Skip to content

WIP: Rebase 1.35#2523

Open
jacobsee wants to merge 2455 commits intoopenshift:masterfrom
jacobsee:rebase-1.35
Open

WIP: Rebase 1.35#2523
jacobsee wants to merge 2455 commits intoopenshift:masterfrom
jacobsee:rebase-1.35

Conversation

@jacobsee
Copy link
Member

No description provided.

k8s-release-robot and others added 22 commits November 12, 2025 09:26
…pod-resize

Pod level in place pod resize - alpha
…containerd-skip

[KEP-4639] Remove image volume e2e test because CI has containerd < 2.1
Fix volume performance tests with performance constraints
update github.com/opencontainers/selinux to v1.13.0
* First version of batching w/out signatures.

* First version of pod signatures.

* Integrate batching with signatures.

* Fix merge conflicts.

* Fixes from self-review.

* Test fixes.

* Fix a bug that limited batches to size 2
Also add some new high-level logging and
simplify the pod affinity signature.

* Re-enable batching on perf tests for now.

* fwk.NewStatus(fwk.Success)

* Review feedback.

* Review feedback.

* Comment fix.

* Two plugin specific unit tests.:

* Add cycle state to the sign call, apply to topo spread.
Also add unit tests for several plugi signature
calls.

* Review feedback.

* Switch to distinct stats for hint and store calls.

* Switch signature from string to []byte

* Revert cyclestate in signs. Update node affinity.
Node affinity now sorts all of the various
nested arrays in the structure. CycleState no
longer in signature; revert to signing fewer
cases for pod spread.

* hack/update-vendor.sh

* Disable signatures when extenders are configured.

* Update pkg/scheduler/framework/runtime/batch.go

Co-authored-by: Maciej Skoczeń <87243939+macsko@users.noreply.github.com>

* Update staging/src/k8s.io/kube-scheduler/framework/interface.go

Co-authored-by: Maciej Skoczeń <87243939+macsko@users.noreply.github.com>

* Review feedback.

* Disable node resource signatures when extended DRA enabled.

* Review feedback.

* Update pkg/scheduler/framework/plugins/imagelocality/image_locality.go

Co-authored-by: Maciej Skoczeń <87243939+macsko@users.noreply.github.com>

* Update pkg/scheduler/framework/interface.go

Co-authored-by: Maciej Skoczeń <87243939+macsko@users.noreply.github.com>

* Update pkg/scheduler/framework/plugins/nodedeclaredfeatures/nodedeclaredfeatures.go

Co-authored-by: Maciej Skoczeń <87243939+macsko@users.noreply.github.com>

* Update pkg/scheduler/framework/runtime/batch.go

Co-authored-by: Maciej Skoczeń <87243939+macsko@users.noreply.github.com>

* Review feedback.

* Fixes for review suggestions.

* Add integration tests.

* Linter fixes, test fix.

* Whitespace fix.

* Remove broken test.

* Unschedulable test.

* Remove go.mod changes.

---------

Co-authored-by: Maciej Skoczeń <87243939+macsko@users.noreply.github.com>
Update the procMount test expectations to match the intentional PSA
policy relaxation introduced in commit e8bd3f6.

As of Kubernetes 1.35+, Pod Security Admission Baseline policy
allows UnmaskedProcMount for pods with user namespaces (hostUsers:
false). This was an intentional change to support nested container
use cases while maintaining security through user namespace isolation.

The test "will fail to unmask proc mounts if not privileged" was
written before this relaxation and expected Baseline level to reject
UnmaskedProcMount. Since Baseline now allows it (for user namespace
pods), the test needs to use Restricted level instead, which
unconditionally blocks UnmaskedProcMount regardless of user namespace
settings.

Changes:
- Change PSA level from Baseline to Restricted
- Update test name to clarify it's testing Restricted level behavior
- Update framework name from "proc-mount-baseline-test" to
  "proc-mount-restricted-test"

Fixes the ci-crio-userns-e2e-serial test failure that started occurring
when runtimes began reporting user namespace support.

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
…-userns-validation

test/e2e_node: Update procMount test to use Restricted PSA level
Fixes issue kubernetes#134023 where alpha API warnings were being logged
when binary version (1.34.1) and emulation version (1.34) differed
only in patch version.

The issue was in api_enablement.go where the version comparison
was using EqualTo() which compares all version components including
patch versions. The fix changes the comparison to only check
major.minor versions using version.MajorMinor().

