The InPlacePodVerticalScaling feature gate has been GA and locked to
true since v1.35, and is now removed. Code paths that handled the
disabled state are removed, along with gate overrides in tests.
The node version skew check in pod resize validation is also removed:
the oldest kubelet supported by a v1.38 apiserver is v1.35, where the
feature is always enabled.
The idea is to make apples-to-apples comparison easier by having one benchmark implementation each
for Encode and Decode, and parameterizing with a runtime.Serializer and a []runtime.Object (to vary
the concrete type and contents).
Add seccompProfile.type OCI with the oci field (a digest-pinned ref and an
optional RuntimeDefault or Localhost baseProfile) and the alpha
SecurityProfileOCI feature gate, as described in KEP-6061. The oci field
is validated declaratively, with custom validators for the reference and
the base profile path; the gate check and the rule that privileged
containers cannot use an OCI profile stay handwritten. While the gate is
disabled the type is rejected unless the old object already uses it.
PodSecurity baseline and restricted keep rejecting OCI. The
SecurityProfileOCI node declared feature keeps pods with OCI profiles on
nodes whose kubelet has the gate enabled and a runtime that supports OCI
seccomp profiles. The field is named ref instead of the KEP's reference,
following the kube-api-linter naming convention for new fields.
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
Align internal TokenRequestSpec.ExpirationSeconds with staging v1 (*int64) and mark UserInfo conversions copy-only so conversion-gen emits direct unsafe.Pointer casts.
The one use was a type assertion; runtime now exports the same OpenAPIModelNamer interface, and a k/k test keeps it identical to kube-openapi's.
kube-openapi leaves the go.mod of api, cluster-bootstrap, csi-translation-lib, kube-controller-manager, kube-proxy and kubelet.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
usesIndivisibleHugePagesValues decides whether an update may keep a hugepages
value that fails the divisibility check because the stored object already
holds it. It scanned the containers and spec.overhead but not pod-level
spec.resources, which goes through the same check, so a pod carrying such a
value there failed every update that validates the spec, a label-only one
included (status updates are not affected), while the same value in a
container was kept.
Such a pod can exist. Before Value() saturated (#141305), a request of 2^64
bytes wrapped to zero and passed as a multiple of 2Mi, at the pod level as
well as in a container; since then it saturates to MaxInt64 and fails. A
cluster that stored one on v1.37 cannot update it after the upgrade unless
the pod level is ratcheted like the containers.
Scan spec.resources too, and fold the three scans into one helper.
Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>
We want to avoid having output like `Warning: spec.template.spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[1].matchExpressions[0].key: node-role.kubernetes.io/master is use "node-role.kubernetes.io/control-plane" instead` which isn't really great grammar.
Introduces validation logic for DerivedAttributes, ensuring unique attribute names, properly formatted fully-qualified names, and correct API transitions via conversion. Also implements compile-time CEL checks to verify that derived attributes evaluate to primitive scalars (string, integer, boolean, semver) or lists of them.
to new lifecycle group
- EvictionRequest is managed by a requester
- Eviction is managed by the evictionrequest-controller
- add storage, strategy, printers and validation
kubernetes-prow[bot]