$ the-wire · showcase
PodGroupPreemptionPolicy gate removed, ResourceQuota retry admits denied requests
By RepoJournal · Filed · About Kubernetes · Composed from the cited sources · methodology
![kubernetes-prow[bot]](https://avatars.githubusercontent.com/in/992787?v=4)
The day's consequential work is in the apiserver and the API types: a scheduling feature gate is gone, ResourceQuota admission no longer admits requests it already denied after a conflict retry, and the audit path no longer mislabels original events as truncated.
Merge pull request #143266 from iomarsayed/remove-podgrouppreemptionpolicy-feature-gate-and-merge-into-genericworkload kubernetes/client-go
The PodGroupPreemptionPolicy feature gate is removed, with its behavior merged into the generic Workload API surface. Anything that still toggles that gate, or reads the type it guarded, needs to move to the generic Workload path.
Merge pull request #141905 from Okabe-Junya/Okabe-Junya/fix/resourcequota-admission-retry-deny kubernetes/apiserver
ResourceQuota admission could admit a request it had already denied once the admission path retried after a conflict; the retry now honors the earlier denial. Quota enforcement is where overcommit of constrained namespaces starts, so this closes a path where a denied request leaked through under contention.
Merge pull request #143267 from SEPURI-SAI-KRISHNA/fix-audit-truncate-annotation-leak kubernetes/apiserver
Audit truncation no longer marks the original event as truncated, so the event you receive is not labeled as data loss it did not suffer. Only the derived, truncated copy carries that marker.
Merge pull request #142511 from saschagrunert/api-security-profile-oci kubernetes/client-go
The API adds an OCI seccomp profile type behind the SecurityProfileOCI feature gate, landing in both kubernetes/api and kubernetes/client-go. This is a breaking change to the API surface: existing code that switches over seccomp profile types must handle the new variant, gated off until SecurityProfileOCI is enabled.
apimachinery: compile the wildcard DNS-1123 subdomain regexp once kubernetes/apimachinery
IsWildcardDNS1123Subdomain called regexp.MustCompile on every invocation while the package's other validation regexps compile once; it now compiles at package level and ships with a benchmark. And the long tail: DRA Device Binding Conditions graduate to GA, AtomicWriteVolumeUserFields moves to beta behind its gate, AllocatorPool's default buffer cap drops to 32 KiB, IsWildcardDNS1123Subdomain's...
Action items
- → Migrate off the PodGroupPreemptionPolicy feature gate to the generic Workload API surface in client-go kubernetes/client-go [plan]
- → Add handling for the new OCI seccomp profile type before enabling SecurityProfileOCI in kubernetes/api and client-go kubernetes/api [plan]
