Update pause image to v3.5

Update dependencies and the test images to use pause 3.5. We also
provide a changelog entry for the new container image version.

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>

build/dependencies.yaml

@@ -166,7 +166,7 @@ dependencies:
       match: TAG =
 
   - name: "k8s.gcr.io/pause: dependents"
-    version: 3.4.1
+    version: 3.5
     refPaths:
     - path: cmd/kubeadm/app/constants/constants.go
       match: PauseVersion\s+=
@@ -215,7 +215,7 @@ dependencies:
     - path: test/utils/runners.go
       match: k8s.gcr.io\/pause:\d+\.\d+
     - path: test/utils/image/manifest.go
-      match: configs\[Pause\] = Config{list\.GcRegistry, "pause", "\d+\.\d+.\d+"}
+      match: configs\[Pause\] = Config{list\.GcRegistry, "pause", "\d+\.\d+(.\d+)?"}
 
   # metadata-concealment: bump this one first
   - name: "metadata-concealment"

build/pause/CHANGELOG.md

@@ -1,3 +1,7 @@
+# 3.5
+
+* Run the container image as non root user per default ([#97963](https://github.com/kubernetes/kubernetes/pull/97963))
+
 # 3.4.1
 
 * Support for Windows container images (OS Versions: 20H2) was added.([#97322](https://prs.k8s.io/97322), [@claudiubelu](https://github.com/claudiubelu))

cluster/gce/config-common.sh

@@ -160,7 +160,7 @@ export WINDOWS_KUBEPROXY_KUBECONFIG_FILE="${WINDOWS_K8S_DIR}\kubeproxy.kubeconfi
 # Path for kube-proxy kubeconfig file on Windows nodes.
 export WINDOWS_NODEPROBLEMDETECTOR_KUBECONFIG_FILE="${WINDOWS_K8S_DIR}\node-problem-detector.kubeconfig"
 # Pause container image for Windows container.
-export WINDOWS_INFRA_CONTAINER="k8s.gcr.io/pause:3.4.1"
+export WINDOWS_INFRA_CONTAINER="k8s.gcr.io/pause:3.5"
 # Storage Path for csi-proxy. csi-proxy only needs to be installed for Windows.
 export CSI_PROXY_STORAGE_PATH="https://storage.googleapis.com/gke-release/csi-proxy"
 # Version for csi-proxy

cluster/gce/windows/smoke-test.sh

@@ -358,7 +358,7 @@ spec:
     spec:
       containers:
       - name: pause-win
-        image: k8s.gcr.io/pause:3.4.1
+        image: k8s.gcr.io/pause:3.5
       nodeSelector:
         kubernetes.io/os: windows
       tolerations:

cmd/kubeadm/app/constants/constants.go

@@ -394,7 +394,7 @@ const (
 	ModeNode string = "Node"
 
 	// PauseVersion indicates the default pause image version for kubeadm
-	PauseVersion = "3.4.1"
+	PauseVersion = "3.5"
 
 	// CgroupDriverSystemd holds the systemd driver type
 	CgroupDriverSystemd = "systemd"

cmd/kubeadm/app/phases/kubelet/flags_test.go

@@ -119,11 +119,11 @@ func TestBuildKubeletArgMap(t *testing.T) {
 				nodeRegOpts: &kubeadmapi.NodeRegistrationOptions{
 					CRISocket: "/var/run/dockershim.sock",
 				},
-				pauseImage: "gcr.io/pause:3.4.1",
+				pauseImage: "gcr.io/pause:3.5",
 			},
 			expected: map[string]string{
 				"network-plugin":            "cni",
-				"pod-infra-container-image": "gcr.io/pause:3.4.1",
+				"pod-infra-container-image": "gcr.io/pause:3.5",
 			},
 		},
 	}

cmd/kubeadm/app/util/template_test.go

@@ -21,9 +21,9 @@ import (
 )
 
 const (
-	validTmpl    = "image: {{ .ImageRepository }}/pause:3.4.1"
+	validTmpl    = "image: {{ .ImageRepository }}/pause:3.5"
-	validTmplOut = "image: k8s.gcr.io/pause:3.4.1"
+	validTmplOut = "image: k8s.gcr.io/pause:3.5"
-	doNothing    = "image: k8s.gcr.io/pause:3.4.1"
+	doNothing    = "image: k8s.gcr.io/pause:3.5"
 	invalidTmpl1 = "{{ .baz }/d}"
 	invalidTmpl2 = "{{ !foobar }}"
 )