Changes:
- Modified version comparison logic in ApplyTo() method to only
  compare major.minor versions, not patch versions
- Added comprehensive test cases to verify the fix works correctly
- Tests confirm that warnings are still logged for different
  major/minor versions but not for different patch versions

This prevents spurious warnings when emulation version is set to
major.minor (e.g., 1.34) and binary version includes patch (e.g., 1.34.1).
…rnings-134023

Fix alpha API warnings for patch version differences
Signed-off-by: Aman Shrivastava <amanshrivastava118@gmail.com>
@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 20, 2025
@openshift-ci-robot openshift-ci-robot added the backports/unvalidated-commits Indicates that not all commits come to merged upstream PRs. label Nov 20, 2025
@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 20, 2025
@openshift-ci-robot
Copy link

@jacobsee: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

@openshift-ci openshift-ci bot added the vendor-update Touching vendor dir or related files label Nov 20, 2025
@openshift-ci
Copy link

openshift-ci bot commented Nov 20, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jacobsee
Once this PR has been reviewed and has the lgtm label, please assign p0lyn0mial for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci-robot
Copy link

@jacobsee: the contents of this pull request could not be automatically validated.

The following commits are valid:

The following commits could not be validated and must be approved by a top-level approver:

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

@jacobsee
Copy link
Member Author

/test e2e-aws-ovn-crun e2e-aws-crun-wasm k8s-e2e-gcp-ovn e2e-aws-ovn-serial-1of2 e2e-aws-ovn-techpreview-serial-1of2

1 similar comment
@jacobsee
Copy link
Member Author

/test e2e-aws-ovn-crun e2e-aws-crun-wasm k8s-e2e-gcp-ovn e2e-aws-ovn-serial-1of2 e2e-aws-ovn-techpreview-serial-1of2

@jacobsee
Copy link
Member Author

/test e2e-aws-ovn-techpreview-serial-1of2

@jacobsee
Copy link
Member Author

/test e2e-aws-ovn-techpreview-serial-2of2

1 similar comment
@neisw
Copy link

neisw commented Feb 12, 2026

/test e2e-aws-ovn-techpreview-serial-2of2

@neisw
Copy link

neisw commented Feb 12, 2026

/retest-required

@neisw
Copy link

neisw commented Feb 12, 2026

/test e2e-aws-ovn-techpreview-serial-1of2

@neisw
Copy link

neisw commented Feb 12, 2026

/test e2e-metal-ipi-ovn-ipv6

@neisw
Copy link

neisw commented Feb 12, 2026

/payload 4.22 nightly blocking
/payload 4.22 ci blocking

@openshift-ci
Copy link

openshift-ci bot commented Feb 12, 2026

@neisw: trigger 14 job(s) of type blocking for the nightly release of OCP 4.22

  • periodic-ci-openshift-release-main-ci-4.22-e2e-aws-upgrade-ovn-single-node
  • periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-upgrade-fips
  • periodic-ci-openshift-release-main-ci-4.22-e2e-azure-ovn-upgrade
  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-rt-upgrade
  • periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aws-ovn-conformance
  • periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-serial-1of2
  • periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-serial-2of2
  • periodic-ci-openshift-release-main-ci-4.22-e2e-aws-ovn-techpreview
  • periodic-ci-openshift-release-main-ci-4.22-e2e-aws-ovn-techpreview-serial-1of3
  • periodic-ci-openshift-release-main-ci-4.22-e2e-aws-ovn-techpreview-serial-2of3
  • periodic-ci-openshift-release-main-ci-4.22-e2e-aws-ovn-techpreview-serial-3of3
  • periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-upgrade-fips-no-nat-instance
  • periodic-ci-openshift-release-main-nightly-4.22-e2e-metal-ipi-ovn-ipv4
  • periodic-ci-openshift-release-main-nightly-4.22-e2e-metal-ipi-ovn-ipv6

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/a1531410-0823-11f1-96f3-8e307b3e82c7-0

trigger 5 job(s) of type blocking for the ci release of OCP 4.22

  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-aws-ovn-upgrade
  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-azure-ovn-upgrade
  • periodic-ci-openshift-release-main-ci-4.22-e2e-gcp-ovn-upgrade
  • periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aks
  • periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aws-ovn

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/a1531410-0823-11f1-96f3-8e307b3e82c7-1

@jacobsee
Copy link
Member Author

/test e2e-metal-ipi-ovn-ipv6

@openshift-ci-robot
Copy link

@jacobsee: the contents of this pull request could not be automatically validated.

