The InPlacePodVerticalScaling feature gate has been GA and locked to
true since v1.35, and is now removed. Code paths that handled the
disabled state are removed, along with gate overrides in tests.
The node version skew check in pod resize validation is also removed:
the oldest kubelet supported by a v1.38 apiserver is v1.35, where the
feature is always enabled.
WithCompression takes a per-resource Rule under one fixed 1472Ki limit,
and the reader rejects trailing bytes and padded lengths. The v1alpha1
types get declarative validation and API defaulting, with the top-level
list renamed compressionResources and encryption's validation untouched.
Add seccompProfile.type OCI with the oci field (a digest-pinned ref and an
optional RuntimeDefault or Localhost baseProfile) and the alpha
SecurityProfileOCI feature gate, as described in KEP-6061. The oci field
is validated declaratively, with custom validators for the reference and
the base profile path; the gate check and the rule that privileged
containers cannot use an OCI profile stay handwritten. While the gate is
disabled the type is rejected unless the old object already uses it.
PodSecurity baseline and restricted keep rejecting OCI. The
SecurityProfileOCI node declared feature keeps pods with OCI profiles on
nodes whose kubelet has the gate enabled and a runtime that supports OCI
seccomp profiles. The field is named ref instead of the KEP's reference,
following the kube-api-linter naming convention for new fields.
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
Pulls in github.com/pandatix/go-abnf (OpenMetrics decoder in expfmt),
pinned to v0.5.5 for the long-line decoding fix (prometheus/common#1028).
v0.73.0 is skipped: its go-abnf v0.5.1 requires the blocklisted
hashicorp/go-uuid.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
go tool's output format changed with Go 1.27; it now shows
command (module)
This updates hack/update-tools.sh to handle the new format.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Fix correctness bugs in the PreQueueingHint narrowing added in
879f922f6b.
Add an evaluateAllPods field to preQueueingHintPodKeys to distinguish
1) some plugins want all pods evaluated while others narrow, from
2) all pods must be evaluated for all plugins.
Before, a PreQueueingHintFn that returned AllPods or an error made
runPreQueueingHintPlugins return nil, which always meant (2). A plugin
without a PreQueueingHintFn was skipped, so another plugin's narrowing
could drop pods that only the skipped plugin would requeue.
Cases handled:
1. A plugin with no PreQueueingHintFn is treated as AllPods: set
evaluateAllPods, so its pods are evaluated for it while other plugins
narrow.
2. A PreQueueingHintFn error falls back to AllPods for that plugin only;
other plugins' narrowing is preserved.
3. A plugin returning AllPods sets evaluateAllPods without discarding
other plugins' narrowing.
4. A plugin can have several registrations matching an event, in one or
more profiles, and perPlugin is keyed by plugin name. If any of them
needs all pods, that plugin is not narrowed for the event.
Also skip PreQueueingHint entirely when CompositePodGroup is enabled,
instead of running the hints and discarding the result. Report
PreQueueingHintFn errors, and pod lookup failures other than NotFound,
with HandleErrorWithLogger. Add the prequeueing_hint_fn_error value to
the result label of scheduler_pre_queueing_hint_evaluations_total (now
constants), and update its help text and the generated metrics
documentation. Plugins without a PreQueueingHintFn are not recorded.
Update the PreQueueingHintFn and PreQueueingHintResult API docs: the
hint runs per matching registration, and narrowing is per plugin.
Add unit tests for each case, the result label values, multi-profile
narrowing, and group preCheck.
KEP: kubernetes/enhancements#6132
The updated logcheck now warns about passing a pointer as value where String
could crash if nil. The new findings are false positives, but there have been
real issues before and adding klog.SafePtr is cheap mitigation for false
positives.
The HandleError* wrappers around contextual logging are now annotated such that
the new logcheck knows that they do contextual logging. This revealed some real
issues (expecting printf-style formatting or missing keys, passing a *function*
instead of the function result).
