Conversation
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
To verify: ``` dockerd-rootless-setuptool.sh install kubetest2-kind --build --up --down --test=ginkgo -- --use-built-binaries --focus-regex='\[Feature:KubeletInUserNamespace\]' ``` Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
The 'disabled' test case asserted that the drop in memory.available after reserving 32x2Mi hugepages should be less than expectedHugepageBytes - margin (64MiB - 50MiB = 14MiB). This threshold is too strict because the cgroup-based WorkingSet for the root cgroup already reflects some of the hugepage reservation: the kernel removes hugepages from the free pool, so MemFree drops and WorkingSet rises, causing AvailableBytes (= Limit - WorkingSet) to decrease naturally even without adjustForHugePages. In the failing run the natural drop was ~47MiB, exceeding the 14MiB threshold. Change the assertion to compare against expectedHugepageBytes (64MiB) instead of expectedHugepageBytes - margin. This still distinguishes the disabled case (drop < 64MiB, natural WorkingSet increase only) from the enabled case (drop >= 64MiB - 50MiB = 14MiB, adjustForHugePages subtracts full capacity). Introduced in df35523 ('Make the eviction signal hugepages aware.'). Signed-off-by: Lukasz Wojciechowski <l.wojciechow@partner.samsung.com>
…2e-fix Update hostname.exe in busybox image to support --fqdn on Windows
Pass clear pod group cycle state in podgroup preemption
…preparation DRA: Optional Node Operations
…netes#140759) * cli-runtime: include group in resource-not-found error message Signed-off-by: Abhishek Pareek <makeittotop@users.noreply.github.com> * cli-runtime: align resource-not-found error with helpers.go pattern Per review feedback on kubernetes#140759: use a switch covering group+version, group-only, version-only. Also drops the added unit test as requested. * cli-runtime: drop stray whitespace diff in builder_test.go Per review feedback on kubernetes#140759: revert the leftover blank-line changes from the removed test so this file has no unrelated diff. --------- Signed-off-by: Abhishek Pareek <makeittotop@users.noreply.github.com> Co-authored-by: Abhishek Pareek <makeittotop@users.noreply.github.com>
…troller-informer-cache-events-revert Revert "DRA ResourceClaim controller: updated mutation cache based on events"
Introduces the `DerivedAttributes` field to `ExactDeviceRequest` and `DeviceSubRequest`, along with the `DeviceDerivedAttribute` type, to support virtual CEL-derived attributes in DRA. Registers the `DRADerivedAttributes` feature gate.
…tion for derived attributes Introduces validation logic for DerivedAttributes, ensuring unique attribute names, properly formatted fully-qualified names, and correct API transitions via conversion. Also implements compile-time CEL checks to verify that derived attributes evaluate to primitive scalars (string, integer, boolean, semver) or lists of them.
- Implement CEL evaluation runtime for derived attributes, supporting primitive scalars, lists of scalars, and semantic version types. - Refactor cel.Cache to use a private getOrCompile helper that partitions the cache keyspace using 'selector' and 'derived' scopes. - Remove the unused Check method from the cel.Cache struct.
Plumb the DRADerivedAttributes feature gate to the scheduler and the experimental structured allocator, and implement runtime evaluation and request-scoped caching of CEL-derived virtual attributes. Specifically: - Update the `allocator` struct to maintain a request-scoped cache of evaluated derived attributes (`derivedAttributesCache`), preventing leakage or interference when different requests/subrequests define conflicting CEL expressions for the same virtual attribute name. - Implement unified attribute resolution in `lookupAttribute` that first resolves and caches derived attributes via CEL compilation and evaluation, falling back to static physical attributes on failure or absence. - Refactor the `constraint` interface (`add` and `remove` methods) to receive the full `requestData` context, enabling constraints to leverage the allocator's unified request-aware attribute lookup. - Plumb the `DRADerivedAttributes` feature gate through the scheduler's feature framework down to the allocator. - Add allocator test cases covering cross-request hardware alignment (e.g. mapping `numa` and `numaNode` to a virtual shared numa node), attribute shadowing/overriding, and CEL evaluation error handling.
