1.36: Save SELinuxWarningController upgradeability to a ConfigMap#2714

Draft

jsafrane wants to merge 2998 commits into

openshift:masterfrom

jsafrane:test-1.36-kcm-selinux

This pull request is big! We're only showing the most recent 250 commits

Commits on Mar 25, 2026

Commits on Mar 27, 2026

Commits on Mar 28, 2026

Merge pull request #137996 from pacoxu/inplace-disable
k8s-ci-robot
authored
e2e_node: wait for pod drain before asserting zero pods in Memory Manager Metrics
dims
committed

Commits on Mar 30, 2026

Commits on Apr 1, 2026

Commits on Apr 2, 2026

Commits on Apr 3, 2026

pause: fix version drift in various files
neolit123
committed

Commits on Apr 4, 2026

Commits on Apr 6, 2026

Commits on Apr 7, 2026

Commits on Apr 9, 2026

Commits on Apr 11, 2026

Commits on Apr 12, 2026

scheduler: fix inFlightPods leak when pod is recreated during scheduling failure
MaybeSam05
committed

Commits on Apr 13, 2026

Commits on Apr 16, 2026

Commits on Apr 17, 2026

Commits on Apr 20, 2026

skip MemoryQoS rollback test until implementation is resolved
QiWang19
committed

Commits on Apr 21, 2026

Commits on Apr 22, 2026

Commits on Apr 23, 2026

Commits on Apr 25, 2026

Commits on Apr 26, 2026

Commits on Apr 28, 2026

kube-proxy: don't do full periodic syncs on large cluster mode
aojea
committed

Commits on Apr 29, 2026

kubeadm: use the localAPIEndpoint for all API calls in 'init'
neolit123
committed

Commits on May 5, 2026

Commits on May 6, 2026

Commits on May 7, 2026

KEP-5304: DecodeMetadataFromStream only skips metadata entries with unknown API versions
alaypatel07
committed

Commits on May 8, 2026

Commits on May 11, 2026

Commits on May 12, 2026

Commits on May 18, 2026

Commits on May 20, 2026

Restore ability to plumb binary data through envvar values
liggitt
committed

Commits on May 27, 2026

batch/job: Fix scheduling directives mutation for not-yet-started suspended Jobs
kannon92
committed

Commits on May 28, 2026

Fix DRA scoring bug with mixed allocated and unallocated claims

johnbelamaric
authored and
nojnhuh
committed

Commits on Jun 1, 2026

Merge pull request #139329 from kannon92/automated-cherry-pick-of-#139287-upstream-release-1.36
k8s-ci-robot
authored

Commits on Jun 2, 2026

kubeadm: fix dry-run CA copy paths in init certs

ErikJiang
authored and
HirazawaUi
committed

Commits on Jun 3, 2026

Commits on Jun 4, 2026

Commits on Jun 8, 2026

Commits on Jun 9, 2026

Commits on Jun 11, 2026

Release commit for Kubernetes v1.36.2
k8s-release-robot
committed

Commits on Jun 26, 2026

Merge downstream-master using ours strategy
jubittajohn
committed
UPSTREAM: 74956: apiserver: switch authorization to use protobuf client

mfojtik
authored and
jubittajohn
committed
UPSTREAM: 93286: wait for apiservices on startup

deads2k
authored and
jubittajohn
committed
UPSTREAM: <carry>: filter out CustomResourceQuota paths from OpenAPI

sttts
authored and
jubittajohn
committed
UPSTREAM: <carry>: patch aggregator to allow delegating resources

mfojtik
authored and
jubittajohn
committed
UPSTREAM: <carry>: remove apiservice from sync in CRD registration when it exists

mfojtik
authored and
jubittajohn
committed
UPSTREAM: <carry>: hardcoded restmapper with a few entries to rebootstrap SDN when SDN is down

deads2k
authored and
jubittajohn
committed
UPSTREAM: <carry>: Extend NodeLogQuery feature

aravindhp
authored and
jubittajohn
committed
UPSTREAM: <carry>: kube-controller-manager: add service serving cert signer to token controller

deads2k
authored and
jubittajohn
committed
UPSTREAM: <carry>: kube-controller-manager: allow running bare kube-controller-manager

