chore(deps): update dependency kubernetes-asyncio to v31 #886
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==29.0.0->==31.1.0Release Notes
tomplus/kubernetes_asyncio (kubernetes-asyncio)
v31.1.0Compare Source
Added
load_configfunction (#331, @james-mchugh)Watch() retries 410 errors (#327, @tomplus)
Pod exec enhancements (#328, @olivier-matz-6wind)
Fix content-type detection for object sending as patch (#334, @tomplus)
Fix stopping Watch for logs and events with timeout (#330, @tomplus)
API Change
The resource/v1alpha3.ResourceSliceList filed which should have been named "metadata" but was instead named "listMeta" is now properly "metadata". (kubernetes/kubernetes#126761, @thockin) [SIG API Machinery]
'ACTION REQUIRED: The Dynamic Resource Allocation (DRA) driver's DaemonSet
must be deployed with a service account that enables writing ResourceSlice
and reading ResourceClaim objects.'
(kubernetes/kubernetes#125163, @pohly) [SIG Auth, Node and Testing]
Add UserNamespaces field to NodeRuntimeHandlerFeatures (kubernetes/kubernetes#126034, @sohankunkerkar) [SIG API Machinery, Apps and Node]
Added Coordinated Leader Election as Alpha under the
CoordinatedLeaderElectionfeature gate. With the feature enabled, the control plane can use LeaseCandidate objects (coordination.k8s.io/v1alpha1 API group) to participate in a leader election and let the kube-apiserver select the best instance according to some strategy. (kubernetes/kubernetes#124012, @Jefftree) [SIG API Machinery, Apps, Auth, Cloud Provider, Etcd, Node, Release, Scheduling and Testing]Added a
.status.features.supplementalGroupsPolicyfield to Nodes. The field is true when the feature is implemented in the CRI implementation (KEP-3619). (kubernetes/kubernetes#125470, @everpeace) [SIG API Machinery, Apps, Node and Testing]Added an
allocatedResourcesStatusto each container status to indicate the health status of devices exposed by the device plugin. (kubernetes/kubernetes#126243, @SergeyKanzhelev) [SIG API Machinery, Apps, Node and Testing]Added support to the kube-proxy nodePortAddresses / --nodeport-addresses option to
accept the value "primary", meaning to only listen for NodePort connections
on the node's primary IPv4 and/or IPv6 address (according to the Node object).
This is strongly recommended, if you were not previously using
--nodeport-addresses, to avoid surprising behavior.
(This behavior is enabled by default with the nftables backend; you would
need to explicitly request
--nodeport-addresses 0.0.0.0/0,::/0there to getthe traditional "listen on all interfaces" behavior.) (kubernetes/kubernetes#123105, @danwinship) [SIG API Machinery, Network and Windows]
Added the feature gates
StrictCostEnforcementForVAPandStrictCostEnforcementForWebhooksto enforce the strict cost calculation for CEL extended libraries. It is strongly recommended to turn on the feature gates as early as possible. (kubernetes/kubernetes#124675, @cici37) [SIG API Machinery, Auth, Node and Testing]Changed how the API server handles updates to
.spec.defaultBackendof Ingress objects.Server-side apply now considers
.spec.defaultBackendto be an atomic struct. This means that any field-owner who sets values in that struct (they are mutually exclusive) owns the whole struct. For almost all users this change has no impact; for controllers that want to change the default backend port from number to name (or vice-versa), this makes it easier. (kubernetes/kubernetes#126207, @thockin) [SIG API Machinery]Component-base/logs: when compiled with Go >= 1.21, component-base will automatically configure the slog default logger together with initializing klog. (kubernetes/kubernetes#120696, @pohly) [SIG API Machinery, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Storage and Testing]
CustomResourceDefinition objects created with non-empty
caBundlefields which are invalid or do not contain any certificates will not appear in discovery or serve endpoints until a validcaBundleis provided. Updates to CustomResourceDefinition are no longer allowed to transition a validcaBundlefield to an invalidcaBundlefield, because this breaks serving of the existing CustomResourceDefinition. (kubernetes/kubernetes#124061, @Jefftree) [SIG API Machinery]Dynamic Resource Allocation (DRA): Added a feature so the number of ResourceClaim objects can be limited per namespace and by the number of devices requested through a specific class via the v1.ResourceQuota mechanism. (kubernetes/kubernetes#120611, @pohly) [SIG API Machinery, Apps, Auth, CLI, Etcd, Node, Release, Scheduling and Testing]
