This change updates the Windows e2e node helper to read container job-object affinity through a host-scoped SYSTEM token instead of relying on the current elevated process context.
On Windows, an Administrator process is not enough to inspect a container silo job object in all cases. The previous approach could hit access-denied failures because the security boundary is enforced on the job object itself, and tokens from silo-scoped SYSTEM processes are still insufficient for cross-silo access.
Extend the Windows CPU manager node e2e suite with coverage that was
present on Linux but missing on Windows:
- strict-cpu-reservation: with the policy option enabled the reserved CPU
is excluded from the burstable shared pool; without it (default) the
reserved CPU stays in the shared pool.
- dynamic shared-pool resizing: a running burstable container's affinity
shrinks and grows via the CPU manager reconcile loop as a guaranteed
pod takes and releases an exclusive CPU.
Toggling strict-cpu-reservation invalidates the persisted CPU manager
checkpoint (the reserved CPU moves in/out of the default pool), so the
kubelet refuses to start until the state file is removed. Implement the
previously no-op deleteStateFile on Windows and clear the CPU/memory
manager state files when toggling the option, mirroring the Linux
updateKubeletConfig(..., deleteStateFiles=true) behavior.
Add the Windows node e2e CPU affinity tests and the supporting suite
plumbing: fix the build and drop the dependency on test/e2e_node by
porting the kubeletconfig, criproxy and testing-manifests subpackages
locally (CRI proxy uses a Windows named pipe).
Introduce test/e2e_node_windows/ as a self-contained Windows node e2e
test suite, fully isolated from the Linux-focused test/e2e_node/ package.
All new files are gated with //go:build windows, and the tree includes
a scoped OWNERS file so it lands under an agreed governance model.
In hack/lib/golang.sh, skip building test/e2e_node/e2e_node.test when
KUBE_BUILD_PLATFORMS targets Windows. Windows has a separate e2e_node
test binary which does not currently need to be bundled in an archive.
Document the Windows feature label in test/e2e/feature/feature.go.