deads2k
authored and
jubittajohn
committed
UPSTREAM: <carry>: kube-controller-manager: exclude some origin resources from quota

deads2k
authored and
jubittajohn
committed
UPSTREAM: <carry>: kube-apiserver: add our immortal namespaces directly to admission plugin

deads2k
authored and
jubittajohn
committed
UPSTREAM: <carry>: openshift-kube-apiserver: add kube-apiserver patches

deads2k
authored and
jubittajohn
committed
UPSTREAM: <carry>: openshift-kube-apiserver: add openshift-kube-apiserver code

jacobsee
authored and
jubittajohn
committed
UPSTREAM: <carry>: kube-apiserver: priorize some CRD groups over others

deads2k
authored and
jubittajohn
committed
UPSTREAM: <carry>: create termination events

sttts
authored and
jubittajohn
committed
UPSTREAM: <carry>: bootstrap-rbac-policy: move over .well-known rules

jacobsee
authored and
jubittajohn
committed
UPSTREAM: <carry>: warn only about unknown feature gates

sttts
authored and
jubittajohn
committed
UPSTREAM: <carry>: disable AES24, not supported by FIPS

rphillips
authored and
jubittajohn
committed
UPSTREAM: <carry>: Remove excessive e2e logging

p0lyn0mial
authored and
jubittajohn
committed
UPSTREAM: <carry>: conditionally fill the UserAgent from the currently running test

p0lyn0mial
authored and
jubittajohn
committed
UPSTREAM: <carry>: refactor/improve CRD publishing e2e tests in an HA setup

p0lyn0mial
authored and
jubittajohn
committed
UPSTREAM: <carry>: Add OpenShift tooling, images, configs and docs

marun
authored and
jubittajohn
committed
UPSTREAM: <carry>: export HandleFlags

soltysh
authored and
jubittajohn
committed
UPSTREAM: <carry>: noderestrictions: add node-role.kubernetes.io/* to allowed node labels

sttts
authored and
jubittajohn
committed
UPSTREAM: <carry>: kube-apiserver: ignore SIGTERM/INT after the first one

sttts
authored and
jubittajohn
committed
UPSTREAM: <carry>: use hardcoded metrics scraping authorizer for delegated apiservers

deads2k
authored and
jubittajohn
committed
UPSTREAM: <carry>: allow kubelet to self-authorize metrics scraping

deads2k
authored and
jubittajohn
committed
UPSTREAM: <carry>: provide events, messages, and bodies for probe failures of important pods

deads2k
authored and
jubittajohn
committed
UPSTREAM: <carry>: allows for switching KS to talk to Kube API over localhost

p0lyn0mial
authored and
jubittajohn
committed
UPSTREAM: <carry>: add management support to kubelet

rphillips
authored and
jubittajohn
committed
UPSTREAM: <carry>: allows for switching KCM to talk to Kube API over localhost

p0lyn0mial
authored and
jubittajohn
committed
UPSTREAM: <carry>: Ensure service ca is mounted for projected tokens

jacobsee
authored and
jubittajohn
committed
UPSTREAM: <carry>: apiserver: add system_client=kube-{apiserver,cm,s} to apiserver_request_total

sttts
authored and
jubittajohn
committed
UPSTREAM: <carry>: emit event when readyz goes true

deads2k
authored and
jubittajohn
committed
UPSTREAM: <carry>: crd: add ClusterOperator condition message table column

sttts
authored and
jubittajohn
committed
UPSTREAM: 103612: tolerate additional, but congruent, events for integration test

deads2k
authored and
jubittajohn
committed
UPSTREAM: <carry>: add a way to inject a vulnerable, legacy service-ca.crt for migration compatibility

deads2k
authored and
jubittajohn
committed
UPSTREAM: <carry>: skip posting failures to aggregated APIs to avoid getting false positives until the server becomes ready

p0lyn0mial
authored and
jubittajohn
committed
UPSTREAM: <carry>: send Retry-After when not ready with a caller opt in

tkashem
authored and
jubittajohn
committed
UPSTREAM: <carry>: add max_housekeeping_interval

rphillips
authored and
jubittajohn
committed
UPSTREAM: <carry>: sets X-OpenShift-Internal-If-Not-Ready HTTP Header for GC and Namespace controllers

p0lyn0mial
authored and
jubittajohn
committed
UPSTREAM: <carry>: Release lock on KCM and KS termination

tnozicka
authored and
jubittajohn
committed
UPSTREAM: <carry>: use console-public config map for console redirect

atiratree
authored and
jubittajohn
committed
UPSTREAM: <carry>: fix [sig-auth] ServiceAccounts no secret-based service account token should be auto-generated

tkashem
authored and
jubittajohn
committed
UPSTREAM: <carry>: optionally enable retry after until apiserver is ready

tkashem
authored and
jubittajohn
committed
UPSTREAM: <carry>: make the PSA workload admission warnings honor the changes that SCC will eventually make to the pod

deads2k
authored and
jubittajohn
committed
UPSTREAM: <carry>: PSa metrics: log platform namespaces in audit denies

stlaz
authored and
jubittajohn
committed
UPSTREAM: 115328: annotate early and late requests

tkashem
authored and
jubittajohn
committed
UPSTREAM: <carry>: disable load balancing on created cgroups when managed is enabled

haircommander
authored and
jubittajohn
committed
UPSTREAM: <carry>: APISelfSubjectReview: only test v1beta1 API

bertinatto
authored and
jubittajohn
committed
UPSTREAM: <carry>: Export internal code from k8s.io/apimachinery/pkg/util/managedfields

bertinatto
authored and
jubittajohn
committed
UPSTREAM: <carry>: when only this kube-apiserver can fulfill the kubernetes.default.svc, don't wait for aggregated availability

deads2k
authored and
jubittajohn
committed
UPSTREAM: <carry>: merge v3 openapi discovery and specs for special groups

atiratree
authored and
jubittajohn
committed
UPSTREAM: <carry>: selfsubjectaccessreview: grant user:full scope to self-SARs that have user:check-access

liouk
authored and
jubittajohn
committed
UPSTREAM: <carry>: retry etcd Unavailable errors

p0lyn0mial
authored and
jubittajohn
committed
UPSTREAM: <carry>: Export cpu stats of ovs.slice via prometheus

MarSik
authored and
jubittajohn
committed
UPSTREAM: <carry>: advertise shared cpus for mixed cpus feature

Tal-or
authored and
jubittajohn
committed
UPSTREAM: <carry>: temporarily disable reporting e2e text bugs and enforce 2nd labeling to make tests work

soltysh
authored and
jubittajohn
committed
UPSTREAM: <carry>: add new admission for handling shared cpus

Tal-or
authored and
jubittajohn
committed
UPSTREAM: <carry>: Add openshift feature gates to kube-apiserver - inject openshift feature gates into pkg/features

jacobsee
authored and
jubittajohn
committed
UPSTREAM: <carry>: allow type mutation for specific secrets

tkashem
authored and
jubittajohn
committed
UPSTREAM: <carry>: annotate audit events for requests during unready phase and graceful termination phase

tkashem
authored and
jubittajohn
committed
UPSTREAM: <carry>: add etcd3RetryingProberMonitor for retrying etcd Unavailable errors for the etcd health checker client

jacobsee
authored and
jubittajohn
committed
UPSTREAM: <carry>: add arbiter node role to known labels

eggfoobar
authored and
jubittajohn
committed
UPSTREAM: <carry>: disable etcd readiness checks by default

ingvagabund
authored and
jubittajohn
committed
UPSTREAM: <carry>: log only deprecated api requests

sanchezl
authored and
jubittajohn
committed
UPSTREAM: <carry>: admission: validate minimumKubeletVersion

jacobsee
authored and
jubittajohn
committed
UPSTREAM: <carry>: Add volume group snapshot test driver

jsafrane
authored and
jubittajohn
committed
UPSTREAM: <carry>: allow TLS1.3 or modern profile to be specified

authored and
jubittajohn
committed
UPSTREAM: <carry>: unrevert: Mark admissionregistration.k8s.io/v1beta1 as deprecated."

