Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Pod os field kubelet #105292

Merged
merged 1 commit into from Nov 9, 2021
Merged

Pod os field kubelet #105292

merged 1 commit into from Nov 9, 2021

Conversation

ravisantoshgudimetla
Copy link
Contributor

@ravisantoshgudimetla ravisantoshgudimetla commented Sep 27, 2021 •
edited

What type of PR is this?

/kind feature

What this PR does / why we need it:

Once #104613 and #104693
merge, we'll have OS field in pod spec. Kubelet will also start reconciling labels.
From then on, Kubelet should start rejecting pods
where pod.Spec.OS and node's OS label won't match

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Kubelet should reject pods whose OS doesn't match the node's OS label.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

[KEP]: https://github.com/kubernetes/enhancements/pull/2803

@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/feature Categorizes issue or PR as related to a new feature. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Sep 27, 2021
@k8s-ci-robot
Copy link
Contributor

@ravisantoshgudimetla: This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added the needs-priority Indicates a PR lacks a `priority/foo` label and requires one. label Sep 27, 2021
@k8s-ci-robot k8s-ci-robot added area/kubelet kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/apps Categorizes an issue or PR as relevant to SIG Apps. sig/node Categorizes an issue or PR as relevant to SIG Node. and removed do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Sep 27, 2021
@k8s-triage-robot
Copy link

This PR may require API review.

If so, when the changes are ready, complete the pre-review checklist and request an API review.

Status of requested reviews is tracked in the API Review project.

@ehashman ehashman added this to Triage in SIG Node PR Triage Sep 27, 2021
@fedebongio
Copy link
Contributor

/remove-sig api-machinery

@k8s-ci-robot k8s-ci-robot removed the sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. label Sep 28, 2021
@ehashman
Copy link
Member

What is the KEP for this?

/label api-review

@k8s-ci-robot k8s-ci-robot added the api-review Categorizes an issue or PR as actively needing an API review. label Sep 29, 2021
@ehashman ehashman moved this from Triage to Waiting on Author in SIG Node PR Triage Sep 29, 2021
@ravisantoshgudimetla
Copy link
Contributor Author

/remove label api-review

@ehashman - I updated the description with KEP associated. The api review can be done on #104693. I picked the commits from that PR to make the testing easier.

@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 1, 2021
@liggitt liggitt assigned liggitt and unassigned liggitt Oct 4, 2021
@liggitt liggitt removed the api-review Categorizes an issue or PR as actively needing an API review. label Oct 4, 2021
@k8s-ci-robot k8s-ci-robot removed the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Oct 29, 2021
@derekwaynecarr
Copy link
Member

/lgtm
/approve

remove the hold after the requisite pr merges (just tagged)

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 4, 2021
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: derekwaynecarr, ravisantoshgudimetla

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 4, 2021
liggitt
liggitt reviewed Nov 8, 2021
View reviewed changes
pkg/kubelet/lifecycle/predicate.go Outdated
}
// Node OS label can be used as source of truth as the OS and arch reconciliation would have happened by now
if nodeOS, ok := labels[v1.LabelOSStable]; ok {
if string(pod.Spec.OS.Name) != nodeOS {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

don't compare the pod os to the node labels, compare it to runtime.GOOS

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the pod nodeSelector should be compared to the node labels with the OS/Arch label ensured to match the real runtime.GOOS/GOARCH, but that's distinct from checking the pod.spec.os against runtime.GOOS

@k8s-ci-robot k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed lgtm "Looks good to me", indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Nov 8, 2021
@ravisantoshgudimetla ravisantoshgudimetla force-pushed the podOS-field-kubelet branch 2 times, most recently from 138c87c to 6380487 Compare November 8, 2021 22:50
@k8s-ci-robot k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 8, 2021
@ravisantoshgudimetla
Copy link
Contributor Author

@liggitt suggested to not rely on featuregate in kubelet to reject pods. He also suggested to add another featuregate for Pod security standards so that they can get merged in this release instead of waiting till 1.26 or 1.27(when IdentifyPodOS feature graduates to GA).

@ravisantoshgudimetla
Copy link
Contributor Author

/retest

liggitt
liggitt reviewed Nov 9, 2021
View reviewed changes
pkg/kubelet/lifecycle/predicate.go Outdated
if rejectPodAdmissionBasedOnOSField(admitPod) {
return PodAdmitResult{
Admit: false,
Reason: "PodOSFieldNodeLabelDoesNotMatch",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

drop NodeLabel from the reason… we're not comparing to the label

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pick a reason that will continue to make sense if LCOW is ever supported… maybe PodOSNotSupported or something?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The only reason for keeping it is - the user may not know about the OS of the node. Sometimes the only object he/she may have access to is node object. In any case, I changed it.

@ravisantoshgudimetla
[kubelet] Reject pods with OS field mismatch
889d45d 
Once kubernetes#104613 and kubernetes#104693
merge, we'll have OS field in pod spec. Kubelet should start rejecting pods
where pod.Spec.OS and node's OS(using runtime.GOOS) won't match
@liggitt
Copy link
Member

liggitt commented Nov 9, 2021

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 9, 2021
@ravisantoshgudimetla
Copy link
Contributor Author

/retest

@ravisantoshgudimetla
Copy link
Contributor Author

/hold cancel

/retest

@k8s-ci-robot k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 9, 2021
@k8s-ci-robot k8s-ci-robot merged commit a9ad15c into kubernetes:master Nov 9, 2021
SIG Node PR Triage automation moved this from Waiting on Author to Done Nov 9, 2021
@k8s-ci-robot k8s-ci-robot added this to the v1.23 milestone Nov 9, 2021
@ravisantoshgudimetla ravisantoshgudimetla mentioned this pull request Nov 10, 2021
Closed
26 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@liggitt liggitt liggitt left review comments

@derekwaynecarr derekwaynecarr derekwaynecarr requested changes

@brendandburns brendandburns Awaiting requested review from brendandburns

@caesarxuchao caesarxuchao Awaiting requested review from caesarxuchao

Assignees

@liggitt liggitt

@derekwaynecarr derekwaynecarr

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/kubelet cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API kind/feature Categorizes issue or PR as related to a new feature. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/apps Categorizes an issue or PR as relevant to SIG Apps. sig/node Categorizes an issue or PR as relevant to SIG Node. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
SIG Node PR Triage
Done
Milestone
v1.23
Development

Successfully merging this pull request may close these issues.

None yet
7 participants
@ravisantoshgudimetla @k8s-ci-robot @k8s-triage-robot @fedebongio @ehashman @derekwaynecarr @liggitt