Dynamic Resource Allocation (DRA): client-side validation of a ResourceHandle would have accepted a missing DriverName, whereas server-side validation then would have raised an error. (kubernetes/kubernetes#124075, @pohly)
Dynamic Resource Allocation (DRA): in the
pod.spec.recourceClaimsarray, thesourceindirection is no longer necessary. Instead of e.g.source: resourceClaimTemplateName: my-template, one can writeresourceClaimTemplateName: my-template. (kubernetes/kubernetes#125116, @pohly) [SIG API Machinery, Apps, Auth, Node, Scheduling and Testing]Enhanced the Dynamic Resource Allocation (DRA) with an updated version of the resource.k8s.io API group. The primary user-facing type remains the ResourceClaim, however significant changes have been made, resulting in the new version, v1alpha3, which is not compatible with the previous version. (kubernetes/kubernetes#125488, @pohly) [SIG API Machinery, Apps, Auth, CLI, Cluster Lifecycle, Etcd, Node, Release, Scheduling, Storage and Testing]
Fixed a 1.30.0 regression in OpenAPI descriptions of the
imagePullSecretsandhostAliasesfields to mark the fields used as keys in those lists as either defaultedor required. (kubernetes/kubernetes#124553, @pmalek)
Fixed a 1.30.0 regression in openapi descriptions of
PodIP.IPandHostIP.IPfields to mark the fields used as keys in those lists as required. (kubernetes/kubernetes#126057, @thockin)Fixed a bug in the API server where empty collections of ValidatingAdmissionPolicies did not have an
itemsfield. (kubernetes/kubernetes#124568, @xyz-li) [SIG API Machinery]Fixed a deep copy issue when retrieving the controller reference. (kubernetes/kubernetes#124116, @HiranmoyChowdhury) [SIG API Machinery and Release]
Fixed code-generator client-gen to work with
api/v1-like package structure. (kubernetes/kubernetes#125162, @sttts) [SIG API Machinery and Apps]Fixed incorrect "v1 Binding is deprecated in v1.6+" warning in kube-scheduler log. (kubernetes/kubernetes#125540, @pohly) [SIG API Machinery]
Fixed the comment for the Job's managedBy field. (kubernetes/kubernetes#124793, @mimowo) [SIG API Machinery and Apps]
Fixed the documentation for the default value of the
procMountentry insecurityContextwithin a Pod.The documentation was previously using the name of the internal variable
DefaultProcMount, rather than the actual value, "Default". (kubernetes/kubernetes#125782, @aborrero) [SIG Apps and Node]Graduate PodDisruptionConditions to GA and lock (kubernetes/kubernetes#125461, @mimowo) [SIG Apps, Node, Scheduling and Testing]
Graduated MatchLabelKeys/MismatchLabelKeys feature in PodAffinity/PodAntiAffinity to Beta. (kubernetes/kubernetes#123638, @sanposhiho) [SIG API Machinery, Apps, Scheduling and Testing]
Graduated
JobPodFailurePolicyto GA and locked it to it's default. (kubernetes/kubernetes#125442, @mimowo) [SIG API Machinery, Apps, Scheduling and Testing]Graduated the Job
successPolicyfield to beta.The new reason label, "SuccessPolicy" and "CompletionsReached" are added to the "jobs_finished_total" metric.
Additionally, if you enable the
JobSuccessPolicyfeature gate, the Job gets "CompletionsReached" reason for the "SuccessCriteriaMet" and "Complete" condition typewhen the number of succeeded Job Pods (
.status.succeeded) reached the desired completions (.spec.completions). (kubernetes/kubernetes#126067, @tenzen-y) [SIG API Machinery, Apps and Testing]Graduated the
DisableNodeKubeProxyVersionfeature gate to beta. By default, the kubelet no longer attempts to set the.status.kubeProxyVersionfield for its associated Node. (kubernetes/kubernetes#123845, @HirazawaUi) [SIG API Machinery, Cloud Provider, Network, Node and Testing]Improved scheduling performance when many nodes, and prefilter returned 1-2 nodes (e.g. daemonset)
For developers of out-of-tree PostFilter plugins, note that the semantics of NodeToStatusMap are changing: A node with an absent value in the NodeToStatusMap should be interpreted as having an UnschedulableAndUnresolvable status. (kubernetes/kubernetes#125197, @gabesaba)
Introduced a new boolean kubelet flag
--fail-cgroupv1. (kubernetes/kubernetes#126031, @harche) [SIG API Machinery and Node]K8s.io/apimachinery/pkg/util/runtime: Added support for new calls to handle panics and errors in the context where they occur.
