OCPBUGS-100177: Rebase release-4.23 to Kubernetes v1.35.7 - #2726
OCPBUGS-100177: Rebase release-4.23 to Kubernetes v1.35.7#2726redhat-chai-bot wants to merge 102 commits into
Conversation
Signed-off-by: Chao Chen <chaochn@amazon.com>
Fixes kube-proxy's nftables mode to work on systems with nft 1.1.3.
When a pod has a sidecar (initContainer with restartPolicy: Always) with a startupProbe, and one or more regular containers crash after a kubelet restart, the kubelet fails to restart the regular containers. RestartCount stays at 0 indefinitely. When ChangeContainerStatusOnKubeletRestart is disabled (default in v1.35), the prober worker skips seeding probe results for containers that predate the kubelet restart. For a sidecar with a startupProbe this means startupManager.Get() returns found=false permanently. In computeInitContainerActions, the sidecar Running case breaks out early at the !found check, leaving podHasInitialized=false. computePodActions then returns early at the !hasInitialized guard without restarting the crashed regular containers. Fix: when the gate is off and a restartable init container's startup probe is being seeded for the first time after a kubelet restart, check the container's Started field in the pod status. If Started=true, the sidecar had already passed startup before the restart, so seed the startup manager with Success. This allows computeInitContainerActions to detect pod initialization via the sidecar Running path without altering readiness or liveness probe seeding behaviour. Add and update tests to cover the fix: - worker unit tests for sidecar startup/readiness/liveness restart behaviour - e2e node regression test for sidecar with startupProbe across kubelet restart Fixes: kubernetes#136910
…-pick-of-#137501-origin-release-1.35 Automated cherry pick of kubernetes#137501: Fix kube-proxy on systems with nft 1.1.3 (take 2)
Signed-off-by: Maciej Szulik <soltysh@gmail.com>
When oldObj is nil (e.g. new map entry added during update), union ratcheting incorrectly treats nil old and empty new as unchanged membership, skipping validation entirely. Fix by checking reflect.ValueOf(oldObj).IsNil() and disabling ratcheting when oldObj is nil, so the new value is fully validated. This affects Union, DiscriminatedUnion, and ZeroOrOneOfUnion (via unionValidate).
Add tests for Union, DiscriminatedUnion, and ZeroOrOneOfUnion validating that nil oldObj (new map entry or newly-set pointer field during update) does not skip validation via ratcheting.
Test that declarative validation catches a DeviceAttribute with no value fields set, which was the original bug scenario where union ratcheting incorrectly skipped validation for new map entries.
- Use reflect.ValueOf(oldObj).IsZero() instead of IsNil() so union validation works with non-nilable T (e.g. value types) - Remove hasOldValue guard from inner loop conditionals; only check at the final ratcheting skip point - Add doc comments explaining T is "any" rather than "comparable" because union members can be slices - Add value-type subtests for Union and DiscriminatedUnion Co-authored-by: Tim Hockin <thockin@google.com>
- Code generator: use len() != 0 for slice/map member extractors instead of != nil, so empty slice/map are treated as "not set" - Add slice and map members to union test types (both discriminated and undiscriminated) - Add test coverage for nil vs empty, ratcheting, and nil oldObj with slice/map members Co-authored-by: Tim Hockin <thockin@google.com>
…-pick-of-#137146-upstream-release-1.35 Automated cherry pick of kubernetes#137146: kubelet: fix containers not restarting when sidecar keeps running
…pick-of-#135685-upstream-release-1.35 Automated cherry pick of kubernetes#135685: Bugfix: calculate request latency properly in audit log filter
When a container restarts before kubelet restarts, containerMap has multiple entries (old exited + new running). GetContainerID() may return the exited container, causing the running check to fail. Fixed by checking if ANY container for the pod/name is running. Also filter terminal pods from podresources since they no longer consume resources, and fix test error handling to avoid exiting Eventually immediately on transient errors. Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
terminated pods should not be reported by Get() calls, we should get an error instead Signed-off-by: Francesco Romani <fromani@redhat.com>
Currently the provider that the podresources API consumes does *not* obviously filters out the terminal pod, and this is corroborated by the fact the related e2e test starts to fail. We had a bug in the test which masked the real failure, but now it's evident. So we perform a trivial extraction of the kubelet filtering code and we apply in both places. Note that the existing flow is unaffected except for the trivial code extraciton. Signed-off-by: Francesco Romani <fromani@redhat.com>
… time, includes only stateless and immediately schedulable pods
…ck-of-#138131-upstream-release-1.35 Automated cherry pick of kubernetes#138131: Deflake TestPodSubresourceAuth by waiting for effective permissions before testing
Cherry pick of 137864
…ck-of-#137904-upstream-release-1.35 Automated cherry pick of kubernetes#137904: KEP-961: demote maxUnavailable feature in statefulset to off by default
Signed-off-by: Marko Mudrinić <mudrinic.mare@gmail.com>
[release-1.35] Bump images and versions to go 1.25.9 and distroless iptables
…k-of-#135485-upstream-release-1.35 Automated cherry pick of kubernetes#135485: Fix device plugin admission failure after container restart
Kubernetes-commit: 7e9c2c8eef26f99aa2f94d8e09d6d32de86c7769
[release-1.35] Update go.opentelemetry.io/otel to v1.41.0
…-v0.5.1-1.35 [1.35] Update github.com/moby/spdystream from v0.5.0 to v0.5.1
openshift-ci-robot
added
the
backports/unvalidated-commits
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: redhat-chai-bot The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@redhat-chai-bot: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/retitle OCPBUGS-100177: Rebase release-4.23 to Kubernetes v1.35.7 |
openshift-ci
Bot
changed the title
openshift-ci-robot
added
jira/valid-reference
|
@redhat-chai-bot: This pull request references Jira Issue OCPBUGS-100177, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
openshift-ci
Bot
added
the
needs-rebase
|
/jira refresh |
|
@JSampsonIV: This pull request references Jira Issue OCPBUGS-100177, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira-refresh |
jacobsee
left a comment
jacobsee
left a comment
There was a problem hiding this comment.
Conflict resolution needs to follow the standard documented process & be separated into its own commit. These results cast some doubt on the determinism of the patch rebase process, let's talk about it next week.
|
Acknowledged — same gap as #2728 and #2729. The conflict resolution should have been in a separate Note: this PR also has merge conflicts that will need resolving before it can merge or retests will run cleanly. |
|
This PR is unneeded, in the time between this rebase and now 4.22 has been rebased to 1.36 instead. |
|
/close |
|
@redhat-chai-bot: This pull request references Jira Issue OCPBUGS-100177. The bug has been updated to no longer refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@JSampsonIV: Closed this PR. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
20 participants
Summary
Rebases the
release-4.23branch from Kubernetes 1.35.3 to v1.35.7 (upstream release 2026-07-22).Conflicts Resolved
10 files — accepted upstream version:
go.sumgo.mod/go.sumfilesOpenShift Dependencies
OpenShift deps (
openshift/api,client-go,library-go,apiserver-library-go) kept at their existing pinned versions. The newer branch heads pull in go 1.26 / k8s 1.36 APIs that are incompatible with k8s 1.35.@dusk125 requested in Slack thread