Update dependency kcp-dev/kcp to v0.31.1#129
Open
gardener-ci-robot wants to merge 1 commit intomasterfrom
Open
Update dependency kcp-dev/kcp to v0.31.1#129gardener-ci-robot wants to merge 1 commit intomasterfrom
gardener-ci-robot wants to merge 1 commit intomasterfrom
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
gardener-prow
Bot
added
cla: yes
gardener-ci-robot
force-pushed
the
renovate/kcp-devkcp
branch
from
35092e9 to
4f4ea37
Compare
gardener-ci-robot
changed the title
Contributor
Author
|
gardener-ci-robot
force-pushed
the
renovate/kcp-devkcp
branch
from
4f4ea37 to
aee5240
Compare
gardener-ci-robot
changed the title
gardener-ci-robot
force-pushed
the
renovate/kcp-devkcp
branch
from
aee5240 to
c3fa3a6
Compare
gardener-ci-robot
changed the title
gardener-prow
Bot
added
cla: no
gardener-ci-robot
force-pushed
the
renovate/kcp-devkcp
branch
from
c3fa3a6 to
781149a
Compare
gardener-ci-robot
changed the title
gardener-ci-robot
force-pushed
the
renovate/kcp-devkcp
branch
from
781149a to
32b3334
Compare
gardener-ci-robot
changed the title
|
@gardener-ci-robot: The following tests failed, say
Full PR test history. Your PR dashboard. Command help for this repository. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.29.0→v0.31.1Release Notes
kcp-dev/kcp (kcp-dev/kcp)
v0.31.1Compare Source
Changes by Kind
Bug or Regression
/services/...requests keep impersonation headers request-scoped. (#4009, @officialasishkumar)Dependencies
Added
Nothing has changed.
Changed
Removed
Nothing has changed.
v0.31.0Compare Source
Special mentions
🚀 Rebase to Kubernetes 1.35.1 — #3842 (@xmudrii)
Foundation upgrade to Kubernetes 1.35.1 + Go 1.25.7. XL change touching the entire codebase — API adaptations, test adjustments, separate etcd lifecycle context to prevent shutdown blocking.
🔒 Cross-shard service account lookup — #3973 (@ntnn)
Enables service account validation across shards via a TTL cache. Removes the previous same-shard requirement for SAs. Drops the GlobalServiceAccount feature gate (now always-on).
⚙️ APIResourceSchema Virtual Workspace — #3881 (@mjudeikis)
New virtual workspace enabling providers to access consumer workspace schemas — key for kube-bind.io integration. Requires GlobalServiceAccounts and cross-workspace RBAC.
🔑 defaultSelector for PermissionClaim on APIExport — #3884 (@mjudeikis)
API change: providers can specify default permission claim selectors on APIExport that automatically apply when APIBindings are auto-created via WorkspaceType. Replaces a cache-replication approach (#3859) that had O(workspaces × bindings) scalability concerns.
🛟 Extract Virtual Workspace framework to staging repo — #3959 (@xmudrii)
Moves pkg/virtual/framework and pkg/virtual/options into github.com/kcp-dev/virtual-workspace-framework. External VW developers no longer need to vendor the entire kcp core repo. Also moves OpenAPI defs to SDK and crdpuller to the new repo.
🏋️ Load testing framework & infrastructure — #3796, #3866, #3895 (@SimonTheLeg)
Three-part effort: concept doc, k8s infra setup, and the framework itself. Inspired by clusterloader2, uses Go iterators for tuning sets, supports scenarios like "10,000 empty workspaces" with P99 stats.
🐛 Etcd key poisoning fix — #4011 (@mjudeikis)
Critical data integrity fix: unresolved workspace paths were poisoning etcd keys with malformed cluster names. Adds 404 handling and defense-in-depth filtering.
🔨 CLI permission claims management — #3956 (@rxinui) + #3946 (@ghdrope)
New kcp claims accept / kcp claims reject subcommands plus --accept-all-permission-claims / --reject-all-permission-claims flags on kubectl kcp bind. Significant UX improvement for API consumers.
🎁 SSA (Server-Side Apply) committer — #4002 (@swastik959)
Introduces Server-Side Apply support for controllers, fixing race conditions where JSON Merge Patch would lose concurrent condition updates.