cmd/kubelet/app/options/container_runtime.go

@@ -28,7 +28,7 @@ import (
 const (
 	// When these values are updated, also update test/utils/image/manifest.go
 	defaultPodSandboxImageName    = "k8s.gcr.io/pause"
-	defaultPodSandboxImageVersion = "3.4.1"
+	defaultPodSandboxImageVersion = "3.5"
 )
 
 var (

hack/testdata/filter/pod-apply-selector.yaml

@@ -8,4 +8,4 @@ metadata:
 spec:
   containers:
   - name: kubernetes-pause
-    image: k8s.gcr.io/pause:3.4.1
+    image: k8s.gcr.io/pause:3.5

hack/testdata/filter/pod-dont-apply.yaml

@@ -8,4 +8,4 @@ metadata:
 spec:
   containers:
   - name: kubernetes-pause
-    image: k8s.gcr.io/pause:3.4.1
+    image: k8s.gcr.io/pause:3.5

hack/testdata/multi-resource-1.yaml

@@ -11,7 +11,7 @@ metadata:
 spec:
   containers:
   - name: kubernetes-pause
-    image: k8s.gcr.io/pause:3.4.1
+    image: k8s.gcr.io/pause:3.5
 ---
 apiVersion: v1
 kind: Namespace

hack/testdata/multi-resource-3.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   containers:
   - name: kubernetes-pause
-    image: k8s.gcr.io/pause:3.4.1
+    image: k8s.gcr.io/pause:3.5
 ---
 apiVersion: v1
 kind: Pod
@@ -17,7 +17,7 @@ metadata:
 spec:
   containers:
   - name: kubernetes-pause
-    image: k8s.gcr.io/pause:3.4.1
+    image: k8s.gcr.io/pause:3.5
 ---
 apiVersion: v1
 kind: Pod
@@ -26,5 +26,5 @@ metadata:
 spec:
   containers:
   - name: kubernetes-pause
-    image: k8s.gcr.io/pause:3.4.1
+    image: k8s.gcr.io/pause:3.5
 

hack/testdata/multi-resource-json-modify.json

@@ -43,7 +43,7 @@
        "spec":{
          "containers":[{
            "name": "mock-container",
-           "image": "k8s.gcr.io/pause:3.4.1",
+           "image": "k8s.gcr.io/pause:3.5",
            "ports":[{
              "containerPort":9949,
              "protocol":"TCP"

hack/testdata/multi-resource-json.json

@@ -41,7 +41,7 @@
        "spec":{
          "containers":[{
            "name": "mock-container",
-           "image": "k8s.gcr.io/pause:3.4.1",
+           "image": "k8s.gcr.io/pause:3.5",
            "ports":[{
              "containerPort":9949,
              "protocol":"TCP"

hack/testdata/multi-resource-list-modify.json

@@ -47,7 +47,7 @@
                "spec":{
                   "containers":[{
                     "name": "mock-container",
-                    "image": "k8s.gcr.io/pause:3.4.1",
+                    "image": "k8s.gcr.io/pause:3.5",
                     "ports":[{
                         "containerPort":9949,
                         "protocol":"TCP"

hack/testdata/multi-resource-list.json

@@ -45,7 +45,7 @@
                "spec":{
                   "containers":[{
                     "name": "mock-container",
-                    "image": "k8s.gcr.io/pause:3.4.1",
+                    "image": "k8s.gcr.io/pause:3.5",
                     "ports":[{
                         "containerPort":9949,
                         "protocol":"TCP"

hack/testdata/multi-resource-rclist-modify.json

@@ -26,7 +26,7 @@
                "spec":{
                   "containers":[{
                     "name": "mock-container",
-                    "image": "k8s.gcr.io/pause:3.4.1",
+                    "image": "k8s.gcr.io/pause:3.5",
                     "ports":[{
                         "containerPort":9949,
                         "protocol":"TCP"
@@ -60,7 +60,7 @@
             "spec":{
               "containers":[{
                 "name": "mock-container",
-                "image": "k8s.gcr.io/pause:3.4.1",
+                "image": "k8s.gcr.io/pause:3.5",
                 "ports":[{
                   "containerPort":9949,
                   "protocol":"TCP"

hack/testdata/multi-resource-rclist.json

@@ -26,7 +26,7 @@
                "spec":{
                   "containers":[{
                     "name": "mock-container",
-                    "image": "k8s.gcr.io/pause:3.4.1",
+                    "image": "k8s.gcr.io/pause:3.5",
                     "ports":[{
                         "containerPort":9949,
                         "protocol":"TCP"
@@ -60,7 +60,7 @@
             "spec":{
               "containers":[{
                 "name": "mock-container",
-                "image": "k8s.gcr.io/pause:3.4.1",
+                "image": "k8s.gcr.io/pause:3.5",
                 "ports":[{
                   "containerPort":9949,
                   "protocol":"TCP"

