[PodLevelResources] Add validation for Windows OS #133046

toVersus · 2025-07-18T02:52:30Z

What type of PR is this?

/kind bug

What this PR does / why we need it:

This PR is taking over from #132627.

Adds the following checks based on the KEP description:

API server to reject Pod with PodLevelResources if Pod targets Windows OS.
kubelet to reject Pod with PodLevelResources on nodes other than Linux OS at admission phase.

Which issue(s) this PR is related to:

Fixes: #132582

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Added validation to reject Pods using the `PodLevelResources` feature on Windows OS due to lack of support. The API server rejects Pods with Pod-level resources and a `Pod.spec.os.name` targeting Windows. Kubelet on nodes running Windows also rejects Pods with Pod-level resources at admission phase.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

[KEP]: https://github.com/kubernetes/enhancements/issues/2837

k8s-ci-robot · 2025-07-18T02:52:39Z

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2025-07-18T02:52:39Z

Hi @toVersus. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

toVersus · 2025-07-18T02:53:14Z

/assign @tallclair @ndixita

pkg/kubelet/lifecycle/handlers.go

HirazawaUi

I noticed that validatePodResources currently doesn't have a dedicated unit test. Given that it's complex enough, would you be willing to add one?

pkg/apis/core/validation/validation.go

toVersus · 2025-07-18T05:47:29Z

I noticed that validatePodResources currently doesn't have a dedicated unit test. Given that it's complex enough, would you be willing to add one?

Thanks for the suggestion! I've added a new unit test specifically for validatePodResources. Since unit tests for the functions called within validatePodResources already exist, I focused on adding basic test cases and ones focused on validatePodResources.

HirazawaUi · 2025-07-18T12:35:40Z

/ok-to-test

k8s-ci-robot · 2025-07-22T18:45:39Z

LGTM label has been added.

Git tree hash: ebd3624ab87caf0294ab174a86988fc9a6ae888a

pkg/apis/core/validation/validation.go

msau42 · 2025-07-22T21:13:53Z

pkg/apis/core/validation/validation.go

 	if spec.Resources == nil {
 		return nil
 	}
+	resourcesFldPath := fldPath.Child("resources")


(no action item here, just documenting my thought process)

Normally when we change validation, we need to consider ratcheting validation to support n-1 version skew betwen api servers.

But in this case since it's alpha in 1.33 and the Pod.spec.resources field is immutable in 1.33, then this is a safe change to make. Objects created in 1.34 will have the tightened validation, and 1.33 api servers will still succeed validation with the looser validation.

pkg/apis/core/validation/validation_test.go

pkg/apis/core/validation/validation.go

Reject Pod with PodLevelResources in spec if Pod targets Windows OS.

Reject pods with PodLevelResources running on Windows nodes at kubelet admission phase

k8s-triage-robot · 2025-07-22T22:45:48Z

This PR may require API review.

If so, when the changes are ready, complete the pre-review checklist and request an API review.

Status of requested reviews is tracked in the API Review project.

msau42 · 2025-07-22T23:57:32Z

Approving API changes with one spelling nit.
/approve

msau42 · 2025-07-22T23:54:28Z

pkg/apis/core/validation/validation.go

+		// Do not include more detailed errors on the resources field value
+		// if the resources field may not be set on the target OS.
+		return field.ErrorList{
+			field.Forbidden(resourcesFldPath, "may not be set for a windows pod"),


Should "windows" be capitalized?

I'd like to keep it as is for consistency with other existing validation messages, which also use the term "windows pods."

ndixita · 2025-07-23T18:09:45Z

/lgtm

k8s-ci-robot · 2025-07-23T18:09:52Z

LGTM label has been added.

Git tree hash: 6637be9307631e3bf273cb848215c330af3b530d

dchen1107 · 2025-07-23T21:48:16Z

/lgtm
/approve

k8s-ci-robot · 2025-07-23T21:48:29Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dchen1107, msau42, toVersus

