OCPBUGS-100170: Rebase master to Kubernetes v1.36.3 - #2727
OCPBUGS-100170: Rebase master to Kubernetes v1.36.3#2727redhat-chai-bot wants to merge 33 commits into
Conversation
Move isLearner and isStarted variables to the outer var block of MemberPromote so their values are accessible after the poll loop. After the poll, if isLearner is false the member was already promoted, so return nil early without issuing a redundant promote call.
Signed-off-by: Siyuan Zhang <sizhang@google.com>
Handwritten validation previously fell through to NotSupported when PriorityLevelConfigurationSpec.Type or LimitResponse.Type was empty. The declarative validator emits FieldValueRequired for these fields, so the two paths disagreed for the empty case. Branch on len(Type)==0 to emit Required (matching declarative); keep NotSupported for unknown values.
Add declarative-validation test cases for empty Spec.Type and empty LimitResponse.Type, closing the FieldValueRequired coverage gap reported for PriorityLevelConfiguration across v1, v1beta1, v1beta2, v1beta3.
When manageJob() needs to create replacement pods but defers creation
because a pod-failure backoff is still active, it returned a hardcoded
active=0 to the caller. Because no pods were actually created or deleted,
this left Status.Active=0 while Status.Ready still reflected the running
pods. The apiserver correctly rejects such updates ("cannot set more
ready pods than active") with a 422, which blocks flushing uncounted
terminated pods, removing finalizers, and updating job status, leaving
pods stuck Terminating with stale status.
Return the real active count from both backoff early-returns instead,
since the deferral does not change the number of active pods.
Issue: kubernetes#139428
(cherry picked from commit 2fe49b0)
During kubeadm join, the mandatory kubeadm-config ConfigMap fetch uses GetConfigMapWithShortRetry, which has a 350ms polling budget. When the API server is slow to respond, the single GET attempt blocks for up to 10 seconds (the client timeout), exhausting the polling budget with no retry. Since this call site has no fallback, the join fails. Add a shortConfigMapGet parameter to getInitConfigurationFromCluster and FetchInitConfigurationFromCluster. When false, the kubeadm-config ConfigMap is fetched using KubernetesAPICallTimeout (default 1 minute, user-configurable) with retries, matching the pattern used by getAPIEndpointFromPodAnnotation. When true, the existing GetConfigMapWithShortRetry is used for callers like kubeadm reset that don't need a long retry. Signed-off-by: Damiano Donati <damiano.donati@gmail.com>
…-of-139667-release-1.36 Automated cherry pick of kubernetes#139667: fix(kubeadm): use KubernetesAPICallTimeout for mandatory kubeadm-config fetch during join
…ck-of-#139964-upstream-release-1.36 [1.36] Automated cherry pick of kubernetes#139964: Restore string JSON encoding of cri-api KeyValue
…erry-pick-of-#139457-upstream-release-1.36 Automated cherry pick of kubernetes#139457: Fix job controller reporting active=0 during pod creation backoff [1.36]
…-pick-of-#139842-upstream-release-1.36 Automated cherry pick of kubernetes#139842: kubeadm: treat already promoted learner as successful
…-pick-of-#138584-upstream-release-1.36 Automated cherry pick of kubernetes#138584: [chore] test/compatibility_lifecycle: resolve feature names from variables
…-pick-of-#138740-upstream-release-1.36 Automated cherry pick of kubernetes#138740: flowcontrol: cover declarative Required rule for PriorityLevelConfiguration type field
…ck-of-#139651-upstream-release-1.36 Automated cherry pick of kubernetes#139651: Align DeviceTaintRule informer API version with handlers
…pick-of-#139850-upstream-release-1.36 Automated cherry pick of kubernetes#139850: kubelet startPodSync: reuse the previous context to fix memory leak regression
…ck-of-#138390-origin-release-1.36 Automated cherry pick of kubernetes#138390: kubeadm: skip promote call when etcd member is already a voting member
Signed-off-by: Nabarun Pal <pal.nabarun95@gmail.com>
Backport of kubernetes#140431 to release-1.36 (six commits squashed). allocateDevice reserves a device's shared counters and adds claim constraints before it may reject a candidate on a device taint or a claim constraint, and for an accepted candidate it also marks the device in use and reserves consumable capacity. Some rejection and backtracking paths did not reverse what they had done, so a leaked counter reservation made the allocator treat a counter set as exhausted and fail to allocate a device combination a node can satisfy. Each call now records what it mutated in a small deviceRollbackState value and reverses it with one rollbackDevice method, on every rejection path and on the backtracking undo. It also preserves the shared empty-capacity marker when rolling back one share of an allow-multiple device that another live share still relies on, so a later share is no longer wrongly rejected with insufficient counters. DRAConsumableCapacity, DRADeviceTaints, and DRAPartitionableDevices are beta and on by default in 1.36, so the bug is reachable on a default cluster.
…revert Manual cherry-pick of # 140294: Revert SMD openshift#306 to fix regression in SSA for nullable container types
…-pick-of-#140163-upstream-release-1.36 Automated cherry pick of kubernetes#140163: kubelet: stop logging missing optional container annotations
…d-counters-backport-1.36 Automated cherry pick of kubernetes#140431: DRA: roll back reserved state in allocateDevice
[release-1.36] Bump images and versions to golang 1.26.5 and update distroless-iptables
Kubernetes official release v1.36.3 # Conflicts: # staging/src/k8s.io/code-generator/examples/go.mod # staging/src/k8s.io/sample-controller/go.mod
openshift-ci-robot
added
the
backports/unvalidated-commits
WalkthroughThe changes publish v1.36.2 metadata, refresh toolchain and dependencies, adjust kubeadm, etcd, controller, kubelet, validation, CRI, and DRA behavior, and add regression, compatibility, and integration tests. ChangesRelease and maintenance updates
Estimated code review effort: 5 (Critical) | ~120 minutes ✨ Finishing Touches🧪 Generate unit tests (beta)
|
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: redhat-chai-bot The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🧹 Nitpick comments (7)
cmd/kubeadm/app/util/config/cluster.go (1)
55-58: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider an option struct instead of a fourth trailing bool.