PanicHandlersandErrorHandlersnow must accept a context parameter for that. Log output is structured instead of unstructured. (kubernetes/kubernetes#121970, @pohly) [SIG API Machinery and Instrumentation]KEP-1880: Users of the new feature to add multiple service CIDR will use by default a dual-write strategy on the new ClusterIP allocators to avoid the problem of possible duplicate IPs allocated to Services when running skewed kube-apiservers using different allocators. They can opt-out of this behavior by enabled the feature gate DisableAllocatorDualWrite. (kubernetes/kubernetes#122047, @aojea) [SIG API Machinery, Apps, Instrumentation and Testing]
Kube-apiserver: Added Alpha features to allow API server authz to check the context of requests:
AuthorizeWithSelectorsfeature gate enables including field and label selector information from requests in webhook authorization calls.AuthorizeNodeWithSelectorsfeature gate changes node authorizer behavior to limit requests from node API clients, so that each Node can only get / list / watch its own Node API object, and can also only get / list / watch Pod API objects bound to that node. Clients using kubelet credentials to read other nodes or unrelated pods must change their authentication credentials (recommended), adjust their usage, or obtain broader read access independent of the node authorizer. (kubernetes/kubernetes#125571, @liggitt) [SIG API Machinery, Auth, Node, Scheduling and Testing]Kube-apiserver: ControllerRevision objects are now verified to contain valid JSON data in the
datafield. (kubernetes/kubernetes#125549, @liggitt) [SIG API Machinery and Apps]Kube-apiserver: the
--encryption-provider-configfile is now loaded with strict deserialization, which fails if the config file contains duplicate or unknown fields. This protects against accidentally running with config files that are malformed, mis-indented, or have typos in field names, and getting unexpected behavior. When--encryption-provider-config-automatic-reloadis used, new encryption config files that contain typos after the kube-apiserver is running are treated as invalid and the last valid config is used. (kubernetes/kubernetes#124912, @enj) [SIG API Machinery and Auth]Kube-controller-manager: the
horizontal-pod-autoscaler-upscale-delayandhorizontal-pod-autoscaler-downscale-delayflags have been removed (deprecated and non-functional since v1.12). (kubernetes/kubernetes#124948, @SataQiu) [SIG API Machinery, Apps and Autoscaling]Made kube-proxy Windows service control manager integration (
--windows-service) configurable in v1alpha1 component configuration viawindowsRunAsServicefield. (kubernetes/kubernetes#126072, @aroradaman) [SIG Network and Scalability]PersistentVolumeLastPhaseTransitionTime feature is stable and enabled by default. (kubernetes/kubernetes#124969, @RomanBednar) [SIG API Machinery, Apps, Storage and Testing]
Promoted
LocalStorageCapacityIsolationto beta; the behaviour is enabled by default. Within the kubelet, storage capacity isolation is active if the feature gate is enabled and the specific Pod is using a user namespace. (kubernetes/kubernetes#126014, @PannagaRao) [SIG Apps, Autoscaling, Node, Storage and Testing]Promoted
StatefulSetStartOrdinalto stable. This means--feature-gates=StatefulSetStartOrdinal=trueare not needed on kube-apiserver and kube-controller-manager binaries and they'll be removed soon following policy at https://kubernetes.io/docs/reference/using-api/deprecation-policy/#deprecation. (kubernetes/kubernetes#125374, @pwschuurman) [SIG API Machinery, Apps and Testing]Promoted feature-gate
VolumeAttributesClassto beta (disabled by default). Users need to enable the feature gate and thestorage.k8s.io/v1beta1API group to use this feature.Promoted the VolumeAttributesClass API to beta. (kubernetes/kubernetes#126145, @carlory) [SIG API Machinery, Apps, CLI, Etcd, Storage and Testing]
Removed deprecated command flags --volume-host-cidr-denylist
and --volume-host-allow-local-loopback from kube-controller-manager.
(kubernetes/kubernetes#124017, @carlory) [SIG API Machinery, Apps, Cloud Provider and Storage]
Removed feature gate
CustomResourceValidationExpressions. (kubernetes/kubernetes#126136, @cici37) [SIG API Machinery, Cloud Provider and Testing]Reverted a change where
ConsistentListFromCachewas moved to beta and enabled by default. (kubernetes/kubernetes#126139, @enj)Revised the Pod API with Alpha support for volumes derived from OCI artifacts. This feature is behind the
ImageVolumefeature gate. (kubernetes/kubernetes#125660, @saschagrunert) [SIG API Machinery, Apps and Node]Supported fine-grained supplemental groups policy (KEP-3619), which enabled
fine-grained control for supplementary groups in the first container processes.
