…sruption

Add worker to clean up stale DisruptionTarget condition

…-test

Promote NamespaceStatus endpoints test +3 Endpoints

…a2-deprecated

Deprecate kubescheduler ComponentConfig v1beta2

update smd to 4.2.3

ginkgo: disable color escape sequences by default when not connected to a terminal

KEP-3327: Add CPUManager policy option to align CPUs by Socket instead of by NUMA node

Upgrade CSIMigrationGCE feature gate to GA

Enable 'running_managed_controllers' for KCM/CCM controllers: routes, services and cloud-node

…nges

Update CRI API to support Evented PLEG

…ges for kubelet client and serving certificates

Signed-off-by: Paco Xu <paco.xu@daocloud.io>

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

It is used to request that a pod runs in a unique user namespace.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
Co-authored-by: Rodrigo Campos <rodrigoca@microsoft.com>

Move e2e test from alpha with feature promoted to beta

…ment

Allow retroactive storage class assigment to PVCs

KEP: /enhancements/keps/sig-node/1287-in-place-update-pod-resources

…ed files)

Promote CronJobTimeZone to beta

Change-Id: I3be351fb3b53216948a37b1d58224f8fbbf22b47

…uceeded

Fix JobTrackingWithFinalizers when a pod succeeds after the job fails

…ional

modify the signing/approving controller to tolerate either set of usages for kubelet client and serving certificates

….12.1, kustomize/v4.5.7 (kubernetes#111606)

Signed-off-by: Abirdcfly <fp544037857@gmail.com>

…ertical-scaling-cri

CRI changes to support in-place pod resize

This change is to promote local storage capacity isolation feature to GA

At the same time, to allow rootless system disable this feature due to
unable to get root fs, this change introduced a new kubelet config
"localStorageCapacityIsolation". By default it is set to true. For
rootless systems, they can set this configuration to false to disable
the feature. Once it is set, user cannot set ephemeral-storage
request/limit because capacity and allocatable will not be set.

Change-Id: I48a52e737c6a09e9131454db6ad31247b56c000a

modify

modify

modify

modify

modify

define a feature gate for the user namespaces support.  The feature is
not enabled by default.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

e2e: Trim junit reporter to adapt with testgrid

…d-arch-installing-etcd

Avoid hard coding Operating System and Architecture in hack/lib/etcd.sh

…im_report

Revert "e2e: Trim junit reporter to adapt with testgrid"

Including the full information for successful tests makes the resulting XML
file too large for the 200GB limit in Spyglass when running large jobs (like
scale testing).

The original solution from kubernetes#111627
broke JUnit reporting in other test suites, in particular
test/e2e_node. Keeping the code inside the framework ensures that all test
suites continue to have the JUnit reporting.

AfterReadingAllFlags is a good place to set this up because all test suites
using the test context are expected to call it before running tests and after
parsing flags.

Removing the ReportEntries added by ginkgo.By from all test reports usually
avoids the `system-err` part in the JUnit file, which in Spyglass avoids
the extra "open stdout" button.

Co-authored-by: Patrick Ohly <patrick.ohly@intel.com>
Co-authored-by: Dave Chen <dave.chen@arm.com>

Signed-off-by: David Porter <david@porter.me>

This commit just adds a validation according to KEP-127. We check that
only the supported volumes for phase 1 of the KEP are accepted.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

it is used to allocate and keep track of the unique users ranges
assigned to each pod that runs in a user namespace.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
Co-authored-by: Rodrigo Campos <rodrigoca@microsoft.com>

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

In future commits we will need this to set the user/group of supported
volumes of KEP 127 - Phase 1.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

This commit only changes the UID/GID if user namespaces is enabled. When
it is enabled, it changes it so the hostUID and hostGID that are mapped
to the currently used UID/GID. This is needed so volumes are created
with the hostUID/hostGID and the user inside the container can read
them.

If user namespaces are disabled for this pod, this is a no-op: there is
no user namespace mapping, so the hostUID/hostGID are the same as inside
the container.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

it is a preparatory change for the next commit.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Set the user namespace options to use for the pod.

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

Co-authored-by: Rodrigo Campos <rodrigoca@microsoft.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

vendor: Bump cAdvisor to v0.45.0

- add feature gate
- add encrypted object and run generated_files
- generate protobuf for encrypted object and add unit tests
- move parse endpoint to util and refactor
- refactor interface and remove unused interceptor
- add protobuf generate to update-generated-kms.sh
- add integration tests
- add defaulting for apiVersion in kmsConfiguration
- handle v1/v2 and default in encryption config parsing
- move metrics to own pkg and reuse for v2
- use Marshal and Unmarshal instead of serializer
- add context for all service methods
- check version and keyid for healthz

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

…-2022

Add support for user namespaces phase 1 (KEP 127)

Promote Local storage capacity isolation feature to GA

…reference

make ObjectReference field ownership granular

…-local-svc

Avoid re-syncing LBs for ETP=local services

Implement KMS v2alpha1

cleanup: Remove storageos volume plugins from k8s codebase

Signed-off-by: Davanum Srinivas <davanum@gmail.com>

Signed-off-by: Davanum Srinivas <davanum@gmail.com>

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>

don't quota events.k8s.io events by default

e2e: trim junit report for Spyglass

Stop panic in govet levee under golang 1.19

Signed-off-by: cpanato <ctadeu@gmail.com>

The new field tells Kubernetes if the CSI driver supports mounting of
volumes with -o context=XYZ or not.

Let volume plugins decide if they want to mount volumes with "-o
context=XYZ" or let the container runtime relabel the volume on container
startup.

Using NewMounter, as it's the call where a volume plugin gets the other MountOptions.

Add a new call to VolumePlugin interface and change all its
implementations.

Kubelet's VolumeManager will be interested whether a volume supports
mounting with -o conext=XYZ or not to hanle SetUp() / MountDevice()
accordingly.

Both ActualStateOfWorld and DesiredStateOfWorld must track SELinux context
of volume mounts.

Add separate _errors and _warnings to capture volumes that were rejected
from those will be rejected when the feature is expanded to all access
mode.

With some minor refactoring to use common getCSIDriver function.

To keep the function smaller.

In theory the check is not necessary, but for sake of robustness and
completenes, let's check SELinuxMountReadWriteOncePod feature gate before
assuming anything about SELinux labels.

Add handlerSELinuxMetricError() which bumps the right metric + either
consumes a SELinux error or lets it propagate up the stack.

github.com/opencontainers/selinux/go-selinux needs OS that supports SELinux
and SELinux enabled in it to return useful data, therefore add an interface
in front of it, so we can mock its behavior in unit tests.

The error would be logged every reconciler sync (100 ms).

To be able to update content of the function to other access modes when we
implement SELinux mount for more of them.

…er minute, scale up&down limited by percentage of Pods per minute

Update publishing-bot rules for go1.17.13 and go1.18.5

add test for GetAPIServerVirtualIP