WithCompression takes a per-resource Rule under one fixed 1472Ki limit,
and the reader rejects trailing bytes and padded lengths. The v1alpha1
types get declarative validation and API defaulting, with the top-level
list renamed compressionResources and encryption's validation untouched.
Pulls in github.com/pandatix/go-abnf (OpenMetrics decoder in expfmt),
pinned to v0.5.5 for the long-line decoding fix (prometheus/common#1028).
v0.73.0 is skipped: its go-abnf v0.5.1 requires the blocklisted
hashicorp/go-uuid.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
Fix correctness bugs in the PreQueueingHint narrowing added in
879f922f6b.
Add an evaluateAllPods field to preQueueingHintPodKeys to distinguish
1) some plugins want all pods evaluated while others narrow, from
2) all pods must be evaluated for all plugins.
Before, a PreQueueingHintFn that returned AllPods or an error made
runPreQueueingHintPlugins return nil, which always meant (2). A plugin
without a PreQueueingHintFn was skipped, so another plugin's narrowing
could drop pods that only the skipped plugin would requeue.
Cases handled:
1. A plugin with no PreQueueingHintFn is treated as AllPods: set
evaluateAllPods, so its pods are evaluated for it while other plugins
narrow.
2. A PreQueueingHintFn error falls back to AllPods for that plugin only;
other plugins' narrowing is preserved.
3. A plugin returning AllPods sets evaluateAllPods without discarding
other plugins' narrowing.
4. A plugin can have several registrations matching an event, in one or
more profiles, and perPlugin is keyed by plugin name. If any of them
needs all pods, that plugin is not narrowed for the event.
Also skip PreQueueingHint entirely when CompositePodGroup is enabled,
instead of running the hints and discarding the result. Report
PreQueueingHintFn errors, and pod lookup failures other than NotFound,
with HandleErrorWithLogger. Add the prequeueing_hint_fn_error value to
the result label of scheduler_pre_queueing_hint_evaluations_total (now
constants), and update its help text and the generated metrics
documentation. Plugins without a PreQueueingHintFn are not recorded.
Update the PreQueueingHintFn and PreQueueingHintResult API docs: the
hint runs per matching registration, and narrowing is per plugin.
Add unit tests for each case, the result label values, multi-profile
narrowing, and group preCheck.
KEP: kubernetes/enhancements#6132
The updated logcheck now warns about passing a pointer as value where String
could crash if nil. The new findings are false positives, but there have been
real issues before and adding klog.SafePtr is cheap mitigation for false
positives.
The HandleError* wrappers around contextual logging are now annotated such that
the new logcheck knows that they do contextual logging. This revealed some real
issues (expecting printf-style formatting or missing keys, passing a *function*
instead of the function result).
This ensures that new upstream versions are made visible using
standard Go tools; it also avoids repeated "go install"s of the same
version of the tool.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This ensures that new upstream versions are made visible using
standard Go tools; it also avoids repeated "go install"s of the same
version of the tool.
Since the version of zeitgeist is tracked in hack/tools/go.mod, this
also removes the version tracking in zeitgeist's own
build/dependencies.yaml, and updates the introductory comment there.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
This ensures that upstream changes aren't applied without review; it
also avoids repeated "go install"s of the same version of the tool.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
govulncheck complains about publishing-verifier's use of glog:
The package pattern matched the following 2 root packages:
k8s.io/kubernetes/hack/tools/publishing-verifier
k8s.io/kubernetes/hack/tools/traceparse
Govulncheck scanned the following 6 modules and the go1.27.3 standard library:
k8s.io/kubernetes/hack/tools
github.com/golang/glog@v1.2.2
golang.org/x/exp@v0.0.0-20260212183809-81e46e3db34a
golang.org/x/mod@v0.41.0
gopkg.in/yaml.v2@v2.4.0
k8s.io/publishing-bot@v0.5.0
=== Symbol Results ===
Vulnerability #1: GO-2025-3372
Vulnerability when creating log files in github.com/golang/glog
More info: https://pkg.go.dev/vuln/GO-2025-3372
Module: github.com/golang/glog
Found in: github.com/golang/glog@v1.2.2
Fixed in: github.com/golang/glog@v1.2.4
Example traces found:
#1: publishing-verifier/publishing-verifier.go:167:32: publishing.verifyPublishingBotRules calls config.LoadRules, which calls glog.Infof
=== Package Results ===
No other vulnerabilities found.
=== Module Results ===
No other vulnerabilities found.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
storage/value/compression (KEP-6264) compresses objects ahead of any
encryption at rest, in frames with a 9-byte header and a CRC32C. Only a
checksum mismatch is value.IsDataCorruption, so a malformed frame can't
make an intact object eligible for unsafe deletion. Reads always decode
frames. Writes follow a StorageCompressionConfiguration whose resource
checks are shared with EncryptionConfiguration. Values over 1.5 MiB minus
64 KiB are never compressed, so anything compressed can be rewritten
uncompressed. The flag and storage wiring come later.
Add two alpha Kubelet error counter metrics per KEP-5972:
- kubelet_sync_result_errors_total (label: action) recorded in
kubeGenericRuntimeManager.SyncPod for each failed SyncResult action or
top-level PodSyncResult.SyncError (action="SyncPod").
- kubelet_pod_worker_errors_total (label: operation_type) incremented in
podWorkerLoop when a sync iteration fails with a non-Canceled error.
* scheduler: rank pods from disruption mode Single groups as individual preemption victims
* scheduler: label preemption_workload_disruptions by victim type
Record workload preemption disruptions per preemption unit type (pod,
podgroup, compositepodgroup) instead of a single count of group-related
units.
- PreemptionVictim gains Type(); PreemptionCandidate replaces
NumPodGroupDisruptions() with NumDisruptionsByVictimType().
- The unit type is the topmost DisruptionMode=All group, or pod for
pods evicted on their own (standalone or in DisruptionMode=Single
groups). isGroupVictim is removed.
- The metric stays workload-preemptor only: legacy pod preemption keeps
its own metrics until naked pods move to the workload scheduling cycle.
* scheduler: parameterize pod group scheduling attempt and latency metrics with type and profile
Parameterize pod group scheduling attempts, scheduling latency, and algorithm latency metrics with entity type ("podgroup" vs "compositepodgroup") and profile. Specifically:
- Export PodGroupScheduleAttempts and PodGroupSchedulingLatency with [result, profile, type] labels.
- Convert PodGroupSchedulingAlgorithmLatency to HistogramVec with [profile, type] labels.
- Update profile metrics helpers with entityType and add PodGroupAlgorithmLatency helper.
- Update scheduleOnePodGroup call sites to pass rootPodGroupInfo.Type() and profile name.
- Add unit tests in profile_metrics_test.go and schedule_one_podgroup_test.go.
* Address review comments
- Wait for the asynchronous binding cycle to finish before asserting
attempt metrics.
- Add the child pod group result in the composite pod group case so the
per-leaf loop actually runs.
- Drop the algorithm latency assertion: submitPodGroupAlgorithmResult
does not record it, and TestPodGroupAlgorithmLatency covers it.
- Assert that only the root entity type is reported.
* scheduler: rename pod group scheduling metrics entity label from type to entity
* Update pkg/scheduler/metrics/profile_metrics_test.go
Co-authored-by: Antoni Zawodny <zawodny@google.com>
---------
Co-authored-by: Antoni Zawodny <zawodny@google.com>
The device manager already tracks how many devices it considers healthy
and unhealthy for each resource, and never reports it. The only
device-plugin metrics kubelet exposes are
device_plugin_registration_total and
device_plugin_alloc_duration_seconds, so from outside a node the single
observable symptom of devices going bad is allocatable shrinking --
which conflates three different causes: the plugin reported devices
unhealthy, the plugin deregistered, or the hardware is gone. An operator
cannot tell them apart from metrics alone.