This allows you to choose whether to include groups defined in the container image (/etc/groups)
for the container's primary UID or not. (kubernetes/kubernetes#117842, @everpeace) [SIG API Machinery, Apps and Node]
The (alpha) nftables mode of kube-proxy now requires version 1.0.1 or later
of the nft command-line, and kernel 5.13 or later. (For testing/development
purposes, you can use older kernels, as far back as 5.4, if you set the
nftables.skipKernelVersionCheckoption in the kube-proxy config, but this is notrecommended in production since it may cause problems with other nftables
users on the system.) (kubernetes/kubernetes#124152, @danwinship) [SIG Network]
To enhance usability and developer experience, CRD validation rules now support direct use of (CEL) reserved keywords as field names in object validation expressions for existing expressions in storage, will fully support runtime in next release for compatibility concern. (kubernetes/kubernetes#126188, @cici37) [SIG API Machinery and Testing]
Updated the feature MultiCIDRServiceAllocator to beta (disabled by default). Users need to enable the feature gate and the networking v1beta1 group to be able to use this new feature, that allows to dynamically reconfigure Service CIDR ranges. (kubernetes/kubernetes#125021, @aojea) [SIG API Machinery, Apps, CLI, Etcd, Instrumentation, Network and Testing]
Use omitempty for optional Job Pod Failure Policy fields. (kubernetes/kubernetes#126046, @mimowo)
User can choose a different static policy option
SpreadPhysicalCPUsPreferredOptionto spread cpus across physical cpus for some specific applications (kubernetes/kubernetes#123733, @Jeffwan) [SIG Node]When the featuregate AnonymousAuthConfigurableEndpoints is enabled users can update the AuthenticationConfig file with endpoints for with anonymous requests are alllowed. (kubernetes/kubernetes#124917, @vinayakankugoyal) [SIG API Machinery, Auth, Cloud Provider, Node and Testing]
Move ConsistentListFromCache feature flag to Beta and enable it by default (kubernetes/kubernetes#126469, @serathius) [SIG API Machinery]
Add Coordinated Leader Election as alpha under the CoordinatedLeaderElection feature gate. With the feature enabled, the control plane can use LeaseCandidate objects (coordination.k8s.io/v1alpha1 API group) to participate in a leader election and let the kube-apiserver select the best instance according to some strategy. (kubernetes/kubernetes#124012, @Jefftree) [SIG API Machinery, Apps, Auth, Cloud Provider, Etcd, Node, Release, Scheduling and Testing]
Add an AllocatedResourcesStatus to each container status to indicate the health status of devices exposed by the device plugin. (kubernetes/kubernetes#126243, @SergeyKanzhelev) [SIG API Machinery, Apps, Node and Testing]
Added Node.Status.Features.SupplementalGroupsPolicy field which is set to true when the feature is implemented in the CRI implementation (KEP-3619) (kubernetes/kubernetes#125470, @everpeace) [SIG API Machinery, Apps, Node and Testing]
CustomResourceDefinition objects created with non-empty
caBundlefields which are invalid or do not contain any certificates will not appear in discovery or serve endpoints until a validcaBundleis provided. Updates to CustomResourceDefinition are no longer allowed to transition a validcaBundlefield to an invalidcaBundlefield. (kubernetes/kubernetes#124061, @Jefftree) [SIG API Machinery]DRA: The DRA driver's daemonset must be deployed with a service account that enables writing ResourceSlice and reading ResourceClaim objects. (kubernetes/kubernetes#125163, @pohly) [SIG Auth, Node and Testing]
DRA: new API and several new features (kubernetes/kubernetes#125488, @pohly) [SIG API Machinery, Apps, Auth, CLI, Cluster Lifecycle, Etcd, Node, Release, Scheduling, Storage and Testing]
DRA: the number of ResourceClaim objects can be limited per namespace and by the number of devices requested through a specific class via the v1.ResourceQuota mechanism. (kubernetes/kubernetes#120611, @pohly) [SIG API Machinery, Apps, Auth, CLI, Etcd, Node, Release, Scheduling and Testing]
Fix the documentation for the default value of the procMount entry in the pod securityContext.
The documentation was previously using the name of the internal variable 'DefaultProcMount' rather than the actual value 'Default'. (kubernetes/kubernetes#125782, @aborrero) [SIG Apps and Node]
Fixed a bug in the API server where empty collections of ValidatingAdmissionPolicies did not have an
itemsfield. (kubernetes/kubernetes#124568, @xyz-li) [SIG API Machinery]Graduate the Job SuccessPolicy to Beta.
The new reason label, "SuccessPolicy" and "CompletionsReached" are added to the "jobs_finished_total" metric.