FetchInitConfigurationFromCluster(client, printer, prefix, true, false, true, false)is already hard to read at call sites; a small options struct would be clearer. Fine to defer if you want to stay close to upstream.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/kubeadm/app/util/config/cluster.go` around lines 55 - 58, Consider replacing the trailing boolean parameters of FetchInitConfigurationFromCluster with a named options struct containing getNodeRegistration, getAPIEndpoint, getComponentConfigs, and shortConfigMapGet, then update its call sites to pass the struct so each option is self-describing.cmd/kubeadm/app/util/etcd/etcd.go (1)
643-648: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low value
listMembersOnceopens a fresh etcd client on every retry.
cliis already connected a few lines above; each retry now dials and tears down an extra client just to read membership. Usingcli.MemberList(ctx)directly would avoid the churn.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/kubeadm/app/util/etcd/etcd.go` around lines 643 - 648, Update the retry logic around listMembersOnce to reuse the already-connected cli client by calling cli.MemberList(ctx) directly for membership reads. Preserve the existing status-error logging, lastError assignment, and return behavior while removing the fresh-client retry path.cmd/kubeadm/app/util/etcd/etcd_test.go (1)
1089-1090: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueReplace the
-1sentinel with an explicit flag.
wantPromoteCalls: -1silently disables the assertion; askipPromoteCallCheck bool(or*int) reads better and prevents an accidental unchecked case.Also applies to: 1159-1161
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/kubeadm/app/util/etcd/etcd_test.go` around lines 1089 - 1090, Replace the wantPromoteCalls: -1 sentinel in the relevant etcd test cases with an explicit skipPromoteCallCheck boolean (or equivalent explicit flag), update the assertion logic to skip promotion-call validation only when that flag is set, and adjust both referenced test cases consistently while preserving normal call-count checks.cmd/kubeadm/app/util/config/cluster_test.go (1)
543-543: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winNo coverage for the new long-retry branch.
All cases pass
shortConfigMapGet=true, so the newPollUntilContextTimeoutpath ingetInitConfigurationFromClusteris untested. Consider adding a case withfalse(overrideEtcdAPICall-style timeouts viakubeadmapi.SetActiveTimeoutsto keep the failure case fast), similar to whatTestMemberPromotedoes incmd/kubeadm/app/util/etcd/etcd_test.go.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/kubeadm/app/util/config/cluster_test.go` at line 543, The tests around getInitConfigurationFromCluster only exercise the short retry path; add a case passing shortConfigMapGet=false to cover the PollUntilContextTimeout branch. Configure kubeadmapi.SetActiveTimeouts with shortened EtcdAPICall-style timeouts so the failure scenario remains fast, following the TestMemberPromote test pattern.pkg/kubelet/pod_workers_test.go (1)
605-605: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winAdd assertions for context reuse and cancellation.
Nulling
expected.ctxandstatus.ctxhides the behavior introduced inpkg/kubelet/pod_workers.go. Add a focused test that verifies reuse across normal starts, then verifies a new context is created aftercancelFnis called.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/kubelet/pod_workers_test.go` at line 605, Add focused assertions in the relevant pod worker test around expected.ctx and status.ctx: verify the same context is reused across normal starts, then call cancelFn and verify the subsequent start receives a newly created context. Remove the unconditional context nulling that masks these behaviors.staging/src/k8s.io/dynamic-resource-allocation/resourceslice/tracker/tracker_test.go (1)
282-289: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRename
alphaDeviceTaint— it now builds a v1beta2 taint.The helper name still says alpha after the migration, which is misleading for readers checking which API version fixtures target.
♻️ Suggested rename
- alphaDeviceTaint = func(taint resourceapi.DeviceTaint) resourcebetaapi.DeviceTaint { + betaDeviceTaint = func(taint resourceapi.DeviceTaint) resourcebetaapi.DeviceTaint {Update the call site at line 295 accordingly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@staging/src/k8s.io/dynamic-resource-allocation/resourceslice/tracker/tracker_test.go` around lines 282 - 289, Rename the alphaDeviceTaint helper to reflect that it constructs a v1beta2 DeviceTaint, and update its call site around the referenced fixture setup to use the new name.test/integration/dra/device_taints.go (1)
419-473: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd a
defaultbranch to the switch.
testEvictClusterfails fast on an unknownuseRuleMode; here an unknown mode would silently create an untainted slice and the test would still "pass".♻️ Suggested addition
} + default: + tCtx.Fatalf("unsupported useRule %d", useRule) }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/integration/dra/device_taints.go` around lines 419 - 473, Add a default branch to the switch on useRule that fails the test context for any unsupported mode, matching testEvictCluster’s fail-fast behavior; keep the existing useV1alpha3Rule, useV1beta2Rule, and useNoRule handling unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/kubeadm/app/util/config/cluster.go`:
- Around line 92-107: Update the polling closure in the cluster configuration
retrieval flow to accept and pass its poll context to the ConfigMaps Get call
instead of using context.Background(), preserving the KubernetesAPICall timeout.
When wait.PollUntilContextTimeout returns an error, only replace it with lastErr
when lastErr is non-nil; otherwise retain the poll error so execution cannot
continue with a nil configMap.
In `@cmd/kubeadm/app/util/etcd/etcd.go`:
- Around line 617-619: Update MemberPromote so the initial !isLearner
early-return path also adds the member to memberList and registers its endpoint,
matching the already-voting branch in the retry loop. Factor the existing
endpoint-registration loop near addEndpoint into a helper and invoke it from
both paths, preserving the current behavior for learner promotion.
In `@pkg/kubelet/pod_workers.go`:
- Around line 1165-1169: Cancel each stored pod context before removing its
status entry: update all paths that execute delete(p.podSyncStatuses,
...)—including status.delete(), unstarted/orphan cleanup, and
removeTerminatedWorker()—to invoke the corresponding status.cancelFn when
present. Ensure cancellation occurs before the map deletion, including statuses
not marked finished, while preserving existing removal behavior.
In `@staging/src/k8s.io/apiextensions-apiserver/test/integration/apply_test.go`:
- Around line 208-216: Update the local apply helper around the
dynamicClient.Resource(gvr).Apply call to create a short test-local timeout
context instead of using context.TODO(). Ensure the derived context is cancelled
after the request and pass it to Apply, preserving the existing object and
ApplyOptions behavior.
- Around line 238-244: Update the NestedFieldNoCopy call in the test around
inner to retain and validate its found result. When tc.wantNull is true, require
inner to be present and explicitly null; fail the test if found is false, while
preserving the existing non-null rejection.
In `@staging/src/k8s.io/sample-apiserver/go.mod`:
- Line 69: Update the OpenTelemetry SDK dependency in the sample-apiserver
module from v1.40.0 to v1.43.0 or later, or use a library-go revision that
brings in the fixed SDK. Regenerate the module dependency metadata and rescan
the module to confirm the affected dependency is removed.
In `@test/integration/dra/device_taints.go`:
- Around line 487-496: Pass the newly created tolerating claim to createPod in
the toleratingPod setup so pod.Spec.ResourceClaims references that claim. Keep
the existing toleratingClaim creation and waitForPodScheduled flow unchanged,
ensuring scheduling still occurs on the helper-created worker-0 node.
---
Nitpick comments:
In `@cmd/kubeadm/app/util/config/cluster_test.go`:
- Line 543: The tests around getInitConfigurationFromCluster only exercise the
short retry path; add a case passing shortConfigMapGet=false to cover the
PollUntilContextTimeout branch. Configure kubeadmapi.SetActiveTimeouts with
shortened EtcdAPICall-style timeouts so the failure scenario remains fast,
following the TestMemberPromote test pattern.
In `@cmd/kubeadm/app/util/config/cluster.go`:
- Around line 55-58: Consider replacing the trailing boolean parameters of
FetchInitConfigurationFromCluster with a named options struct containing
getNodeRegistration, getAPIEndpoint, getComponentConfigs, and shortConfigMapGet,
then update its call sites to pass the struct so each option is self-describing.
In `@cmd/kubeadm/app/util/etcd/etcd_test.go`:
- Around line 1089-1090: Replace the wantPromoteCalls: -1 sentinel in the
relevant etcd test cases with an explicit skipPromoteCallCheck boolean (or
equivalent explicit flag), update the assertion logic to skip promotion-call
validation only when that flag is set, and adjust both referenced test cases
consistently while preserving normal call-count checks.
In `@cmd/kubeadm/app/util/etcd/etcd.go`:
- Around line 643-648: Update the retry logic around listMembersOnce to reuse
the already-connected cli client by calling cli.MemberList(ctx) directly for
membership reads. Preserve the existing status-error logging, lastError
assignment, and return behavior while removing the fresh-client retry path.
In `@pkg/kubelet/pod_workers_test.go`:
- Line 605: Add focused assertions in the relevant pod worker test around
expected.ctx and status.ctx: verify the same context is reused across normal
starts, then call cancelFn and verify the subsequent start receives a newly
created context. Remove the unconditional context nulling that masks these
behaviors.
In
`@staging/src/k8s.io/dynamic-resource-allocation/resourceslice/tracker/tracker_test.go`:
- Around line 282-289: Rename the alphaDeviceTaint helper to reflect that it
constructs a v1beta2 DeviceTaint, and update its call site around the referenced
fixture setup to use the new name.
In `@test/integration/dra/device_taints.go`:
- Around line 419-473: Add a default branch to the switch on useRule that fails
the test context for any unsupported mode, matching testEvictCluster’s fail-fast
behavior; keep the existing useV1alpha3Rule, useV1beta2Rule, and useNoRule
handling unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 75131e05-3aa7-48ef-8033-829ba3d9c202
⛔ Files ignored due to path filters (43)
go.sumis excluded by!**/*.sumstaging/src/k8s.io/api/go.sumis excluded by!**/*.sumstaging/src/k8s.io/apiextensions-apiserver/go.sumis excluded by!**/*.sumstaging/src/k8s.io/apimachinery/go.sumis excluded by!**/*.sumstaging/src/k8s.io/apiserver/go.sumis excluded by!**/*.sumstaging/src/k8s.io/cli-runtime/go.sumis excluded by!**/*.sumstaging/src/k8s.io/client-go/go.sumis excluded by!**/*.sumstaging/src/k8s.io/cloud-provider/go.sumis excluded by!**/*.sumstaging/src/k8s.io/cluster-bootstrap/go.sumis excluded by!**/*.sumstaging/src/k8s.io/code-generator/examples/go.sumis excluded by!**/*.sumstaging/src/k8s.io/code-generator/go.sumis excluded by!**/*.sumstaging/src/k8s.io/component-base/go.sumis excluded by!**/*.sumstaging/src/k8s.io/component-helpers/go.sumis excluded by!**/*.sumstaging/src/k8s.io/controller-manager/go.sumis excluded by!**/*.sumstaging/src/k8s.io/cri-client/go.sumis excluded by!**/*.sumstaging/src/k8s.io/csi-translation-lib/go.sumis excluded by!**/*.sumstaging/src/k8s.io/dynamic-resource-allocation/go.sumis excluded by!**/*.sumstaging/src/k8s.io/endpointslice/go.sumis excluded by!**/*.sumstaging/src/k8s.io/kube-aggregator/go.sumis excluded by!**/*.sumstaging/src/k8s.io/kube-controller-manager/go.sumis excluded by!**/*.sumstaging/src/k8s.io/kube-proxy/go.sumis excluded by!**/*.sumstaging/src/k8s.io/kube-scheduler/go.sumis excluded by!**/*.sumstaging/src/k8s.io/kubectl/go.sumis excluded by!**/*.sumstaging/src/k8s.io/kubelet/go.sumis excluded by!**/*.sumstaging/src/k8s.io/metrics/go.sumis excluded by!**/*.sumstaging/src/k8s.io/pod-security-admission/go.sumis excluded by!**/*.sumstaging/src/k8s.io/sample-apiserver/go.sumis excluded by!**/*.sumstaging/src/k8s.io/sample-cli-plugin/go.sumis excluded by!**/*.sumstaging/src/k8s.io/sample-controller/go.sumis excluded by!**/*.sumvendor/github.com/openshift/api/config/v1/types_infrastructure.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_kmsencryption.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/features/features.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_kmsencryption.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultkmspluginconfig.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/client-go/config/applyconfigurations/internal/internal.gois excluded by!**/vendor/**,!vendor/**vendor/modules.txtis excluded by!**/vendor/**,!vendor/**vendor/sigs.k8s.io/structured-merge-diff/v6/typed/remove.gois excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (71)
.go-versionCHANGELOG/CHANGELOG-1.36.mdbuild/build-image/cross/VERSIONbuild/common.shbuild/dependencies.yamlcmd/kubeadm/app/cmd/certs.gocmd/kubeadm/app/cmd/join.gocmd/kubeadm/app/cmd/reset.gocmd/kubeadm/app/cmd/upgrade/apply.gocmd/kubeadm/app/cmd/upgrade/common.gocmd/kubeadm/app/cmd/upgrade/diff.gocmd/kubeadm/app/cmd/upgrade/diff_test.gocmd/kubeadm/app/cmd/upgrade/node.gocmd/kubeadm/app/util/config/cluster.gocmd/kubeadm/app/util/config/cluster_test.gocmd/kubeadm/app/util/etcd/etcd.gocmd/kubeadm/app/util/etcd/etcd_test.gogo.modopenshift-hack/images/hyperkube/Dockerfile.rhelpkg/apis/flowcontrol/validation/validation.gopkg/apis/flowcontrol/validation/validation_test.gopkg/controller/job/job_controller.gopkg/controller/job/job_controller_test.gopkg/kubelet/kuberuntime/labels.gopkg/kubelet/pod_workers.gopkg/kubelet/pod_workers_test.gopkg/registry/flowcontrol/prioritylevelconfiguration/declarative_validation_test.gostaging/src/k8s.io/api/go.modstaging/src/k8s.io/apiextensions-apiserver/go.modstaging/src/k8s.io/apiextensions-apiserver/test/integration/apply_test.gostaging/src/k8s.io/apimachinery/go.modstaging/src/k8s.io/apiserver/go.modstaging/src/k8s.io/cli-runtime/go.modstaging/src/k8s.io/client-go/go.modstaging/src/k8s.io/cloud-provider/go.modstaging/src/k8s.io/cluster-bootstrap/go.modstaging/src/k8s.io/code-generator/examples/go.modstaging/src/k8s.io/code-generator/go.modstaging/src/k8s.io/component-base/go.modstaging/src/k8s.io/component-helpers/go.modstaging/src/k8s.io/controller-manager/go.modstaging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api_json.gostaging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api_json_126_test.gostaging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api_json_127_test.gostaging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api_json_test.gostaging/src/k8s.io/csi-translation-lib/go.modstaging/src/k8s.io/dynamic-resource-allocation/go.modstaging/src/k8s.io/dynamic-resource-allocation/resourceslice/tracker/tracker.gostaging/src/k8s.io/dynamic-resource-allocation/resourceslice/tracker/tracker_test.gostaging/src/k8s.io/dynamic-resource-allocation/structured/internal/allocatortesting/allocator_testing.gostaging/src/k8s.io/dynamic-resource-allocation/structured/internal/experimental/allocator_experimental.gostaging/src/k8s.io/dynamic-resource-allocation/structured/internal/incubating/allocator_incubating.gostaging/src/k8s.io/dynamic-resource-allocation/structured/internal/stable/allocator_stable.gostaging/src/k8s.io/endpointslice/go.modstaging/src/k8s.io/kube-aggregator/go.modstaging/src/k8s.io/kube-controller-manager/go.modstaging/src/k8s.io/kube-proxy/go.modstaging/src/k8s.io/kube-scheduler/go.modstaging/src/k8s.io/kubectl/go.modstaging/src/k8s.io/kubelet/go.modstaging/src/k8s.io/metrics/go.modstaging/src/k8s.io/pod-security-admission/go.modstaging/src/k8s.io/sample-apiserver/go.modstaging/src/k8s.io/sample-cli-plugin/go.modstaging/src/k8s.io/sample-controller/go.modtest/compatibility_lifecycle/cmd/feature_gates.gotest/compatibility_lifecycle/cmd/feature_gates_test.gotest/compatibility_lifecycle/reference/versioned_feature_list.yamltest/integration/dra/device_taints.gotest/integration/dra/dra.gotest/utils/image/manifest.go
| err = wait.PollUntilContextTimeout(context.Background(), | ||
| constants.KubernetesAPICallRetryInterval, | ||
| kubeadmapi.GetActiveTimeouts().KubernetesAPICall.Duration, | ||
| true, func(_ context.Context) (bool, error) { | ||
| var err error | ||
| configMap, err = client.CoreV1().ConfigMaps(metav1.NamespaceSystem).Get( | ||
| context.Background(), constants.KubeadmConfigConfigMap, metav1.GetOptions{}) | ||
| if err == nil { | ||
| return true, nil | ||
| } | ||
| lastErr = err | ||
| return false, nil | ||
| }) | ||
| if err != nil { | ||
| err = lastErr | ||
| } |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Propagate the poll context and guard against a nil lastErr.
The closure discards the poll context and issues the Get with context.Background(), so individual API calls aren't bounded by the KubernetesAPICall deadline. Also, if wait ever returns an error while lastErr is nil, err becomes nil and execution falls through to line 122 with a nil configMap.
As per path instructions, "context.Context for cancellation and timeouts".
🛠️ Proposed fix
- err = wait.PollUntilContextTimeout(context.Background(),
+ err = wait.PollUntilContextTimeout(context.Background(),
constants.KubernetesAPICallRetryInterval,
kubeadmapi.GetActiveTimeouts().KubernetesAPICall.Duration,
- true, func(_ context.Context) (bool, error) {
+ true, func(ctx context.Context) (bool, error) {
var err error
configMap, err = client.CoreV1().ConfigMaps(metav1.NamespaceSystem).Get(
- context.Background(), constants.KubeadmConfigConfigMap, metav1.GetOptions{})
+ ctx, constants.KubeadmConfigConfigMap, metav1.GetOptions{})
if err == nil {
return true, nil
}
lastErr = err
return false, nil
})
- if err != nil {
+ if err != nil && lastErr != nil {
err = lastErr
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| err = wait.PollUntilContextTimeout(context.Background(), | |
| constants.KubernetesAPICallRetryInterval, | |
| kubeadmapi.GetActiveTimeouts().KubernetesAPICall.Duration, | |
| true, func(_ context.Context) (bool, error) { | |
| var err error | |
| configMap, err = client.CoreV1().ConfigMaps(metav1.NamespaceSystem).Get( | |
| context.Background(), constants.KubeadmConfigConfigMap, metav1.GetOptions{}) | |
| if err == nil { | |
| return true, nil | |
| } | |
| lastErr = err | |
| return false, nil | |
| }) | |
| if err != nil { | |
| err = lastErr | |
| } | |
| err = wait.PollUntilContextTimeout(context.Background(), | |
| constants.KubernetesAPICallRetryInterval, | |
| kubeadmapi.GetActiveTimeouts().KubernetesAPICall.Duration, | |
| true, func(ctx context.Context) (bool, error) { | |
| var err error | |
| configMap, err = client.CoreV1().ConfigMaps(metav1.NamespaceSystem).Get( | |
| ctx, constants.KubeadmConfigConfigMap, metav1.GetOptions{}) | |
| if err == nil { | |
| return true, nil | |
| } | |
| lastErr = err | |
| return false, nil | |
| }) | |
| if err != nil && lastErr != nil { | |
| err = lastErr | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@cmd/kubeadm/app/util/config/cluster.go` around lines 92 - 107, Update the
polling closure in the cluster configuration retrieval flow to accept and pass
its poll context to the ConfigMaps Get call instead of using
context.Background(), preserving the KubernetesAPICall timeout. When
wait.PollUntilContextTimeout returns an error, only replace it with lastErr when
lastErr is non-nil; otherwise retain the poll error so execution cannot continue
with a nil configMap.
Source: Path instructions
| if !isLearner { | ||
| return nil | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Early return skips endpoint registration, unlike the equivalent branch in the promote loop.
When the member is already voting on the first status check, MemberPromote returns before reaching the addEndpoint loop at Line 679. The analogous "already a voting member" case inside the retry loop (Lines 655-659) does populate memberList and register the endpoint, so the outcome now depends on when the promotion was observed. Consider making both paths add the endpoint.
🛠️ Sketch
if !isLearner {
- return nil
+ resp, err := c.listMembersOnce()
+ if err != nil {
+ return err
+ }
+ c.addPeerEndpoint(resp.Members, learnerID)
+ return nil
}(factor the Line 679 loop into a small helper reused by both paths)
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if !isLearner { | |
| return nil | |
| } | |
| if !isLearner { | |
| resp, err := c.listMembersOnce() | |
| if err != nil { | |
| return err | |
| } | |
| c.addPeerEndpoint(resp.Members, learnerID) | |
| return nil | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@cmd/kubeadm/app/util/etcd/etcd.go` around lines 617 - 619, Update
MemberPromote so the initial !isLearner early-return path also adds the member
to memberList and registers its endpoint, matching the already-voting branch in
the retry loop. Factor the existing endpoint-registration loop near addEndpoint
into a helper and invoke it from both paths, preserving the current behavior for
learner promotion.
| if status.ctx == nil || status.ctx.Err() != nil { | ||
| // create a context with parentCtx's values, and reuse it until it is canceled | ||
| status.ctx, status.cancelFn = context.WithCancel(context.WithoutCancel(parentCtx)) | ||
| } | ||
| ctx = status.ctx |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
rg -n -C4 '\b(cancelFn|status\.ctx|podSyncStatuses)\b' pkg/kubelet/pod_workers.goRepository: openshift/kubernetes
Length of output: 10560
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the shutdown-related functions and status removal paths in pkg/kubelet/pod_workers.go.
printf '--- file outline around podWorkers methods ---\n'
ast-grep outline pkg/kubelet/pod_workers.go --view compact 2>/dev/null | sed -n '1,220p' || true
printf '\n--- relevant function ranges ---\n'
sed -n '1560,1710p' pkg/kubelet/pod_workers.go
printf '\n--- complete/purge ranges ---\n'
sed -n '1460,1515p' pkg/kubelet/pod_workers.go
printf '\n--- update cancellation range ---\n'
sed -n '980,1010p' pkg/kubelet/pod_workers.go
printf '\n--- all delete(p.podSyncStatuses occurrences with context ---\n'
rg -n -C6 'delete\(p\.podSyncStatuses|cleanupPodUpdates\(|Start\(|Shutdown\(|podSyncStatuses\[uid\]' pkg/kubelet/pod_workers.goRepository: openshift/kubernetes
Length of output: 249
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
p = Path('pkg/kubelet/pod_workers.go')
text = p.read_text()
for needle in ['delete(p.podSyncStatuses', 'cleanupPodUpdates(uid)', 'status.cancelFn()']:
print(f'\n{needle!r} occurrences:')
for i,line in enumerate(text.splitlines(),1):
if needle in line:
start = max(1, i-5)
end = min(len(text.splitlines()), i+6)
lines = text.splitlines()
print(f'--- lines {start}-{end} ---')
for j in range(start, end+1):
print(f'{j}: {lines[j-1]}')
PYRepository: openshift/kubernetes
Length of output: 2483
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Read targeted ranges in pkg/kubelet/pod_workers.go and search shutdown/status-reuse helpers.
sed -n '1445,1510p' pkg/kubelet/pod_workers.go
echo '---'
sed -n '1645,1695p' pkg/kubelet/pod_workers.go
echo '---'
rg -n -C3 'shutdown|Shutdown|Stop\(|podWorkers|podSyncStatuses\] = |podSyncStatuses\[uid\] = |completeOrTerminated|finalizeHistory|runtime pod is transient' pkg/kubelet/pod_workers.go
echo '--- exact cancellation and removal searches ---'
while IFS= read -r -d '' needle; do
echo "needle: ${needle}"
while IFS= read -r -d '' f; do
rg -n -C4 "$needle" "$f" || true
done < <(find pkg/kubelet -maxdepth 1 -type f -name '*.go' -print0)
done < <(printf '%s\0' 'delete\(p\.podSyncStatuses' 'cleanupPodUpdates\(' 'status\.cancelFn\(\)' '\.Stop\(' '\.Shutdown\(' 'podWorkers\.Shutdown' 'podWorkers\.Stop')Repository: openshift/kubernetes
Length of output: 17731
Cancel detached pod contexts before dropping status entries.
context.WithoutCancel(parentCtx) detaches the stored context from kubelet shutdown, and the existing status.delete() paths do not call status.cancelFn. removeTerminatedWorker() also only deletes when status.finished is already set, so unstarted/orphan cleanup or any other final status removal paths need explicit cancellation before delete(p.podSyncStatuses, ...) to avoid leaking long-lived sync/prober goroutines.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pkg/kubelet/pod_workers.go` around lines 1165 - 1169, Cancel each stored pod
context before removing its status entry: update all paths that execute
delete(p.podSyncStatuses, ...)—including status.delete(), unstarted/orphan
cleanup, and removeTerminatedWorker()—to invoke the corresponding
status.cancelFn when present. Ensure cancellation occurs before the map
deletion, including statuses not marked finished, while preserving existing
removal behavior.
Source: Path instructions
| apply := func(object, field string, inner interface{}) (*unstructured.Unstructured, error) { | ||
| obj := &unstructured.Unstructured{Object: map[string]interface{}{ | ||
| "apiVersion": apiVersion, | ||
| "kind": kind, | ||
| "metadata": map[string]interface{}{"name": object}, | ||
| "spec": map[string]interface{}{field: map[string]interface{}{"inner": inner}}, | ||
| }} | ||
| return dynamicClient.Resource(gvr).Apply(context.TODO(), object, obj, metav1.ApplyOptions{FieldManager: "apply_test"}) | ||
| } |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Locate target file and related context usage"
fd -a 'apply_test.go|.*test.*integration.*go$' . | sed 's#^\./##' | head -100
echo
echo "Target file excerpt"
if [ -f staging/src/k8s.io/apiextensions-apiserver/test/integration/apply_test.go ]; then
wc -l staging/src/k8s.io/apiextensions-apiserver/test/integration/apply_test.go
sed -n '180,230p' staging/src/k8s.io/apiextensions-apiserver/test/integration/apply_test.go | cat -n -v
end
echo
echo "Search for integration-context deadlines in apiextensions tests"
rg -n "context\.WithTimeout|context\.WithTimeoutContext|context\.WaitGroup|timeout|Duration\(.*Second|context\.TODO|Apply\(context\.TODO" k8s.io/apiextensions-apiserver/test/integration k8s.io/apiextensions-apiserver 2>/dev/null | head -200Repository: openshift/kubernetes
Length of output: 639
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Git status/stat for context"
git status --short || true
git diff --stat || true
echo
echo "Find context constants/helpers nearby"
rg -n "Default|PerRequest|Integration|Timeout|Duration|context\.TODO|WithTimeout" staging/src/k8s.io/apiextensions-apiserver/test/integration -S || trueRepository: openshift/kubernetes
Length of output: 50376
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "apply_test.go lines 190-220 with line numbers"
sed -n '190,220p' staging/src/k8s.io/apiextensions-apiserver/test/integration/apply_test.go | cat -n
echo
echo "Relevant imports and Timeout constants in apiextensions integration tests"
sed -n '1,35p' staging/src/k8s.io/apiextensions-apiserver/test/integration/apply_test.go | cat -n
rg -n "TimeOutInterval|DefaultTimeout|Short|Duration\\(|context\\.TODO|context\\.Background|context\\.TODO\\(\\)" staging/src/k8s.io/apiextensions-apiserver/test/integration/helpers.go staging/src/k8s.io/apiextensions-apiserver/test/integration/apply_test.go -S
echo
echo "Find integration timeout constants in test helpers/config files"
rg -n "TimeOutInterval|DefaultTimeout|Short" k8s.io kubectl test kubeadm staging/src/k8s.io/apiextensions-apiserver -S | head -200Repository: openshift/kubernetes
Length of output: 33600
Bound the dynamic-client request context.
context.TODO() has no deadline or cancellation path, so a stalled Apply can wait for the outer test harness. Use context.WithTimeout before the dynamic Apply request with a short test-local timeout.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@staging/src/k8s.io/apiextensions-apiserver/test/integration/apply_test.go`
around lines 208 - 216, Update the local apply helper around the
dynamicClient.Resource(gvr).Apply call to create a short test-local timeout
context instead of using context.TODO(). Ensure the derived context is cancelled
after the request and pass it to Apply, preserving the existing object and
ApplyOptions behavior.
Source: Path instructions
| inner, _, err := unstructured.NestedFieldNoCopy(got.Object, "spec", field, "inner") | ||
| if err != nil { | ||
| t.Fatalf("reading spec.%s.inner: %v", field, err) | ||
| } | ||
| if tc.wantNull && inner != nil { | ||
| t.Errorf("want inner to be null, got %#v", inner) | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Assert that inner is present before accepting null.
NestedFieldNoCopy returns (nil, false, nil) when the field is absent. Ignoring found lets an SSA omission regression pass even though this test intends to require an explicit null.
Proposed fix
- inner, _, err := unstructured.NestedFieldNoCopy(got.Object, "spec", field, "inner")
+ inner, found, err := unstructured.NestedFieldNoCopy(got.Object, "spec", field, "inner")
if err != nil {
t.Fatalf("reading spec.%s.inner: %v", field, err)
}
+ if !found {
+ t.Fatalf("spec.%s.inner is absent; want explicit null", field)
+ }
if tc.wantNull && inner != nil {📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| inner, _, err := unstructured.NestedFieldNoCopy(got.Object, "spec", field, "inner") | |
| if err != nil { | |
| t.Fatalf("reading spec.%s.inner: %v", field, err) | |
| } | |
| if tc.wantNull && inner != nil { | |
| t.Errorf("want inner to be null, got %#v", inner) | |
| } | |
| inner, found, err := unstructured.NestedFieldNoCopy(got.Object, "spec", field, "inner") | |
| if err != nil { | |
| t.Fatalf("reading spec.%s.inner: %v", field, err) | |
| } | |
| if !found { | |
| t.Fatalf("spec.%s.inner is absent; want explicit null", field) | |
| } | |
| if tc.wantNull && inner != nil { | |
| t.Errorf("want inner to be null, got %#v", inner) | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@staging/src/k8s.io/apiextensions-apiserver/test/integration/apply_test.go`
around lines 238 - 244, Update the NestedFieldNoCopy call in the test around
inner to retain and validate its found result. When tc.wantNull is true, require
inner to be present and explicitly null; fail the test if found is false, while
preserving the existing non-null rejection.
