From 2cb704849cf9adfb44f6db24d6d334502940baca Mon Sep 17 00:00:00 2001 From: SiorMeir Date: Sun, 6 Sep 2026 14:06:29 +0300 Subject: [PATCH] add PriorityClassName, GoMemLimit(Ratio), ExtendedResourceClaimAllocation,FIPSOnly, InPlacePodResize, and PodGroup minMember=0 support Signed-off-by: SiorMeir --- .../unreleased/Added-20260805-142800.yaml | 2 + .../unreleased/added-20260906-120848.yaml | 3 + config/crd/kai.scheduler_configs.yaml | 33 + .../crd/kai.scheduler_schedulingshards.yaml | 16 + .../crd/scheduling.run.ai_bindrequests.yaml | 896 ++++++++++++++++++ config/crd/scheduling.run.ai_podgroups.yaml | 6 +- kai/v1/admission/admission.go | 26 + kai/v1/admission/zz_generated.deepcopy.go | 30 + kai/v1/global.go | 14 + kai/v1/schedulingshard_types.go | 15 + kai/v1/zz_generated.deepcopy.go | 20 + scheduling/v1alpha2/bindrequest_types.go | 22 +- scheduling/v1alpha2/zz_generated.deepcopy.go | 37 + scheduling/v2alpha2/podgroup_types.go | 6 +- 14 files changed, 1120 insertions(+), 6 deletions(-) create mode 100644 .changes/unreleased/Added-20260805-142800.yaml create mode 100644 .changes/unreleased/added-20260906-120848.yaml diff --git a/.changes/unreleased/Added-20260805-142800.yaml b/.changes/unreleased/Added-20260805-142800.yaml new file mode 100644 index 0000000..38384fb --- /dev/null +++ b/.changes/unreleased/Added-20260805-142800.yaml @@ -0,0 +1,2 @@ +kind: Added +body: Add PriorityClassName, GoMemLimit(Ratio) and ExtendedResourceClaimAllocation types diff --git a/.changes/unreleased/added-20260906-120848.yaml b/.changes/unreleased/added-20260906-120848.yaml new file mode 100644 index 0000000..eb3be27 --- /dev/null +++ b/.changes/unreleased/added-20260906-120848.yaml @@ -0,0 +1,3 @@ +kind: Added +body: |- + Add FIPSOnly, InPlacePodResize, and PodGroup minMember=0 support diff --git a/config/crd/kai.scheduler_configs.yaml b/config/crd/kai.scheduler_configs.yaml index 7a98f57..16503d3 100644 --- a/config/crd/kai.scheduler_configs.yaml +++ b/config/crd/kai.scheduler_configs.yaml @@ -71,6 +71,27 @@ spec: description: GPUSharing enables GPU sharing functionality for the admission service type: boolean + inPlacePodResize: + description: InPlacePodResize configures in-place pod resize (KEP-1287) + behaviour. + properties: + blockUpsizeOnBoundedQueues: + description: |- + BlockUpsizeOnBoundedQueues rejects any upsize on a queue (or ancestor) + that has a finite CPU or memory limit, regardless of current allocation. + This prevents concurrent-resize races from exceeding hard limits. + Disabled by default; enable only when strict race-free enforcement is + required and best-effort checks are insufficient. + Has no effect when ValidateQuota is false. + type: boolean + validateQuota: + description: |- + ValidateQuota enables best-effort hierarchical queue quota checks on + pods/resize requests. When false, the webhook admits all resizes without + checking queue limits or quota, and BlockUpsizeOnBoundedQueues is ignored. + Defaults to true. + type: boolean + type: object mutatingWebhookConfigurationName: description: MutatingWebhookConfigurationName is the name of the MutatingWebhookConfiguration for the admission service @@ -3995,6 +4016,13 @@ spec: type: string type: object type: array + fipsOnly: + description: |- + FIPSOnly sets GODEBUG=fips140=only on every KAI container, enforcing FIPS 140-3 mode + at runtime instead of just using FIPS-built images. This can panic at runtime if any + non-approved cryptographic algorithm is used - see + https://go.dev/doc/security/fips140#the-fips140-godebug-option. + type: boolean imagesPullSecret: description: |- Deprecated: ImagePullSecret defines a single container registry secret credential. @@ -4028,6 +4056,11 @@ spec: description: PodLabelSelector filters pods for webhooks and pod grouper type: object + priorityClassName: + description: |- + PriorityClassName defines the priority class for KAI operators & services. + An empty value leaves the pods without a priority class. + type: string queueLabelKey: description: QueueLabelKey specifies the pod label key whose value will be the queue name of the pod. diff --git a/config/crd/kai.scheduler_schedulingshards.yaml b/config/crd/kai.scheduler_schedulingshards.yaml index 9324dda..6780221 100644 --- a/config/crd/kai.scheduler_schedulingshards.yaml +++ b/config/crd/kai.scheduler_schedulingshards.yaml @@ -81,6 +81,22 @@ spec: * Only valid flags defined in the scheduler's flag set will be accepted * Duplicated flags will override the behavior of flags generated by other fields type: object + goMemLimit: + anyOf: + - type: integer + - type: string + description: GoMemLimit overrides automatic cgroup-derived GOMEMLIMIT + for this shard. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + goMemLimitRatio: + description: |- + GoMemLimitRatio is the fraction of the scheduler container memory limit + applied as GOMEMLIMIT. Defaults to 0.9. + exclusiveMinimum: true + maximum: 1 + minimum: 0 + type: number kValue: description: KValue specifies the kValue for the proportion plugin. Default is 1.0. diff --git a/config/crd/scheduling.run.ai_bindrequests.yaml b/config/crd/scheduling.run.ai_bindrequests.yaml index ae6f897..c53df35 100644 --- a/config/crd/scheduling.run.ai_bindrequests.yaml +++ b/config/crd/scheduling.run.ai_bindrequests.yaml @@ -49,6 +49,902 @@ spec: description: BackoffLimit is the number of retries before giving up format: int32 type: integer + extendedResourceClaimAllocation: + description: |- + ExtendedResourceClaimAllocation holds the allocation for the synthetic DRA claim + created to satisfy extended resource requests backed by a DeviceClass. + properties: + allocation: + description: Allocation is the allocation result from the DRA + allocator. + properties: + allocationTimestamp: + description: |- + AllocationTimestamp stores the time when the resources were allocated. + This field is not guaranteed to be set, in which case that time is unknown. + + This is an alpha field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus + feature gate. + format: date-time + type: string + devices: + description: Devices is the result of allocating devices. + properties: + config: + description: |- + This field is a combination of all the claim and class configuration parameters. + Drivers can distinguish between those based on a flag. + + This includes configuration parameters for drivers which have no allocated + devices in the result because it is up to the drivers which configuration + parameters they support. They can silently ignore unknown configuration + parameters. + items: + description: DeviceAllocationConfiguration gets embedded + in an AllocationResult. + properties: + opaque: + description: Opaque provides driver-specific configuration + parameters. + properties: + driver: + description: |- + Driver is used to determine which kubelet plugin needs + to be passed these configuration parameters. + + An admission policy provided by the driver developer could use this + to decide whether it needs to validate them. + + Must be a DNS subdomain and should end with a DNS domain owned by the + vendor of the driver. It should use only lower case characters. + type: string + parameters: + description: |- + Parameters can contain arbitrary data. It is the responsibility of + the driver developer to handle validation and versioning. Typically this + includes self-identification and a version ("kind" + "apiVersion" for + Kubernetes types), with conversion between different versions. + + The length of the raw data must be smaller or equal to 10 Ki. + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - driver + - parameters + type: object + requests: + description: |- + Requests lists the names of requests where the configuration applies. + If empty, its applies to all requests. + + References to subrequests must include the name of the main request + and may include the subrequest using the format
[/]. If just + the main request is given, the configuration applies to all subrequests. + items: + type: string + type: array + x-kubernetes-list-type: atomic + source: + description: |- + Source records whether the configuration comes from a class and thus + is not something that a normal user would have been able to set + or from a claim. + type: string + required: + - source + type: object + type: array + x-kubernetes-list-type: atomic + results: + description: Results lists all allocated devices. + items: + description: DeviceRequestAllocationResult contains + the allocation result for one request. + properties: + adminAccess: + description: |- + AdminAccess indicates that this device was allocated for + administrative access. See the corresponding request field + for a definition of mode. + + This is an alpha field and requires enabling the DRAAdminAccess + feature gate. Admin access is disabled if this field is unset or + set to false, otherwise it is enabled. + type: boolean + bindingConditions: + description: |- + BindingConditions contains a copy of the BindingConditions + from the corresponding ResourceSlice at the time of allocation. + + This is an alpha field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus + feature gates. + items: + type: string + type: array + x-kubernetes-list-type: atomic + bindingFailureConditions: + description: |- + BindingFailureConditions contains a copy of the BindingFailureConditions + from the corresponding ResourceSlice at the time of allocation. + + This is an alpha field and requires enabling the DRADeviceBindingConditions and DRAResourceClaimDeviceStatus + feature gates. + items: + type: string + type: array + x-kubernetes-list-type: atomic + consumedCapacity: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + ConsumedCapacity tracks the amount of capacity consumed per device as part of the claim request. + The consumed amount may differ from the requested amount: it is rounded up to the nearest valid + value based on the device’s requestPolicy if applicable (i.e., may not be less than the requested amount). + + The total consumed capacity for each device must not exceed the DeviceCapacity's Value. + + This field is populated only for devices that allow multiple allocations. + All capacity entries are included, even if the consumed amount is zero. + type: object + device: + description: |- + Device references one device instance via its name in the driver's + resource pool. It must be a DNS label. + type: string + driver: + description: |- + Driver specifies the name of the DRA driver whose kubelet + plugin should be invoked to process the allocation once the claim is + needed on a node. + + Must be a DNS subdomain and should end with a DNS domain owned by the + vendor of the driver. It should use only lower case characters. + type: string + pool: + description: |- + This name together with the driver name and the device name field + identify which device was allocated (`//`). + + Must not be longer than 253 characters and may contain one or more + DNS sub-domains separated by slashes. + type: string + request: + description: |- + Request is the name of the request in the claim which caused this + device to be allocated. If it references a subrequest in the + firstAvailable list on a DeviceRequest, this field must + include both the name of the main request and the subrequest + using the format
/. + + Multiple devices may have been allocated per request. + type: string + shareID: + description: |- + ShareID uniquely identifies an individual allocation share of the device, + used when the device supports multiple simultaneous allocations. + It serves as an additional map key to differentiate concurrent shares + of the same device. + type: string + tolerations: + description: |- + A copy of all tolerations specified in the request at the time + when the device got allocated. + + The maximum number of tolerations is 16. + + This is an alpha field and requires enabling the DRADeviceTaints + feature gate. + items: + description: |- + The ResourceClaim this DeviceToleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + Must be a label name. + type: string + operator: + default: Equal + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a ResourceClaim can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + If larger than zero, the time when the pod needs to be evicted is calculated as