$ the-wire · showcase
Alibaba Cloud provider fixes stale LB backends, release tooling goes SPDX 3
By RepoJournal · Filed · About Kubernetes · Composed from the cited sources · methodology
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4)
![kubernetes-prow[bot]](https://avatars.githubusercontent.com/in/992787?v=4)
9 people shipped this
The day's most consequential fix is in cloud-provider-alibaba-cloud, where a taint-only Node update could leave nodes in load balancer backends indefinitely, while SIG Release's tooling shipped SPDX 3 SBOMs, faster watch bookmarks, and a CEL bump.
fix(service): reconcile when the autoscaler taint is added or removed kubernetes/cloud-provider-alibaba-cloud
Nodes carrying the ToBeDeletedByClusterAutoscaler taint are excluded when the load balancer model is built, but nodeSpecChanged() only compared labels, spec.unschedulable and the Ready condition, so a taint-only update never enqueued a Service. With SyncPeriod unset, the backend set stayed stale until controller-runtime's 10h resync or some unrelated change forced a reconcile.
v0.23.0 kubernetes/release
kubernetes/release v0.23.0 publishes release artifact SBOMs as SPDX 3.0.1 JSON-LD, adds a trixie kube-cross variant, and renames krel's --gcs-root flag to --bucket-root, which is a breaking change for any staging scripts still passing the old flag.
Watchcache simplify bookmarks kubernetes/kubernetes
The watch cache drops a large amount of bookmark handling code by assuming that setting resourceVersion on a bookmark event never fails, a trade serathius argues is safe because failure there would already break far more. Filed as cleanup with a NONE release note, so no behavior change is promised.
Keep only the release files as final provenance subjects kubernetes/release
Reading the release SBOM through protobom made bom emit image packages, layers and binaries as provenance subjects named NONE: a mock release of master published 480 subjects, 380 of them gs://<bucket>/release/<version>/NONE. Final provenance now keeps only the release files again.
Bump cel go 0.33.2 kubernetes/kubernetes
The apiserver's CEL dependency moves to cel-go 0.33.2, alongside a new BenchmarkAdmissionPolicyRequestCost that measures per-request heap allocations for ValidatingAdmissionPolicy and MutatingAdmissionPolicy at 1, 10 and 100 containers, wiring admission overhead into perf-dash.
fix: skip update task for to-be-deleted slb kubernetes/cloud-provider-alibaba-cloud
Elsewhere in the same provider, the CLB v1 controller no longer enqueues an SLB update task for a Service that is being deleted, with a regression test covering preservation of an IPv6 load balancer during deletion.
Action items
- → Switch krel invocations from --gcs-root to --bucket-root before upgrading kubernetes/release to v0.23.0 kubernetes/release [plan]
