Commit Graph

3402 Commits

Author SHA1 Message Date
Ismail Alidzhikov 4a76cd8405 Remove configmaps related rules from the kube-controller-manager and kube-scheduler leader election roles 2025-09-26 16:52:09 +03:00
Jordan Liggitt 4b0eeeb618
Make pod-security-admission honor emulation version 2025-09-17 15:32:32 -04:00
Jordan Liggitt 7f4ee652ea
Delete temporary ProbeHostPodSecurityStandards feature gate 2025-09-17 15:23:32 -04:00
Jordan Liggitt 55419eca7a
Plumb effective version into admission initializer 2025-09-17 15:23:31 -04:00
Kubernetes Prow Robot 529f147dfc
Merge pull request #133740 from pacoxu/add-events-group-view
add events.events.k8s.io to clusterrole view/edit default
2025-09-03 08:45:15 -07:00
Paco Xu ef7cee89bf add events.events.k8s.io to clusterrole view/edit/node default 2025-09-03 10:06:14 +08:00
Kubernetes Prow Robot a6693542b7
Merge pull request #133781 from pohly/test-apiserver-flag-registration
test/integration/apiserver: fix several data races
2025-09-02 13:09:17 -07:00
Patrick Ohly fa1f9d444c apiserver: avoid default toleration seconds data race for all tests
This reverts commit 2e756e7412,
which addressed the data race only for test/integration/apiserver/oidc.
It also occurs for test/integration/controlplane/transformation:

    WARNING: DATA RACE
    Read at 0x000008b9de38 by goroutine 104616:
      k8s.io/kubernetes/plugin/pkg/admission/defaulttolerationseconds.RegisterFlags()
          /home/prow/go/src/k8s.io/kubernetes/plugin/pkg/admission/defaulttolerationseconds/admission.go:42 +0x30
      k8s.io/kubernetes/pkg/kubeapiserver/options.registerAllAdmissionPluginFlags()
          /home/prow/go/src/k8s.io/kubernetes/pkg/kubeapiserver/options/plugins.go:115 +0x64
      k8s.io/kubernetes/pkg/kubeapiserver/options.(*AdmissionOptions).AddFlags()
          /home/prow/go/src/k8s.io/kubernetes/pkg/kubeapiserver/options/admission.go:73 +0x55
      k8s.io/kubernetes/pkg/controlplane/apiserver/options.(*Options).AddFlags()
          /home/prow/go/src/k8s.io/kubernetes/pkg/controlplane/apiserver/options/options.go:154 +0x388
      k8s.io/kubernetes/cmd/kube-apiserver/app/options.(*ServerRunOptions).Flags()
          /home/prow/go/src/k8s.io/kubernetes/cmd/kube-apiserver/app/options/options.go:101 +0x73
      k8s.io/kubernetes/cmd/kube-apiserver/app/testing.StartTestServer()
          /home/prow/go/src/k8s.io/kubernetes/cmd/kube-apiserver/app/testing/testserver.go:219 +0xb77
      k8s.io/kubernetes/test/integration/controlplane/transformation.newTransformTest()
          /home/prow/go/src/k8s.io/kubernetes/test/integration/controlplane/transformation/transformation_test.go:131 +0x6d0
      k8s.io/kubernetes/test/integration/controlplane/transformation.TestKMSv2Healthz()
          /home/prow/go/src/k8s.io/kubernetes/test/integration/controlplane/transformation/kmsv2_transformation_test.go:874 +0x1c8
      testing.tRunner()
          /usr/local/go/src/testing/testing.go:1792 +0x225
      testing.(*T).Run.gowrap1()
          /usr/local/go/src/testing/testing.go:1851 +0x44