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~api/OWNERS~~ [msau42]
~~pkg/apis/OWNERS~~ [msau42]
~~pkg/generated/openapi/OWNERS~~ [dchen1107,msau42]
~~pkg/kubelet/OWNERS~~ [dchen1107]
~~staging/src/k8s.io/api/OWNERS~~ [msau42]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Jul 18, 2025

k8s-ci-robot requested review from dchen1107 and smarterclayton July 18, 2025 02:52

k8s-ci-robot added area/kubelet sig/apps Categorizes an issue or PR as relevant to SIG Apps. sig/node Categorizes an issue or PR as relevant to SIG Node. labels Jul 18, 2025

github-project-automation bot added this to SIG Apps Jul 18, 2025

k8s-ci-robot removed the do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. label Jul 18, 2025

github-project-automation bot moved this to Needs Triage in SIG Apps Jul 18, 2025

github-project-automation bot added this to SIG Node: code and documentation PRs Jul 18, 2025

github-project-automation bot moved this to Triage in SIG Node: code and documentation PRs Jul 18, 2025

k8s-ci-robot assigned ndixita and tallclair Jul 18, 2025

toVersus changed the title ~~Reject windows in api server~~ [PodLevelResources] Add validation for Windows OS Jul 18, 2025

toVersus commented Jul 18, 2025

View reviewed changes

pkg/kubelet/lifecycle/handlers.go Outdated Show resolved Hide resolved

HirazawaUi reviewed Jul 18, 2025

View reviewed changes

pkg/apis/core/validation/validation.go Outdated Show resolved Hide resolved

toVersus force-pushed the reject-windows-in-api-server branch from 14f7dab to d81b37b Compare July 18, 2025 05:43

toVersus force-pushed the reject-windows-in-api-server branch from d81b37b to 02399ed Compare July 18, 2025 06:55

msau42 reviewed Jul 22, 2025

View reviewed changes

thockin reviewed Jul 22, 2025

View reviewed changes

pkg/apis/core/validation/validation.go Outdated Show resolved Hide resolved

annasong20 and others added 3 commits July 23, 2025 07:08

Check OS for PodLevelResources in API server

e2c308a

Reject Pod with PodLevelResources in spec if Pod targets Windows OS.

Check OS for PodLevelResources in kubelet

c2b2661

Reject pods with PodLevelResources running on Windows nodes at kubelet admission phase

Add PodLevelResources to the Windows OS limitations in the API doc

88af8b6

toVersus force-pushed the reject-windows-in-api-server branch from fb3bafc to 88af8b6 Compare July 22, 2025 22:08

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 22, 2025

k8s-ci-robot requested review from msau42, ndixita and tallclair July 22, 2025 22:08

k8s-ci-robot added area/code-generation kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API labels Jul 22, 2025

msau42 reviewed Jul 22, 2025

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 23, 2025

k8s-ci-robot assigned dchen1107 Jul 23, 2025

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 23, 2025

k8s-ci-robot merged commit 9adc49f into kubernetes:master Jul 24, 2025
16 checks passed

k8s-ci-robot added this to the v1.34 milestone Jul 24, 2025

github-project-automation bot moved this from Needs Review to Done in SIG Node: Pod Level Resources Jul 24, 2025

github-project-automation bot moved this from Needs Triage to Done in SIG Apps Jul 24, 2025

github-project-automation bot moved this from Triage to Done in SIG Node: code and documentation PRs Jul 24, 2025

toVersus deleted the reject-windows-in-api-server branch July 24, 2025 03:15

toVersus mentioned this pull request Aug 5, 2025

Clean up pod spec validation test to check returned errors #133381

Open

[PodLevelResources] Add validation for Windows OS #133046

[PodLevelResources] Add validation for Windows OS #133046

Uh oh!

Conversation

toVersus commented Jul 18, 2025

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR is related to:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

Uh oh!

k8s-ci-robot commented Jul 18, 2025

Uh oh!

k8s-ci-robot commented Jul 18, 2025

Uh oh!

toVersus commented Jul 18, 2025

Uh oh!

Uh oh!

HirazawaUi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

toVersus commented Jul 18, 2025

Uh oh!

HirazawaUi commented Jul 18, 2025

Uh oh!

k8s-ci-robot commented Jul 22, 2025

Uh oh!

Uh oh!

msau42 Jul 22, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

k8s-triage-robot commented Jul 22, 2025

Uh oh!

msau42 commented Jul 22, 2025

Uh oh!

msau42 Jul 22, 2025

Choose a reason for hiding this comment

Uh oh!

toVersus Jul 23, 2025

Choose a reason for hiding this comment

Uh oh!

ndixita commented Jul 23, 2025

Uh oh!

k8s-ci-robot commented Jul 23, 2025

Uh oh!

dchen1107 commented Jul 23, 2025

Uh oh!

k8s-ci-robot commented Jul 23, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants