Skip to content

Commit 7d545b2

Browse files
atiratreeatiratree
committed
Merge tag 'v1.31.10' into bump-1.31.10
Kubernetes official release v1.31.10
2 parents 84b31a3 + 6118358 commit 7d545b2

File tree

17 files changed

+315
-139
lines changed

17 files changed

+315
-139
lines changed

‎.go-version

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.23.8
1+
1.23.10

‎CHANGELOG/CHANGELOG-1.31.md

Lines changed: 192 additions & 87 deletions
Large diffs are not rendered by default.

‎build/build-image/cross/VERSION

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
v1.31.0-go1.23.8-bullseye.0
1+
v1.31.0-go1.23.10-bullseye.0

‎build/common.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -97,8 +97,8 @@ readonly KUBE_RSYNC_PORT="${KUBE_RSYNC_PORT:-}"
9797
readonly KUBE_CONTAINER_RSYNC_PORT=8730
9898

9999
# These are the default versions (image tags) for their respective base images.
100-
readonly __default_distroless_iptables_version=v0.5.13
101-
readonly __default_go_runner_version=v2.4.0-go1.23.8-bookworm.0
100+
readonly __default_distroless_iptables_version=v0.6.11
101+
readonly __default_go_runner_version=v2.4.0-go1.23.10-bookworm.0
102102
readonly __default_setcap_version=bookworm-v1.0.3
103103

104104
# These are the base images for the Docker-wrapped binaries.

‎build/dependencies.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ dependencies:
116116

117117
# Golang
118118
- name: "golang: upstream version"
119-
version: 1.23.8
119+
version: 1.23.10
120120
refPaths:
121121
- path: .go-version
122122
- path: build/build-image/cross/VERSION
@@ -139,7 +139,7 @@ dependencies:
139139
# match: minimum_go_version=go([0-9]+\.[0-9]+)
140140

141141
- name: "registry.k8s.io/kube-cross: dependents"
142-
version: v1.31.0-go1.23.8-bullseye.0
142+
version: v1.31.0-go1.23.10-bullseye.0
143143
refPaths:
144144
- path: build/build-image/cross/VERSION
145145

@@ -177,15 +177,15 @@ dependencies:
177177
match: registry\.k8s\.io\/build-image\/debian-base:[a-zA-Z]+\-v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)
178178

179179
- name: "registry.k8s.io/distroless-iptables: dependents"
180-
version: v0.5.13
180+
version: v0.6.11
181181
refPaths:
182182
- path: build/common.sh
183183
match: __default_distroless_iptables_version=
184184
- path: test/utils/image/manifest.go
185185
match: configs\[DistrolessIptables\] = Config{list\.BuildImageRegistry, "distroless-iptables", "v([0-9]+)\.([0-9]+)\.([0-9]+)"}
186186

187187
- name: "registry.k8s.io/go-runner: dependents"
188-
version: v2.4.0-go1.23.8-bookworm.0
188+
version: v2.4.0-go1.23.10-bookworm.0
189189
refPaths:
190190
- path: build/common.sh
191191
match: __default_go_runner_version=

‎pkg/kubelet/kubelet_getters.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -120,8 +120,9 @@ func (kl *Kubelet) ListPodsFromDisk() ([]types.UID, error) {
120120
// user namespaces.
121121
func (kl *Kubelet) HandlerSupportsUserNamespaces(rtHandler string) (bool, error) {
122122
rtHandlers := kl.runtimeState.runtimeHandlers()
123-
if rtHandlers == nil {
124-
return false, fmt.Errorf("runtime handlers are not set")
123+
if len(rtHandlers) == 0 {
124+
// The slice is empty if the runtime is old and doesn't support this message.
125+
return false, nil
125126
}
126127
for _, h := range rtHandlers {
127128
if h.Name == rtHandler {