    Previous write at 0x000008b9de38 by goroutine 111926:
      github.com/spf13/pflag.newInt64Value()
          /home/prow/go/src/k8s.io/kubernetes/vendor/github.com/spf13/pflag/int64.go:9 +0x49
      github.com/spf13/pflag.(*FlagSet).Int64Var()
          /home/prow/go/src/k8s.io/kubernetes/vendor/github.com/spf13/pflag/int64.go:41 +0x3d
      k8s.io/kubernetes/plugin/pkg/admission/defaulttolerationseconds.RegisterFlags()
          /home/prow/go/src/k8s.io/kubernetes/plugin/pkg/admission/defaulttolerationseconds/admission.go:42 +0x25
      k8s.io/kubernetes/pkg/kubeapiserver/options.registerAllAdmissionPluginFlags()
          /home/prow/go/src/k8s.io/kubernetes/pkg/kubeapiserver/options/plugins.go:115 +0x64
      k8s.io/kubernetes/pkg/kubeapiserver/options.(*AdmissionOptions).AddFlags()
          /home/prow/go/src/k8s.io/kubernetes/pkg/kubeapiserver/options/admission.go:73 +0x55
      k8s.io/kubernetes/pkg/controlplane/apiserver/options.(*Options).AddFlags()
          /home/prow/go/src/k8s.io/kubernetes/pkg/controlplane/apiserver/options/options.go:154 +0x388
      k8s.io/kubernetes/cmd/kube-apiserver/app/options.(*ServerRunOptions).Flags()
          /home/prow/go/src/k8s.io/kubernetes/cmd/kube-apiserver/app/options/options.go:101 +0x73
      k8s.io/kubernetes/cmd/kube-apiserver/app/testing.StartTestServer()
          /home/prow/go/src/k8s.io/kubernetes/cmd/kube-apiserver/app/testing/testserver.go:219 +0xb77
      k8s.io/kubernetes/test/integration/controlplane/transformation.newTransformTest()
          /home/prow/go/src/k8s.io/kubernetes/test/integration/controlplane/transformation/transformation_test.go:131 +0x6d0
      k8s.io/kubernetes/test/integration/controlplane/transformation.TestKMSv2FeatureFlag()
          /home/prow/go/src/k8s.io/kubernetes/test/integration/controlplane/transformation/kmsv2_transformation_test.go:1009 +0x117
      testing.tRunner()
          /usr/local/go/src/testing/testing.go:1792 +0x225
      testing.(*T).Run.gowrap1()
          /usr/local/go/src/testing/testing.go:1851 +0x44

A more general solution is to lock while registering the variables (= write)
and while reading the variables once in InspectFeatureGates.
2025-09-02 21:01:04 +02:00
Maciej Szulik 09e357d31f
Drop StatefulSetAutoDeletePVC after the feature GA-ed in 1.32
Signed-off-by: Maciej Szulik <soltysh@gmail.com>
2025-08-28 13:35:16 +02:00
Sergey Kanzhelev 944b0a4923 do not allow the node to update it's owner reference 2025-08-10 14:38:24 -07:00
carlory 89b5034d56 Make podcertificaterequestcleaner role feature-gated 2025-08-07 13:46:08 +08:00
yliao 34a64db2c7 extended resource backed by DRA: implementation 2025-07-29 18:55:21 +00:00
Kubernetes Prow Robot 2d5f58a0ed
Merge pull request #133176 from liggitt/psa-host-probe-emulation
Make PSA host enforcement honor emulation version
2025-07-24 17:59:27 -07:00
Kubernetes Prow Robot 7912e5fd67
Merge pull request #131549 from carlory/KEP-3751-GA
[Kep-3751] Promote VolumeAttributesClass to GA
2025-07-24 16:44:27 -07:00
carlory 94bf8fc8a9 Promoted API `VolumeAttributesClass` and `VolumeAttributesClassList` to `storage.k8s.io/v1`.
Promoted feature-gate `VolumeAttributesClass` to GA (on by default)

Signed-off-by: carlory <baofa.fan@daocloud.io>
2025-07-25 01:53:59 +08:00
Jordan Liggitt 27e1675153
Make PSA host enforcement honor emulation version 2025-07-24 12:36:26 -04:00
Patrick Ohly 24de875ceb DRA: graduate DynamicResourceAllocation feature to GA
It hasn't been on-by-default before, therefore it does not get locked to the
new default on yet. This has some impact on the scheduler configuration
because the plugin is now enabled by default.

