Skip to content

Update Helm release descheduler to v0.35.1#1993

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/descheduler-0.x
Closed

Update Helm release descheduler to v0.35.1#1993
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/descheduler-0.x

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 13, 2026

This PR contains the following updates:

Package Update Change
descheduler minor 0.34.0 → 0.35.1

Release Notes

kubernetes-sigs/descheduler (descheduler)

v0.35.1: Descheduler v0.35.1

Compare Source

What's Changed

  • fix(ci): pin helm-unittest plugin version and bump chart-testing-action by @​a7i in #​1834
  • [v0.35.0] update helm chart by @​a7i in #​1835
  • Automated cherry pick of #​1836: Synchronize helm clusterrole RBAC with base yaml
    #​1826: Add init containers support to Helm chart
    #​1838: Change icon URL in Chart.yaml
    #​1842: fix: resolve detected data races
    #​1847: fix(ci): upgrade codeql-action to v4 and clean up security
    #​1848: update go dependencies
    #​1844: Extend PodLifeTime with condition, exit code, owner kind, by @​a7i in #​1850

Full Changelog: kubernetes-sigs/descheduler@v0.35.0...v0.35.1

v0.35.0: Descheduler v0.35.0

Compare Source

What's Changed

New Contributors

Full Changelog: kubernetes-sigs/descheduler@v0.34.0...v0.35.0

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • "after 2am and before 8am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the renovate label Apr 13, 2026
@renovate renovate Bot requested a review from claytono as a code owner April 13, 2026 06:05
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 13, 2026 •
edited
Loading

descheduler (helm) 0.34.0 -> 0.35.1

Risk: 🟢 Safe

The Deep Dive

Update Scope

Helm chart descheduler updating from 0.34.0 to 0.35.1 (minor + patch). This updates both the chart scaffolding and the descheduler app image from v0.34.0 to v0.35.1 — there is no kustomize image override, so the deployed container version changes. The only file modified is kubernetes/descheduler/Chart.yaml (version pin bump). Rendered Helm templates will be regenerated by CI.

Performance & Stability

  • Node indexer optimization — replaces listing nodes with a global node selector by registering a node indexer, improving performance for node lookups (#1802)
  • Data race fix — resolves detected data races in unit testing, improving runtime stability (#1842, cherry-picked into v0.35.1)
  • Profiles created outside descheduling cycle — reduces per-cycle overhead by building profiles once rather than on every run (#1815)

Features & UX

  • Storage class pod protection (#1752) — protects pods using specific storage classes from eviction. Not configured — requires podProtections.extraEnabled: [PodsWithPVC] in DefaultEvictor args. To enable, add podProtections config to DefaultEvictor plugin args in values.yaml.
  • Namespace label selector (#1786) — filters pods by namespace labels in DefaultEvictor. Not configured — requires namespaceLabelSelector in DefaultEvictor args.
  • PodLifeTime extensions (#1844, cherry-picked into v0.35.1) — adds conditions, exitCodes, ownerKinds, and transition-time filters. Not configured — current PodLifeTime config uses only maxPodLifeTimeSeconds and states, which remain unchanged. To enable, add fields under the PodLifeTime args in values.yaml: conditions (array of {type, status, reason, minTimeSinceLastTransitionSeconds}), exitCodes (array of integers), or ownerKinds with include/exclude lists.
  • Init containers Helm support (#1826) — adds initContainers field to Helm values. Not configured — opt-in via initContainers in values.yaml.

Security

This update resolves pre-existing Go module vulnerabilities bundled in the descheduler binary. The modules updated in #1822 include golang.org/x/crypto (v0.38.0 → v0.47.0) and golang.org/x/net (v0.40.0 → v0.49.0).

golang.org/x/net (fixed in v0.45.0): CVE-2025-47911 (quadratic parsing complexity in x/net/html) and CVE-2025-58190 (infinite parsing loop in x/net/html). Not affected — both are in the x/net/html package; the descheduler does not parse HTML.

golang.org/x/crypto (fixed in v0.45.0): CVE-2025-58181 (unbounded memory consumption in x/crypto/ssh), GHSA-f6x5-jh6r-wrfv (panic in x/crypto/ssh/agent), and GO-2025-4135 (DoS in x/crypto/ssh/agent). Not affected — all are in the x/crypto/ssh package; the descheduler does not use SSH.

All five CVEs are pre-existing (present in v0.34.0) and resolved by v0.35.1. None are in code paths used by the descheduler, so they do not affect the risk assessment.

Key Fixes

  • RBAC sync for PVC permissions (#1836, cherry-picked into v0.35.1) — The v0.35.0 app introduced a PVC informer (for storage class protection) but the Helm chart's ClusterRole was missing persistentvolumeclaims get/watch/list permissions. Without this fix, v0.35.0 logged permission errors: persistentvolumeclaims is forbidden. The v0.35.1 chart adds these RBAC rules. The current deployment's ClusterRole will gain PVC permissions after re-rendering — this is expected and harmless.
  • Native sidecar resource calculation (#1771) — fixes pod resource calculation to properly account for Kubernetes native sidecar containers, which could have caused incorrect eviction decisions on pods with init containers using restartPolicy: Always.

Newer Versions

v0.35.1 is the latest release (released 2026-03-09). No newer versions exist.

Hazards & Risks

None identified. All new features (storage class protection, namespace label selector, PodLifeTime extensions, init containers) are opt-in and require explicit configuration to activate. The user's existing config keys (maxPodLifeTimeSeconds, states, podRestartThreshold, evictLocalStoragePods, metricsUtilization) are unchanged in behavior. The only structural change to deployed manifests is the addition of PVC RBAC permissions in the ClusterRole, which prevents log errors from the PVC informer introduced in v0.35.0.

Sources

🟢 Verdict: Safe

Straightforward minor update with no breaking changes. All new features are opt-in, the RBAC fix for PVC permissions is needed and ships automatically, and the user's existing config requires no modifications.

@renovate renovate Bot force-pushed the renovate/descheduler-0.x branch 18 times, most recently from d4aa9bd to 9616481 Compare April 13, 2026 18:23
@renovate renovate Bot force-pushed the renovate/descheduler-0.x branch from c7d12f2 to 15dc1a0 Compare April 13, 2026 18:38
@claytono
Copy link
Copy Markdown
Owner

claytono commented Apr 13, 2026

Closing — v0.35.1 does not fix the LowNodeUtilization Prometheus regression (upstream issue kubernetes-sigs/descheduler#1840 still open). Local tracker: #1647. Will re-evaluate when upstream lands a fix.

@claytono claytono closed this Apr 13, 2026
@renovate
Copy link
Copy Markdown
Contributor Author

renovate Bot commented Apr 13, 2026

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (0.35.1). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate renovate Bot deleted the renovate/descheduler-0.x branch April 13, 2026 18:40
@claytono claytono restored the renovate/descheduler-0.x branch April 13, 2026 18:41
@renovate renovate Bot deleted the renovate/descheduler-0.x branch April 13, 2026 18:42
@github-actions github-actions Bot mentioned this pull request May 5, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@claytono claytono Awaiting requested review from claytono claytono is a code owner

Assignees

No one assigned

Labels

renovate:evaluated renovate:safe renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@claytono