WIP: debug rebase + patch#2687
Open
haircommander wants to merge 2998 commits into
Open
Conversation
…Policy is Always'
scheduler: fix race in DRA pending allocation sharing
Flaky test fix for 'should restart failing container when pod restartPolicy is Always'
Revert "Switch PLEGOnDemandRelist default to `false` for 1.36"
The kubelet status manager was not preserving the pod.status.nodeAllocatableResourceClaimStatuses field set by the scheduler during pod status merges. This caused the information to the to be destroyed by the kubelet's next status sync, making the field always appear empty. Add the same preservation pattern already used for ResourceClaimStatuses and ExtendedResourceClaimStatus to both mergePodStatus() and isPodStatusByKubeletEqual(). Signed-off-by: Antti Kervinen <antti.kervinen@intel.com>
Kubelet: Add alpha-2 stage implementation for UserNamespacesHostNetworkSupport feature gate
This commit introduces the DRAResourceClaimGranularStatusAuthorization feature gate (Beta in 1.36) to enforce fine-grained authorization checks on ResourceClaim status updates. Previously, 'update' permission on 'resourceclaims/status' allowed modifying the entire status. To enforce the principle of least privilege for DRA drivers and the scheduler, this change introduces synthetic subresources and verb prefixes: - 'resourceclaims/binding': Required to update 'status.allocation' and 'status.reservedFor'. - 'resourceclaims/driver': Required to update 'status.devices'. Evaluated on a per-driver basis using 'associated-node:<verb>' (for node-local ServiceAccounts) or 'arbitrary-node:<verb>' (for cluster-wide controllers).
Fine-grained Authorization for ResourceClaim Status Updates
Fix race condition in updating the PodStatus cache
…actuated resources Signed-off-by: ndixita <ndixita@google.com>
set InPlacePodLevelResourcesVerticalScaling to false if needed
…ager Metrics The Memory Manager Metrics BeforeEach asserts that zero pods are running on the node after a kubelet config update. This hard assertion flakes when a preceding serial test's namespace deletion hasn't completed yet — framework namespace cleanup is async and the kubelet restart in updateKubeletConfig can delay in-flight pod termination. CI logs show leftover pods from MemoryQoS tests (memqos-burstable, memqos-no-limit, etc.), Probe Stress tests (50-container pods), and Summary API PSI tests (memory-pressure-pod), all still Running when the assertion fires 4-7ms after the previous test finishes. Replace the immediate Expect(count).To(BeZero()) with an Eventually poll (2 minute timeout, 5 second interval) that gives pods time to drain after the kubelet restart. The existing printAllPodsOnNode diagnostic output is preserved inside the poll for debugging. Signed-off-by: Davanum Srinivas <davanum@gmail.com>
Pod events fix
…rics-cleanup e2e_node: wait for pod drain before asserting zero pods in Memory Manager Metrics
Fix flakiness in integration test for TopologyAwareScheduling with Basic Policy
…urce-test Deflake TestPodSubresourceAuth by waiting for effective permissions before testing
Signed-off-by: Alay Patel <alayp@nvidia.com>
…di-spec kep-5304: bump cdi spec version to 0.5.0
…deAllocatableResourceClaimStatuses kubelet: do not destroy nodeAllocatableResourceClaimStatuses
Signed-off-by: yashsingh74 <yashsingh1774@gmail.com>
Update CNI plugins to v1.9.1
Make cleanup aware of uid differences
The latest pause version is 3.10.2 but due to the introduction of the PATCH level version to the pause image (previously was only MAJOR.MINOR), various files have remained on an older version. Either 3.10 or 3.10.1. Our validation with build/dependencies.yaml ./hack/verify-external-dependencies.sh did not account for that.
Signed-off-by: Mujib Ahasan <ahasanmujib8@gmail.com>
After openshift/origin#30786 added ibmcloud to the provider switch in openshift-tests, the provider name is now correctly passed through to k8s-tests-ext. However, k8s-tests-ext only registers upstream Kubernetes providers (aws, azure, gce, kubemark, openstack, vsphere) via the test/e2e/providers.go import. OpenShift-specific providers like ibmcloud are not registered, causing framework.AfterReadingAllFlags to call SetupProviderConfig which fails with "Unknown provider" and Exit(1), crashing every test process. This registers all OpenShift-specific cloud providers (baremetal, ovirt, kubevirt, alibabacloud, nutanix, ibmcloud, external) as NullProviders in k8s-tests-ext. These providers don't require special setup for upstream kube e2e tests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…e2e test Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The WatchList test “[sig-api-machinery] API Streaming (aka. WatchList) [FeatureGate:WatchList] [Beta] should be requested by metadatainformer when WatchListClient is enabled” works by fetching an expected (initial) state of secrets, starting an informer, and polling until context timeout for the informer to converge to that expected state. If any other secret in the namespace changes while the test is running, they never converge, and the test times out. This change limits the secrets we’re listing to just the ones relevant to the test.
