Kubernetes This Week: Kubelet Volume Checkpoints, ResourceQuota Fix and DRA GA

Kubernetes is the container orchestrator that most of us run in some form. I looked at 183 commits and 15 merged pull requests from the last week. The headline is kubelet work on checkpointing pod volumes, with a few real bug fixes next to it.

Kubelet volume state and a new feature gate

The biggest change is kubelet checkpointing pod volumes into actuated state (#143522). It is built from several commits. One adds methods for checkpointing pod volumes in kubelet state. Another wires the volume manager to actuated state. A third shares that state between kuberuntime and the VolumeManager.

The PR title says the checkpoint is used for ASOW reconstruction, meaning rebuilding the actual state of world after a kubelet restart. The PR is labeled as cleanup, so it is groundwork rather than a user facing feature.

Related: a commit adds the DynamicNodeLocalEphemeralVolumes feature gate. I only saw the gate land. Check pkg/features/kube_features.go for its stage before you plan anything around it.

Fixes operators can feel

Three bug fixes stand out.

• ResourceQuota admission admitting denied requests after a conflict retry (#141905). The fix preserves determined denials across retries, and a follow up test covers it. If you rely on quotas under heavy write contention, this matters.
• Sub second precision loss in CRI sourced container metrics (#143028). The CRI API gains Metric.double_value for fractional values, and the kubelet prefers it when emitting metrics. Runtimes will need to populate the new field.
• Audit: do not mark the original event as truncated (#143267) and client-go: use the default dialer when connrotation dial is nil (#143105), both labeled as bugs with release notes.

A smaller one: skip eviction metrics for terminating pods.

Graduations and feature gates

Several API level changes merged on November 4 and 5:

• DRA Device Binding Conditions graduate to GA (#142478)
• KEP 5936: beta support for atomic write volume user fields (#142467), behind AtomicWriteVolumeUserFields
• OCI seccomp profile type behind SecurityProfileOCI (#142511)

Also, the PodGroupPreemptionPolicy feature gate was removed, with a follow up to update API codegen and feature gate references. If you set that gate explicitly on a build from master, expect it to be gone.

Scheduler and validation changes

In the scheduler, nominated pods are re queued when the target node allocatable decreases, part of the InPlaceNodeResourceResize work. PodGroup scheduling also got e2e tests for Composite PodGroup scheduling.

On validation, declarative validation now runs on kubelet static pods (#143646), and the admission manifest loaders use a shared declarative validation helper. The apimachinery change to compile the wildcard DNS-1123 subdomain regexp once is a small allocation saver. The apiserver cacher code in cacher.go was also the most touched file, mostly with test changes.

The rest of the window is test flake fixes and generated files, so little to act on there.

What to watch

• Static pod manifests may now be rejected by declarative validation. Check your manifests before the next upgrade.
• Container runtimes should start filling Metric.double_value once it ships.
• Follow DynamicNodeLocalEphemeralVolumes and the kubelet volume checkpoint work for the next steps.