When some plugin was registered as "unschedulable" in some previous scheduling
attempt, it kept that attribute for a pod forever. When that plugin then later
failed with an error that requires backoff, the pod was incorrectly moved to the
"unschedulable" queue where it got stuck until the periodic flushing because
there was no event that the plugin was waiting for.

Here's an example where that happened:

     framework.go:1280: E0831 20:03:47.184243] Reserve/DynamicResources: Plugin failed err="Operation cannot be fulfilled on podschedulingcontexts.resource.k8s.io \"test-dragxd5c\": the object has been modified; please apply your changes to the latest version and try again" node="scheduler-perf-dra-7l2v2" plugin="DynamicResources" pod="test/test-dragxd5c"
    schedule_one.go:1001: E0831 20:03:47.184345] Error scheduling pod; retrying err="running Reserve plugin \"DynamicResources\": Operation cannot be fulfilled on podschedulingcontexts.resource.k8s.io \"test-dragxd5c\": the object has been modified; please apply your changes to the latest version and try again" pod="test/test-dragxd5c"
    ...
    scheduling_queue.go:745: I0831 20:03:47.198968] Pod moved to an internal scheduling queue pod="test/test-dragxd5c" event="ScheduleAttemptFailure" queue="Unschedulable" schedulingCycle=9576 hint="QueueSkip"

Pop still needs the information about unschedulable plugins to update the
UnschedulableReason metric. It can reset that information before returning the
PodInfo for the next scheduling attempt.

The status error was embedded inside the new error constructed by
WaitForPodsResponding's get function, but not wrapped. Therefore
`apierrors.IsServiceUnavailable(err)` didn't find it and returned false -> no
retries.

Wrapping fixes this and Gomega formatting of the error remains useful:

	err := &errors.StatusError{}
	err.ErrStatus.Code = 503
	err.ErrStatus.Message = "temporary failure"

	err2 := fmt.Errorf("Controller %s: failed to Get from replica pod %s:\n%w\nPod status:\n%s",
		"foo", "bar",
		err, "some status")
	fmt.Println(format.Object(err2, 1))
        fmt.Println(errors.IsServiceUnavailable(err2))

=>

    <*fmt.wrapError | 0xc000139340>:
    Controller foo: failed to Get from replica pod bar:
    temporary failure
    Pod status:
    some status
    {
        msg: "Controller foo: failed to Get from replica pod bar:\ntemporary failure\nPod status:\nsome status",
        err: <*errors.StatusError | 0xc0001a01e0>{
            ErrStatus: {
                TypeMeta: {Kind: "", APIVersion: ""},
                ListMeta: {
                    SelfLink: "",
                    ResourceVersion: "",
                    Continue: "",
                    RemainingItemCount: nil,
                },
                Status: "",
                Message: "temporary failure",
                Reason: "",
                Details: nil,
                Code: 503,
            },
        },
    }

    true

it is required for Server-SIde-Apply to function correctly (SSA is based on OpenAPI schemas)

…verter

relates to  kubernetes#116311

k8s_tag_files_matching looks for a slash after its argument, so the current value doesnt match anything

also update codegen

this is required for apiextensions-apiserver tests. After fixing apiextensions server tests to use type-aware SSA (instead of erroneously using untyped SSA) there were errors since none of the apiextensions types were actually used in the openapi given to tests.

it should never be nil

…Transient

Signed-off-by: Humble Chirammal <humble.devassy@gmail.com>

In the installation script we use coreos/etcd path which redirect
to etcd-io/etcd. This commit replace the same.

Signed-off-by: Humble Chirammal <humble.devassy@gmail.com>

Signed-off-by: Humble Chirammal <humble.devassy@gmail.com>

…-of-#120559-origin-release-1.27

Automated cherry pick of kubernetes#120559: e2e pods: fix WaitForPodsResponding retry

…ck-of-#118027-upstream-release-1.27

[1.27] Automated cherry pick of kubernetes#118027: etcd: Update version to 3.5.9

The Service API Rest implementation is complex and has to use different
hooks on the REST storage. The status store was making a shallow copy of
the storage before adding the hooks, so it was not inheriting the hooks.

The status store must have the same hooks as the rest store to be able
to handle correctly the allocation and deallocation of ClusterIPs and
nodePorts.

Change-Id: I44be21468d36017f0ec41a8f912b8490f8f13f55
Signed-off-by: Antonio Ojea <aojea@google.com>

Change-Id: I7ed4b006faecf0a7e6e583c42b4d6bc4b786a164

Signed-off-by: TommyStarK <thomasmilox@gmail.com>

this check needs to go after any mutations. After the mutating admission chain, rest.BeforeUpdate (which is responsible for reverting updates to immutable timestamp fields, among other things.) is called in the store.Update function. Without moving this check, it will be possible for an object to be written to etcd with only a change to its managed fields timestamp.