A raw rest.Config lets a controller build a client that bypasses the
client configuration and transport wrappers the controller manager
applies to the clients it builds, such as the leader election write gate
of KEP-6361. Deprecate Config and ConfigOrDie on ControllerClientBuilder
and on the cloud-provider copy of the interface; out-of-tree cloud
providers and controller managers that call them keep working, and the
configs they get still carry the controller manager's wrappers.
Add TypedClientBuilder, implemented by both in-tree builders, with the
clients controllers were building from raw configs: metadata, dynamic
and scale clients, WithRateLimits for controllers that need more QPS and
burst than the defaults, and WithDropManagedFields for the informer
clients. The controller managers hand the builder to their controllers,
and a forbidigo rule keeps in-tree code off the deprecated methods. Unit
tests cover the derived builders on both implementations.
DiscoveryClient's discovery-tuned limits become a floor rather than an
override, so a builder configured with higher limits keeps them; the
storage version migrator relies on that for its discovery client.
The HPA metrics and apiextensions clients still need a config and are
built in one lint-exempted place in the controller context, since
k8s.io/controller-manager does not depend on those client packages.
DynamicControllerClientBuilder cached the composed WrapTransport, so the
base config's wrapper was applied twice to every client after the first
one built under a service account name. Cache only the token wrapper.
This ensures that new upstream versions are made visible using
standard Go tools; it also avoids repeated "go install"s of the same
version of the tool.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This ensures that new upstream versions are made visible using
standard Go tools; it also avoids repeated "go install"s of the same
version of the tool.
Since the version of zeitgeist is tracked in hack/tools/go.mod, this
also removes the version tracking in zeitgeist's own
build/dependencies.yaml, and updates the introductory comment there.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This ensures that upstream changes aren't applied without review; it
also avoids repeated "go install"s of the same version of the tool.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Add the k8s.io/apiextensions-api staging module and move the v1 and
v1beta1 types there. The old packages keep the conversions and alias the
moved identifiers in a generated deprecated.go.
govulncheck complains about publishing-verifier's use of glog:
The package pattern matched the following 2 root packages:
k8s.io/kubernetes/hack/tools/publishing-verifier
k8s.io/kubernetes/hack/tools/traceparse
Govulncheck scanned the following 6 modules and the go1.27.3 standard library:
k8s.io/kubernetes/hack/tools
github.com/golang/glog@v1.2.2
golang.org/x/exp@v0.0.0-20260212183809-81e46e3db34a
golang.org/x/mod@v0.41.0
gopkg.in/yaml.v2@v2.4.0
k8s.io/publishing-bot@v0.5.0
=== Symbol Results ===
Vulnerability #1: GO-2025-3372
Vulnerability when creating log files in github.com/golang/glog
More info: https://pkg.go.dev/vuln/GO-2025-3372
Module: github.com/golang/glog
Found in: github.com/golang/glog@v1.2.2
Fixed in: github.com/golang/glog@v1.2.4
Example traces found:
#1: publishing-verifier/publishing-verifier.go:167:32: publishing.verifyPublishingBotRules calls config.LoadRules, which calls glog.Infof
=== Package Results ===
No other vulnerabilities found.
=== Module Results ===
No other vulnerabilities found.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
storage/value/compression (KEP-6264) compresses objects ahead of any
encryption at rest, in frames with a 9-byte header and a CRC32C. Only a
checksum mismatch is value.IsDataCorruption, so a malformed frame can't
make an intact object eligible for unsafe deletion. Reads always decode
frames. Writes follow a StorageCompressionConfiguration whose resource
checks are shared with EncryptionConfiguration. Values over 1.5 MiB minus
64 KiB are never compressed, so anything compressed can be rewritten
uncompressed. The flag and storage wiring come later.
Add two alpha Kubelet error counter metrics per KEP-5972:
- kubelet_sync_result_errors_total (label: action) recorded in
kubeGenericRuntimeManager.SyncPod for each failed SyncResult action or
top-level PodSyncResult.SyncError (action="SyncPod").
- kubelet_pod_worker_errors_total (label: operation_type) incremented in
podWorkerLoop when a sync iteration fails with a non-Canceled error.
