Merge branch 'main' into descheduler-steal-time

Author: SoWieMarkus

.github/workflows/check-alerts.yaml

@@ -5,6 +5,12 @@ on:
     paths:
       - '**/*.rules.yaml'
       - '**/*.alerts.yaml'
+      # Cortex core alert template and related files.
+      # These files are monitored for changes to trigger rendering and validation
+      # of cortex-core/templates/alerts.yaml with promtool.
+      - '**/cortex-core/templates/alerts.yaml'
+      - '**/ci/core-alert-values.yaml'
+      - '**/helm/render-alerts.sh'
 
 jobs:
   lint:
@@ -14,19 +20,42 @@ jobs:
       - name: Checkout PR
         uses: actions/checkout@v5
 
-      - name: Get changed rule and alert files
-        id: changed
-        uses: tj-actions/changed-files@v46
+      - name: Install Helm
+        uses: azure/setup-helm@v4
         with:
-          files: |
-            **/*.rules.yaml
-            **/*.alerts.yaml
+          version: '3.12.0'
+
+      - name: Install tools
+        run: |
+          # Install yq
+          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
+          sudo chmod +x /usr/local/bin/yq
+
+      - name: Render alert templates
+        run: |
+          chmod +x helm/render-alerts.sh
+          ./helm/render-alerts.sh
+
+      - name: Get all alert files (static + rendered)
+        id: alert-files
+        run: |
+          # Find static alert files
+          # Exclude rendered template files
+          static_files=$(find . -name "*.alerts.yaml" -o -name "*.rules.yaml" | grep -v rendered | tr '\n' ' ')
+
+          # Find rendered alert files
+          rendered_files=$(find . -path "*/rendered/alerts.yaml" | tr '\n' ' ')
+
+          # Combine all files
+          all_files="$static_files $rendered_files"
+          echo "files=$all_files" >> $GITHUB_OUTPUT
+          echo "Found alert files: $all_files"
 
       - name: Check changed rule and alert files via promtool
-        if: steps.changed.outputs.any_changed == 'true'
+        if: steps.alert-files.outputs.files != ''
         uses: peimanja/[email protected]
         with:
           promtool_actions_subcommand: 'rules'
-          promtool_actions_files: ${{ steps.changed.outputs.all_changed_files }}
+          promtool_actions_files: ${{ steps.alert-files.outputs.files }}
           promtool_actions_version: 'latest'
           promtool_actions_comment: 'false'

.github/workflows/push-images.yaml

@@ -64,7 +64,7 @@ jobs:
             GIT_COMMIT=${{ github.sha }}
       - name: Generate Artifact Attestation for Cortex Postgres
         if: steps.changed_postgres_files.outputs.all_changed_files != ''
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v3
         with:
           subject-name: ${{ env.REGISTRY }}/${{ github.repository }}-postgres
           subject-digest: ${{ steps.push_cortex_postgres.outputs.digest }}
@@ -93,7 +93,7 @@ jobs:
             GIT_TAG=${{ github.ref_name }}
             GIT_COMMIT=${{ github.sha }}
       - name: Generate Artifact Attestation for Cortex
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v3
         with:
           subject-name: ${{ env.REGISTRY }}/${{ github.repository }}
           subject-digest: ${{ steps.push_cortex.outputs.digest }}
@@ -134,7 +134,7 @@ jobs:
             GIT_COMMIT=${{ github.sha }}
       - name: Generate Artifact Attestation for Cortex Reservations
         if: steps.changed_reservations_files.outputs.all_changed_files != ''
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v3
         with:
           subject-name: ${{ env.REGISTRY }}/${{ github.repository }}-reservations-operator
           subject-digest: ${{ steps.push_cortex_reservations.outputs.digest }}

Dockerfile

@@ -1,10 +1,15 @@
 FROM golang:1.24.6-alpine3.21 AS builder
 
+ARG GOCACHE=/root/.cache/go-build
+ENV GOCACHE=${GOCACHE}
+
 RUN apk add --no-cache --no-progress ca-certificates gcc git make musl-dev
 
 COPY . /src
 ARG BININFO_BUILD_DATE BININFO_COMMIT_HASH BININFO_VERSION # provided to 'make install'
-RUN make -C /src install PREFIX=/pkg GOTOOLCHAIN=local
+RUN --mount=type=cache,target=/go/pkg/mod/ \
+    --mount=type=cache,target=${GOCACHE} \
+    make -C /src install PREFIX=/pkg GOTOOLCHAIN=local
 
 ################################################################################
 

Dockerfile.kubebuilder

@@ -4,6 +4,8 @@ ARG TARGETOS
 ARG TARGETARCH
 # Path of our go.mod
 ARG GO_MOD_PATH=.
+ARG GOCACHE=/root/.cache/go-build
+ENV GOCACHE=${GOCACHE}
 