…rry-pick-of-#116865-upstream-release-1.27

Automated cherry pick of kubernetes#116865: move check for noop managed field timestamp updates

Bumping govmomi to include an error check fix needed
to work with go1.20. We made this fix in the CI, but
were reliant on the text matching of error strings,
which is why it didn't catch the actual issue. This

Fix in vmware/govmomi@b4eac19
PR to bump govmomi in cloud-provider-vsphere: kubernetes/cloud-provider-vsphere#738

Signed-off-by: Madhav Jivrajani <madhav.jiv@gmail.com>

Signed-off-by: Madhav Jivrajani <madhav.jiv@gmail.com>

…p-1.27

[1.27][go1.20] .: bump govmomi to v0.30.6

…-of-#120334-origin-release-1.27

Automated cherry pick of kubernetes#120334: scheduler: start scheduling attempt with clean

…-of-#120623-upstream-release-1.27

Automated cherry pick of kubernetes#120623: sync Service API status rest storage

…k-of-#120577-upstream-release-1.27

Automated cherry pick of kubernetes#120577: Increase range of job_sync_duration_seconds

…-pick-of-#117539-upstream-release-1.27

Automated cherry pick of kubernetes#117539: mount-utils: fix flaky test 'TestFormat'

…list of cronjobs

Signed-off-by: Andrew Sy Kim <andrewsy@google.com>

…rry-pick-of-#114998-upstream-release-1.27-1694538959

Automated cherry pick of kubernetes#114998

…ry-pick-of-#119317-upstream-release-1.27

Automated cherry pick of kubernetes#119317: change rolling update logic to exclude sunsetting nodes

…y-pick-of-#120649-origin-release-1.27

Automated cherry pick of kubernetes#120649: cronjob controller: ensure already existing jobs are added to

Etcd version has been bumped in master and 1.28 branch to 3.5.9
however cluster image has been kept on older versions. This bump
the same to 3.5.9 to make it consistent.

Signed-off-by: Humble Chirammal <humble.devassy@gmail.com>

Change-Id: I9d1ee7f49f01c3308b967d84865fa6bcfafc4b0d

bump etcd cluster image to 3.5.9

Signed-off-by: cpanato <ctadeu@gmail.com>

[release-1.27] [go] Bump images, versions and deps to use Go 1.20.9

Volume that failed Detach() should not be marked as attached, CSI
external-attacher is probably still trying to detach it.

Mark it uncertain instead and wait for Detach() to succeed.

Bumping golang.org/x/net in light of CVE-2023-39325 and CVE-2023-44487.

Signed-off-by: Madhav Jivrajani <madhav.jiv@gmail.com>

PDB with an empty selector `{}` is selecting all the pods in a namespace.
But, during the `drain`, all the pods are getting evicted which is not expected.
This change should fix the issue and honor the pdb before evicting the pods.

Signed-off-by: Sai Ramesh Vanka <svanka@redhat.com>

Signed-off-by: cpanato <ctadeu@gmail.com>

…-pick-of-#121015-upstream-release-1.27

Automated cherry pick of kubernetes#121015: Add nil checks for hpa object target type values

[1.27][CVE-2023-39325] .: bump golang.org/x/net to v0.17.0

…ick-of-#120595-upstream-release-1.27

Automated cherry pick of kubernetes#120595: Mark a volume as uncertain-attached after detach error

[release-1.27] [go] Bump images, dependencies and versions to go 1.20.10

This change fully addresses CVE-2023-44487 and CVE-2023-39325 for
the API server when the client is unauthenticated.

The changes to util/runtime are required because otherwise a large
number of requests can get blocked on the time.Sleep calls.

For unauthenticated clients (either via 401 or the anonymous user),
we simply no longer allow such clients to hold open http2
connections.  They can use http2, but with the performance of http1
(with keep-alive disabled).

Since this change has the potential to cause issues, the
UnauthenticatedHTTP2DOSMitigation feature gate can be disabled to
remove this protection (it is enabled by default).  For example,
when the API server is fronted by an L7 load balancer that is set up
to mitigate http2 attacks, unauthenticated clients could force
disable connection reuse between the load balancer and the API
server (many incoming connections could share the same backend
connection).  An API server that is on a private network may opt to
disable this protection to prevent performance regressions for
unauthenticated clients.

For all other clients, we rely on the golang.org/x/net fix in
golang/net@b225e7c
That change is not sufficient to adequately protect against a
motivated client - future changes to Kube and/or golang.org/x/net
will be explored to address this gap.