* scheduler: rank pods from disruption mode Single groups as individual preemption victims
* scheduler: label preemption_workload_disruptions by victim type
Record workload preemption disruptions per preemption unit type (pod,
podgroup, compositepodgroup) instead of a single count of group-related
units.
- PreemptionVictim gains Type(); PreemptionCandidate replaces
NumPodGroupDisruptions() with NumDisruptionsByVictimType().
- The unit type is the topmost DisruptionMode=All group, or pod for
pods evicted on their own (standalone or in DisruptionMode=Single
groups). isGroupVictim is removed.
- The metric stays workload-preemptor only: legacy pod preemption keeps
its own metrics until naked pods move to the workload scheduling cycle.
* scheduler: parameterize pod group scheduling attempt and latency metrics with type and profile
Parameterize pod group scheduling attempts, scheduling latency, and algorithm latency metrics with entity type ("podgroup" vs "compositepodgroup") and profile. Specifically:
- Export PodGroupScheduleAttempts and PodGroupSchedulingLatency with [result, profile, type] labels.
- Convert PodGroupSchedulingAlgorithmLatency to HistogramVec with [profile, type] labels.
- Update profile metrics helpers with entityType and add PodGroupAlgorithmLatency helper.
- Update scheduleOnePodGroup call sites to pass rootPodGroupInfo.Type() and profile name.
- Add unit tests in profile_metrics_test.go and schedule_one_podgroup_test.go.
* Address review comments
- Wait for the asynchronous binding cycle to finish before asserting
attempt metrics.
- Add the child pod group result in the composite pod group case so the
per-leaf loop actually runs.
- Drop the algorithm latency assertion: submitPodGroupAlgorithmResult
does not record it, and TestPodGroupAlgorithmLatency covers it.
- Assert that only the root entity type is reported.
* scheduler: rename pod group scheduling metrics entity label from type to entity
* Update pkg/scheduler/metrics/profile_metrics_test.go
Co-authored-by: Antoni Zawodny <zawodny@google.com>
---------
Co-authored-by: Antoni Zawodny <zawodny@google.com>
The device manager already tracks how many devices it considers healthy
and unhealthy for each resource, and never reports it. The only
device-plugin metrics kubelet exposes are
device_plugin_registration_total and
device_plugin_alloc_duration_seconds, so from outside a node the single
observable symptom of devices going bad is allocatable shrinking --
which conflates three different causes: the plugin reported devices
unhealthy, the plugin deregistered, or the hardware is gone. An operator
cannot tell them apart from metrics alone.
Two cases motivate this concretely. A healthy device turning unhealthy
leaves node capacity unchanged, because capacity counts both sets and
only allocatable counts healthy devices, so the event is at best
inferable by diffing two other series. And a resource whose devices have
all gone unhealthy looks exactly like a resource whose plugin went away,
since both end up at zero allocatable.
Add kubelet_device_plugin_devices{resource_name,health_state}, an ALPHA
gauge sourced from the sets GetCapacity already walks. GetCapacity is
the one of the four mutation sites that already holds m.mutex and
already iterates healthyDevices and unhealthyDevices to compute capacity
and allocatable, and its deletedResources loop is where resources are
garbage collected, so the series are dropped there too. Without that
removal the last observed counts would be reported forever for a
resource that no longer exists. The refresh cadence becomes the node
status sync rather than every ListAndWatch message, which suits a gauge.
The metric deliberately carries no per-device label. Whole-device
plugins advertise one ID per card, where such a label would be fine, but
shared-resource plugins advertise synthetic quota units instead, so a
per-device label there yields many series that carry no information
because the IDs do not correspond to distinct hardware. Per-device
detail remains available through the podresources API.
Signed-off-by: Jian Zhang <jian.zhang@bitdeer.com>
* scheduler: parameterize topology-aware placement metrics with entity type
* Address review comments
* scheduler: clarify placement metrics help text for composite pod groups
* scheduler: rename placement metrics entity label from type to entity
Align scheduler_queued_entities and scheduler_queue_incoming_entities_total
with the placement metrics, which use "entity" for the same values.
"type" is also ambiguous next to scheduler_cache_size{type}, where it
means the cached object kind.
kubernetes-prow[bot]