Signed-off-by: Shaza Aldawamneh <shaza.aldawamneh@hotmail.com>
…e when claims.email is used in username expression Signed-off-by: Shaza Aldawamneh <shaza.aldawamneh@hotmail.com>
Also prevent duplicate metric emissions
RouteExternalCertificate is now enabled by default. This update is removing references to this feature gate, hardcoding its value to true. This update is also a pre-requisite to remove it from openshift/cluster-ingress-operator. This feature gate was added in 1448e1c
…reating clients on each metrics scrape Signed-off-by: xigang <wangxigang2014@gmail.com>
Add a kubernetes/conformance suite that aggregates tests from kubernetes/conformance/parallel and kubernetes/conformance/serial, enabling `openshift-tests run kubernetes/conformance` to run all kubernetes conformance tests in a single invocation. Uses AddGlobalSuite (not AddSuite) so the umbrella starts with zero qualifiers and inherits exclusively from its children via the mergeParentQualifiers fixed-point loop in origin. AddSuite would prepend a catch-all source qualifier that bypasses the exclusion filters ([Disabled:], [Disruptive], [Slow], etc.) in the child qualifiers. Companion to openshift/origin#31261 which adds the Parents field and mergeParentQualifiers mechanism. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: jubittajohn <jujohn@redhat.com>
To be squashed with the following commit later:"UPSTREAM: <carry>: Add OpenShift tooling, images, configs and docs" Signed-off-by: jubittajohn <jujohn@redhat.com>
…er_manager_linux_test.go Squash into: UPSTREAM: <carry>: disable load balancing on created cgroups when managed is enabled
…s in flagz_test.go and statusz_test.go
Squash into: UPSTREAM: <carry>: apiserver: add system_client=kube-{apiserver,cm,s} to apiserver_request_total
…acheGC is enabled Squash into UPSTREAM: <carry>: create termination events
Squash into: UPSTREAM: <carry>: add management support to kubelet
Signed-off-by: jubittajohn <jujohn@redhat.com>
… driver when not enabled The upstream csi-hostpath-plugin.yaml manifest now includes a csi-snapshot-metadata sidecar container and volume (added in k/k#130918). Upstream PR k/k#137057 added conditional stripping of these when CapSnapshotMetadata is not enabled, but only for the upstream hostpathCSIDriver. The OpenShift-specific groupSnapshotHostpathCSIDriver was never updated, causing the driver pod to fail with "secret csi-snapshot-metadata-server-certs not found" and all csi-hostpath-groupsnapshot tests to fail in techpreview jobs. Signed-off-by: jubittajohn <jujohn@redhat.com>
Signed-off-by: Sai Ramesh Vanka <svanka@redhat.com>
Signed-off-by: jubittajohn <jujohn@redhat.com>
Signed-off-by: jubittajohn <jujohn@redhat.com>
… pods Exclude non-admitted pods from allocation capacity calculations. This prevents pods that haven't been admitted yet (and may fail admission) from being incorrectly counted when calculating available node resources. Signed-off-by: Peter Hunt <pehunt@redhat.com>
When SyncPod receives a pod from HandlePodSyncs, it gets a fresh copy from the pod manager which has desired resources (from the API spec), not allocated resources. Even though the pod worker calls UpdatePodFromAllocation when queueing updates, HandlePodSyncs replaces the pod with GetPodAndMirrorPod which returns a fresh pod from the pod manager. This causes two issues: 1. IsPodResizeInProgress compares desired vs actual instead of allocated vs actual 2. generateAPIPodStatus populates containerStatus.allocatedResources with desired resources instead of allocated resources This commit adds a call to UpdatePodFromAllocation at the beginning of the InPlacePodVerticalScaling block in SyncPod to ensure we always have the latest allocated resources when: - Checking if resize is in progress - Generating resize completion events - Populating container status The test TestSyncPodUsesAllocatedResources verifies this behavior: - Without fix: containerStatus.allocatedResources shows 1991m (desired) - FAIL - With fix: containerStatus.allocatedResources shows 186m (allocated) - PASS This fixes the failing e2e test where container status incorrectly showed desired resources instead of allocated resources. Signed-off-by: Peter Hunt <pehunt@redhat.com>
Signed-off-by: Peter Hunt <pehunt@redhat.com>
haircommander
force-pushed
the
debug-resize
branch
from
83bd6c7 to
04d877d
Compare
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: haircommander The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Member
Author
|
/test e2e-aws-ovn-techpreview-serial-1of2 |
|
@haircommander: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
What this PR does / why we need it:
Which issue(s) this PR is related to:
Special notes for your reviewer:
Does this PR introduce a user-facing change?
Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:
Summary by CodeRabbit
New Features
shardSelectorandshardInfo.MutatingAdmissionPolicy,MutatingAdmissionPolicyBinding,PodGroup,DeviceTaintRule, andResourcePoolStatusRequest.v1alpha1tov1alpha2, adjusting available scheduling resources.Chores