hack/testdata/multi-resource-yaml-modify.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
       - name: mock-container
-        image: k8s.gcr.io/pause:3.4.1
+        image: k8s.gcr.io/pause:3.5
         ports:
         - containerPort: 9949
           protocol: TCP

hack/testdata/multi-resource-yaml.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
       - name: mock-container
-        image: k8s.gcr.io/pause:3.4.1
+        image: k8s.gcr.io/pause:3.5
         ports:
         - containerPort: 9949
           protocol: TCP

hack/testdata/pod-apply.yaml

@@ -7,4 +7,4 @@ metadata:
 spec:
   containers:
   - name: kubernetes-pause
-    image: k8s.gcr.io/pause:3.4.1
+    image: k8s.gcr.io/pause:3.5

hack/testdata/pod-with-precision.json

@@ -9,7 +9,7 @@
     "containers": [
       {
         "name": "kubernetes-pause",
-        "image": "k8s.gcr.io/pause:3.4.1"
+        "image": "k8s.gcr.io/pause:3.5"
       }
     ],
     "restartPolicy": "Never",

hack/testdata/pod.yaml

@@ -7,4 +7,4 @@ metadata:
 spec:
   containers:
   - name: kubernetes-pause
-    image: k8s.gcr.io/pause:3.4.1
+    image: k8s.gcr.io/pause:3.5

hack/testdata/prune/a.yaml

@@ -7,4 +7,4 @@ metadata:
 spec:
   containers:
   - name: kubernetes-pause
-    image: k8s.gcr.io/pause:3.4.1
+    image: k8s.gcr.io/pause:3.5

hack/testdata/prune/b.yaml

@@ -8,4 +8,4 @@ metadata:
 spec:
   containers:
   - name: kubernetes-pause
-    image: k8s.gcr.io/pause:3.4.1
+    image: k8s.gcr.io/pause:3.5

hack/testdata/sorted-pods/sorted-pod1.yaml

@@ -8,4 +8,4 @@ metadata:
 spec:
   containers:
   - name: kubernetes-pause2
-    image: k8s.gcr.io/pause:3.4.1
+    image: k8s.gcr.io/pause:3.5

hack/testdata/sorted-pods/sorted-pod2.yaml

@@ -8,4 +8,4 @@ metadata:
 spec:
   containers:
   - name: kubernetes-pause1
-    image: k8s.gcr.io/pause:3.4.1
+    image: k8s.gcr.io/pause:3.5

hack/testdata/sorted-pods/sorted-pod3.yaml

@@ -8,4 +8,4 @@ metadata:
 spec:
   containers:
   - name: kubernetes-pause3
-    image: k8s.gcr.io/pause:3.4.1
+    image: k8s.gcr.io/pause:3.5

pkg/kubelet/dockershim/docker_sandbox.go

@@ -40,7 +40,7 @@ import (
 )
 
 const (
-	defaultSandboxImage = "k8s.gcr.io/pause:3.4.1"
+	defaultSandboxImage = "k8s.gcr.io/pause:3.5"
 
 	// Various default sandbox resources requests/limits.
 	defaultSandboxCPUshares int64 = 2

staging/src/k8s.io/kubectl/testdata/set/multi-resource-yaml.yaml

@@ -13,7 +13,7 @@ spec:
     spec:
       containers:
       - name: mock-container
-        image: k8s.gcr.io/pause:3.4.1
+        image: k8s.gcr.io/pause:3.5
 ---
 apiVersion: v1
 kind: ReplicationController
@@ -30,4 +30,4 @@ spec:
     spec:
       containers:
       - name: mock-container
-        image: k8s.gcr.io/pause:3.4.1
+        image: k8s.gcr.io/pause:3.5

staging/src/k8s.io/kubectl/testdata/set/namespaced-resource.yaml

@@ -14,4 +14,4 @@ spec:
     spec:
       containers:
       - name: mock-container
-        image: k8s.gcr.io/pause:3.4.1
+        image: k8s.gcr.io/pause:3.5

