Add the CRI surface of KEP-6061: the OCI profile type with oci_ref and
base_profile in SecurityProfile, the SecurityProfileBase message, the
PullSecurityProfile, ListSecurityProfiles, and RemoveSecurityProfile
ImageService RPCs with SecurityProfileKind, the seccomp_profile_oci
runtime feature, and the SecurityProfileInvalid well-known error for
permanent pull failures. The kubelet owns the lifecycle of pulled
profiles through the list and remove RPCs. The remote client, the fake
image service, the kubelet's instrumented service, and the e2e CRI
proxies implement the new methods; the kubelet does not call them yet.
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
With WindowsCPUAndMemoryAffinity on by default, the baseline "none" policy
now writes a CPU manager checkpoint. Switching to "static" without removing
it makes the kubelet fail to start with a checkpoint policy mismatch.
Always delete CPU/memory manager state files when reconfiguring the kubelet,
matching the Linux helper.
This makes the test helper code more flexible. In particular, passing a
ktesting.TContext instance is okay: it implements all required methods, but
isn't *testing.T and cannot implement testing.TB (private method).
Instead of a new testutils.TB interface, ktesting.TB could have been used. This
is not done because TContext usage should go together with other changes (for
example, merging with ctx or client parameters and renaming to tCtx). That can
be done later if desired.
A potential downside of the custom interface, loosing printf checking, gets
avoided by making the connection to testing.T visible.
Expose the pod checkpoint and restore messages through RuntimeService so
kubelet and runtimes can negotiate pod-wide checkpoint data.
Preserve caller-supplied deadlines for long-running operations, apply the
default CRI timeout only when no deadline exists, and wire the calls
through cri-client, instrumentation, fakes, and both node e2e CRI
proxies.
Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>
This change updates the Windows e2e node helper to read container job-object affinity through a host-scoped SYSTEM token instead of relying on the current elevated process context.
On Windows, an Administrator process is not enough to inspect a container silo job object in all cases. The previous approach could hit access-denied failures because the security boundary is enforced on the job object itself, and tokens from silo-scoped SYSTEM processes are still insufficient for cross-silo access.
Extend the Windows CPU manager node e2e suite with coverage that was
present on Linux but missing on Windows:
- strict-cpu-reservation: with the policy option enabled the reserved CPU
is excluded from the burstable shared pool; without it (default) the
reserved CPU stays in the shared pool.
- dynamic shared-pool resizing: a running burstable container's affinity
shrinks and grows via the CPU manager reconcile loop as a guaranteed
pod takes and releases an exclusive CPU.
Toggling strict-cpu-reservation invalidates the persisted CPU manager
checkpoint (the reserved CPU moves in/out of the default pool), so the
kubelet refuses to start until the state file is removed. Implement the
previously no-op deleteStateFile on Windows and clear the CPU/memory
manager state files when toggling the option, mirroring the Linux
updateKubeletConfig(..., deleteStateFiles=true) behavior.
Add the Windows node e2e CPU affinity tests and the supporting suite
plumbing: fix the build and drop the dependency on test/e2e_node by
porting the kubeletconfig, criproxy and testing-manifests subpackages
locally (CRI proxy uses a Windows named pipe).
Introduce test/e2e_node_windows/ as a self-contained Windows node e2e
test suite, fully isolated from the Linux-focused test/e2e_node/ package.
All new files are gated with //go:build windows, and the tree includes
a scoped OWNERS file so it lands under an agreed governance model.
In hack/lib/golang.sh, skip building test/e2e_node/e2e_node.test when
KUBE_BUILD_PLATFORMS targets Windows. Windows has a separate e2e_node
test binary which does not currently need to be bundled in an archive.
Document the Windows feature label in test/e2e/feature/feature.go.
Sascha Grunert