‎pkg/kubelet/kubelet_pods.go

Lines changed: 5 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,6 @@ import (
4141
"k8s.io/apimachinery/pkg/types"
4242
"k8s.io/apimachinery/pkg/util/sets"
4343
utilvalidation "k8s.io/apimachinery/pkg/util/validation"
44-
"k8s.io/apimachinery/pkg/util/version"
4544
utilfeature "k8s.io/apiserver/pkg/util/feature"
4645
runtimeapi "k8s.io/cri-api/pkg/apis/runtime/v1"
4746
"k8s.io/klog/v2"
@@ -62,7 +61,6 @@ import (
6261
"k8s.io/kubernetes/pkg/kubelet/status"
6362
kubetypes "k8s.io/kubernetes/pkg/kubelet/types"
6463
utilfs "k8s.io/kubernetes/pkg/util/filesystem"
65-
utilkernel "k8s.io/kubernetes/pkg/util/kernel"
6664
utilpod "k8s.io/kubernetes/pkg/util/pod"
6765
volumeutil "k8s.io/kubernetes/pkg/volume/util"
6866
"k8s.io/kubernetes/pkg/volume/util/hostutil"
@@ -131,16 +129,11 @@ func (kl *Kubelet) getKubeletMappings() (uint32, uint32, error) {
131129

132130
if !utilfeature.DefaultFeatureGate.Enabled(features.UserNamespacesSupport) {
133131
return defaultFirstID, defaultLen, nil
134-
} else {
135-
kernelVersion, err := utilkernel.GetVersion()
136-
if err != nil {
137-
return 0, 0, fmt.Errorf("failed to get kernel version, unable to determine if feature %s can be supported : %w",
138-
features.UserNamespacesSupport, err)
139-
}
140-
if kernelVersion != nil && !kernelVersion.AtLeast(version.MustParseGeneric(utilkernel.UserNamespacesSupportKernelVersion)) {
141-
klog.InfoS("WARNING: the kernel version is incompatible with the feature gate, which needs as a minimum kernel version",
142-
"kernelVersion", kernelVersion, "feature", features.UserNamespacesSupport, "minKernelVersion", utilkernel.UserNamespacesSupportKernelVersion)
143-
}
132+
}
133+
134+
// Windows doesn't support user namespaces, let's return the default mappings.
135+
if runtime.GOOS == "windows" {
136+
return defaultFirstID, defaultLen, nil
144137
}
145138

146139
_, err := user.Lookup(kubeletUser)

‎pkg/kubelet/userns/types.go

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package userns
18+
19+
import "k8s.io/apimachinery/pkg/types"
20+
21+
// Here go types that are common for all supported OS (windows, linux).
22+
23+
type userNsPodsManager interface {
24+
HandlerSupportsUserNamespaces(runtimeHandler string) (bool, error)
25+
GetPodDir(podUID types.UID) string
26+
ListPodsFromDisk() ([]types.UID, error)
27+
GetKubeletMappings() (uint32, uint32, error)
28+
GetMaxPods() int
29+
}

‎pkg/kubelet/userns/userns_manager.go

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
//go:build !windows
2+
// +build !windows
3+
14
/*
25
Copyright 2022 The Kubernetes Authors.
36
@@ -43,14 +46,6 @@ const userNsLength = (1 << 16)
4346
// since Go maps never free memory.
4447
const mapReInitializeThreshold = 1000
4548

46-
type userNsPodsManager interface {
47-
HandlerSupportsUserNamespaces(runtimeHandler string) (bool, error)
48-
GetPodDir(podUID types.UID) string
49-
ListPodsFromDisk() ([]types.UID, error)
50-
GetKubeletMappings() (uint32, uint32, error)
51-
GetMaxPods() int
52-
}
53-
5449
type UsernsManager struct {
5550
used *allocator.AllocationBitmap
5651
usedBy map[types.UID]uint32 // Map pod.UID to range used
@@ -132,7 +127,7 @@ func (m *UsernsManager) readMappingsFromFile(pod types.UID) ([]byte, error) {
132127
func MakeUserNsManager(kl userNsPodsManager) (*UsernsManager, error) {
133128
kubeletMappingID, kubeletMappingLen, err := kl.GetKubeletMappings()
134129
if err != nil {
135-
return nil, err
130+
return nil, fmt.Errorf("kubelet mappings: %w", err)
136131
}
137132

138133
if kubeletMappingID%userNsLength != 0 {
@@ -411,10 +406,15 @@ func (m *UsernsManager) GetOrCreateUserNamespaceMappings(pod *v1.Pod, runtimeHan
411406
// From here onwards, hostUsers=false and the feature gate is enabled.
412407