🐞 VW proxy impersonation isolation — #4009 (@officialasishkumar)
Security fix: the shared ReverseProxy in VW was being mutated concurrently, causing impersonation header leakage between requests. Each request now gets an isolated proxy instance.
Honourable mentions
Changes by Kind
Chore
API Change
defaultSelectorfield toPermissionClaimonAPIExport. When APIBindings are auto-created viaWorkspaceType.defaultAPIBindings, the selector is now taken from the APIExport'sdefaultSelectorinstead of defaulting tomatchAll: true. Existing APIExports withoutdefaultSelectorretain the previousmatchAll: truebehavior. (#3884, @mjudeikis)Feature
/readyznow usesNewInformerSyncHealthzAdd
/liveznow usesPingHealthz(#3935, @nuromirg)sharded-test-server: added --cache-kubeconfig flag to use an external cache-server (#3831, @gman0)
kcp claims acceptandkcp claims reject(#3956, @rxinui)pkg/virtual/frameworkandpkg/virtual/optionspackages into a dedicated staging repository (github.com/kcp-dev/virtual-workspace-frameworkpkg/openapi) to the SDK repositorypkg/crdpullerpackage to the newly addedvirtual-workspace-frameworkrepository (#3959, @xmudrii)Bug or Regression
Fix {cluster} extract logic for VirtualWorkspaces. Previously, if VirtualWorkspace, used in FrontProxy mapping, had a path
cluster/{cluster}- it was not resolved, and so WorkspaceAuthorizationConfiguration was not run if used inside FrontProxy, but forwarded to VirtualWorkspace without checking. As a result, if one has misconfigured VirtualWorkspace, it might receive traffic intended for another recipient. (#3857, @mjudeikis)--shard-virtual-workspace-url,--shard-virtual-workspace-ca-file,--shard-client-key-file,--shard-client-cert-filenot being taken into account when disabling the in-process kcp virtual workspaces server on a shard. (#3955, @xrstf)/clusters/<path>/...on a shard could cause resources to be written to etcd under a key segment containing the raw workspace path instead of the logical cluster name, producing orphaned rows invisible to the normal API read path. The shard now returns 404 for unresolvable workspace paths, and a new defense-in-depth filter rejects any request whose context carries a path-shaped cluster name before it can reach storage. (#4011, @mjudeikis)multiple requests share the same user.Info reference. (#3856, @dweidenfeld)
/services/...requests keep impersonation headers request-scoped. (#4009, @officialasishkumar)Other (Cleanup or Flake)
--logging-formatflag to the cache-server. (#3904, @xrstf)--external-hostname, determined based on--shard-base-urlor--bind-addressinstead (#3832, @ntnn)--shard-external-urlforvirtual-workspace(#3849, @ntnn)Dependencies
Added
Changed
a0af3ef→b8f7ae3a0af3ef→b8f7ae385fd79d→ec3ebc5f3f2b99→589584f4c0f3b2→bc988d5cfa47c3→2d32026Removed
v0.30.3Compare Source
What's Changed
Full Changelog: kcp-dev/kcp@v0.30.2...v0.30.3
v0.30.2Compare Source
What's Changed
Full Changelog: kcp-dev/kcp@v0.30.1...v0.30.2
v0.30.1Compare Source
What's Changed
Full Changelog: kcp-dev/kcp@v0.30.0...v0.30.1
v0.30.0Compare Source
Changes by Kind
Chore
API Change
typefield to the VirtualWorkspace API schema to distinguish between initializing and terminating workspace URLs. (#3707, @olamilekan000)Feature
Documentation
Bug or Regression
Dependencies
Added
63bb56e2b7fd8aChanged
7e4ce0a→87e1e73bda5523→8fff8a5e6fa225→a0af3efe6fa225→a0af3efe3bc6f1→85fd79dc8a335a→f3f2b99Removed
d0100b6012b6fcea95bdfv0.29.3Compare Source
What's Changed
Full Changelog: kcp-dev/kcp@v0.29.2...v0.29.3
v0.29.2Compare Source
What's Changed
Full Changelog: kcp-dev/kcp@v0.29.1...v0.29.2
v0.29.1Compare Source
What's Changed
Full Changelog: kcp-dev/kcp@v0.29.0...v0.29.1
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
Release note: