Repository navigation
k8s: NFD v0.20.1, agent-sandbox v1.0.8, EAS patch 0003 on nri-plugins v0.15.0, kubectl v1.37.2 for the wildct and cross-host rows - #239
Merged
Conversation
Both were the newest releases on 2026-10-29 (GitHub releases, and the use-latest-version registry check), and each image is pinned to the index digest docker buildx imagetools resolves. - Node Feature Discovery v0.19.0 -> v0.20.1. It carries the GO-2026-6809 x509 fix and is built against the Kubernetes 1.37 libraries; its notes list no public API change. share/node-feature-discovery.yml is re-rendered with kubectl kustomize from v0.20.1's default overlay plus Intel's NodeFeatureRules v0.37.1, with the same patches and worker config (the header's kustomization reproduces the committed v0.19.0 body byte for byte before the bump). The body changes only in CRD descriptions, one master config comment, the config map's hash suffix and the image. NFD's default cpuid blacklist and its klauspost/cpuid (v2.4.0) are unchanged, so the launcher's label list stands. Image sha256:6fc5c9af...8379. - agent-sandbox v1.0.7 -> v1.0.8. The release file (sha256 e68bfae0...) adds only the optional failedPodPolicy field (default Retain) and the controller's new tag. The controller and the python runtime are re-pinned. The release's action items (the MCP output cap and the router kustomization) do not apply: k3d-gpu installs neither. Goldens: the audit goldens and fixtures name the new NFD tag and digest (the lock still holds 52 images), the remote sandbox golden names v1.0.8, and the lock-drift case edits the v0.20.1 pin. Checked on throwaway k3d clusters (rancher/k3s v1.37.1-k3s1 at the Dockerfile's digest, the manifest in the server's manifests directory, as the image bakes it): the three NFD pods run the v0.20.1 digest, Ready with no restarts, and publish the same 70 feature labels, keys and values, as v0.19.0 on the same node, both fresh and after an in-place upgrade from v0.19.0. `k3d-gpu sandbox up` from this tree brought up the v1.0.8 controller and a ready warm pool; a SandboxClaim adopted it and POST /execute answered.
The unsent draft pinned the balloons chart to v0.14.0 as "the newest release today". v0.15.0 (2026-10-21) is the newest in the nri-plugins Helm index now, and EAS main (5767995) still has no chart pin, so a fresh install floats to v0.15.0. The patch is regenerated with git format-patch on EAS main with the version and its message changed; the issue draft and README follow. Re-checked on 2026-10-29: every patch applies to EAS main 5767995 on its own and as a series (checks/apply-check.sh). The role's advanced-balloon-values.yaml.j2, rendered with sample inputs in both reserved-CPU forms, goes through helm template for chart v0.15.0 (sha256 1c727a8d..., the digest k3d-gpu's own component pins), and the BalloonsPolicy validates against that chart's CRD with unknown fields rejected; the image resolves to nri-resource-policy-balloons:v0.15.0.
Rule W7 pins kubectl v1.37.1, "the newest release on 2026-10-20". Kubernetes v1.37.2 came out on 2026-10-28 and is the newest now (dl.k8s.io stable.txt, read 2026-10-29); k3d v5.9.0 and helm v4.3.1 are still the newest of theirs. P1 moves W7's kubectl to v1.37.2, mechanics only. No wildct hold has run (smoke1 was discarded), and install.sh runs again before the first hold to install W7's newest k3d-gpu release, so every wildct row runs on it. bench/wildct/install.sh fetches v1.37.2 and checks it against its .sha256 file, as before; W7 points to P1. If wildct amendment R1 (PR #226) merges, its sentence keeping v1.37.1 is superseded.
Cross-host rule 5 pins kubectl v1.35.2 in ~/k3dgpu-xhost/bin, which bench/xhost/hold.sh puts first on PATH. The node image the cross-host rows run (0.1.61) serves Kubernetes v1.37.1, two minors past the client and outside kubectl's one-minor skew policy. Crescent amendment E4 (PR #238) moves shared rule 5's workspace, ~/k3dgpu-bench/bin; it does not touch this one. K1 moves rule 5's kubectl to v1.37.2 (the newest release, 2026-10-28; k3d v5.9.0 stays), mechanics only. It covers H28x's run 2 and H7x, whose first measuring holds have not run. H25x, H27x and H34x are records and keep what they ran. A row runs all its holds on the kubectl in place at its first measuring hold. Rule 5's tools had no script in this repo. bench/xhost/tools.sh installs exactly k3d v5.9.0 and kubectl v1.37.2 into ~/k3dgpu-xhost/bin, checks both against their upstream checksum files before installing either, and prints both versions. A run against the real upstream gave "k3d: OK", "kubectl: OK", k3d v5.9.0 and kubectl v1.37.2. tests/xhost_tools_test.sh (in CI) runs it against a curl shim: exactly the two binaries at the pinned versions, four downloads, nothing else touched, a checksum mismatch on either installs nothing, no download directory left behind. Five broken copies of tools.sh (old kubectl, an install before the second check, no kubectl check, an extra binary, no cleanup) each fail it.
…lugins v0.15.0 The node image bakes the nri-plugins balloons chart v0.15.0 (component.conf, share/nri-balloons.yml, since #192), and v0.15.0 is still the newest release in the nri-plugins Helm index (2026-10-21, chart sha256 1c727a8d...). Two current-state lines still named v0.14.0: the README's `helm upgrade --install` that adopts the baked objects pinned `--version v0.14.0`, so following it would move a v0.15.0 node back to the older chart, and docs/intel.md said the image bakes balloons v0.14.0. Both now read v0.15.0. `helm template` of the chart from the repo at v0.15.0 renders the same kinds and the v0.15.0 image the baked manifest carries. The statements that describe v0.14.0's behaviour (docs/intel.md's CRD options and live run, docs/failure-modes.md's snapshot, the dated security audit, the H14 record) are left as they are.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the k8s-area pins of the 2026-10-29 audit to their newest releases, each checked that day with the use-latest-version registry check and the registry itself (
gh apireleases,dl.k8s.io/release/stable.txtand.sha256, the nri-plugins Helm index, anddocker buildx imagetools inspectfor every image digest).Merge after H52b's hold. NFD is baked into the node image, so merging cuts a release, and H52b's plain
upruns main's default node image (amendment D2). If this lands first, H52b runs NFD v0.20.1, and itsnode-image.txtshould record that. Wildct's rows take W7's newest release at their first hold anyway.Changes (class ours)
share/node-feature-discovery.yml, baked)2fa1c99a...6fc5c9af...8379share/agent-sandbox.yml,sandbox up)f254384c...e1d96312...share/agent-sandbox-k3d.yml)fc92654c...41da8480...nri_cpu_balloons_chart_versionbench/wildct/install.sh)~/k3dgpu-xhost/bin)bench/xhost/tools.shkubectl kustomizefrom v0.20.1'sdeployment/overlays/defaultplus Intel's NodeFeatureRules v0.37.1, using the same patches and worker config. Before the bump, the header's kustomization reproduced the committed v0.19.0 body byte for byte, with kubectl v1.35.2 and v1.37.2 alike.e68bfae0...) adds only the optionalfailedPodPolicyfield (defaultRetain) and the new controller tag. Its action items, the MCP output cap and the router kustomization, do not apply: k3d-gpu installs neither. The runtime image keeps its user, command, port and workdir; it moves from Python 3.14.8 to 3.14.9.bench/eatflow/agent.lockand the coding constraints stay at 1.0.7 as H43's record.git format-patchon EASmain5767995, with the version and its message changed. The issue draft, the upstream README anddocs/intel/upstream-eat.md's patch tree follow. The patch's own reason ("the newest release today") now holds again: v0.15.0, 2026-10-21, chart sha2561c727a8d..., the same chart k3d-gpu's component pins.install.shruns again before the first one to install W7's newest k3d-gpu release, so every wildct row gets v1.37.2. If wildct amendment R1 (bench(wildct): resume pack, bounded host calls and a host health check (amendment R1) #226) merges, its sentence keeping v1.37.1 is superseded. P1 and R1 both follow the wildct pre-registration; keep-both resolves it.bench/xhost/tools.shinstalls exactly k3d v5.9.0 and kubectl v1.37.2, and checks both against their upstream checksum files before installing either. H25x, H27x and H34x keep what they ran.Left to #238, to avoid duplicate edits
#238 already carries these, with the same versions and sha256:
packaging/install.sh.~/k3dgpu-bench/bin, for H53, H58 and later crescent rows).E4 does not touch the cross-host workspace, which is why K1 exists. This branch merges cleanly with #238.
Kept
rancher/k3s:v1.34.12-k3s1, which matches EAS main's kubectl v1.34.3. v1.34.12 is the newest 1.34 k3s.hack/tools.envhelm v3.22.1 (deliberately v3).docs/security-audit.md's dated audit, and the fixture SOURCES that cite NFD v0.19.0.hack/components/nri-balloons/header.txt(and so inshare/nri-balloons.yml),tests/prefill_guard_test.shandtests/detect_test.sh. agent: llama.cpp backend the fit picks, and busy Intel cards left out of the device plugin #182 and ci: hold.sh stops CMD's group with one TERM under GNU timeout; prefill guard test reads the pinned chart version #224 touch part of that. The statements describe v0.14.0's behaviour and would need checking against v0.15.0's source before being renamed.Tests
rancher/k3s:v1.37.1-k3s1at the Dockerfile's digest, with the NFD manifest in the server's manifests directory as the image bakes it, and kubectl v1.37.2. Both clusters were deleted afterwards.6fc5c9af..., Ready, with no restarts.k3d-gpu sandbox upfrom this tree:POST /executeanswered{"stdout":"42 3.14.9\n",...,"exit_code":0}.tests/detect_test.sh1185 passed.tests/audit_test.sh49 passed. The goldens were regenerated with--update, and only the NFD lines changed. The lock still holds 52 images.tests/remote_test.pyOK. The sandbox golden was regenerated.tests/share_kubeconform.sh: 67 valid, 0 invalid, 11 skipped, the same as main.tests/kubeconform.shok.scripts/images-lock checkandpinsok.tests/image_pins_test.sh39 passed.tests/sim_matrix_test.sh256 passed.tests/console_test.sh61 passed, andconsole/ledger-rules.jsonis unchanged.tests/eat_test.sh64 passed.tests/docs_test.sh61 passed, with the hashed mkdocs lock.tests/ci_wiring_test.sh58 passed.tests/render_test.sh16 passed, with helm v3.22.1.tests/claims_check.sh: 25 files clean.tests/ledger_drift_check.py: 40 files agree with 74 rows. Every in-page anchor of EXPERIMENTS.md resolves.tests/xhost_tools_test.sh(new, in CI) 18 passed.tools.sheach fail it: old kubectl, an install before the second check, no kubectl check, an extra binary, and no cleanup.tools.shagainst the real upstream printedk3d: OK,kubectl: OK, k3d v5.9.0 and kubectl v1.37.2.integrations/eat/upstream/checks/apply-check.shon EASmain5767995: all five patches apply alone and as a series.helm templateof the role's values in both reserved-CPU forms, and the BalloonsPolicy against the chart's CRD with unknown fields rejected.