The updated logcheck now warns about passing a pointer as value where String
could crash if nil. The new findings are false positives, but there have been
real issues before and adding klog.SafePtr is cheap mitigation for false
positives.
The HandleError* wrappers around contextual logging are now annotated such that
the new logcheck knows that they do contextual logging. This revealed some real
issues (expecting printf-style formatting or missing keys, passing a *function*
instead of the function result).
A raw rest.Config lets a controller build a client that bypasses the
client configuration and transport wrappers the controller manager
applies to the clients it builds, such as the leader election write gate
of KEP-6361. Deprecate Config and ConfigOrDie on ControllerClientBuilder
and on the cloud-provider copy of the interface; out-of-tree cloud
providers and controller managers that call them keep working, and the
configs they get still carry the controller manager's wrappers.
Add TypedClientBuilder, implemented by both in-tree builders, with the
clients controllers were building from raw configs: metadata, dynamic
and scale clients, WithRateLimits for controllers that need more QPS and
burst than the defaults, and WithDropManagedFields for the informer
clients. The controller managers hand the builder to their controllers,
and a forbidigo rule keeps in-tree code off the deprecated methods. Unit
tests cover the derived builders on both implementations.
DiscoveryClient's discovery-tuned limits become a floor rather than an
override, so a builder configured with higher limits keeps them; the
storage version migrator relies on that for its discovery client.
The HPA metrics and apiextensions clients still need a config and are
built in one lint-exempted place in the controller context, since
k8s.io/controller-manager does not depend on those client packages.
DynamicControllerClientBuilder cached the composed WrapTransport, so the
base config's wrapper was applied twice to every client after the first
one built under a service account name. Cache only the token wrapper.
Unexpected linter reports are found when verify fails, but accidentally
disabling or breaking a linter check (for example, when editing the
configuration files or updating golangci-lint) could only be detected manually
by adding code which triggers the linter.
Now test cases in hack/testdata/golangci-lint provide expected linter
messages to detect such regressions. The test in test/integration/golangci-lint
verifies that all of them are reported and also fails when there are unexpected
reports for things which we intentionally do not enforce.
The test also verifies that all enabled linters are either covered or
documented as not being tested via "<linter> untested" comments. Stale comments
like that also cause a test failure.
Switch e2e tests to the freshly promoted test images:
- agnhost 2.66.1
- nginx 1.27.0-2 and 1.28.0-2
- glibc-dns-testing 2.1.1
Promoted in kubernetes/k8s.io#9787 and kubernetes/k8s.io#9788.
All four tags verified live on registry.k8s.io with digests
matching the promotion manifests.
The agnhost bump follows build/dependencies.yaml refPaths: the
manifest.go config, the kitten and nautilus BASEIMAGE files, and
the yaml fixtures that hardcode the tag.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
The new version includes a generic /envvar endpoint in netexec that
reads any named environment variable, enabling e2e tests to retrieve
spec.nodeName via the Downward API instead of relying on os.Hostname().
Ref: https://github.com/kubernetes/k8s.io/pull/9608
Signed-off-by: Jitesh Kumar <jiteshkumardj@gmail.com>
The latest pause version is 3.10.2 but due to the introduction
of the PATCH level version to the pause image (previously was
only MAJOR.MINOR), various files have remained on an older
version. Either 3.10 or 3.10.1. Our validation with
build/dependencies.yaml ./hack/verify-external-dependencies.sh
did not account for that.
Update outdated image versions across test manifests and add tracking
to build/dependencies.yaml for version drift detection via zeitgeist:
- agnhost: 2.32/2.53/2.54/2.57 → 2.61 (latest)
- etcd: 3.2.24 → 3.6.7-0
- kitten/nautilus BASEIMAGE: agnhost 2.57 → 2.61
and added etcd statefulset reference to existing etcd entry.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
Container runtimes like CRI-O and containerd reuse the code by copying
it from Kubernetes. To have a single source of truth for the streaming
server we now move the already isolated implementation to the
k8s.io/kubelet staging repository. This way runtimes can re-use the code
without copying the parts.
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
- Also update test-cmd.sh to pass a signing ca to the kube controller
manager, so CSRs work properly in integration tests.
Signed-off-by: Margo Crawford <margaretc@vmware.com>
When CRDs are deleted, discovery local cache is not invalidated.
This brings about `resource not found` error when new CRD with same name is created
with different fields(ie. changing scope from cluster-wide to namespaced).
Because this already deleted CRD still stays in serverresources.json and kubectl tries to use it.
This local cached files have 10 minutes TTL. After deletion, if user waits 10 minutes,
files will be expired and deleted and there will be no errors. However, 10 minutes is a long time
and cache needs to be invalidated after deletion occurs.
This PR adds a document into delete command by noting that there might be a need to invalidate discovery
cache when CRD is deleted. In addition to that this PR adds a test to catch this behavior.
Removes any reference from the registry gcr.io/kubernetes-e2e-test-images in
kubernetes/kubernetes, replacing it with k8s.gcr.io/kubernetes-e2e-test-images.
In some cases, the images had to be updated since a few things have changed since
their original implementation, most notably being the fact that some of the images
have been centralized into the agnhost image.
Co-Authored-By: Claudiu Belu <cbelu@cloudbasesolutions.com>
Update dependencies and the test images to use pause 3.5. We also
provide a changelog entry for the new container image version.
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
* Remove \b boundary for sinks; Unicode backspace \b != regexp boundary \b.
* Specify those source type fields that have not yet been tagged.
* Add exclusions for current false-positive set.
* Add static analysis to hack/verify-govet-levee.sh for defense against
accidental logging of credentials.
* Add binary dependency to hack/tools/tools.go and associated go.mod, go.sum.
* Add analysis configuration to hack/testdata/levee/
Patrick Ohly