Skip to content

[WIP] CNTRLPLANE-371: Update to Kubernetes v1.33 #2261

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2,403 commits into
base: master
Choose a base branch
from

Conversation

bertinatto
Copy link
Member

This is a temporary PR create to get the initial steps of the kube bump ready.

This will be closed before starting the payload-testing phase.

carlory and others added 30 commits March 21, 2025 10:42
Remove general available feature-gate CPUManager
…ularContainerImgChangeE2E

Revert "Add e2e test for Regular Container image change"
The defaulting of TimeAdded randomly broke some of the tests:

   TestList:
       resttest.go:1393: expected:
       []runtime.Object{(*resource.DeviceTaintRule)(0xc000b83080), (*resource.DeviceTaintRule)(0xc000b831e0)},
       got:
       []runtime.Object{(*resource.DeviceTaintRule)(0xc0003db608), (*resource.DeviceTaintRule)(0xc0003db750)}
       ...

   TestCreate:
    resttest.go:346: unexpected obj: &resource.DeviceTaintRule{TypeMeta:v1.TypeMeta{Kind:"", APIVersion:""}, ObjectMeta:v1.ObjectMeta{Name:"foo2", GenerateName:"", Namespace:"", SelfLink:"", UID:"18d3084d-7d11-4575-8730-4650b81cf1a7", ResourceVersion:"8", Generation:1, CreationTimestamp:time.Date(2025, time.March, 21, 8, 27, 23, 0, time.Local), DeletionTimestamp:<nil>, DeletionGracePeriodSeconds:(*int64)(nil), Labels:map[string]string(nil), Annotations:map[string]string(nil), OwnerReferences:[]v1.OwnerReference(nil), Finalizers:[]string(nil), ManagedFields:[]v1.ManagedFieldsEntry(nil)}, Spec:resource.DeviceTaintRuleSpec{DeviceSelector:(*resource.DeviceTaintSelector)(nil), Taint:resource.DeviceTaint{Key:"example.com/taint", Value:"", Effect:"NoExecute", TimeAdded:time.Date(2025, time.March, 21, 8, 27, 23, 0, time.Local)}}}, expected &resource.DeviceTaintRule{TypeMeta:v1.TypeMeta{Kind:"", APIVersion:""}, ObjectMeta:v1.ObjectMeta{Name:"foo2", GenerateName:"", Namespace:"", SelfLink:"", UID:"18d3084d-7d11-4575-8730-4650b81cf1a7", ResourceVersion:"8", Generation:1, CreationTimestamp:time.Date(2025, time.March, 21, 8, 27, 23, 0, time.Local), DeletionTimestamp:<nil>, DeletionGracePeriodSeconds:(*int64)(nil), Labels:map[string]string(nil), Annotations:map[string]string(nil), OwnerReferences:[]v1.OwnerReference(nil), Finalizers:[]string(nil), ManagedFields:[]v1.ManagedFieldsEntry(nil)}, Spec:resource.DeviceTaintRuleSpec{DeviceSelector:(*resource.DeviceTaintSelector)(nil), Taint:resource.DeviceTaint{Key:"example.com/taint", Value:"", Effect:"NoExecute", TimeAdded:time.Date(2025, time.March, 21, 8, 27, 24, 0, time.Local)}}}

Failure rate before: 3m40s: 1332 runs so far, 7 failures (0.53%)

It's not obvious from the test failure, but the difference is the
TimeAdded. Setting it beforehand to a value that can be encoded (i.e. truncated
to seconds) fixes the flake.

Failure rate after: 5m0s: 1825 runs so far, 0 failures
goos: linux
goarch: amd64
pkg: k8s.io/client-go/tools/cache
cpu: Intel(R) Xeon(R) CPU @ 2.60GHz
BenchmarkLister_Match_1k_100
BenchmarkLister_Match_1k_100-48      	   41910	     28255 ns/op	   16384 B/op	       1 allocs/op
BenchmarkLister_Match_10k_100
BenchmarkLister_Match_10k_100-48     	    3487	    337728 ns/op	  163848 B/op	       1 allocs/op
BenchmarkLister_Match_100k_100
BenchmarkLister_Match_100k_100-48    	     222	   7040793 ns/op	 1605659 B/op	       1 allocs/op
BenchmarkLister_Match_1M_100
BenchmarkLister_Match_1M_100-48      	      12	  97962328 ns/op	16007172 B/op	       1 allocs/op
PASS
ok  	k8s.io/client-go/tools/cache	10.480s
benchmarks inefficiency on listers linear search lookup
…t-flake