…tributes [KEP-6080] (alpha) Add implementation of DRA Derived Attributes
Add compatibility groups to resource.k8s.io across v1, v1beta1, v1beta2 and the internal API: the driver-declared DeviceCounterConsumption.CompatibilityGroups field (an atomic list of opaque group names, declaratively unique) and the DeviceCompatibilityGroupsMaxSize constant bounding it. All compatibility-group validation is declarative, applied directly as recommended for net-new fields, with no handwritten counterparts. Also includes the DRADeviceCompatibilityGroups feature gate (registered in the versioned feature reference list), the apiserver drop strategy, and the apiserver-side tests: create/update strategy drop tests, declarative-validation coverage, and the max-size ResourceSlice test objects (the generated declarative rules and test fixtures land with the next commit; the integration wiring that enables the feature gate lands with the implementation commit).
Regenerate deepcopy, conversions, declarative validations, protobuf (.pb.go and .proto), swagger docs, openapi (generated code and published api/openapi-spec files), model names, client-go apply-configurations, the k8s.io/api serialization-compatibility fixtures, and the generated declarative-validation test fixtures for the new compatibility-groups field.
KEP-2033: promote KubeletInUserNamespace feature to beta (v1.37)
…d e2e tests Implement compatibility-group-aware allocation in the structured allocator (experimental, incubating, and stable channels) and the scheduler DRA plugin, and teach the resourceslice controller DroppedFieldsError.DisabledFeatures to report the DRADeviceCompatibilityGroups gate. Add allocator and controller unit tests, integration tests (core, scheduler_perf), and e2e tests including the feature-gate-cycle test. The compatibility-groups-taint-rollback regression test is by thc1006, who found the candidate-rollback gap in review and provided the test case. Co-authored-by: thc1006 <hctsai@linux.com>
…sybox 1.38.0-1 These Windows test images use busybox as their base image. Re-point their Windows BASEIMAGE entries at busybox:1.38.0-1 (which adds --fqdn support to hostname.exe) and bump each image version so the rebuilt images are published and consumed by e2e: agnhost 2.66.0 -> 2.66.1 nginx 1.27.0-1 -> 1.27.0-2 nginx-new 1.28.0-1 -> 1.28.0-2 glibc-dns-testing 2.1.0 -> 2.1.1
The gate-off skip derived its grouped-counter-set map eagerly over every device of every slice at each NewAllocator call, scanning AllocatedSharedDeviceIDs per device. At consumable-capacity scale this made every pod-scheduling attempt pay O(devices x shared allocations) even in clusters that use no compatibility groups at all, collapsing scheduling throughput (pull-kubernetes-scheduler-perf, ConsumableCapacity/full_1000nodes). Replace it with groupedCounterSetsForPool: computed lazily the first time the version-skew skip touches a pool and then cached, mirroring availableCounters. Pools whose devices never reach the skip - including every pool in a cluster without compatibility groups - never pay for the walk, and pools that do pay only for their own slices.
…ister gives no hint in batching
The set is produced from and probed with UniqueString counter-set names, so keep it in that domain instead of converting to plain strings on both sides: handle comparisons replace byte-string hashing, matching how the counter accounting already indexes by CounterSet directly.
…on on events Add PreQueueingHintFn that plugins implement to return targeted pod keys per event, narrowing which pods are evaluated on cluster events and avoiding thundering herd on the scheduling queue. The DRA plugin implements this for ResourceClaimTemplate-based workloads, falling back to evaluating all pods for deallocation or errors. Per-plugin narrowing ensures each plugin\047s QueueingHintFn is only called for pods that plugin\047s PreQueueingHintFn identified. Feature gate: SchedulerPreQueueingHints (beta, default=true) KEP: kubernetes/enhancements#6132
Signed-off-by: weizhou blue <weizhou.lan@daocloud.io>
Adding the new Lifecycle API group caused apidiff to complain because
this situation had not been encountered when setting up the initial set of
allow rules and wasn't handled.