| github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect | ||
| github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect | ||
| github.com/openshift/library-go v0.0.0-20260715193157-1a5091f58ece // indirect | ||
| github.com/openshift/library-go v0.0.0-20260724131744-e4053a935312 // indirect |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== go.mod excerpt =="
sed -n '60,78p' staging/src/k8s.io/sample-apiserver/go.mod
echo
echo "== OpenTelemetry deps in sample-apiserver go modules =="
rg -n "go\.opentelemetry\.io/otel|otel|github\.com/openshift/library-go" staging/src/k8s.io/sample-apiserver/go.mod staging/src/k8s.io/sample-apiserver/go.sum 2>/dev/null || true
echo
echo "== OSV metadata for reported issues =="
python3 - <<'PY'
import urllib.request, json
for vuln_id in ["GO-2026-5426", "GHSA-hfvc-g4fc-pqh"]:
print(f"-- {vuln_id} --")
try:
url = f"https://api.osv.dev/v1/vulns/{vuln_id}"
with urllib.request.urlopen(url, timeout=20) as r:
data = json.load(r)
print(json.dumps({
"id": data.get("id"),
"summary": data.get("summary"),
"severity": data.get("severity"),
"affected": [{
"package": a.get("package"),
"ranges": [{
"type": b.get("type"),
"events": b.get("events")
} for b in a.get("ranges", [])]
} for a in data.get("affected", [])[:5]]
}, indent=2)[:2000])
except Exception as e:
print(f"ERROR: {e}")
PYRepository: openshift/kubernetes
Length of output: 5856
🌐 Web query:
GHSA-hfvc-g4fc-pqh go.opentelemetry.io/otel/sdk v1.40.0 vulnerability
💡 Result:
The identifier GHSA-hfvc-g4fc-pqhx (often written with an 'x' at the end) refers to a security vulnerability in the OpenTelemetry Go SDK related to PATH hijacking [1][2][3]. Regarding your query about go.opentelemetry.io/otel/sdk version v1.40.0: 1. Vulnerability Status: Version v1.40.0 is not vulnerable to GHSA-hfvc-g4fc-pqhx; in fact, this version was the release that patched a related, similar vulnerability (CVE-2026-24051 / GHSA-9h8m-3fm2-qjrq) [4][5][6]. 2. GHSA-hfvc-g4fc-pqhx Specifics: This advisory identifies a PATH hijacking vulnerability that specifically affects BSD and Solaris platforms [1][2][3]. It occurs because the SDK used a bare name for the kenv command, allowing an attacker to place a malicious binary in the system's $PATH [1][3]. 3. Fix for GHSA-hfvc-g4fc-pqhx: This issue was addressed in go.opentelemetry.io/otel/sdk version v1.43.0 [3][7]. In summary, while v1.40.0 patched a previous macOS-specific PATH hijacking vulnerability [4][6], it remains affected by the BSD/Solaris-specific issue (GHSA-hfvc-g4fc-pqhx), which was subsequently fixed in v1.43.0 [3]. Users of v1.40.0 should upgrade to v1.43.0 or later to remediate this specific vulnerability [3][7].
Citations:
- 1: https://osv.dev/vulnerability/GHSA-hfvc-g4fc-pqhx
- 2: https://cvepremium.circl.lu/vuln/ghsa-hfvc-g4fc-pqhx
- 3: https://mondoo.com/vulnerability-intelligence/vulnerability/GHSA-hfvc-g4fc-pqhx
- 4: GHSA-9h8m-3fm2-qjrq
- 5: https://osv.dev/vulnerability/GHSA-9h8m-3fm2-qjrq
- 6: https://osv.dev/vulnerability/CVE-2026-24051
- 7: ory/hydra@5b69a56
🌐 Web query:
CVE-2026-24051 go.opentelemetry.io/otel/sdk v1.40.0 GHSA-9h8m-3fm2-qjrq PATH hijacking
💡 Result:
CVE-2026-24051 (also tracked as GHSA-9h8m-3fm2-qjrq) is a security vulnerability in the OpenTelemetry Go SDK (go.opentelemetry.io/otel/sdk) that allows for arbitrary code execution via PATH hijacking on macOS/Darwin systems [1][2][3]. The vulnerability exists in the resource detection component, specifically within the sdk/resource/host_id.go file, where the ioreg system command is executed using an untrusted search path [1][4]. An attacker who can locally modify the PATH environment variable can exploit this to execute malicious code in the context of the application [5][3]. This issue affects versions 1.21.0 through 1.39.0 of the go.opentelemetry.io/otel/sdk package [1][6][3]. It was patched in version 1.40.0, released on February 2, 2026 [1][5]. Users are advised to upgrade to version 1.40.0 or later to mitigate this risk [1][2].
Citations:
- 1: GHSA-9h8m-3fm2-qjrq
- 2: https://nvd.nist.gov/vuln/detail/CVE-2026-24051
- 3: GHSA-9h8m-3fm2-qjrq
- 4: https://osv.dev/vulnerability/GHSA-9h8m-3fm2-qjrq
- 5: https://osv.dev/vulnerability/CVE-2026-24051
- 6: https://pkg.go.dev/vuln/GO-2026-4394
🌐 Web query:
osv.dev GHSA-hfvc-g4fc-pqhx packages affected go.opentelemetry.io/otel/sdk versions
💡 Result:
The security advisory GHSA-hfvc-g4fc-pqhx (also identified as CVE-2026-39883) affects the package go.opentelemetry.io/otel/sdk [1][2][3]. The vulnerability affects all versions of the package from v1.15.0 up to and including v1.42.0 (i.e., >= v1.15.0, <= 1.42.0) [4][5][3]. It was fixed in version 1.43.0 [2][4]. This issue involves an incomplete fix for a previous vulnerability (CVE-2026-24051), where the BSD kenv command used in resource detection does not use an absolute path. This flaw allows for PATH hijacking on systems such as DragonFly BSD, FreeBSD, NetBSD, OpenBSD, and Solaris, potentially leading to arbitrary code execution if an attacker can place a malicious binary in the system's $PATH [1][4][5].
Citations:
- 1: https://osv.dev/vulnerability/GHSA-hfvc-g4fc-pqhx
- 2: https://osv.dev/vulnerability/CVE-2026-39883
- 3: https://pkg.go.dev/vuln/GO-2026-5426
- 4: GHSA-hfvc-g4fc-pqhx
- 5: GHSA-hfvc-g4fc-pqhx
Upgrade OpenTelemetry SDK to remove the BSD/OpenTelemetry PATH-hijacking dependency.
staging/src/k8s.io/sample-apiserver/go.mod still has go.opentelemetry.io/otel/sdk v1.40.0, which is affected by GHSA-hfvc-g4fc-pqhx / GO-2026-5426 because it uses a bare BSD kenv path. Use a library-go revision or bump the SDK to v1.43.0 or later, then regenerate and rescan the module.