DRA API: fix DeviceTaintRule REST storage test
…efs-tests

Revert "Separate SeparateDiskTests from eviction"
Run in-place resize tests in default CI jobs
Includes v2beta2 HPA round-trip conversion, defaulting, and validation.
also debug inotify limits before/after setting
benluddy and others added 17 commits May 15, 2025 15:12
The existing patch retried any etcd error returned from storage with the code "Unavailable". Writes
can only be safely retried if the client can be absolutely sure that the initial attempt ended
before persisting any changes. The "Unavailable" code includes errors like "timed out" that can't be
safely retried for writes.
Signed-off-by: Peter Hunt <[email protected]>

UPSTREAM: <carry>: authorization: add minimumkubeletversion package

MinimumKubeletVersion is a way for an admin to declare that nodes any older than the
minimum version cannot authorize with the apiserver. This effectively prevents them from joining.

Doing so means the apiservers can trust newer features are usable on clusters with version skews

Signed-off-by: Peter Hunt <[email protected]>

UPSTREAM: <carry>: authorizer: move mininum kubelet version authorizer to pkg/kubeapiserver and add authorization mode

this does require a line of code be moved from the enablement package to stop a cyclical import

Signed-off-by: Peter Hunt <[email protected]>

UPSTREAM: <carry>: crdvalidation: move latency profile file to be agnostic of field

Signed-off-by: Peter Hunt <[email protected]>

UPSTREAM: <carry>: features: add MinimumKubeletVersion feature

Signed-off-by: Peter Hunt <[email protected]>
Upstream enables volume group snapshots by editing yaml files in a shell
script [1]. We can't use this script in openshift-tests.

Create a brand new, OCP specific test driver based on csi-driver-hostpath,
only with the --feature-gate=VolumeGroupSnapshot on external-snapshotter command line.

We will need to carry this patch until the feature graduates to GA. I've
chosen to create brand new files in this carry patch, so it can't conflict
with the existing ones.

1: https://github.com/kubernetes/kubernetes/blob/91d6fd3455c4a071408df20c7f48df221f2b6d30/test/e2e/testing-manifests/storage-csi/external-snapshotter/volume-group-snapshots/run_group_snapshot_e2e.sh
The test that checks that a volume can be accessed from multiple nodes
should create ReadWriteMany volume and not ReadWriteOnce.
…ates various priority Pods preempt expectedly with the async preemption: replace finalizers with preStop hook and TerminationGracePeriodSeconds
@openshift-ci-robot
Copy link

@bertinatto: the contents of this pull request could not be automatically validated.

The following commits are valid:

The following commits could not be validated and must be approved by a top-level approver:

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

@openshift-ci-robot
Copy link

@bertinatto: the contents of this pull request could not be automatically validated.

The following commits are valid:

The following commits could not be validated and must be approved by a top-level approver:

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

@bertinatto
Copy link
Member Author

/retest

@openshift-ci-robot
Copy link

@bertinatto: the contents of this pull request could not be automatically validated.

The following commits are valid:

The following commits could not be validated and must be approved by a top-level approver:

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

@openshift-ci-robot
Copy link

@bertinatto: the contents of this pull request could not be automatically validated.

The following commits are valid:

The following commits could not be validated and must be approved by a top-level approver:

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

Copy link

openshift-ci bot commented May 17, 2025

@bertinatto: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/verify-deps bdd207a link false /test verify-deps

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-ci-robot
Copy link

@bertinatto: the contents of this pull request could not be automatically validated.

The following commits are valid:

The following commits could not be validated and must be approved by a top-level approver:

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

@bertinatto
Copy link
Member Author

/retest

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. backports/unvalidated-commits Indicates that not all commits come to merged upstream PRs. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. vendor-update Touching vendor dir or related files
Projects
None yet
Development

Successfully merging this pull request may close these issues.