test/cmd/core.sh

@@ -537,9 +537,9 @@ run_pod_tests() {
   kube::test::get_object_assert pods "{{range.items}}{{$image_field}}:{{end}}" 'changed-with-yaml:'
   ## Patch pod from JSON can change image
   # Command
-  kubectl patch "${kube_flags[@]}" -f test/fixtures/doc-yaml/admin/limitrange/valid-pod.yaml -p='{"spec":{"containers":[{"name": "kubernetes-serve-hostname", "image": "k8s.gcr.io/pause:3.4.1"}]}}'
+  kubectl patch "${kube_flags[@]}" -f test/fixtures/doc-yaml/admin/limitrange/valid-pod.yaml -p='{"spec":{"containers":[{"name": "kubernetes-serve-hostname", "image": "k8s.gcr.io/pause:3.5"}]}}'
   # Post-condition: valid-pod POD has expected image
-  kube::test::get_object_assert pods "{{range.items}}{{$image_field}}:{{end}}" 'k8s.gcr.io/pause:3.4.1:'
+  kube::test::get_object_assert pods "{{range.items}}{{$image_field}}:{{end}}" 'k8s.gcr.io/pause:3.5:'
 
   # pod has field for kubectl patch field manager
   output_message=$(kubectl get pod valid-pod -o=jsonpath='{.metadata.managedFields[*].manager}' "${kube_flags[@]:?}" 2>&1)

test/e2e/testing-manifests/scheduling/nvidia-driver-installer.yaml

@@ -81,6 +81,6 @@ spec:
         - name: root-mount
           mountPath: /root
       containers:
-      - image: "k8s.gcr.io/pause:3.4.1"
+      - image: "k8s.gcr.io/pause:3.5"
         name: pause
 

test/fixtures/pkg/kubectl/cmd/set/multi-resource-yaml.yaml

@@ -13,7 +13,7 @@ spec:
     spec:
       containers:
       - name: mock-container
-        image: k8s.gcr.io/pause:3.4.1
+        image: k8s.gcr.io/pause:3.5
 ---
 apiVersion: v1
 kind: ReplicationController
@@ -30,4 +30,4 @@ spec:
     spec:
       containers:
       - name: mock-container
-        image: k8s.gcr.io/pause:3.4.1
+        image: k8s.gcr.io/pause:3.5

test/fixtures/pkg/kubectl/cmd/set/namespaced-resource.yaml

@@ -14,4 +14,4 @@ spec:
     spec:
       containers:
       - name: mock-container
-        image: k8s.gcr.io/pause:3.4.1
+        image: k8s.gcr.io/pause:3.5

test/integration/benchmark-controller.json

@@ -17,7 +17,7 @@
        "spec": {
            "containers": [{
              "name": "test-container",
-             "image": "k8s.gcr.io/pause:3.4.1"
+             "image": "k8s.gcr.io/pause:3.5"
            }]
        }
     }

test/integration/scheduler_perf/config/churn/pod-default.yaml

@@ -4,5 +4,5 @@ metadata:
   generateName: pod-churn-
 spec:
   containers:
-  - image: k8s.gcr.io/pause:3.4.1
+  - image: k8s.gcr.io/pause:3.5
     name: pause

test/integration/scheduler_perf/config/pod-default.yaml

@@ -4,7 +4,7 @@ metadata:
   generateName: pod-
 spec:
   containers:
-  - image: k8s.gcr.io/pause:3.4.1
+  - image: k8s.gcr.io/pause:3.5
     name: pause
     ports:
     - containerPort: 80

test/integration/scheduler_perf/config/pod-high-priority.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   priority: 10
   containers:
-  - image: k8s.gcr.io/pause:3.4.1
+  - image: k8s.gcr.io/pause:3.5
     name: pause
     ports:
     - containerPort: 80

test/integration/scheduler_perf/config/pod-large-cpu.yaml

@@ -4,7 +4,7 @@ metadata:
   generateName: pod-
 spec:
   containers:
-  - image: k8s.gcr.io/pause:3.4.1
+  - image: k8s.gcr.io/pause:3.5
     name: pause
     ports:
     - containerPort: 80

test/integration/scheduler_perf/config/pod-low-priority.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   terminationGracePeriodSeconds: 0
   containers:
-  - image: k8s.gcr.io/pause:3.4.1
+  - image: k8s.gcr.io/pause:3.5
     name: pause
     ports:
     - containerPort: 80

test/integration/scheduler_perf/config/pod-with-node-affinity.yaml

@@ -14,7 +14,7 @@ spec:
             - zone1
             - zone2
   containers:
-  - image: k8s.gcr.io/pause:3.4.1
+  - image: k8s.gcr.io/pause:3.5
     name: pause
     ports:
     - containerPort: 80