Two cases motivate this concretely. A healthy device turning unhealthy
leaves node capacity unchanged, because capacity counts both sets and
only allocatable counts healthy devices, so the event is at best
inferable by diffing two other series. And a resource whose devices have
all gone unhealthy looks exactly like a resource whose plugin went away,
since both end up at zero allocatable.
Add kubelet_device_plugin_devices{resource_name,health_state}, an ALPHA
gauge sourced from the sets GetCapacity already walks. GetCapacity is
the one of the four mutation sites that already holds m.mutex and
already iterates healthyDevices and unhealthyDevices to compute capacity
and allocatable, and its deletedResources loop is where resources are
garbage collected, so the series are dropped there too. Without that
removal the last observed counts would be reported forever for a
resource that no longer exists. The refresh cadence becomes the node
status sync rather than every ListAndWatch message, which suits a gauge.
The metric deliberately carries no per-device label. Whole-device
plugins advertise one ID per card, where such a label would be fine, but
shared-resource plugins advertise synthetic quota units instead, so a
per-device label there yields many series that carry no information
because the IDs do not correspond to distinct hardware. Per-device
detail remains available through the podresources API.
Signed-off-by: Jian Zhang <jian.zhang@bitdeer.com>
* scheduler: parameterize topology-aware placement metrics with entity type
* Address review comments
* scheduler: clarify placement metrics help text for composite pod groups
* scheduler: rename placement metrics entity label from type to entity
Align scheduler_queued_entities and scheduler_queue_incoming_entities_total
with the placement metrics, which use "entity" for the same values.
"type" is also ambiguous next to scheduler_cache_size{type}, where it
means the cached object kind.
* scheduler: support CompositePodGroup in workload preemption metrics
* Address review comments
- Use metrics.EntityTypeToLabel for preemptor metric labels instead of
string(...) conversion of fwk.EntityKeyType.
- Reorder workload_preemption_attempts_total labels to (preemptor, result)
for consistency with other preemption metrics.
* Apply suggestion from @tosi3k
Rebased onto current master and re-vendored as requested.
The RC was validated in this PR earlier with no issues found.
Signed-off-by: Kemal Akkoyun <kakkoyun@gmail.com>
Generalize resourceSizeEstimateCollector into a reusable
timestampedResourceGaugeCollector for timestamped per-resource gauge
metrics and use it for both apiserver_resource_size_estimate_bytes and
apiserver_resource_objects.
Preserve the last observed value and timestamp (or omit if none) on
fetch errors rather than emitting -1.
%d doesn't dereference pointers, so pointers are logged as such rather
than showing the value they point to. golangci-lint v2.14.0 now flags
this.
Most of these are obvious and safe because the pointer is dereferenced
before the log. flowcontrol/format/formatting.go is slightly more
involved, and formatting_test.go is added to illustrate the problem.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
All three were held back by the grpc pin. otlptracegrpc v1.46.0 needs
grpc-gateway v2.30.0, which stays pinned. Five otel modules leave the
go-spew and yaml.v3 unwanted-reference lists.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
golang.org/x/net v0.59.0, crypto v0.57.0, sys v0.48.0, term v0.46.0,
text v0.42.0, sync v0.23.0, tools v0.50.0, mod v0.41.0, time v0.16.0,
oauth2 v0.37.0, exp 85c1c2202aba, and github.com/mdlayher/socket v0.7.0.
x/mod v0.40.0 fixed CVE-2026-56865 and CVE-2026-56864 in sumdb; the
package is not vendored but module scanners flag the requirement. The
floors move together: x/net v0.59.0 requires the crypto, sys, term and
text versions above, x/crypto v0.57.0 and mdlayher/socket v0.7.0
require x/net >= v0.58.0, and x/tools v0.50.0 requires x/mod v0.41.0.
Refactor apiserver_resource_size_estimate_bytes from a standard GaugeVec
into a custom collector (resourceSizeEstimateCollector) to emit metrics
with explicit timestamps corresponding to when store stats were updated.
Invalidate and omit the metric on fetch errors or when object count is
positive but estimated average size is zero, rather than emitting -1.
kubernetes-prow[bot]