNS, because the tests fail due to `open /proc/sys/kernel/shm_rmid_forced: permission denied` (as expected). Can be verified with Rootless kind (https://kind.sigs.k8s.io/docs/user/rootless/): ``` dockerd-rootless-setuptool.sh install : The following steps are added because 'kubetest2 kind --build' does not seem to build e2e.test and ginkgo make WHAT=test/e2e/e2e.test make ginkgo cp -f _output/bin/{e2e.test,ginkgo} _output/dockerized/bin/linux/amd64 kubetest2 kind --build --up --down --test=ginkgo -- \ --use-built-binaries \ --focus-regex='\[NodeConformance\]' \ --skip-regex='\[Environment:NotInUserNS\]' ``` Test with the following host environment: - kubernetes-sigs/kind@ac28d7f (main) - kubernetes-sigs/kubetest2@89f09b6 (master) - Docker 24.0.6 - Ubuntu 22.04 amd64, kernel 5.15 Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

Co-authored-by: Yuki Iwai <yuki.iwai.tz@gmail.com>

Signed-off-by: lowang-bh <lhui_wang@163.com>

Signed-off-by: TommyStarK <thomasmilox@gmail.com>

This reverts commit 33f2d48.

During scheduler_perf testing, roughly 10% of the PodSchedulingContext update operations failed with a conflict error. Using SSA would avoid that, but performance measurements showed that this causes a considerable slowdown (primarily because of the slower encoding with JSON instead of protobuf, but also because server-side processing is more expensive). Therefore a normal update is tried first and SSA only gets used when there has been a conflict. Using SSA in that case instead of giving up outright is better because it avoids another scheduling attempt.

…it's not defined in the container

Signed-off-by: Nilekh Chaudhari <1626598+nilekhc@users.noreply.github.com>

Signed-off-by: tao.yang <tao.yang@daocloud.io>

Signed-off-by: bzsuni <bingzhe.sun@daocloud.io>

This is unusual and complicates the upcoming refactoring of test definitions.

This makes it possible to select tests through `ginkgo --label-filter` also for the custom labels.

…ut missed schedules Initially this method was returning a number of missed schedules, but that turned out to be not reliable for some complex schedules. For example, those which are being run only during week days. The second approach was to only return a boolean indicating the too many missed information. It turns out that we need to return all three values: none missed, few missed and many missed, to let consumers know what to do, but don't leak the wrong number out of mostRecentScheduleTime.

…atio metric

…s#121342) * cleanup: refactor pod replacement policy integration test into staged assertion * cleanup: remove typo in job_test.go * refactor PodReplacementPolicy test and remove test for defaulting the policy * fix issue with missing update in job controller for terminating status and refactor pod replacement policy integration test * use t.Cleanup instead of defer in PodReplacementPolicy integration tests * revert t.Cleanup to defer for reseting feature flag in PodReplacementPolicy integration tests

Co-authored-by: Mike Brown <brownwm@us.ibm.com>

…metric

This ensures that the amount of subdomains should always match the glob+dot (`*.`) pattern. Refers to kubernetes#119941 Signed-off-by: Sascha Grunert <sgrunert@redhat.com>

Signed-off-by: bzsuni <bingzhe.sun@daocloud.io>

Signed-off-by: Davanum Srinivas <davanum@gmail.com>

Signed-off-by: kerthcet <kerthcet@gmail.com>

Change-Id: I45b85440a792e5ed2f75a344ec1f0332854d8d6d

Signed-off-by: Nilekh Chaudhari <1626598+nilekhc@users.noreply.github.com>

Record volume plugin name when a volume in a Pod needs a different "mount -o context" value than the actually mounted one. We expect that NFS, CIFS and CephFS volumes would be able to mount such volumes just fine with multiple "-o context" values. We know that the block-volume based ones (ext4, xfs, btrfs, ...) cannot do that. Therefore want to distinguish the volume plugin in metrics, anything block-volume based could break an existing application.

volume_manager_selinux_volume_context_mismatch_warnings_total should be counted only once per volume + pod. The previous location is evaluated periodically, so bump the metric only when a new pod is added to volume.