Additionally, If we enable the "JobSuccessPolicy" feature gate, the Job gets "CompletionsReached" reason for the "SuccessCriteriaMet" and "Complete" condition type
when the number of succeeded Job Pods (".status.succeeded") reached the desired completions (".spec.completions"). (kubernetes/kubernetes#126067, @tenzen-y) [SIG API Machinery, Apps and Testing]
Introduce a new boolean kubelet flag --fail-cgroupv1 (kubernetes/kubernetes#126031, @harche) [SIG API Machinery and Node]
Kube-apiserver: adds an alpha AuthorizeWithSelectors feature that includes field and label selector information from requests in webhook authorization calls; adds an alpha AuthorizeNodeWithSelectors feature that makes the node authorizer limit requests from node API clients to get / list / watch its own Node API object, and to get / list / watch its own Pod API objects. Clients using kubelet credentials to read other nodes or unrelated pods must change their authentication credentials (recommended), adjust their usage, or grant broader read access independent of the node authorizer. (kubernetes/kubernetes#125571, @liggitt) [SIG API Machinery, Auth, Node, Scheduling and Testing]
Kube-proxy Windows service control manager integration(--windows-service) is now configurable in v1alpha1 component configuration via
WindowsRunAsServicefield (kubernetes/kubernetes#126072, @aroradaman) [SIG Network and Scalability]Promote LocalStorageCapacityIsolation to beta and enable if user namespace is enabled for the pod (kubernetes/kubernetes#126014, @PannagaRao) [SIG Apps, Autoscaling, Node, Storage and Testing]
Promote StatefulSetStartOrdinal to stable. This means
--feature-gates=StatefulSetStartOrdinal=trueare not needed on kube-apiserver and kube-controller-manager binaries and they'll be removed soon following policy at https://kubernetes.io/docs/reference/using-api/deprecation-policy/#deprecation (kubernetes/kubernetes#125374, @pwschuurman) [SIG API Machinery, Apps and Testing]Promoted feature-gate
VolumeAttributesClassto beta (disabled by default). Users need to enable the feature gate and the storage v1beta1 group to use this new feature.VolumeAttributesClassandVolumeAttributesClassListtostorage.k8s.io/v1beta1. (kubernetes/kubernetes#126145, @carlory) [SIG API Machinery, Apps, CLI, Etcd, Storage and Testing]Removed feature gate
CustomResourceValidationExpressions. (kubernetes/kubernetes#126136, @cici37) [SIG API Machinery, Cloud Provider and Testing]Revert "Move ConsistentListFromCache feature flag to Beta and enable it by default" (kubernetes/kubernetes#126139, @enj) [SIG API Machinery]
Revised the Pod API with alpha support for volumes derived from OCI artefacts.
This feature is behind the
ImageVolumefeature gate. (kubernetes/kubernetes#125660, @saschagrunert) [SIG API Machinery, Apps and Node]The Ingress.spec.defaultBackend is now considered an atomic struct for the purposes of server-side-apply. This means that any field-owner who sets values in that struct (they are mutually exclusive) owns the whole struct. For almost all users this change has no impact. For controllers which want to change port from number to name (or vice-versa), this makes it easier. (kubernetes/kubernetes#126207, @thockin) [SIG API Machinery]
To enhance usability and developer experience, CRD validation rules now support direct use of (CEL) reserved keywords as field names in object validation expressions for existing expressions in storage, will fully support runtime in next release for compatibility concern. (kubernetes/kubernetes#126188, @cici37) [SIG API Machinery and Testing]
Add UserNamespaces field to NodeRuntimeHandlerFeatures (kubernetes/kubernetes#126034, @sohankunkerkar) [SIG API Machinery, Apps and Node]
Fixes a 1.30.0 regression in openapi descriptions of PodIP.IP and HostIP.IP fields to mark the fields used as keys in those lists as required. (kubernetes/kubernetes#126057, @thockin) [SIG API Machinery]
Graduate JobPodFailurePolicy to GA and lock (kubernetes/kubernetes#125442, @mimowo) [SIG API Machinery, Apps, Scheduling and Testing]
Graduate PodDisruptionConditions to GA and lock (kubernetes/kubernetes#125461, @mimowo) [SIG Apps, Node, Scheduling and Testing]
PersistentVolumeLastPhaseTransitionTime feature is stable and enabled by default. (kubernetes/kubernetes#124969, @RomanBednar) [SIG API Machinery, Apps, Storage and Testing]
The (alpha) nftables mode of kube-proxy now requires version 1.0.1 or later
of the nft command-line, and kernel 5.13 or later. (For testing/development
purposes, you can use older kernels, as far back as 5.4, if you set the
