Automated cherry pick of #1836: Synchronize helm clusterrole RBAC with base yaml #1826: Add init containers support to Helm chart #1838: Change icon URL in Chart.yaml #1842: fix: resolve detected data races #1847: fix(ci): upgrade codeql-action to v4 and clean up security #1848: update go dependencies #1844: Extend PodLifeTime with condition, exit code, owner kind,

.github/workflows/security.yaml

@@ -17,9 +17,6 @@ jobs:
       actions: read
       contents: read
       security-events: write
-
-    strategy:
-      fail-fast: false
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -41,7 +38,6 @@ jobs:
           output: 'trivy-results.sarif'
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: 'trivy-results.sarif'
-          exit-code: '0'

README.md

@@ -297,7 +297,7 @@ Balance Plugins: These plugins process all pods, or groups of pods, and determin
 | [RemovePodsViolatingNodeTaints](#removepodsviolatingnodetaints) |Deschedule|Evicts pods violating node taints|
 | [RemovePodsViolatingTopologySpreadConstraint](#removepodsviolatingtopologyspreadconstraint) |Balance|Evicts pods violating TopologySpreadConstraints|
 | [RemovePodsHavingTooManyRestarts](#removepodshavingtoomanyrestarts) |Deschedule|Evicts pods having too many restarts|
-| [PodLifeTime](#podlifetime) |Deschedule|Evicts pods that have exceeded a specified age limit|
+| [PodLifeTime](#podlifetime) |Deschedule|Evicts pods based on age, status transitions, conditions, states, exit codes, and owner kinds|
 | [RemoveFailedPods](#removefailedpods) |Deschedule|Evicts pods with certain failed reasons and exit codes|
 
 
@@ -785,30 +785,52 @@ profiles:
 
 ### PodLifeTime
 
-This strategy evicts pods that are older than `maxPodLifeTimeSeconds`.
+This strategy evicts pods based on their age, status transitions, conditions, states, exit codes, and owner kinds. It supports both simple age-based eviction and fine-grained cleanup of pods matching specific transition criteria.
 
-You can also specify `states` parameter to **only** evict pods matching the following conditions:
-> The primary purpose for using states like `Succeeded` and `Failed` is releasing resources so that new pods can be rescheduled.
-> I.e., the main motivation is not for cleaning pods, rather to release resources.
-  - [Pod Phase](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-phase) status of: `Running`, `Pending`, `Succeeded`, `Failed`, `Unknown`
-  - [Pod Reason](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-conditions) reasons of: `NodeAffinity`, `NodeLost`, `Shutdown`, `UnexpectedAdmissionError`
-  - [Container State Waiting](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-state-waiting) condition of: `PodInitializing`, `ContainerCreating`, `ImagePullBackOff`, `CrashLoopBackOff`, `CreateContainerConfigError`, `ErrImagePull`, `ImagePullBackOff`, `CreateContainerError`, `InvalidImageName`
+All non-empty filter categories are ANDed (a pod must satisfy every specified filter). Within each category, items are ORed (matching any one entry satisfies that filter). For `conditions`, a pod is eligible for eviction if **any** of the listed condition filters match — each filter is evaluated independently against the pod's `status.conditions[]` entries. Pods are processed from oldest to newest based on their creation time.
 
-If a value for `states` or `podStatusPhases` is not specified,
-Pods in any state (even `Running`) are considered for eviction.
+See the [plugin README](pkg/framework/plugins/podlifetime/README.md) for detailed documentation and advanced use cases.
 
 **Parameters:**
 
-| Name                           | Type                                              | Notes                    |
-|--------------------------------|---------------------------------------------------|--------------------------|
-| `maxPodLifeTimeSeconds`        | int                                               |                          |
-| `states`                       | list(string)                                      | Only supported in v0.25+ |
-| `includingInitContainers`      | bool                                              | Only supported in v0.31+ |
-| `includingEphemeralContainers` | bool                                              | Only supported in v0.31+ |
-| `namespaces`                   | (see [namespace filtering](#namespace-filtering)) |                          |
-| `labelSelector`                | (see [label filtering](#label-filtering))         |                          |
+| Name | Type | Notes |
+|------|------|-------|
+| `conditions` | list(object) | Each with optional `type`, `status`, `reason`, `minTimeSinceLastTransitionSeconds` fields |
+| `exitCodes` | list(int32) | Container terminated exit codes |
+| `includingEphemeralContainers` | bool | Extend state filtering to ephemeral containers |
+| `includingInitContainers` | bool | Extend state/exitCode filtering to init containers |
+| `labelSelector` | (see [label filtering](#label-filtering)) | |
+| `maxPodLifeTimeSeconds` | uint | Pods older than this many seconds are evicted |
+| `namespaces` | (see [namespace filtering](#namespace-filtering)) | |
+| `ownerKinds` | object | `include` or `exclude` list of owner reference kinds |
+| `states` | list(string) | Pod phases, pod status reasons, container waiting/terminated reasons |
 
-**Example:**
+**Example (transition-based eviction):**
+
+```yaml
+apiVersion: "descheduler/v1alpha2"
+kind: "DeschedulerPolicy"
+profiles:
+  - name: ProfileName
+    pluginConfig:
+    - name: "PodLifeTime"
+      args:
+        states:
+        - "Succeeded"
+        conditions:
+        - reason: "PodCompleted"
+          status: "True"
+          minTimeSinceLastTransitionSeconds: 14400
+        ownerKinds:
+          exclude:
+          - "Job"
+    plugins:
+      deschedule:
+        enabled:
+          - "PodLifeTime"
+```
+
+**Example (age-based eviction):**
 
 ```yaml
 apiVersion: "descheduler/v1alpha2"
@@ -829,6 +851,7 @@ profiles:
 ```
 