The following commits are valid:

The following commits could not be validated and must be approved by a top-level approver:

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

@jacobsee
Copy link
Member Author

/retest

@openshift-ci
Copy link

openshift-ci bot commented Feb 13, 2026

@jacobsee: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-crun-wasm 10edd8b link true /test e2e-aws-crun-wasm
ci/prow/e2e-metal-ipi-ovn-ipv6 a810e78 link true /test e2e-metal-ipi-ovn-ipv6

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@jacobsee
Copy link
Member Author

/test e2e-metal-ipi-ovn-ipv6

@jacobsee
Copy link
Member Author

/payload 4.22 nightly blocking
/payload 4.22 ci blocking

@openshift-ci
Copy link

openshift-ci bot commented Feb 13, 2026

@jacobsee: trigger 14 job(s) of type blocking for the nightly release of OCP 4.22

  • periodic-ci-openshift-release-main-ci-4.22-e2e-aws-upgrade-ovn-single-node
  • periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-upgrade-fips
  • periodic-ci-openshift-release-main-ci-4.22-e2e-azure-ovn-upgrade
  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-rt-upgrade
  • periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aws-ovn-conformance
  • periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-serial-1of2
  • periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-serial-2of2
  • periodic-ci-openshift-release-main-ci-4.22-e2e-aws-ovn-techpreview
  • periodic-ci-openshift-release-main-ci-4.22-e2e-aws-ovn-techpreview-serial-1of3
  • periodic-ci-openshift-release-main-ci-4.22-e2e-aws-ovn-techpreview-serial-2of3
  • periodic-ci-openshift-release-main-ci-4.22-e2e-aws-ovn-techpreview-serial-3of3
  • periodic-ci-openshift-release-main-nightly-4.22-e2e-aws-ovn-upgrade-fips-no-nat-instance
  • periodic-ci-openshift-release-main-nightly-4.22-e2e-metal-ipi-ovn-ipv4
  • periodic-ci-openshift-release-main-nightly-4.22-e2e-metal-ipi-ovn-ipv6

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/126add30-08a7-11f1-98a7-c4f004d48fa3-0

trigger 5 job(s) of type blocking for the ci release of OCP 4.22

  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-aws-ovn-upgrade
  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-azure-ovn-upgrade
  • periodic-ci-openshift-release-main-ci-4.22-e2e-gcp-ovn-upgrade
  • periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aks
  • periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aws-ovn

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/126add30-08a7-11f1-98a7-c4f004d48fa3-1

@neisw
Copy link

neisw commented Feb 13, 2026

/payload-aggregate periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-rt-upgrade 10

@openshift-ci
Copy link

openshift-ci bot commented Feb 13, 2026

@neisw: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-rt-upgrade

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/56112980-08ee-11f1-92d8-bc485a5a34e1-0

@neisw
Copy link

neisw commented Feb 13, 2026

/payload-aggregate periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aws-ovn-conformance 10

@openshift-ci
Copy link

openshift-ci bot commented Feb 13, 2026

@neisw: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aws-ovn-conformance

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/910f8c70-08ee-11f1-90dd-294b5b02017a-0

@neisw
Copy link

neisw commented Feb 13, 2026

/payload-job periodic-ci-openshift-release-main-nightly-4.22-e2e-metal-ipi-ovn-ipv4 periodic-ci-openshift-release-main-nightly-4.22-e2e-metal-ipi-ovn-ipv6

@openshift-ci
Copy link

openshift-ci bot commented Feb 13, 2026

@neisw: trigger 2 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-release-main-nightly-4.22-e2e-metal-ipi-ovn-ipv4
  • periodic-ci-openshift-release-main-nightly-4.22-e2e-metal-ipi-ovn-ipv6

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/d062f1a0-08ee-11f1-8792-3dfed807434f-0

@neisw
Copy link

neisw commented Feb 13, 2026

/payload-job periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aks

@openshift-ci
Copy link

openshift-ci bot commented Feb 13, 2026

@neisw: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

  • periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aks

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/f70dc730-08ee-11f1-9394-9157c2b2cd9f-0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backports/unvalidated-commits Indicates that not all commits come to merged upstream PRs. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. vendor-update Touching vendor dir or related files

Projects

None yet

Development

Successfully merging this pull request may close these issues.