The Kube API server now uses a max stream of 100 instead of 250
(this matches the Go http2 client default).  This lowers the abuse
limit from 1000 to 400.

Signed-off-by: Monis Khan <mok@microsoft.com>

This makes backports safer by not changing any default behavior.

Signed-off-by: Monis Khan <mok@microsoft.com>

These occasionally flake on CI:

https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/121200/pull-kubernetes-unit-go-compatibility/1712589824344461312

=== Failed
=== FAIL: vendor/k8s.io/apiserver/pkg/endpoints/filters TestUnauthenticatedHTTP2ClientConnectionClose/other_skip=true/http/1.1 (0.19s)
    authentication_test.go:653: expect TCP connection: 1, actual: 2
        --- FAIL: TestUnauthenticatedHTTP2ClientConnectionClose/other_skip=true/http/1.1 (0.19s)

=== FAIL: vendor/k8s.io/apiserver/pkg/endpoints/filters TestUnauthenticatedHTTP2ClientConnectionClose/other_skip=true (0.23s)
    --- FAIL: TestUnauthenticatedHTTP2ClientConnectionClose/other_skip=true (0.23s)

=== FAIL: vendor/k8s.io/apiserver/pkg/endpoints/filters TestUnauthenticatedHTTP2ClientConnectionClose (2.30s)

Signed-off-by: Monis Khan <mok@microsoft.com>

…f-#121196-upstream-release-1.27

Automated cherry pick of kubernetes#121196: Prevent rapid reset http2 DOS on API server

Update nodes if providerID has changed

…ck-of-#121225-upstream-release-1.27

Automated cherry pick of kubernetes#121224: Register UnauthenticatedHTTP2DOSMitigation into kube

…ated-cherry-pick-of-#121142-upstream-release-1.27

Automated cherry pick of kubernetes#121142: Modify test PVC to detect concurrent map write bug

…-pick-of-#119732-upstream-release-1.27

Automated cherry pick of kubernetes#119732: Fix to honor PDB with an empty selector `{}`

…fter 1.28

…omated-cherry-pick-of-#121116-upstream-release-1.27

Automated cherry pick of kubernetes#121116: KCCM: fix GCP ILB by reintroducing readiness predicate for

…pick-of-#120834-upstream-release-1.27

Automated cherry pick of kubernetes#120834: Fix panic testing intree vSphere dynamic PV.

…k-of-#121103-upstream-release-1.27

Automated cherry pick of kubernetes#121103: Use Patch instead of SSA for Pod Disruption condition

…k-of-#120731-upstream-release-1.27

Automated cherry pick of kubernetes#120731: Fixing CurrentReplicas and CurrentRevision in

…y-pick-of-#120330-upstream-release-1.27

Automated cherry pick of kubernetes#120330: Retry operations if CSI Driver Isn't Found by Treating this

Signed-off-by: Mark Rossetti <marosset@microsoft.com>

…ut missed schedules

Initially this method was returning a number of missed schedules, but
that turned out to be not reliable for some complex schedules. For
example, those which are being run only during week days. The second
approach was to only return a boolean indicating the too many missed
information. It turns out that we need to return all three values:
none missed, few missed and many missed, to let consumers know what to
do, but don't leak the wrong number out of mostRecentScheduleTime.

Bumping golang.org/grpc in light of CVE-2023-44487.

Signed-off-by: Jonathan Gonzalez V <jonathan.abdiel@gmail.com>

1.27 Cherry pick of kubernetes#120492: service controller: improve node lifecycle updates - update

…ck-of-#121327-upstream-release-1.27

Automated cherry pick of kubernetes#121327: Fix next schedule time duration

Signed-off-by: Mark Rossetti <marosset@microsoft.com>

…of-#121364-upstream-release-1.27

Automated cherry pick of kubernetes#121364: bump golang.org/grpc to v1.56.3

Signed-off-by: cpanato <ctadeu@gmail.com>

[release-1.27] [go] Bump images, dependencies and versions to go 1.20.11

Signed-off-by: James Sturtevant <jstur@microsoft.com>

…y-pick-of-#118365-upstream-release-1.27

Automated cherry pick of kubernetes#118365: Fixing gmsa-webhook install steps for Windows GMSA full tests

…ick-of-#120948-upstream-release-1.27

Automated cherry pick of kubernetes#120948: Fixing attempt to deploy past allocatable memory limits test

…f-#121881-upstream-release-1.27

Automated cherry pick of kubernetes#121881: Use golang library instead of mklink

Kubernetes official release v1.27.8