nftables.skipKernelVersionCheckoption in the kube-proxy config, but this is notrecommended in production since it may cause problems with other nftables
users on the system.) (kubernetes/kubernetes#124152, @danwinship) [SIG Network]
Use omitempty for optional Job Pod Failure Policy fields (kubernetes/kubernetes#126046, @mimowo) [SIG Apps]
User can choose a different static policy option
SpreadPhysicalCPUsPreferredOptionto spread cpus across physical cpus for some specific applications (kubernetes/kubernetes#123733, @Jeffwan) [SIG Node]DRA: in the
pod.spec.recourceClaimsarray, thesourceindirection is no longer necessary. Instead of e.g.source: resourceClaimTemplateName: my-template, one can writeresourceClaimTemplateName: my-template. (kubernetes/kubernetes#125116, @pohly) [SIG API Machinery, Apps, Auth, Node, Scheduling and Testing]Fix code-generator client-gen to work with
api/v1-like package structure. (kubernetes/kubernetes#125162, @sttts) [SIG API Machinery and Apps]KEP-1880: Users of the new feature to add multiple service CIDR will use by default a dual-write strategy on the new ClusterIP allocators to avoid the problem of possible duplicate IPs allocated to Services when running skewed kube-apiservers using different allocators. They can opt-out of this behavior by enabled the feature gate DisableAllocatorDualWrite (kubernetes/kubernetes#122047, @aojea) [SIG API Machinery, Apps, Instrumentation and Testing]
Kube-apiserver: ControllerRevision objects are now verified to contain valid JSON data in the
datafield. (kubernetes/kubernetes#125549, @liggitt) [SIG API Machinery and Apps]Update the feature MultiCIDRServiceAllocator to beta (disabled by default). Users need to enable the feature gate and the networking v1beta1 group to be able to use this new feature, that allows to dynamically reconfigure Service CIDR ranges. (kubernetes/kubernetes#125021, @aojea) [SIG API Machinery, Apps, CLI, Etcd, Instrumentation, Network and Testing]
When the featuregate AnonymousAuthConfigurableEndpoints is enabled users can update the AuthenticationConfig file with endpoints for with anonymous requests are alllowed. (kubernetes/kubernetes#124917, @vinayakankugoyal) [SIG API Machinery, Auth, Cloud Provider, Node and Testing]
Fixed incorrect "v1 Binding is deprecated in v1.6+" warning in kube-scheduler log. (kubernetes/kubernetes#125540, @pohly) [SIG API Machinery]
Added the feature gates
StrictCostEnforcementForVAPandStrictCostEnforcementForWebhooksto enforce the strct cost calculation for CEL extended libraries. It is strongly recommended to turn on the feature gates as early as possible. (kubernetes/kubernetes#124675, @cici37) [SIG API Machinery, Auth, Node and Testing]Component-base/logs: when compiled with Go >= 1.21, component-base will automatically configure the slog default logger together with initializing klog. (kubernetes/kubernetes#120696, @pohly) [SIG API Machinery, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Storage and Testing]
DRA: client-side validation of a ResourceHandle would have accepted a missing DriverName, whereas server-side validation then would have raised an error. (kubernetes/kubernetes#124075, @pohly) [SIG Apps]
Fix Deep Copy issue in getting controller reference (kubernetes/kubernetes#124116, @HiranmoyChowdhury) [SIG API Machinery and Release]
Fix the comment for the Job's managedBy field (kubernetes/kubernetes#124793, @mimowo) [SIG API Machinery and Apps]
Fixes a 1.30.0 regression in openapi descriptions of imagePullSecrets and hostAliases fields to mark the fields used as keys in those lists as either defaulted or required. (kubernetes/kubernetes#124553, @pmalek) [SIG API Machinery]
Graduate MatchLabelKeys/MismatchLabelKeys feature in PodAffinity/PodAntiAffinity to Beta (kubernetes/kubernetes#123638, @sanposhiho) [SIG API Machinery, Apps, Scheduling and Testing]
Graduated the
DisableNodeKubeProxyVersionfeature gate to beta. By default, the kubelet no longer attempts to set the.status.kubeProxyVersionfield for its associated Node. (kubernetes/kubernetes#123845, @HirazawaUi) [SIG API Machinery, Cloud Provider, Network, Node and Testing]Improved scheduling performance when many nodes, and prefilter returns 1-2 nodes (e.g. daemonset)
For developers of out-of-tree PostFilter plugins, note that the semantics of NodeToStatusMap are changing: A node with an absent value in the NodeToStatusMap should be interpreted as having an UnschedulableAndUnresolvable status (kubernetes/kubernetes#125197, @gabesaba) [SIG Scheduling]
K8s.io/apimachinery/pkg/util/runtime: new calls support handling panics and errors in the context where they occur.