 WORKDIR /workspace
 # Copy shared cortex code
@@ -12,14 +14,21 @@ COPY . /
 COPY ${GO_MOD_PATH} .
 # cache deps before building and copying source so that we don't need to re-download as much
 # and so that source changes don't invalidate our downloaded layer
-RUN go mod download
+RUN --mount=type=cache,target=/go/pkg/mod/ \
+    --mount=type=cache,target=${GOCACHE} \
+    go mod download
 
 # Build
 # the GOARCH has not a default value to allow the binary be built according to the host where the command
 # was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
 # the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
 # by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
-RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o manager cmd/main.go
+ENV CGO_ENABLED=0
+ENV GOOS=${TARGETOS:-linux}
+ENV GOARCH=${TARGETARCH}
+RUN --mount=type=cache,target=/go/pkg/mod/ \
+    --mount=type=cache,target=${GOCACHE} \
+    go build -a -o manager cmd/main.go
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details

commands/checks/cinder/checks.go

@@ -29,9 +29,8 @@ func checkCinderSchedulerReturnsValidHosts(ctx context.Context, config conf.Conf
 	//
 
 	request := api.ExternalSchedulerRequest{
-		Hosts:     []api.ExternalSchedulerHost{},
-		Weights:   map[string]float64{},
-		Sandboxed: true,
+		Hosts:   []api.ExternalSchedulerHost{},
+		Weights: map[string]float64{},
 	}
 	port := strconv.Itoa(config.GetAPIConfig().Port)
 	apiURL := "http://cortex-cinder-scheduler:" + port + "/scheduler/cinder/external"

commands/checks/manila/checks.go

@@ -71,9 +71,8 @@ func checkManilaSchedulerReturnsValidHosts(ctx context.Context, config conf.Conf
 		})
 	}
 	request := api.ExternalSchedulerRequest{
-		Hosts:     hosts,
-		Weights:   weights,
-		Sandboxed: true,
+		Hosts:   hosts,
+		Weights: weights,
 	}
 	port := strconv.Itoa(config.GetAPIConfig().Port)
 	apiURL := "http://cortex-manila-scheduler:" + port + "/scheduler/manila/external"

commands/checks/nova/checks.go

@@ -7,6 +7,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"fmt"
 	"io"
 	"log/slog"
 	"math/rand"
@@ -22,7 +23,6 @@ import (
 	"github.com/gophercloud/gophercloud/v2/openstack"
 	"github.com/gophercloud/gophercloud/v2/openstack/compute/v2/aggregates"
 	"github.com/gophercloud/gophercloud/v2/openstack/compute/v2/flavors"
-	"github.com/gophercloud/gophercloud/v2/openstack/compute/v2/hypervisors"
 	"github.com/gophercloud/gophercloud/v2/openstack/identity/v3/domains"
 	"github.com/gophercloud/gophercloud/v2/openstack/identity/v3/projects"
 	"github.com/sapcc/go-bits/must"
@@ -43,6 +43,52 @@ type datacenter struct {
 	azs         []string
 }
 
+// Get hypervisors from openstack nova.
+// Note: currently we need to fetch this without gophercloud.
+// Gophercloud will just assume the request is a single page even when
+// the response is paginated, returning only the first page.
+func getHypervisors(ctx context.Context, sc *gophercloud.ServiceClient) ([]nova.Hypervisor, error) {
+	initialURL := sc.Endpoint + "os-hypervisors/detail"
+	var nextURL = &initialURL
+	var hypervisors []nova.Hypervisor
+	for nextURL != nil {
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, *nextURL, http.NoBody)
+		if err != nil {
+			return nil, err
+		}
+		req.Header.Set("X-Auth-Token", sc.Token())
+		req.Header.Set("X-OpenStack-Nova-API-Version", sc.Microversion)
+		resp, err := sc.HTTPClient.Do(req)
+		if err != nil {
+			return nil, err
+		}
+		defer resp.Body.Close()
+		if resp.StatusCode != http.StatusOK {
+			return nil, fmt.Errorf("unexpected status code: %d", resp.StatusCode)
+		}
+		var list struct {
+			Hypervisors []nova.Hypervisor `json:"hypervisors"`
+			Links       []struct {
+				Rel  string `json:"rel"`
+				Href string `json:"href"`
+			} `json:"hypervisors_links"`
+		}
+		err = json.NewDecoder(resp.Body).Decode(&list)
+		if err != nil {
+			return nil, err
+		}
+		hypervisors = append(hypervisors, list.Hypervisors...)
+		nextURL = nil
+		for _, link := range list.Links {
+			if link.Rel == "next" {
+				nextURL = &link.Href
+				break
+			}
+		}
+	}
+	return hypervisors, nil
+}
+
 // Prepare the test by fetching the necessary data from OpenStack.
 func prepare(ctx context.Context, config conf.Config) datacenter {
 	keystoneConf := config.GetKeystoneConfig()
@@ -79,20 +125,15 @@ func prepare(ctx context.Context, config conf.Config) datacenter {
 	slog.Info("nova endpoint found", "novaURL", novaURL)
 