Because the feature is now GA, it doesn't need to be a label on E2E tests,
which wouldn't be possible anyway once it gets removed entirely.
2025-07-24 08:33:56 +02:00
Patrick Ohly d8df1dc1b8 DRA RBAC: fix kube-scheduler bootstrap policy
The pods/finalizer permission can be restricted to just updates because that is
all that matters.

The DeviceTaints rules were under the wrong feature gate check (copy-and-paste)
and must remain disabled when DRA itself becomes enabled.
2025-07-24 08:33:56 +02:00
Patrick Ohly 5c4f81743c DRA: use v1 API
As before when adding v1beta2, DRA drivers built using the
k8s.io/dynamic-resource-allocation helper packages remain compatible with all
Kubernetes release >= 1.32. The helper code picks whatever API version is
enabled from v1beta1/v1beta2/v1.

However, the control plane now depends on v1, so a cluster configuration where
only v1beta1 or v1beta2 are enabled without the v1 won't work.
2025-07-24 08:33:45 +02:00
Kubernetes Prow Robot cc674e7470
Merge pull request #128010 from ahmedtd/pod-certificates-types
Pod Certificates: Preliminary implementation of KEP-4317
2025-07-21 19:26:30 -07:00
Taahir Ahmed 4624cb9bb9 Pod Certificates: Basic implementation
* Define feature gate
* Define and serve PodCertificateRequest
* Implement Kubelet projected volume source
* kube-controller-manager GCs PodCertificateRequests
* Add agnhost subcommand that implements a toy signer for testing

Change-Id: Id7ed030d449806410a4fa28aab0f2ce4e01d3b10
2025-07-21 21:49:57 +00:00
Kubernetes Prow Robot cdef93cedb
Merge pull request #133017 from aramase/aramase/f/kep_4412_beta
Mark KubeletServiceAccountTokenForCredentialProviders feature gate as beta
2025-07-21 14:14:47 -07:00
Kubernetes Prow Robot 558e903fb1
Merge pull request #132462 from munnerz/update-pod-topology-domain
podtopologylabels: update topology.k8s.io->topology.kubernetes.io
2025-07-21 13:06:35 -07:00
Anish Ramasekar 5d4010d2d2
Mark KubeletServiceAccountTokenForCredentialProviders feature gate as beta
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2025-07-21 09:08:43 -05:00
Kubernetes Prow Robot 99f55ae4ef
Merge pull request #132662 from gnufied/bump-recovery-feature-ga
Bump recovery feature ga
2025-07-17 17:10:25 -07:00
Kubernetes Prow Robot d5b2a0438d
Merge pull request #132401 from togettoyou/refactor-admission-plugin-flags
Refactor: isolate flag registration to kube-apiserver to eliminate global state
2025-07-15 22:44:29 -07:00
Junhao Zou ae4a43de6d Refactor: isolate flag registration to kube-apiserver to eliminate global state 2025-07-16 11:01:37 +08:00
Kubernetes Prow Robot 3430e34d88
Merge pull request #132656 from liggitt/selector-authz
KEP-4601: Graduate selector authorization to stable
2025-07-14 16:42:38 -07:00
Jordan Liggitt a04e7cf5eb
KEP-4601: Graduate selector authorization to stable 2025-07-14 16:19:52 -04:00
Hemant Kumar c126870ebc Bump RecoverVolumeExpansionFailure to GA 2025-07-10 12:19:31 -04:00
PatrickLaabs c530b02257 chore: depr. pointer pkg replacement for pkg/security and plugin/pkg 2025-07-08 11:22:07 +02:00
James Munnelly 38bf213271 podtopologylabels: update topology.k8s.io->topology.kubernetes.io 2025-07-03 08:37:23 +01:00
Kubernetes Prow Robot b7c9333f5c
Merge pull request #131837 from sreeram-venkitesh/static-pod-strict-validation-for-api-object-reference
Deny pod admission for static pods referencing API objects
2025-06-26 12:18:30 -07:00
sreeram-venkitesh f9a5aec318 Added unit tests 2025-06-25 23:59:44 +05:30
sreeram-venkitesh 5390f75360 Added podutil.HasAPIObjectReference to deny admission for static pods referencing API objects 2025-06-25 23:59:26 +05:30
Davanum Srinivas 03afe6471b
Add a replacement for cmp.Diff using json+go-difflib
Co-authored-by: Jordan Liggitt <jordan@liggitt.net>
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2025-06-16 17:10:42 -04:00
Gavin Lam 89f5453e31
Allow system:monitoring role to access kubelet metrics endpoints
Signed-off-by: Gavin Lam <gavin.oss@tutamail.com>
2025-06-10 23:16:41 -04:00
Patrick Ohly 1ec7231f63 DRA node: reject static pods which reference ResourceClaims
If someone gains the ability to create static pods, they might try to use that
ability to run code which gets access to the resources associated with some
existing claim which was previously allocated for some other pod. Such an
attempt already fails because the claim status tracks which pods are allowed to
use the claim, the static pod is not in that list, the node is not authorized
to add it, and the kubelet checks that list before starting the pod in
195803cde5/pkg/kubelet/cm/dra/manager.go (L218-L222).