Use device mountable volume, to make it impossible to share the same global mount with different SELinux contexts. And fix pod2Name to actually refer to pod2.

Change-Id: Ibefebf95df47c68e6752e85c61fface9f06cbd38

Signed-off-by: ruiwen-zhao <ruiwen@google.com>

A new --init-only flag is added tha makes kube-proxy perform configuration that requires privileged mode and exit. It is intended to be executed in a privileged initContainer, while the main container may run with a stricter securityContext

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Signed-off-by: Peter Hunt <pehunt@redhat.com>

to free images older than configured ImageGCMaximumAge Signed-off-by: Peter Hunt <pehunt@redhat.com>

Signed-off-by: Peter Hunt <pehunt@redhat.com>

to help find MaxAge thresholds and detect image addition/removal thrashing Signed-off-by: Peter Hunt <pehunt@redhat.com>

stays API compatible while allowing us to pass in our CorrelatedObject va

c

will be shared with CEL and used for metrics

so we can now supply a shared CorrelatedObject

The in-tree configs use a relative path to find logcheck.so. This is useful because then the invocation of golangci-lint also works outside of the script. But when running with a containerized build, GOBIN points somewhere else. For that case, a temporary copy of the configuration has to be created with an absolute path.

Signed-off-by: ruiwen-zhao <ruiwen@google.com>

The tests in pkg/proxy already test that EndpointSlice -> BaseEndpointInfo conversion works correctly; all we need to test in pkg/proxy/ipvs and pkg/proxy/iptables is that the correct set of endpoints get picked out where we expect them to, which doesn't require us to compare the complete BaseEndpointInfo objects.

Remove NodeName, which was unused because we only care about IsLocal which was tracked separately. Remove Zone, which was unused because it's from the old topology system? Fix up some comments which still referred to Endpoints vs EndpointSlice differences. Also remove an unhelpful helper function in endpoints_test.go

BaseEndpointInfo's fields, unlike BaseServicePortInfo's, were all exported, which then required adding "Get" before some of the function names in Endpoint so they wouldn't conflict. Fix that, now that the iptables and ipvs unit tests don't need to be able to construct BaseEndpointInfos by hand.

Signed-off-by: bzsuni <bingzhe.sun@daocloud.io>

Signed-off-by: Dr. Stefan Schimanski <stefan.schimanski@gmail.com>

Co-authored-by: Evan Lezar <elezar@nvidia.com>

Signed-off-by: Krzysztof Wilczyński <kwilczynski@redhat.com>

To keep things in sync when adding new traces, we now use the official semconv types of OTEL rather than our own values. Nothing should change for now behavior wise. Refers to kubernetes#119771 Signed-off-by: Sascha Grunert <sgrunert@redhat.com>

Signed-off-by: Swati Sehgal <swsehgal@redhat.com>

Currently in the tests there is ambiguity in terms of host setup when it comes to cpus or cores. This commit disambiguates that. Signed-off-by: Swati Sehgal <swsehgal@redhat.com>

Signed-off-by: mantuliu <240951888@qq.com>

Signed-off-by: Davanum Srinivas <davanum@gmail.com>

Today, DRA manager does not call plugin NodePrepareResource for claims that it previously successfully handled, that is, if claims are present in cache (checkpoint) even if node rebooted. After node reboots, it is required to call DRA plugin for resource claims so that plugins may prepare them again in case the resources dont persist reboot. To achieve that, once kubelet is started, we call DRA plugins for claims once if a pod sandbox is required to be created during PodSync. Signed-off-by: adrianc <adrianc@nvidia.com>

adjust existing tests and add new test flows to cover new DRA manager behaviour Signed-off-by: adrianc <adrianc@nvidia.com>

Signed-off-by: guangli.bao <guangli.bao@daocloud.io>

… by a CI job when the KUBE_WATCHLIST_INCONSISTENCY_DETECTOR environment variable was set then the reflector performs a data consistency check. The consistency check is meant to be enforced only in the CI, not in production. The check ensures that data retrieved by the watch-list api call is exactly the same as data received by the standard list api call. note that the new env var is set in the same places the ENABLE_CACHE_MUTATION_DETECTOR is set.

Signed-off-by: mantuliu <240951888@qq.com>

Signed-off-by: Davanum Srinivas <davanum@gmail.com>

* Use k8s.io/utils/ptr in pkg/proxy * Replace pointer.String(), pointer.StringPtr(), and pointer.Bool() with ptr.To() * Replace pointer.Int32(constexpr) with ptr.To[int32](constexpr) * Replace pointer.Int32(int32(var)) with ptr.To(int32(var)) * Replace remaining pointer.Int32() cases with ptr.To * Replace 'tcpProtocol := v1.ProtocolTCP; ... &tcpProtocol', etc with ptr.To(v1.ProtocolTCP) * Replace 'nodeName = testHostname; ... &nodeName' with ptr.To(testHostname) * Use ptr.To for SessionAffinityConfig.ClientIP.TimeoutSeconds * Use ptr.To for InternalTrafficPolicy * Use ptr.To for LoadBalancer.Ingress.IPMode

Signed-off-by: Riaan Kleinhans <riaan@ii.coop>

Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>

… shutdown Simiarly to the function `ensureNodeExistsByProviderID`, `shutdownInCloudProvider` should have a logic where in case of an empty providerID we get it using the name of the node. This is to support scenarios when the function is called with Node object that has a name but does not have any provider ID. Currently in such a scenario we have an error as it is not possible to call `InstanceShutdownByProviderID` with empty value. With this change in such a scenario we will first obtain a correct provider ID and only afterwards check the shutdown status. Signed-off-by: Mat Kowalski <mko@redhat.com>

This commit fixes a GCE instance test for a scenario where instance does not exist in the cloud. In the `gce_instances.go` we have a code that handles such a scenario and strips off the error, i.e. ``` if providerID, err = cloudprovider.GetInstanceProviderID(ctx, g, types.NodeName(node.Name)); err != nil { if err == cloudprovider.InstanceNotFound { return false, nil } return false, err } ``` but nevertheless the test was expecing a non-empty error string. This issue got exposed when implementation of `GetInstanceProviderID` in the `cloud-provider/cloud.go` changed to return `InstanceNotFound` as-is and not as a custom string. Signed-off-by: Mat Kowalski <mko@redhat.com>

- Add the new file name: super-admin.conf and a function to return its default path GetSuperAdminKubeConfigPath() - Add the ClusterAdminsGroupAndClusterRoleBinding object name.

- Register the new file in /certs/renewal, so that the file is renewed if present. If not present the common message "MISSING" is shown. Same for other certs/kubeconfig files. - In /kubeconfig, update the spec for admin.conf to use the "kubeadm:cluster-admins" Group. A new spec is added for the "super-admin.conf" file that uses the "system:masters" Group. - Add a new function EnsureAdminClusterRoleBinding() that includes logic to ensure that admin.conf contains a User that is properly bound on the "cluster-admin" built-in ClusterRole. This requires bootstrapping using the "system:masters" containing "super-admin.conf". Add detailed unit tests for this new logic. - In /upgrade#PerformPostUpgradeTasks() add logic to create the "admin.conf" and "super-admin.conf" with the new, updated specs. Add detailed unit tests for this new logic. - In /upgrade#StaticPodControlPlane() ensure that renewal of "super-admin.conf" is performed if the file exists. Update unit tests.

- Update unit tests in certs_test.go related to the "renew" CLI command. - In /init, (d *initData) Client(), make sure that the new logic for bootstrapping an "admin.conf" user is performed, by calling EnsureAdminClusterRoleBinding() from the phases backend. Add a "adminKubeConfigBootstrapped" flag that helps call this logic only once per "kubeadm init" binary execution. - In /phases/init include a new subphase for generating the "super-admin.conf" file. - In /phases/reset make sure the file "super-admin.conf" is cleaned if present. Update unit tests.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support Dev Containers / Github Codespaces #120551

Support Dev Containers / Github Codespaces #120551

Commits on Oct 27, 2023