We don't need a CHANGELOG.md entry for this because it is a normal Go API
change, so the entry gets removed.
Before:
Incompatible changes:
- ./informers.SharedInformerFactory.Lifecycle: added
After:
Acceptable incompatible changes:
- ./informers.SharedInformerFactory.Lifecycle: added
- ./kubernetes.Interface.LifecycleV1alpha1: added
scheduler: add PreQueueingHint extension point to narrow pod evaluation on events
…-pod affinity Introduces a "fast-track" evaluation path for inter-pod affinity and anti-affinity rules that use the "kubernetes.io/hostname" topology key. If only kubernetes.io/hostname topology is present (which is a common use case), we only need to check the current node. There is no need to do O(N*M) cluster-wide scans. Key Optimizations: - Categorized affinity and anti-affinity terms into "host-scoped" (kubernetes.io/hostname) and "non-host-scoped" groups during PreFilter. - Updated NodeInfo and Snapshot to specifically track pods with non-host-scoped anti-affinity, allowing the scheduler to skip global map lookups when only kubernetes.io/hostname rules are present. - Updated the Filter phase to perform efficient local checks against pods already on the target node for kubernetes.io/hostname-scoped rules, rather than relying on global topology counts. The change is guarded with the InterPodAffinityHostnameFastPath feature gate. Testing & Correctness: - Added `TestFastTrackInterPodAffinity` to `filtering_test.go` to verify the new fast-path logic against various topology and namespace scenarios. - Added `TestAffinityDiscrepancy` to `filtering_test.go` to ensure correctness when a pod has multiple affinity terms that must be satisfied by a single existing pod. - Modified relevant integration tests (including preemption and scoring) to execute tests combinatorially with the InterPodAffinityHostnameFastPath gate both enabled and disabled, ensuring functional parity.
…Authorize and EvaluateConditions and related changes
…AwareAuthorize and EvaluateConditions
…dir that needs excluding now
…e validation Upstream kubernetes#136886 migrated Secret.Type immutability validation to declarative validation, adding Origin and CoveredByDeclarative metadata to the field error. Update the expected errors in the OpenShift patch test to match. Signed-off-by: jubittajohn <jujohn@redhat.com>
…alidation Upstream 1.37 added declarative validation to ValidateSelfSubjectAccessReviewCreate, which requires a populated scheme and requestInfo in the context. The sibling subjectaccessreview/rest_test.go was updated but this OpenShift-carry test was missed. Signed-off-by: jubittajohn <jujohn@redhat.com>
…ted podcertificate test The mTLS server container runs under a Restricted security context (non-root with all capabilities dropped). In environments where Linux enforces net.ipv4.ip_unprivileged_port_start (default 1024), binding privileged port 443 fails with permission denied. Bump the container listen port to unprivileged port 8443 and configure the Service targetPort to 8443, retaining Service port 443 for callers.
…ting the test name The 1.37 test framework adds [Provider:gce,local] to the Flexvolumes test names. Update the GCE exclusion to match the provider-qualified names so the SSH-based tests remain skipped on OpenShift clusters without node SSH access. Signed-off-by: jubittajohn <jujohn@redhat.com>
OVN-Kubernetes does not implement localhost nodeport proxying. The upstream tests added in 1.37 for [Feature:LocalhostNodePorts] fail on all -ovn CI lanes because nothing is listening on 127.0.0.1:<NodePort>. Skip them only on OVN-K so they can still run on kube-proxy iptables/nftables/cilium backends. Signed-off-by: jubittajohn <jujohn@redhat.com>
…tream label injection change Signed-off-by: jubittajohn <jujohn@redhat.com>
…work plugin is OVNKubernetes
…r cost estimates Signed-off-by: jubittajohn <jujohn@redhat.com>
jacobsee
force-pushed
the
rebase-1.37
branch
from
September 16, 2026 23:44
878b8bc to
b2a9086
Compare
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jacobsee The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Member
Author
|
/pipeline required |
|
Scheduling required tests: Scheduling tests matching the |
|
/retest |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.