isExistingSocket dials a socket to decide whether it exists. The Windows
implementation assigned the connection from winio.DialPipe to _ and
never closed it, and go-winio sets no finalizer on the handle, so every
socket that answered the probe left a named pipe instance open until
kubeadm exited. DetectCRISocket probes each of the known CRI sockets in
turn, so one instance leaked per socket that answered.
Defer Close on the connection, after the error check since DialPipe
returns a nil connection together with its error. The unix
implementation already closes its connection once the dial succeeds.
With ManagedFieldsOptOutClient enabled, the informers use their own
client with DropManagedFields set, replacing the pod informer's trim.
Plugins' handle.ClientSet() is unchanged.
Add the missing etcd manifest to 'kubeadm upgrade diff' and to the dry
run of 'kubeadm upgrade apply' and 'kubeadm upgrade node' when
etcd.local is set.
These currently show the kube-apiserver, kube-controller-manager and
kube-scheduler manifests, but not the etcd manifest. An upgrade
also rewrites this manifest when etcd is managed by kubeadm.
The diff builds it as the upgrade does and compares it with the manifest
on disk. The dry run writes it before the other components unless the
etcd upgrade is disabled.
* Drop pkg/util/iptables, port to sigs.k8s.io/iptables-wrappers/pkg/iptables
* vendor iptables-wrappers
* update imports
* drop pkg/util/iptables
* update for constructor changes
* update for Restore changes
* update for Monitor changes
* add context args to remaining utiliptables methods
* update for GetChainsFromTable changes
The gate graduated to GA and was locked to its default in 1.34, so 1.38 is
the first release in which the compatibility window allows removing it.
With the gate always on, the kubelet checks collapse: swap behaviour is
validated unconditionally, the node status reports swap capacity whenever
cadvisor reports it, and LimitedSwap depends only on the swap controller
being available. The kubelet configuration error for setting memorySwap
while the gate was disabled is unreachable, since a locked gate cannot be
turned off, and goes with it.
The e2e feature label of the same name is a test selector rather than a
reference to the gate, so it stays.
These methods already exist in informers.SharedInformerFactory. Because the
factories here key informers by group/version/resource,
WaitForCacheSyncWithContext returns the new cache.GVRSyncResult instead of
cache.SyncResult.
Start and WaitForCacheSync are now marked with //logcheck:context. Consumers
which use the logcheck linter must switch to the *WithContext variants.
Mock implementations of these interfaces need to be extended.
A raw rest.Config lets a controller build a client that bypasses the
client configuration and transport wrappers the controller manager
applies to the clients it builds, such as the leader election write gate
of KEP-6361. Deprecate Config and ConfigOrDie on ControllerClientBuilder
and on the cloud-provider copy of the interface; out-of-tree cloud
providers and controller managers that call them keep working, and the
configs they get still carry the controller manager's wrappers.
Add TypedClientBuilder, implemented by both in-tree builders, with the
clients controllers were building from raw configs: metadata, dynamic
and scale clients, WithRateLimits for controllers that need more QPS and
burst than the defaults, and WithDropManagedFields for the informer
clients. The controller managers hand the builder to their controllers,
and a forbidigo rule keeps in-tree code off the deprecated methods. Unit
tests cover the derived builders on both implementations.
DiscoveryClient's discovery-tuned limits become a floor rather than an
override, so a builder configured with higher limits keeps them; the
storage version migrator relies on that for its discovery client.
The HPA metrics and apiextensions clients still need a config and are
built in one lint-exempted place in the controller context, since
k8s.io/controller-manager does not depend on those client packages.
DynamicControllerClientBuilder cached the composed WrapTransport, so the
base config's wrapper was applied twice to every client after the first
one built under a service account name. Cache only the token wrapper.
CoreDNS was pinned to a single hardcoded version constant regardless of the
target Kubernetes version, unlike etcd which already resolves its version
from a per-Kubernetes-minor support map. Users could override the deployed
tag via ClusterConfiguration.dns.imageTag, but several code paths (Corefile
migration, upgrade preflight checks, and `kubeadm upgrade plan` output)
still referenced the raw constant directly, so the override didn't fully
propagate.
Mirror the existing etcd pattern: add SupportedCoreDNSVersion (a
per-Kubernetes-minor map) and CoreDNSSupportedVersion() as a resolver,
sharing the lookup logic with EtcdSupportedVersion(). GetDNSImage/
GetDNSImageTag resolve the default through this map and then apply the
user's dns.imageTag override on top, matching GetEtcdImage/GetEtcdImageTag.
Thread the resolved/overridden version through the Corefile migration
logic, the upgrade preflight CoreDNS checks, and the suggested DNSVersion
in `kubeadm upgrade plan`, so the override is honored everywhere instead of
only in the deployed manifest.
The etcd data dir is backed up with "cp -r <dataDir> <backupDir>" into
an existing backup dir, so the data lives in <backupDir>/<basename>.
Rolling back with "cp -r <backupDir> <dataDir>" copied the backup dir
inside the data dir and left the live data untouched.
Replace the cp and xcopy variants of CopyDir with one portable Go
implementation that copies the contents of src and keeps the source
file modes. Remove the member dir before restoring so files written
since the backup do not survive, and refuse to clear it at all unless
the backup has a member dir to restore from.
The backup copies the data dir of a running etcd, so it can fail when
etcd renames a WAL file during the copy. Retry it for up to 30 seconds,
starting from an empty backup dir each time.
listMembers polls MemberList until the EtcdAPICall timeout, but its
condition returned the error, which stops the poll immediately. One
transient error failed GetMemberID and ListMembers, breaking control
plane join right after adding a learner, and etcd member removal on
reset. Return false, nil like the other etcd retry loops.
Now that the poll runs to the deadline, say that the retry timeout was
exhausted and keep the last etcd error as the cause.
xcopy prompts whether a non-existent destination is a file or a directory and
whether to overwrite existing files, and both prompts fail without an
interactive stdin. The first breaks TestCopyDir/success on Windows (exit status
2), the second would break the etcd data rollback, which copies over an existing
data dir. Pass /I and /Y so xcopy doesn't prompt.
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
kubernetes-prow[bot]