PanicHandlersandErrorHandlersnow must accept a context parameter for that. Log output is structured instead of unstructured. (kubernetes/kubernetes#121970, @pohly) [SIG API Machinery and Instrumentation]Kube-apiserver: the
--encryption-provider-configfile is now loaded with strict deserialization, which fails if the config file contains duplicate or unknown fields. This protects against accidentally running with config files that are malformed, mis-indented, or have typos in field names, and getting unexpected behavior. When--encryption-provider-config-automatic-reloadis used, new encryption config files that contain typos after the kube-apiserver is running are treated as invalid and the last valid config is used. (kubernetes/kubernetes#124912, @enj) [SIG API Machinery and Auth]Kube-controller-manager removes deprecated command flags: --volume-host-cidr-denylist and --volume-host-allow-local-loopback (kubernetes/kubernetes#124017, @carlory) [SIG API Machinery, Apps, Cloud Provider and Storage]
Kube-controller-manager: the
horizontal-pod-autoscaler-upscale-delayandhorizontal-pod-autoscaler-downscale-delayflags have been removed (deprecated and non-functional since v1.12) (kubernetes/kubernetes#124948, @SataQiu) [SIG API Machinery, Apps and Autoscaling]Support fine-grained supplemental groups policy (KEP-3619), which enables fine-grained control for supplementary groups in the first container processes. You can choose whether to include groups defined in the container image(/etc/groups) for the container's primary uid or not. (kubernetes/kubernetes#117842, @everpeace) [SIG API Machinery, Apps and Node]
The kube-proxy nodeportAddresses / --nodeport-addresses option now
accepts the value "primary", meaning to only listen for NodePort connections
on the node's primary IPv4 and/or IPv6 address (according to the Node object).
This is strongly recommended, if you were not previously using
--nodeport-addresses, to avoid surprising behavior.
(This behavior is enabled by default with the nftables backend; you would
need to explicitly request
--nodeport-addresses 0.0.0.0/0,::/0there to getthe traditional "listen on all interfaces" behavior.) (kubernetes/kubernetes#123105, @danwinship) [SIG API Machinery, Network and Windows]
v30.3.1Compare Source
v30.3.0Compare Source
API Change
StrictCostEnforcementForVAPandStrictCostEnforcementForWebhooksto enforce the strct cost calculation for CEL extended libraries. It is strongly recommended to turn on the feature gates as early as possible. (#124676, @cici37) [SIG API Machinery, Auth, Node and Testing]For developers of out-of-tree PostFilter plugins, note that the semantics of NodeToStatusMap are changing: A node with an absent value in the NodeToStatusMap should be interpreted as having an UnschedulableAndUnresolvable status (#125306, @gabesaba) [SIG Scheduling]
v30.1.1Compare Source
v30.1.0Compare Source
API Change
Fixes a 1.30.0 regression in openapi descriptions of imagePullSecrets and hostAliases fields to mark the fields used as keys in those lists as either defaulted or required. (kubernetes/kubernetes#124553, @pmalek) [SIG API Machinery]
Fixes a 1.30.0 regression in openapi descriptions of imagePullSecrets and hostAliases fields to mark the fields used as keys in those lists as either defaulted or required. (kubernetes/kubernetes#124694, @pmalek) [SIG API Machinery]
Added (alpha) support for the
managedByfield on Jobs. Jobs with a custom value of this field - any value other thankubernetes.io/job-controller- were skipped by the job controller, and their reconciliation was delegated to an external controller, indicated by the value of the field. Jobs that didn't have this field at all, or where the field value was the reserved stringkubernetes.io/job-controller, were reconciled by the built-in job controller.(kubernetes/kubernetes#123273, @mimowo)
Added alpha-level support for the SuccessPolicy in Jobs.
(kubernetes/kubernetes#123412, @tenzen-y)
Added the
CELlibrary for IP Addresses and CIDRs. This was made available for use starting from version1.31.(kubernetes/kubernetes#121912, @JoelSpeed)
Allowed container runtimes to fix an image garbage collection bug by adding an
image_idfield to the CRI Container message.(kubernetes/kubernetes#123508, @saschagrunert)
Dynamic Resource Allocation: DRA drivers can now use "structured parameters" to let the scheduler handle claim allocation.
(kubernetes/kubernetes#123516, @pohly)
Fixed accidental enablement of the new alpha
optionalOldSelfAPI field inCustomResourceDefinitionvalidation rules, which should only have been allowed to be set when theCRDValidationRatchetingfeature gate is enabled.(kubernetes/kubernetes#122329, @jpbetz)
Implemented the
prescoreextension point for thevolumeBindingplugin. It now returns skip if it doesn't do anything in Score.(kubernetes/kubernetes#115768, @AxeZhan)
Kubelet would fail if NodeSwap was used with LimitedSwap and cgroupv1 node.