Even if the pod were started, DRA drivers typically manage node-local resources
which can already be accessed via such an attack without involving DRA. DRA
drivers which manage non-node-local resources have to consider access by a
compromised node as part of their threat model.

Nonetheless, it is better to not accept static pods which reference
ResourceClaims or ResourceClaimTemplates in the first place because there
is no valid use case for it.

This is done at different levels for defense in depth:
- configuration validation in the kubelet
- admission checking of node restrictions
- API validation

Co-authored-by: Jordan Liggitt <liggitt@google.com>

Code changes by Jordan, with one small change (resourceClaims -> resourceclaims).
Unit tests by Patrick.
2025-05-05 14:21:25 +02:00
Jordan Liggitt 6bb6c99342
Drop null creationTimestamp from test fixtures 2025-05-02 15:38:40 -04:00
Kubernetes Prow Robot 070f0ad3bd
Merge pull request #129970 from mortent/AddResourceV1beta2API
Add resource v1beta2 API
2025-03-26 09:10:47 -07:00
Morten Torkildsen 39507d911f Add resource v1beta2 API 2025-03-26 14:41:09 +00:00
James Munnelly 8cfb9adbf6 overwrite existing labels during pod Binding storage 2025-03-20 22:39:38 +00:00
James Munnelly 01ae1b1b5a remove kubernetes.io/hostname label copying 2025-03-20 20:19:53 +00:00
James Munnelly 934e247030 Remove kubernetes.io/hostname label copying, skip overriding, and support direct spec.nodeName changes. 2025-03-20 20:19:53 +00:00
James Munnelly 6ddabb6ee6 updating to reflect latest KEP design 2025-03-20 20:19:53 +00:00
James Munnelly 5e7e1e7cf1 KEP-4742: Node Topology Labels via Downward API 2025-03-20 20:19:51 +00:00
Kubernetes Prow Robot ab3cec0701
Merge pull request #130447 from pohly/dra-device-taints
device taints and tolerations (KEP 5055)
2025-03-19 13:00:32 -07:00
Jon Huhn 5760a4f282 DRA scheduler: device taints and tolerations
Thanks to the tracker, the plugin sees all taints directly in the device
definition and can compare it against the tolerations of a request while
trying to find a device for the request.

When the feature is turnedd off, taints are ignored during scheduling.
2025-03-19 09:18:38 +01:00
Patrick Ohly a027b439e5 DRA: add device taint eviction controller
The controller is derived from the node taint eviction controller.
In contrast to that controller it tracks the UID of pods to prevent
deleting the wrong pod when it got replaced.
2025-03-19 09:18:38 +01:00
Penghao a548688ffe fix: add feature-gate is disabled unit tests 2025-03-15 10:41:10 +08:00