* pkg/apis/core: allow unsigned 32-bit Linux UIDs
Signed-off-by: Kunalbehbud <121988281+Kunalbehbud@users.noreply.github.com>
* apimachinery: fix UID validation on 32-bit platforms
Format UID validation range errors with int64 bounds so accepting Linux UIDs
up to MaxUint32 does not overflow int on 32-bit typecheck targets.
Signed-off-by: Kunalbehbud <121988281+Kunalbehbud@users.noreply.github.com>
* pkg/apis/core: limit uint32 UID validation to pod status
Keep pod spec and kubelet image user validation on the existing int32 UID
range, and only accept the full Linux uint32 UID range for container status
user fields.
Signed-off-by: Kunalbehbud <121988281+Kunalbehbud@users.noreply.github.com>
* pkg/apis/core: inline container status UID range check
Per review, inline the uint32 UID range check directly in
validateLinuxContainerUser and drop the generic-sounding
isValidLinuxContainerUserID helper (and its constants), so the range
that is wider than runAsUser can only ever be applied to container
status validation.
* pkg/apis/core: inline linux user validation into validateContainerStatusUsers
Per review, inline the linux container-user checks directly into
validateContainerStatusUsers and remove the validateLinuxContainerUser
helper, so nothing other than container status validation can reach the
wider-than-runAsUser UID range.
---------
Signed-off-by: Kunalbehbud <121988281+Kunalbehbud@users.noreply.github.com>
- enum: check every rule's option so an undefined option always errors, matching IfOption
- operation.Options: note an option can be enabled even when its feature gate is off
- api/testing: fall back to strategy options only when the caller supplied none
HPA, workload, and PodGroup strategies declare their options as map[string]bool,
and the versioned validation-equivalence sweep is given each strategy's declared
options so referenced options are not treated as undeclared.
Extend TestCheckpointStateRestore and TestCheckpointStateStore to cover
the InPlacePodVerticalScalingExclusiveCPUs feature gate and the
baselines field in checkpoint serialization. Existing test cases
are split into all feature gate combinations, and new cases verify
that baselines are correctly stored and restored when the feature gate
is enabled.
Signed-off-by: Lukasz Wojciechowski <l.wojciechow@partner.samsung.com>
Add a clarifying comment in the NUMA distributed allocation path
that this distribution adjustment runs after bestCombo selection
(including alignBySocket handling), and only ensures we do not
request more CPUs from a selected NUMA node than it can provide.
Signed-off-by: Swati Sehgal <swsehgal@redhat.com>
Container-level CPU assignments recorded at admission time, prior to any resize
is required for in-place vertical scaling exclusive CPUs.
This commits stores this in Baseline and in Baselines for all containers.
Refactor the NUMA combo selection path to compute socket
locality and comparison intent with intermediate variables
before updating the best candidate. This keeps same-socket
preference behavior unchanged while making the decision flow
more readable.
Signed-off-by: Swati Sehgal <swsehgal@redhat.com>
With both AlignBySocket and DistributeCPUsAcrossNUMA
policy options enabled, change the calculation of
"distribution" when allocate CPUs across NUMA.
Co-authored-by: Ruquan Zhao <zhaoruquan233@gmail.com>
Signed-off-by: Swati Sehgal <swsehgal@redhat.com>
Adapt takeByTopologyNUMADistributed for contextual logging and CPU sorting
strategy APIs added since PR 118068, so the original commits can apply cleanly.
Signed-off-by: Swati Sehgal <swsehgal@redhat.com>
With ResourceHealthStatus enabled (Beta, default on since 1.36),
RegisterPlugin spawns a goroutine that runs WatchResources stream and
writes to healthInfoCache's state file in the manager's state directory.
Tests called defer cancel() on the context but never DRAPluginManager.Stop()
(which does wg.Wait()), so the goroutine could still be writing to
t.TempDir() when the test framework's RemoveAll cleanup ran, causing:
TempDir RemoveAll cleanup: unlinkat: directory not empty
Add Manager.Stop() that delegates to DRAPluginManager.Stop() and call
defer manager.Stop() in all tests that create a Manager instance.
The resourceclaim controller's `syncHandler` can now return an error
wrapped in the `nonRetryableError` type to signal that the item should
not be retried.
Currently, this is used when the controller reaches a state where it
must either be restarted with different features enabled where it will
completely resync, or the Pod or PodGroup must be recreated which will
invoke the event handlers.
The resourceclaim controller no longer creates a per-Pod ResourceClaim
when the DRAWorkloadResourceClaims feature is disabled, but *would have*
created a per-PodGroup ResourceClaim *if* the feature *was* enabled.
Instead of creating a per-Pod ResourceClaim, the controller returns an
error.
In this scenario, the claim was meant to be made by the PodGroup, so
replicating that claim for every Pod will consume many more resources
than intended.
For a ResourceClaim to be successfully generated for the PodGroup,
restart kube-controller-manager with the DRAWorkloadResourceClaims
feature enabled. For a ResourceClaim to be successfully generated for
each individual Pod, recreate the PodGroup without the claim.
