fix: Maintain feature gate `ValidatingAdmissionPolicy` as removed with Kubernetes v1.32 #12643

marc1404 · 2025-07-31T13:06:28Z

How to categorize this PR?

/area usability quality
/kind bug

What this PR does / why we need it:

This PR maintains the feature gate ValidatingAdmissionPolicy as removed with Kubernetes v1.32.
Otherwise, the kube-apiserver crashes when trying to enable this feature gate with Kubernetes versions >= v1.32.

Which issue(s) this PR fixes:

Follow-up to: #11020

Special notes for your reviewer:

/cc @LucaBernstein @vpnachev

Thanks for bringing this to our attention @vpnachev! 🙏

We sanity checked the list of added and removed feature gates in the Kubernetes version v1.32 against the code, but did not identify further issues.

Release note:

The Kubernetes feature gate `ValidatingAdmissionPolicy` is now marked as removed in Kubernetes 1.32. Previously, it was possible to upgrade a Shoot cluster to Kubernetes 1.32 with this feature gate enabled, which resulted in kube-apiserver failing to start due to an unrecognized feature gate.

…Kubernetes v1.32 Co-authored-by: Luca Bernstein <luca.bernstein@sap.com>

LucaBernstein

/approve

vpnachev

/lgtm

vpnachev · 2025-07-31T13:11:20Z

/cherry-pick release-v1.124

vpnachev · 2025-07-31T13:11:23Z

/cherry-pick release-v1.123

gardener-ci-robot · 2025-07-31T13:11:23Z

@vpnachev: once the present PR merges, I will cherry-pick it on top of release-v1.124 in a new PR and assign it to you.

In response to this:

/cherry-pick release-v1.124

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

gardener-ci-robot · 2025-07-31T13:11:26Z

@vpnachev: once the present PR merges, I will cherry-pick it on top of release-v1.123 in a new PR and assign it to you.

In response to this:

/cherry-pick release-v1.123

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

vpnachev · 2025-07-31T13:11:26Z

/cherry-pick release-v1.122

gardener-ci-robot · 2025-07-31T13:11:29Z

@vpnachev: once the present PR merges, I will cherry-pick it on top of release-v1.122 in a new PR and assign it to you.

In response to this:

/cherry-pick release-v1.122

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

ialidzhikov · 2025-07-31T13:13:27Z

Release note??

ialidzhikov · 2025-07-31T13:13:57Z

pkg/utils/validation/features/featuregates.go

@@ -299,7 +299,7 @@ var featureGateVersionRanges = map[string]*FeatureGateVersionRange{
 	"UserNamespacesPodSecurityStandards":               {VersionRange: versionutils.VersionRange{AddedInVersion: "1.29"}},
 	"UserNamespacesStatelessPodsSupport":               {VersionRange: versionutils.VersionRange{RemovedInVersion: "1.28"}},
 	"UserNamespacesSupport":                            {VersionRange: versionutils.VersionRange{AddedInVersion: "1.28"}},
-	"ValidatingAdmissionPolicy":                        {LockedValue: true, LockedToDefaultInVersion: "1.30"},
+	"ValidatingAdmissionPolicy":                        {LockedValue: true, LockedToDefaultInVersion: "1.30", VersionRange: versionutils.VersionRange{RemovedInVersion: "1.32"}},


Don't we need to maintain also AddedInVersion?

We only maintain this field if we need to ensure a lower Kubernetes version constraint (as can be seen in line 300 above the change).
The feature gate has been added with Kubernetes v1.26 (ref).

I see that it is not very consistent at the moment. @shafeeqes also concluded the same #12486 (comment).

I prefer maintaining the versions despite that they the corresponding Kubernetes versions are no longer supported by Gardener. It makes it obvious to the reader when the feature gate was added and we make sure that we don't miss to maintain it.

Anyways, let's do not block this PR because of this. We can agree outside of this PR and write down the agreement/convention.

Based on a gut feeling, I'd probably also prefer a more consistent approach. As you've said, we didn't want to pollute this PR with changing other feature gate definitions as well.

marc1404 · 2025-07-31T13:18:39Z

Release note??

@ialidzhikov we were debating whether to add a release note or not. It's added now, thanks :)

ialidzhikov · 2025-07-31T13:20:29Z

@ialidzhikov we were debating whether to add a release note or not. It's added now, thanks :)

Thanks! We are cherry-picking the fix, hence it deserve a release note IMO. :)

marc1404 · 2025-07-31T13:25:45Z

Test Integration ResourceManager NodeAgentAuthorizer Suite: [It] NodeAgentAuthorizer tests when machine namespace is unset #Leases #list forbid other gardener-node-agent

[FAILED] Expected success, but got an error:
    <*net.OpError | 0xc0019b14a0>: 
    listen tcp 127.0.0.1:41719: bind: address already in use
    {
        Op: "listen",
        Net: "tcp",
        Source: nil,
        Addr: <*net.TCPAddr | 0xc001ba19b0>{
            IP: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 255, 255, 127, 0, 0, 1],
            Port: 41719,
            Zone: "",
        },
        Err: <*os.SyscallError | 0xc00041b920>{
            Syscall: "bind",
            Err: <syscall.Errno>0x62,
        },
    }
In [BeforeEach] at: /home/prow/go/src/github.com/gardener/gardener/test/integration/resourcemanager/nodeagentauthorizer/nodeagentauthorizer_test.go:94 @ 07/31/25

/test pull-gardener-integration

ialidzhikov

/lgtm

gardener-prow · 2025-07-31T13:42:28Z

LGTM label has been added.

Git tree hash: f70fdb030f98fbbc4dcdf17c2d27d979017b1d92

gardener-prow · 2025-07-31T13:42:31Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ialidzhikov, LucaBernstein

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [LucaBernstein,ialidzhikov]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

gardener-ci-robot · 2025-07-31T14:53:36Z

@vpnachev: new pull request created: #12645

In response to this:

/cherry-pick release-v1.124

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

gardener-ci-robot · 2025-07-31T14:54:19Z

@vpnachev: new pull request created: #12646

In response to this:

/cherry-pick release-v1.123

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

gardener-ci-robot · 2025-07-31T14:54:59Z

@vpnachev: #12643 failed to apply on top of branch "release-v1.122":

Applying: fix: Maintain feature gate ValidatingAdmissionPolicy as removed with Kubernetes v1.32
Using index info to reconstruct a base tree...
M	pkg/utils/validation/features/featuregates.go
Falling back to patching base and 3-way merge...
Auto-merging pkg/utils/validation/features/featuregates.go
CONFLICT (content): Merge conflict in pkg/utils/validation/features/featuregates.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 fix: Maintain feature gate ValidatingAdmissionPolicy as removed with Kubernetes v1.32

In response to this:

/cherry-pick release-v1.122

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

…Kubernetes v1.32 (gardener#12643) Co-authored-by: Luca Bernstein <luca.bernstein@sap.com> (cherry picked from commit 08919f0)

…Kubernetes v1.32 (#12643) (#12651) Co-authored-by: Luca Bernstein <luca.bernstein@sap.com> (cherry picked from commit 08919f0)

…Kubernetes v1.32 (gardener#12643) Co-authored-by: Luca Bernstein <luca.bernstein@sap.com>

fix: Maintain feature gate ValidatingAdmissionPolicy as removed with …

1cf4072

…Kubernetes v1.32 Co-authored-by: Luca Bernstein <luca.bernstein@sap.com>

gardener-prow bot requested review from LucaBernstein and vpnachev July 31, 2025 13:06

LucaBernstein reviewed Jul 31, 2025

View reviewed changes

gardener-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 31, 2025

vpnachev reviewed Jul 31, 2025

View reviewed changes

gardener-prow bot assigned vpnachev Jul 31, 2025

gardener-prow bot added the lgtm Indicates that a PR is ready to be merged. label Jul 31, 2025

ialidzhikov requested changes Jul 31, 2025

View reviewed changes

gardener-prow bot assigned ialidzhikov Jul 31, 2025

gardener-prow bot removed the lgtm Indicates that a PR is ready to be merged. label Jul 31, 2025

gardener-prow bot requested a review from vpnachev July 31, 2025 13:14

ialidzhikov approved these changes Jul 31, 2025

View reviewed changes

gardener-prow bot added the lgtm Indicates that a PR is ready to be merged. label Jul 31, 2025

gardener-prow bot merged commit 08919f0 into gardener:master Jul 31, 2025
19 checks passed

gardener-ci-robot mentioned this pull request Jul 31, 2025

[release-v1.124] fix: Maintain feature gate ValidatingAdmissionPolicy as removed with Kubernetes v1.32 #12645

Merged

gardener-ci-robot mentioned this pull request Jul 31, 2025

[release-v1.123] fix: Maintain feature gate ValidatingAdmissionPolicy as removed with Kubernetes v1.32 #12646

Merged

marc1404 deleted the fix/11020-remove-validationadmissionpolicy-featuregate-k8s-v1.32 branch July 31, 2025 14:59

marc1404 mentioned this pull request Jul 31, 2025

[release-v1.122] fix: Maintain feature gate ValidatingAdmissionPolicy as removed with Kubernetes v1.32 #12651

Merged

gardener-prow bot pushed a commit that referenced this pull request Jul 31, 2025

fix: Maintain feature gate ValidatingAdmissionPolicy as removed with …

789cae7

…Kubernetes v1.32 (#12643) (#12651) Co-authored-by: Luca Bernstein <luca.bernstein@sap.com> (cherry picked from commit 08919f0)

Duciwuci pushed a commit to stackitcloud/gardener that referenced this pull request Sep 1, 2025

fix: Maintain feature gate ValidatingAdmissionPolicy as removed with …

d9c3a30

…Kubernetes v1.32 (gardener#12643) Co-authored-by: Luca Bernstein <luca.bernstein@sap.com>

fix: Maintain feature gate ValidatingAdmissionPolicy as removed with Kubernetes v1.32 #12643

fix: Maintain feature gate ValidatingAdmissionPolicy as removed with Kubernetes v1.32 #12643

Uh oh!

Conversation

marc1404 commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

LucaBernstein left a comment

Choose a reason for hiding this comment

Uh oh!

vpnachev left a comment

Choose a reason for hiding this comment

Uh oh!

vpnachev commented Jul 31, 2025

Uh oh!

vpnachev commented Jul 31, 2025

Uh oh!

gardener-ci-robot commented Jul 31, 2025

Uh oh!

gardener-ci-robot commented Jul 31, 2025

Uh oh!

vpnachev commented Jul 31, 2025

Uh oh!

gardener-ci-robot commented Jul 31, 2025

Uh oh!

ialidzhikov commented Jul 31, 2025

Uh oh!

ialidzhikov Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

marc1404 Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

ialidzhikov Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

marc1404 Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

marc1404 commented Jul 31, 2025

Uh oh!

ialidzhikov commented Jul 31, 2025

Uh oh!

marc1404 commented Jul 31, 2025

Uh oh!

ialidzhikov left a comment

Choose a reason for hiding this comment

Uh oh!

gardener-prow bot commented Jul 31, 2025

Uh oh!

gardener-prow bot commented Jul 31, 2025

Uh oh!

Uh oh!

gardener-ci-robot commented Jul 31, 2025

Uh oh!

gardener-ci-robot commented Jul 31, 2025

Uh oh!

gardener-ci-robot commented Jul 31, 2025

Uh oh!

Uh oh!

fix: Maintain feature gate `ValidatingAdmissionPolicy` as removed with Kubernetes v1.32 #12643

fix: Maintain feature gate `ValidatingAdmissionPolicy` as removed with Kubernetes v1.32 #12643

marc1404 commented Jul 31, 2025 •

edited

Loading