Kubernetes - v1.28.2

Changelog since v1.28.1

Changes by Kind

API Change

• Fixed a bug where CEL expressions in CRD validation rules would incorrectly compute a high estimated cost for functions that return strings, lists or maps.
  The incorrect cost was evident when the result of a function was used in subsequent operations. (#119807, @jpbetz) [SIG API Machinery, Auth and Cloud Provider]
• Mark Job onPodConditions as optional in pod failure policy (#120208, @mimowo) [SIG API Machinery and Apps]

Feature

• Kubernetes is now built with Go 1.20.8 (#120495, @cpanato) [SIG Release and Testing]

Bug or Regression

• Fix OpenAPI v3 not being cleaned up after deleting APIServices (#120108, @tnqn) [SIG API Machinery and Testing]
• Fix a 1.28 regression in scheduler: a pod with concurrent events could incorrectly get moved to the unschedulable queue where it could got stuck until the next periodic purging after 5 minutes if there was no other event for it. (#120445, @pohly) [SIG Scheduling]
• Fix a concurrent map access in TopologyCache's HasPopulatedHints method. (#120372, @Miciah) [SIG Network]
• Fixed a 1.26 regression scheduling bug by ensuring that preemption is skipped when a PreFilter plugin returns UnschedulableAndUnresolvable (#119951, @sanposhiho) [SIG Scheduling]
• Fixed a 1.27 scheduling regression that PostFilter plugin may not function if previous PreFilter plugins return Skip (#119942, @Huang-Wei) [SIG Scheduling and Testing]
• Fixed a 1.28 regression around restarting init containers in the right order relative to normal containers (#120440, @gjkim42) [SIG Node and Testing]
• Fixed a regression in default 1.27 configurations in kube-apiserver: fixed the AggregatedDiscoveryEndpoint feature (beta in 1.27+) to successfully fetch discovery information from aggregated API servers that do not check Accept headers when serving the /apis endpoint (#120359, @Jefftree) [SIG API Machinery]
• Fixes a 1.28 regression handling negative index json patches (#120329, @liggitt) [SIG API Machinery]
• Fixes a bug where images pinned by the container runtime can be garbage collected by kubelet. (#120053, @ruiwen-zhao) [SIG Node]
• Ignore context canceled from validate and mutate webhook (#120155, @divyasri537) [SIG API Machinery]
• Kubeadm: fix nil pointer when etcd member is already removed (#120010, @neolit123) [SIG Cluster Lifecycle]

Dependencies

Added

Nothing has changed.

Changed

• github.com/evanphx/json-patch: v5.6.0+incompatible → v4.12.0+incompatible
• github.com/google/cel-go: v0.16.0 → v0.16.1

Removed

Nothing has changed.