 	slog.Info("listing hypervisors")
-	pages := must.Return(hypervisors.List(novaSC, hypervisors.ListOpts{}).AllPages(ctx))
-	var dataHypervisors = &struct {
-		Hypervisors []nova.Hypervisor `json:"hypervisors"`
-	}{}
-	must.Succeed(pages.(hypervisors.HypervisorPage).ExtractInto(dataHypervisors))
-	hypervisors := dataHypervisors.Hypervisors
+	hypervisors := must.Return(getHypervisors(ctx, novaSC))
 	if len(hypervisors) == 0 {
 		panic("no hypervisors found")
 	}
 	slog.Info("found hypervisors", "count", len(hypervisors))
 
 	slog.Info("listing flavors")
 	flo := flavors.ListOpts{AccessType: flavors.AllAccess}
-	pages = must.Return(flavors.ListDetail(novaSC, flo).AllPages(ctx))
+	pages := must.Return(flavors.ListDetail(novaSC, flo).AllPages(ctx))
 	dataFlavors := &struct {
 		Flavors []nova.Flavor `json:"flavors"`
 	}{}
@@ -242,9 +283,8 @@ func randomRequest(dc datacenter, seed int) api.ExternalSchedulerRequest {
 				"domain_name": []string{domain.Name},
 			},
 		}},
-		Hosts:     hosts,
-		Weights:   weights,
-		Sandboxed: true,
+		Hosts:   hosts,
+		Weights: weights,
 	}
 	return request
 }

commands/replay/main.go

@@ -34,7 +34,7 @@ func main() {
 	password := flag.String("p", "secret", "The password to use for the MQTT connection")
 	schedulerType := flag.String("scheduler", "nova", "The scheduler to use (nova/manila)")
 	sink := flag.String("s", "", "The http endpoint to forward to")
-	sandboxed := flag.Bool("sandboxed", false, "Replay the request in sandbox mode (default: false)")
+	pipeline := flag.String("pipeline", "default", "The pipeline to use (default: 'default')")
 	help := flag.Bool("help", false, "Show this help message")
 	flag.Usage = func() {
 		fmt.Fprintf(flag.CommandLine.Output(), "Usage: %s [options]\n", os.Args[0])
@@ -85,7 +85,7 @@ func main() {
 			req = data.Request
 		}
 
-		req = req.WithSandboxed(*sandboxed)
+		req = req.WithPipeline(*pipeline)
 		for {
 			// Forward the request to the local Cortex instance
 			requestBody := must.Return(json.Marshal(req))

go.mod

@@ -2,7 +2,7 @@ module github.com/cobaltcore-dev/cortex
 
 go 1.24.0
 
-toolchain go1.24.2
+toolchain go1.25.0
 
 replace (
 	github.com/cobaltcore-dev/cortex/commands => ./commands
@@ -21,8 +21,8 @@ require (
 	github.com/ory/dockertest v3.3.5+incompatible
 	github.com/prometheus/client_golang v1.23.0
 	github.com/prometheus/client_model v0.6.2
-	github.com/sapcc/go-api-declarations v1.17.3
-	github.com/sapcc/go-bits v0.0.0-20250820140623-085431e07de8
+	github.com/sapcc/go-api-declarations v1.17.4
+	github.com/sapcc/go-bits v0.0.0-20250828142518-d29beaf1bcca
 	go.uber.org/automaxprocs v1.6.0
 )
 
@@ -34,18 +34,18 @@ require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
-	github.com/fsnotify/fsnotify v1.7.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/go-sql-driver/mysql v1.9.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/btree v1.1.3 // indirect
-	github.com/google/gnostic-models v0.6.9 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gotestyourself/gotestyourself v2.2.0+incompatible // indirect
@@ -54,16 +54,19 @@ require (
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/opencontainers/runc v1.3.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/poy/onpar v1.1.2 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/spf13/pflag v1.0.6 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/ziutek/mymysql v1.5.4 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/net v0.43.0 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
 	golang.org/x/term v0.34.0 // indirect
@@ -74,16 +77,16 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	gotest.tools v2.2.0+incompatible // indirect
-	k8s.io/api v0.33.0 // indirect
-	k8s.io/apiextensions-apiserver v0.33.0 // indirect
-	k8s.io/client-go v0.33.0 // indirect
+	k8s.io/api v0.34.0 // indirect
+	k8s.io/apiextensions-apiserver v0.34.0 // indirect
+	k8s.io/client-go v0.34.0 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )
 
 require (
@@ -99,11 +102,10 @@ require (
 	github.com/prometheus/common v0.65.0 // indirect
 	github.com/prometheus/procfs v0.17.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
-	go.opentelemetry.io/otel/trace v1.35.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	golang.org/x/sync v0.16.0 // indirect
 	golang.org/x/sys v0.35.0 // indirect
 	google.golang.org/protobuf v1.36.7 // indirect
-	k8s.io/apimachinery v0.33.4
-	sigs.k8s.io/controller-runtime v0.21.0
+	k8s.io/apimachinery v0.34.0
+	sigs.k8s.io/controller-runtime v0.22.0
 )