benluddy
authored and
jubittajohn
committed
UPSTREAM: <carry>: Add plugin for storage performant security policy

gnufied
authored and
jubittajohn
committed
UPSTREAM: 134442: Fix ResourceQuota test for CRDs with long names

bertinatto
authored and
jubittajohn
committed
UPSTREAM: <carry>: Skip CPU resource status for workload-pinned pods

harche
authored and
jubittajohn
committed
UPSTREAM: <carry>: Extend k8s suite timeouts for parallel testing load

jupierce
authored and
jubittajohn
committed
UPSTREAM: <carry>: un-skip MutableCSINodeAllocatableCount tests

jsafrane
authored and
jubittajohn
committed
UPSTREAM: <carry>: test: skip private registry test

haircommander
authored and
jubittajohn
committed
UPSTREAM: <carry>: Fix ClusterIsIPv6() detection for dual-stack v6-primary clusters

jluhrsen
authored and
jubittajohn
committed
UPSTREAM: <carry>: Add jacobsee and jubittajohn to DOWNSTREAM_OWNERS

jacobsee
authored and
jubittajohn
committed
UPSTREAM: <carry>: Register OpenShift cloud providers in k8s-tests-ext

authored and
jubittajohn
committed
UPSTREAM: 138259: Filter out unschedulable nodes in kubectl describe e2e test

authored and
jubittajohn
committed
UPSTREAM: 138401: Improve WatchList test robustness

jacobsee
authored and
jubittajohn
committed
UPSTREAM: <carry>: Export email validation functions

ShazaAldawamneh
authored and
jubittajohn
committed
UPSTREAM: <carry>: authentication: enforce claims.email_verified usage when claims.email is used in username expression

ShazaAldawamneh
authored and
jubittajohn
committed
UPSTREAM: 138981: Cache selinux conflicts

gnufied
authored and
jubittajohn
committed
UPSTREAM: <carry>: remove RouteExternalCertificate feature gate

jcmoraisjr
authored and
jubittajohn
committed
UPSTREAM: 138075: apiserver: cache etcd storage monitors to avoid recreating clients on each metrics scrape

xigang
authored and
jubittajohn
committed
UPSTREAM: <carry>: add kubernetes/conformance umbrella suite

authored and
jubittajohn
committed
UPSTREAM: <carry>: fix kubernetes/conformance to filter on [Conformance] label

authored and
jubittajohn
committed
UPSTREAM: <carry>: Add NodeSelectorAdjuster admission plugin for standalone clusters

authored and
jubittajohn
committed
UPSTREAM: <carry>: adapt quota admission to upstream API changes
jubittajohn
committed
UPSTREAM: <carry>: update builder images
jubittajohn
committed
UPSTREAM: <carry>: add SetCPULoadBalanceDisable() stub to qos_container_manager_linux_test.go

jacobsee
authored and
jubittajohn
committed
UPSTREAM: <carry>: add system_client="" to the expected metric strings in flagz_test.go and statusz_test.go

jacobsee
authored and
jubittajohn
committed
UPSTREAM: <drop>: test integration failure

bertinatto
authored and
jubittajohn
committed
UPSTREAM: <carry>: Fix event garbage collection when ClientsAllowTLSCacheGC is enabled

jacobsee
authored and
jubittajohn
committed
UPSTREAM: <drop>: attempt to release object to fix integration issue

bertinatto
authored and
jubittajohn
committed
UPSTREAM: <carry>: Make usage of pinnedManagementEnabled thread-safe

jacobsee
authored and
jubittajohn
committed
UPSTREAM: <carry>: Disable failing e2e tests
jubittajohn
committed
UPSTREAM: <carry>: Strip snapshot-metadata sidecar from groupsnapshot driver when not enabled
jubittajohn
committed
UPSTREAM: 139085: Fix DRA extended resource quota test race condition

sairameshv
authored and
jubittajohn
committed
UPSTREAM: <drop>: hack/update-vendor.sh
jubittajohn
committed
UPSTREAM: <drop>: make update
jubittajohn
committed

Commits on Jul 3, 2026

UPSTREAM: <carry>: Store SELinuxWarningController upgrade check as a ConfigMap
jsafrane
committed