Skip to content

Commit 5c9df33

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #2459 from kevinrizza/bump-1.33.5
OCPBUGS-61554: Bump 1.33.5
2 parents 95b8140 + 61a5f42 commit 5c9df33

File tree

16 files changed

+371
-89
lines changed

16 files changed

+371
-89
lines changed

‎.go-version‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.24.5
1+
1.24.6

‎CHANGELOG/CHANGELOG-1.33.md‎

Lines changed: 194 additions & 59 deletions
Large diffs are not rendered by default.

‎build/build-image/cross/VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
v1.33.0-go1.24.5-bullseye.0
1+
v1.33.0-go1.24.6-bullseye.0

‎build/common.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -97,8 +97,8 @@ readonly KUBE_RSYNC_PORT="${KUBE_RSYNC_PORT:-}"
9797
readonly KUBE_CONTAINER_RSYNC_PORT=8730
9898

9999
# These are the default versions (image tags) for their respective base images.
100-
readonly __default_distroless_iptables_version=v0.7.7
101-
readonly __default_go_runner_version=v2.4.0-go1.24.5-bookworm.0
100+
readonly __default_distroless_iptables_version=v0.7.8
101+
readonly __default_go_runner_version=v2.4.0-go1.24.6-bookworm.0
102102
readonly __default_setcap_version=bookworm-v1.0.4
103103

104104
# These are the base images for the Docker-wrapped binaries.

‎build/dependencies.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ dependencies:
116116

117117
# Golang
118118
- name: "golang: upstream version"
119-
version: 1.24.5
119+
version: 1.24.6
120120
refPaths:
121121
- path: .go-version
122122
- path: build/build-image/cross/VERSION
@@ -139,7 +139,7 @@ dependencies:
139139
match: minimum_go_version=go([0-9]+\.[0-9]+)
140140

141141
- name: "registry.k8s.io/kube-cross: dependents"
142-
version: v1.33.0-go1.24.5-bullseye.0
142+
version: v1.33.0-go1.24.6-bullseye.0
143143
refPaths:
144144
- path: build/build-image/cross/VERSION
145145

@@ -177,15 +177,15 @@ dependencies:
177177
match: registry\.k8s\.io\/build-image\/debian-base:[a-zA-Z]+\-v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)
178178

179179
- name: "registry.k8s.io/distroless-iptables: dependents"
180-
version: v0.7.7
180+
version: v0.7.8
181181
refPaths:
182182
- path: build/common.sh
183183
match: __default_distroless_iptables_version=
184184
- path: test/utils/image/manifest.go
185185
match: configs\[DistrolessIptables\] = Config{list\.BuildImageRegistry, "distroless-iptables", "v([0-9]+)\.([0-9]+)\.([0-9]+)"}
186186

187187
- name: "registry.k8s.io/go-runner: dependents"
188-
version: v2.4.0-go1.24.5-bookworm.0
188+
version: v2.4.0-go1.24.6-bookworm.0
189189
refPaths:
190190
- path: build/common.sh
191191
match: __default_go_runner_version=

‎cmd/kubeadm/app/util/config/initconfiguration.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -381,6 +381,11 @@ func documentMapToInitConfiguration(gvkmap kubeadmapi.DocumentMap, allowDeprecat
381381
// If ClusterConfiguration was given, populate it in the InitConfiguration struct
382382
if clustercfg != nil {
383383
initcfg.ClusterConfiguration = *clustercfg
384+
385+
// TODO: Workaround for missing v1beta3 ClusterConfiguration timeout conversion. Remove this conversion once the v1beta3 is removed
386+
if clustercfg.APIServer.TimeoutForControlPlane.Duration != 0 && clustercfg.APIServer.TimeoutForControlPlane.Duration != kubeadmconstants.ControlPlaneComponentHealthCheckTimeout {
387+
initcfg.Timeouts.ControlPlaneComponentHealthCheck.Duration = clustercfg.APIServer.TimeoutForControlPlane.Duration
388+
}
384389
} else {
385390
// Populate the internal InitConfiguration.ClusterConfiguration with defaults
386391
extclustercfg := &kubeadmapiv1.ClusterConfiguration{}

‎openshift-hack/images/hyperkube/Dockerfile.rhel‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,4 @@ COPY --from=builder /tmp/build/* /usr/bin/
1414
LABEL io.k8s.display-name="OpenShift Kubernetes Server Commands" \
1515
io.k8s.description="OpenShift is a platform for developing, building, and deploying containerized applications." \
1616
io.openshift.tags="openshift,hyperkube" \
17-
io.openshift.build.versions="kubernetes=1.33.4"
17+
io.openshift.build.versions="kubernetes=1.33.5"

‎pkg/securitycontext/util.go‎

Lines changed: 31 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@ limitations under the License.
1717
package securitycontext
1818

1919
import (
20+
"fmt"
21+
"os"
22+
"sync"
23+
2024
v1 "k8s.io/api/core/v1"
2125
)
2226

@@ -188,21 +192,32 @@ func AddNoNewPrivileges(sc *v1.SecurityContext) bool {
188192

189193
var (
190194
// These *must* be kept in sync with moby/moby.
191-
// https://github.com/moby/moby/blob/master/oci/defaults.go#L105-L124
192-
// @jessfraz will watch changes to those files upstream.
193-
defaultMaskedPaths = []string{
194-
"/proc/asound",
195-
"/proc/acpi",
196-
"/proc/kcore",
197-
"/proc/keys",
198-
"/proc/latency_stats",
199-
"/proc/timer_list",
200-
"/proc/timer_stats",
201-
"/proc/sched_debug",
202-
"/proc/scsi",
203-
"/sys/firmware",
204-
"/sys/devices/virtual/powercap",
205-
}
195+
// https://github.com/moby/moby/blob/ecb03c4cdae6f323150fc11b303dcc5dc4d82416/oci/defaults.go#L190-L218
196+
defaultMaskedPaths = sync.OnceValue(func() []string {
197+
maskedPaths := []string{
198+
"/proc/asound",
199+
"/proc/acpi",
200+
"/proc/interrupts",
201+
"/proc/kcore",
202+
"/proc/keys",
203+
"/proc/latency_stats",
204+
"/proc/timer_list",
205+
"/proc/timer_stats",
206+
"/proc/sched_debug",
207+
"/proc/scsi",
208+
"/sys/firmware",
209+
"/sys/devices/virtual/powercap",
210+
}
211+
212+
for _, cpu := range possibleCPUs() {
213+
path := fmt.Sprintf("/sys/devices/system/cpu/cpu%d/thermal_throttle", cpu)
214+
if _, err := os.Stat(path); err == nil {
215+
maskedPaths = append(maskedPaths, path)
216+
}
217+
}
218+
219+
return maskedPaths
220+
})
206221
defaultReadonlyPaths = []string{
207222
"/proc/bus",
208223
"/proc/fs",
@@ -221,7 +236,7 @@ func ConvertToRuntimeMaskedPaths(opt *v1.ProcMountType) []string {
221236
}
222237

223238
// Otherwise, add the default masked paths to the runtime security context.
224-
return defaultMaskedPaths
239+
return defaultMaskedPaths()
225240
}
226241

227242
// ConvertToRuntimeReadonlyPaths converts the ProcMountType to the specified or default

‎pkg/securitycontext/util_darwin.go‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package securitycontext
18+
19+
func possibleCPUs() []int {
20+
return nil
21+
}

‎pkg/securitycontext/util_linux.go‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package securitycontext
18+
19+
import (
20+
"os"
21+
"runtime"
22+
"strconv"
23+
"strings"
24+
"sync"
25+
)
26+
27+
// possibleCPUs returns the number of possible CPUs on this host.
28+
func possibleCPUs() (cpus []int) {
29+
if ncpu := possibleCPUsParsed(); ncpu != nil {
30+
return ncpu
31+
}
32+
33+
for i := range runtime.NumCPU() {
34+
cpus = append(cpus, i)
35+
}
36+
37+
return cpus
38+
}
39+
40+
// possibleCPUsParsed is parsing the amount of possible CPUs on this host from
41+
// /sys/devices.
42+
var possibleCPUsParsed = sync.OnceValue(func() (cpus []int) {
43+
data, err := os.ReadFile("/sys/devices/system/cpu/possible")
44+
if err != nil {
45+
return nil
46+
}
47+
48+
ranges := strings.Split(strings.TrimSpace(string(data)), ",")
49+
50+
for _, r := range ranges {
51+
if rStart, rEnd, ok := strings.Cut(r, "-"); !ok {
52+
cpu, err := strconv.Atoi(rStart)
53+
if err != nil {
54+
return nil
55+
}
56+
cpus = append(cpus, cpu)
57+
} else {
58+
var start, end int
59+
start, err := strconv.Atoi(rStart)
60+
if err != nil {
61+
return nil
62+
}
63+
end, err = strconv.Atoi(rEnd)
64+
if err != nil {
65+
return nil
66+
}
67+
for i := start; i <= end; i++ {
68+
cpus = append(cpus, i)
69+
}
70+
}
71+
}
72+
73+
return cpus
74+
})

0 commit comments

Comments
 (0)