test/integration/scheduler_perf/config/pod-with-pod-affinity.yaml

@@ -14,7 +14,7 @@ spec:
         topologyKey: topology.kubernetes.io/zone
         namespaces: ["sched-test", "sched-setup"]
   containers:
-  - image: k8s.gcr.io/pause:3.4.1
+  - image: k8s.gcr.io/pause:3.5
     name: pause
     ports:
     - containerPort: 80

test/integration/scheduler_perf/config/pod-with-pod-anti-affinity.yaml

@@ -14,7 +14,7 @@ spec:
         topologyKey: kubernetes.io/hostname
         namespaces: ["sched-test", "sched-setup"]
   containers:
-  - image: k8s.gcr.io/pause:3.4.1
+  - image: k8s.gcr.io/pause:3.5
     name: pause
     ports:
     - containerPort: 80

test/integration/scheduler_perf/config/pod-with-preferred-pod-affinity.yaml

@@ -16,7 +16,7 @@ spec:
             namespaces: ["sched-test", "sched-setup"]
           weight: 1
   containers:
-    - image: k8s.gcr.io/pause:3.4.1
+    - image: k8s.gcr.io/pause:3.5
       name: pause
       ports:
         - containerPort: 80

test/integration/scheduler_perf/config/pod-with-preferred-pod-anti-affinity.yaml

@@ -16,7 +16,7 @@ spec:
             namespaces: ["sched-test", "sched-setup"]
           weight: 1
   containers:
-    - image: k8s.gcr.io/pause:3.4.1
+    - image: k8s.gcr.io/pause:3.5
       name: pause
       ports:
         - containerPort: 80

test/integration/scheduler_perf/config/pod-with-preferred-topology-spreading.yaml

@@ -13,7 +13,7 @@ spec:
         matchLabels:
           color: blue
   containers:
-  - image: k8s.gcr.io/pause:3.4.1
+  - image: k8s.gcr.io/pause:3.5
     name: pause
     ports:
     - containerPort: 80

test/integration/scheduler_perf/config/pod-with-secret-volume.yaml

@@ -4,7 +4,7 @@ metadata:
   generateName: secret-volume-
 spec:
   containers:
-  - image: k8s.gcr.io/pause:3.4.1
+  - image: k8s.gcr.io/pause:3.5
     name: pause
     ports:
     - containerPort: 80

test/integration/scheduler_perf/config/pod-with-topology-spreading.yaml

@@ -13,7 +13,7 @@ spec:
         matchLabels:
           color: blue
   containers:
-  - image: k8s.gcr.io/pause:3.4.1
+  - image: k8s.gcr.io/pause:3.5
     name: pause
     ports:
     - containerPort: 80

test/utils/image/manifest.go

@@ -232,7 +232,7 @@ func initImageConfigs(list RegistryList) (map[int]Config, map[int]Config) {
 	configs[Nonewprivs] = Config{list.PromoterE2eRegistry, "nonewprivs", "1.3"}
 	configs[NonRoot] = Config{list.PromoterE2eRegistry, "nonroot", "1.1"}
 	// Pause - when these values are updated, also update cmd/kubelet/app/options/container_runtime.go
-	configs[Pause] = Config{list.GcRegistry, "pause", "3.4.1"}
+	configs[Pause] = Config{list.GcRegistry, "pause", "3.5"}
 	configs[Perl] = Config{list.PromoterE2eRegistry, "perl", "5.26"}
 	configs[PrometheusDummyExporter] = Config{list.GcRegistry, "prometheus-dummy-exporter", "v0.1.0"}
 	configs[PrometheusToSd] = Config{list.GcRegistry, "prometheus-to-sd", "v0.5.0"}

test/utils/runners.go

@@ -1303,7 +1303,7 @@ func MakePodSpec() v1.PodSpec {
 	return v1.PodSpec{
 		Containers: []v1.Container{{
 			Name:  "pause",
-			Image: "k8s.gcr.io/pause:3.4.1",
+			Image: "k8s.gcr.io/pause:3.5",
 			Ports: []v1.ContainerPort{{ContainerPort: 80}},
 			Resources: v1.ResourceRequirements{
 				Limits: v1.ResourceList{
@@ -1725,7 +1725,7 @@ type DaemonConfig struct {
 
 func (config *DaemonConfig) Run() error {
 	if config.Image == "" {
-		config.Image = "k8s.gcr.io/pause:3.4.1"
+		config.Image = "k8s.gcr.io/pause:3.5"
 	}
 	nameLabel := map[string]string{
 		"name": config.Name + "-daemon",