(kubernetes/kubernetes#123738, @kannon92)
Promoted
AdmissionWebhookMatchConditionsto GA. The feature is now stable, and the feature gate is now locked to default.(kubernetes/kubernetes#123560, @ivelichkovich)
Structured Authentication Configuration now supports
DiscoveryURL. If specified,discoveryURLoverrides the URL used to fetch discovery information. This is for scenarios where the well-known and jwks endpoints are hosted at a different location than the issuer (such as locally in the cluster).(kubernetes/kubernetes#123527, @aramase)
The
StorageVersionMigrationAPI, previously available as a Custom Resource Definition (CRD), is now a built-in API in Kubernetes.(kubernetes/kubernetes#123344, @nilekhc)
When configuring a JWT authenticator:
If
username.expressionused 'claims.email', then 'claims.email_verified' must have been used inusername.expressionorextra[*].valueExpressionorclaimValidationRules[*].expression. An example claim validation rule expression that matches the validation automatically applied whenusername.claimis set to 'email' is 'claims.?email_verified.orValue(true)'.(kubernetes/kubernetes#123737, @enj)
readOnlyvolumes now support recursive read-only mounts for kernel versions >= 5.12."(kubernetes/kubernetes#123180, @AkihiroSuda)
cri-api: Implemented KEP-3857: Recursive Read-only (RRO) mounts.
(kubernetes/kubernetes#123272, @AkihiroSuda)
kube-apiserver: the AuthenticationConfiguration type accepted in
--authentication-configfiles has been promoted toapiserver.config.k8s.io/v1beta1.(kubernetes/kubernetes#123696, @aramase)
kubelet allowed specifying a custom root directory for pod logs (instead of the default /var/log/pods) using the
podLogsDirkey in kubelet configuration.(kubernetes/kubernetes#112957, @mxpv)
resource.k8s.io/ResourceClaim (alpha API): The strategic merge patch strategy for the
status.reservedForarray was changed so that a strategic-merge-patch can now add individual entries. This change may break clients using strategic merge patch to update status, which rely on the previous behavior (replacing the entire array).(kubernetes/kubernetes#122276, @pohly)
Added a CBOR implementation of
runtime.Serializer. Until CBOR graduates to Alpha, API servers will refuse to start if configured with CBOR support. (kubernetes/kubernetes#122881, @benluddy)Added a alpha feature, behind the
RelaxedEnvironmentVariableValidationfeature gate.When that gate is enabled, Kubernetes allows almost all printable ASCII characters to be used in the names
of environment variables for containers in Pods. (kubernetes/kubernetes#123385, @HirazawaUi)
Added a new (alpha) field,
trafficDistribution, to the Servicespecto express preferences for traffic distribution to endpoints. Enabled through theServiceTrafficDistributionfeature gate. (kubernetes/kubernetes#123487, @gauravkghildiyal)Added audienceMatchPolicy field to AuthenticationConfiguration and support for configuring multiple audiences.
The "audienceMatchPolicy" can be empty (or unset) when a single audience is specified in the "audiences" field.
The "audienceMatchPolicy" must be set to "MatchAny" when multiple audiences are specified in the "audiences" field. (kubernetes/kubernetes#123165, @aramase)
Added consistent vanity import to files and provided tooling for verifying and updating them. (kubernetes/kubernetes#120642, @jcchavezs)
Added the
disable-force-detachCLI option forkube-controller-manager. By default, it's set tofalse. When enabled, it prevents force detaching volumes based on maximum unmount time and node status. If activated, the non-graceful node shutdown feature must be used to recover from node failure. Additionally, if a pod needs to be forcibly terminated at the risk of corruption, the appropriate VolumeAttachment object must be deleted. (kubernetes/kubernetes#120344, @rohitssingh)Added to
MutableFeatureGatethe ability to override the default setting of feature gates, to allow default-enabling a feature on a component-by-component basis instead of for all affected components simultaneously. (kubernetes/kubernetes#122647, @benluddy)Aggregated discovery supports both
v2beta1and v2 types and feature is promoted to GA. (kubernetes/kubernetes#122882, @Jefftree)Alpha support for field selectors on custom resources has been added. With the
CustomResourceFieldSelectorsfeature gate enabled, the CustomResourceDefinition API now allows specifyingselectableFields. Listing a field there enables filtering custom resources for that CustomResourceDefinition in list or watch requests. (kubernetes/kubernetes#122717, @jpbetz)AppArmor profiles can now be configured through fields on the
PodSecurityContextand containerSecurityContext. The beta AppArmor annotations are deprecated, and AppArmor status is no longer included in the node ready condition. (kubernetes/kubernetes#123435, @tallclair)Contextual logging is now in beta and enabled by default. Check out the KEP and official documentation for more details. (kubernetes/kubernetes#122589, [@pohly](ht
Configuration
📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.