413408
// if the pod requested a user namespace and the runtime doesn't support user namespaces then return an error.
414-
if handlerSupportsUserns, err := m.kl.HandlerSupportsUserNamespaces(runtimeHandler); err != nil {
415-
return nil, err
416-
} else if !handlerSupportsUserns {
417-
return nil, fmt.Errorf("RuntimeClass handler %q does not support user namespaces", runtimeHandler)
409+
if handlerSupportsUserns, err := m.kl.HandlerSupportsUserNamespaces(runtimeHandler); err != nil || !handlerSupportsUserns {
410+
msg := "can't set `spec.hostUsers: false`, runtime does not support user namespaces"
411+
if runtimeHandler != "" {
412+
msg = fmt.Sprintf("can't set `spec.hostUsers: false`, RuntimeClass handler %q does not support user namespaces", runtimeHandler)
413+
}
414+
if err != nil {
415+
return nil, fmt.Errorf("%v: %w", msg, err)
416+
}
417+
return nil, fmt.Errorf("%v", msg)
418418
}
419419

420420
m.lock.Lock()
@@ -429,12 +429,12 @@ func (m *UsernsManager) GetOrCreateUserNamespaceMappings(pod *v1.Pod, runtimeHan
429429
if string(content) != "" {
430430
userNs, err = m.parseUserNsFileAndRecord(pod.UID, content)
431431
if err != nil {
432-
return nil, err
432+
return nil, fmt.Errorf("user namespace: %w", err)
433433
}
434434
} else {
435435
userNs, err = m.createUserNs(pod)
436436
if err != nil {
437-
return nil, err
437+
return nil, fmt.Errorf("create user namespace: %w", err)
438438
}
439439
}
440440

@@ -485,7 +485,7 @@ func (m *UsernsManager) CleanupOrphanedPodUsernsAllocations(pods []*v1.Pod, runn
485485
allFound := sets.New[string]()
486486
found, err := m.kl.ListPodsFromDisk()
487487
if err != nil {
488-
return err
488+
return fmt.Errorf("user namespace: read pods from disk: %w", err)
489489
}
490490

491491
for _, podUID := range found {

‎pkg/kubelet/userns/userns_manager_disabled_test.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
//go:build !windows
2+
// +build !windows
3+
14
/*
25
Copyright 2022 The Kubernetes Authors.
36

‎pkg/kubelet/userns/userns_manager_switch_test.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
//go:build !windows
2+
// +build !windows
3+
14
/*
25
Copyright 2024 The Kubernetes Authors.
36

‎pkg/kubelet/userns/userns_manager_test.go

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
//go:build !windows
2+
// +build !windows
3+
14
/*
25
Copyright 2022 The Kubernetes Authors.
36
@@ -20,7 +23,6 @@ import (
2023
"errors"
2124
"fmt"
2225
"os"
23-
goruntime "runtime"
2426
"testing"
2527

2628
"github.com/stretchr/testify/assert"
@@ -289,7 +291,6 @@ func TestGetOrCreateUserNamespaceMappings(t *testing.T) {
289291
runtimeUserns bool
290292
runtimeHandler string
291293
success bool
292-
skipOnWindows bool
293294
}{
294295
{
295296
name: "no user namespace",
@@ -323,7 +324,6 @@ func TestGetOrCreateUserNamespaceMappings(t *testing.T) {
323324
expMode: runtimeapi.NamespaceMode_POD,
324325
runtimeUserns: true,
325326
success: true,
326-
skipOnWindows: true,
327327
},
328328
{
329329
name: "user namespace, but no runtime support",
@@ -348,10 +348,6 @@ func TestGetOrCreateUserNamespaceMappings(t *testing.T) {
348348

349349
for _, tc := range cases {
350350
t.Run(tc.name, func(t *testing.T) {
351-
if tc.skipOnWindows && goruntime.GOOS == "windows" {
352-
// TODO: remove skip once the failing test has been fixed.
353-
t.Skip("Skip failing test on Windows.")
354-
}
355351
// These tests will create the userns file, so use an existing podDir.
356352
testUserNsPodsManager := &testUserNsPodsManager{
357353
podDir: t.TempDir(),

‎pkg/kubelet/userns/userns_manager_windows.go

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
/*
2+
Copyright 2025 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package userns
18+
19+
import (
20+
v1 "k8s.io/api/core/v1"
21+
"k8s.io/apimachinery/pkg/types"
22+
runtimeapi "k8s.io/cri-api/pkg/apis/runtime/v1"
23+
kubecontainer "k8s.io/kubernetes/pkg/kubelet/container"
24+
)
25+
26+
type UsernsManager struct{}
27+
28+
func MakeUserNsManager(kl userNsPodsManager) (*UsernsManager, error) {
29+
return nil, nil
30+
}
31+
32+
// Release releases the user namespace allocated to the specified pod.
33+
func (m *UsernsManager) Release(podUID types.UID) {
34+
return
35+
}
36+
37+
func (m *UsernsManager) GetOrCreateUserNamespaceMappings(pod *v1.Pod, runtimeHandler string) (*runtimeapi.UserNamespace, error) {
38+
return nil, nil
39+
}
40+
41+
// CleanupOrphanedPodUsernsAllocations reconciliates the state of user namespace
42+
// allocations with the pods actually running. It frees any user namespace
43+
// allocation for orphaned pods.
44+
func (m *UsernsManager) CleanupOrphanedPodUsernsAllocations(pods []*v1.Pod, runningPods []*kubecontainer.Pod) error {
45+
return nil
46+
}
47+
48+
func EnabledUserNamespacesSupport() bool {
49+
return false
50+
}

‎pkg/util/kernel/constants.go

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,6 @@ const TCPFinTimeoutNamespacedKernelVersion = "4.6"
4444
// (ref: https://github.com/torvalds/linux/commit/35dfb013149f74c2be1ff9c78f14e6a3cd1539d1)
4545
const IPVSConnReuseModeFixedKernelVersion = "5.9"
4646

47-
// UserNamespacesSupportKernelVersion is the kernel version where idmap for tmpfs support was added
48-
// (ref: https://github.com/torvalds/linux/commit/05e6295f7b5e05f09e369a3eb2882ec5b40fff20)
49-
const UserNamespacesSupportKernelVersion = "6.3"
50-
5147
const TmpfsNoswapSupportKernelVersion = "6.4"
5248

5349
// NFTablesKubeProxyKernelVersion is the lowest kernel version kube-proxy supports using

‎staging/publishing/rules.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2898,4 +2898,4 @@ rules:
28982898
- staging/src/k8s.io/endpointslice
28992899
recursive-delete-patterns:
29002900
- '*/.gitattributes'
2901-
default-go-version: 1.23.8
2901+
default-go-version: 1.23.10

‎test/images/Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ REGISTRY ?= registry.k8s.io/e2e-test-images
1616
GOARM ?= 7
1717
DOCKER_CERT_BASE_PATH ?=
1818
QEMUVERSION=v5.1.0-2
19-
GOLANG_VERSION=1.23.8
19+
GOLANG_VERSION=1.23.10
2020
export
2121

2222
ifndef WHAT

‎test/utils/image/manifest.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -229,7 +229,7 @@ func initImageConfigs(list RegistryList) (map[ImageID]Config, map[ImageID]Config
229229
configs[BusyBox] = Config{list.PromoterE2eRegistry, "busybox", "1.36.1-1"}
230230
configs[CudaVectorAdd] = Config{list.PromoterE2eRegistry, "cuda-vector-add", "1.0"}
231231
configs[CudaVectorAdd2] = Config{list.PromoterE2eRegistry, "cuda-vector-add", "2.3"}
232-
configs[DistrolessIptables] = Config{list.BuildImageRegistry, "distroless-iptables", "v0.5.13"}
232+
configs[DistrolessIptables] = Config{list.BuildImageRegistry, "distroless-iptables", "v0.6.11"}
233233
configs[Etcd] = Config{list.GcEtcdRegistry, "etcd", "3.5.15-0"}
234234
configs[Httpd] = Config{list.PromoterE2eRegistry, "httpd", "2.4.38-4"}
235235
configs[HttpdNew] = Config{list.PromoterE2eRegistry, "httpd", "2.4.39-4"}

0 commit comments

Comments
 (0)