🧰 Tools
🪛 OSV Scanner (2.4.0)
[HIGH] 69-69: go.opentelemetry.io/otel/sdk 1.40.0: Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk
(GO-2026-5426)
[HIGH] 69-69: go.opentelemetry.io/otel/sdk 1.40.0: opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@staging/src/k8s.io/sample-apiserver/go.mod` at line 69, Update the
OpenTelemetry SDK dependency in the sample-apiserver module from v1.40.0 to
v1.43.0 or later, or use a library-go revision that brings in the fixed SDK.
Regenerate the module dependency metadata and rescan the module to confirm the
affected dependency is removed.
Sources: Path instructions, Linters/SAST tools
| toleratingClaim := claim.DeepCopy() | ||
| toleratingClaim.Spec.Devices.Requests[0].Exactly.Tolerations = []resourceapi.DeviceToleration{ | ||
| { | ||
| Key: taintKey, | ||
| Effect: resourceapi.DeviceTaintEffectNoSchedule, | ||
| }, | ||
| } | ||
| _ = createClaim(tCtx, namespace, "-tolerating", class, toleratingClaim) | ||
| toleratingPod := createPod(tCtx, namespace, "-tolerating", pod) | ||
| waitForPodScheduled(tCtx, namespace, toleratingPod.Name) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
rg -nP -A25 'func createPod\(' test/integration/dra
rg -nP -A20 'func createNodes\(' test/integration/draRepository: openshift/kubernetes
Length of output: 3748
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== device_taints.go outline =="
ast-grep outline test/integration/dra/device_taints.go --view expanded | sed -n '1,160p' || true
echo "== testNoScheduleRule and surrounding lines =="
sed -n '390,510p' test/integration/dra/device_taints.go
echo "== createNode helper =="
sed -n '140,160p' test/integration/dra/helpers.go
sed -n '360,395p' test/integration/dra/dra.go
echo "== createNodes calls in device_taints.go =="
rg -n -C5 'createNodes\(|testNoScheduleRule|MakeResourceSlice\("worker-0"\)' test/integration/dra/device_taints.goRepository: openshift/kubernetes
Length of output: 6739
Wire the tolerating pod to its tolerating claim.
createPod only populates pod.Spec.ResourceClaims from the passed claim arguments, so creating the tolerating claim and then omitting it lets this pod schedule without requesting any device. This makes the scheduled/pod-wired assertion vacuous when no claim exists.
🐛 Likely fix
- _ = createClaim(tCtx, namespace, "-tolerating", class, toleratingClaim)
- toleratingPod := createPod(tCtx, namespace, "-tolerating", pod)
+ toleratingClaim = createClaim(tCtx, namespace, "-tolerating", class, toleratingClaim)
+ toleratingPod := createPod(tCtx, namespace, "-tolerating", pod, toleratingClaim)The "worker-0" node name matches the helper-created worker-0 node, so no change is needed there.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| toleratingClaim := claim.DeepCopy() | |
| toleratingClaim.Spec.Devices.Requests[0].Exactly.Tolerations = []resourceapi.DeviceToleration{ | |
| { | |
| Key: taintKey, | |
| Effect: resourceapi.DeviceTaintEffectNoSchedule, | |
| }, | |
| } | |
| _ = createClaim(tCtx, namespace, "-tolerating", class, toleratingClaim) | |
| toleratingPod := createPod(tCtx, namespace, "-tolerating", pod) | |
| waitForPodScheduled(tCtx, namespace, toleratingPod.Name) | |
| toleratingClaim := claim.DeepCopy() | |
| toleratingClaim.Spec.Devices.Requests[0].Exactly.Tolerations = []resourceapi.DeviceToleration{ | |
| { | |
| Key: taintKey, | |
| Effect: resourceapi.DeviceTaintEffectNoSchedule, | |
| }, | |
| } | |
| toleratingClaim = createClaim(tCtx, namespace, "-tolerating", class, toleratingClaim) | |
| toleratingPod := createPod(tCtx, namespace, "-tolerating", pod, toleratingClaim) | |
| waitForPodScheduled(tCtx, namespace, toleratingPod.Name) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/integration/dra/device_taints.go` around lines 487 - 496, Pass the newly
created tolerating claim to createPod in the toleratingPod setup so
pod.Spec.ResourceClaims references that claim. Keep the existing toleratingClaim
creation and waitForPodScheduled flow unchanged, ensuring scheduling still
occurs on the helper-created worker-0 node.
|
/retest-required |
|
/retitle OCPBUGS-10017: Rebase master to Kubernetes v1.36.3 |
openshift-ci
Bot
changed the title
openshift-ci-robot
added
jira/valid-reference
|
@redhat-chai-bot: This pull request references Jira Issue OCPBUGS-10017, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/retitle OCPBUGS-100170: Rebase master to Kubernetes v1.36.3 |
openshift-ci
Bot
changed the title
openshift-ci-robot
added
jira/valid-bug
|
@redhat-chai-bot: This pull request references Jira Issue OCPBUGS-100170, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
jacobsee
left a comment
jacobsee
left a comment
There was a problem hiding this comment.
Conflict resolution needs to follow the standard documented process & be separated into its own commit. These results cast some doubt on the determinism of the patch rebase process, let's talk about it next week.
|
Acknowledged — same gap as #2728, #2729, and #2726. The conflict resolution should have been in a separate |
|
/retest-required |
|
@redhat-chai-bot: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
20 participants
Summary
Rebases the
masterbranch from Kubernetes 1.36.2 to v1.36.3 (upstream release 2026-07-22).Conflicts Resolved
2 files — accepted upstream version:
code-generator/examples/go.modsample-controller/go.modOpenShift Dependencies
OpenShift deps (
openshift/api,client-go,library-go,apiserver-library-go) bumped to latest branch heads.Notes
release-5.0andrelease-5.1trackmaster, so this rebase covers those branches as well.@dusk125 requested in Slack thread
Summary by CodeRabbit