 ### RemoveFailedPods
+
 This strategy evicts pods that are in failed status phase.
 You can provide optional parameters to filter by failed pods' and containters' `reasons`. and `exitCodes`. `exitCodes` apply to failed pods' containers with `terminated` state only. `reasons` and `exitCodes` can be expanded to include those of InitContainers as well by setting the optional parameter `includingInitContainers` to `true`.
 You can specify an optional parameter `minPodLifetimeSeconds` to evict pods that are older than specified seconds.

charts/descheduler/Chart.yaml

@@ -8,7 +8,7 @@ keywords:
 - descheduler
 - kube-scheduler
 home: https://github.com/kubernetes-sigs/descheduler
-icon: https://kubernetes.io/images/favicon.png
+icon: https://raw.githubusercontent.com/kubernetes-sigs/descheduler/master/assets/logo/descheduler-stacked-color.png
 sources:
 - https://github.com/kubernetes-sigs/descheduler
 maintainers:

charts/descheduler/templates/clusterrole.yaml

@@ -36,6 +36,9 @@ rules:
   resourceNames: ["{{ .Values.leaderElection.resourceName | default "descheduler" }}"]
   verbs: ["get", "patch", "delete"]
 {{- end }}
+- apiGroups: [""]
+  resources: ["persistentvolumeclaims"]
+  verbs: ["get", "watch", "list"]
 {{- if and .Values.deschedulerPolicy }}
 {{- range .Values.deschedulerPolicy.metricsProviders }}
 {{- if and (hasKey . "source") (eq .source "KubernetesMetrics") }}

charts/descheduler/templates/cronjob.yaml

@@ -96,6 +96,10 @@ spec:
           imagePullSecrets:
           {{- toYaml . | nindent 10 }}
           {{- end }}
+          {{- with .Values.initContainers }}
+          initContainers:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           containers:
             - name: {{ .Chart.Name }}
               image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "v%s" .Chart.AppVersion) }}"

charts/descheduler/templates/deployment.yaml

@@ -49,6 +49,10 @@ spec:
       imagePullSecrets:
       {{- toYaml . | nindent 6 }}
       {{- end }}
+      {{- with .Values.initContainers }}
+      initContainers:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "v%s" .Chart.AppVersion) }}"

charts/descheduler/values.yaml

@@ -233,6 +233,13 @@ livenessProbe:
   periodSeconds: 20
   timeoutSeconds: 5
 
+# Init containers to run before the main descheduler container
+initContainers: []
+# Example:
+# - name: init-myservice
+#   image: busybox:1.28
+#   command: ['sh', '-c', 'echo The app is running! && sleep 10']
+
 service:
   enabled: false
   # @param service.ipFamilyPolicy [string], support SingleStack, PreferDualStack and RequireDualStack

examples/pod-life-time-transition.yml

@@ -0,0 +1,20 @@
+apiVersion: "descheduler/v1alpha2"
+kind: "DeschedulerPolicy"
+profiles:
+  - name: ProfileName
+    pluginConfig:
+    - name: "PodLifeTime"
+      args:
+        states:
+        - "Succeeded"
+        conditions:
+        - reason: "PodCompleted"
+          status: "True"
+          minTimeSinceLastTransitionSeconds: 14400 # 4 hours
+        namespaces:
+          include:
+          - "default"
+    plugins:
+      deschedule:
+        enabled:
+          - "PodLifeTime"

go.mod

@@ -13,13 +13,13 @@ require (
 	github.com/prometheus/common v0.67.5
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
-	go.opentelemetry.io/otel v1.40.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.36.0
-	go.opentelemetry.io/otel/sdk v1.38.0
-	go.opentelemetry.io/otel/trace v1.40.0
+	go.opentelemetry.io/otel v1.41.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.41.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.41.0
+	go.opentelemetry.io/otel/sdk v1.41.0
+	go.opentelemetry.io/otel/trace v1.41.0
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
-	google.golang.org/grpc v1.78.0
+	google.golang.org/grpc v1.79.1
 	k8s.io/api v0.35.1
 	k8s.io/apimachinery v0.35.1
 	k8s.io/apiserver v0.35.1
@@ -37,7 +37,7 @@ require (
 )
 
 require (
-	cel.dev/expr v0.24.0 // indirect
+	cel.dev/expr v0.25.1 // indirect
 	github.com/BurntSushi/toml v0.3.1 // indirect
 	github.com/NYTimes/gziphandler v1.1.1 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
@@ -74,7 +74,7 @@ require (
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/jpillora/backoff v1.0.0 // indirect
@@ -98,26 +98,26 @@ require (
 	go.etcd.io/etcd/client/pkg/v3 v3.6.5 // indirect
 	go.etcd.io/etcd/client/v3 v3.6.5 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
-	go.opentelemetry.io/otel/metric v1.40.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.66.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.66.0 // indirect
+	go.opentelemetry.io/otel/metric v1.41.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.47.0 // indirect
-	golang.org/x/mod v0.31.0 // indirect
-	golang.org/x/net v0.49.0 // indirect
-	golang.org/x/oauth2 v0.34.0 // indirect
+	golang.org/x/crypto v0.48.0 // indirect
+	golang.org/x/mod v0.32.0 // indirect
+	golang.org/x/net v0.50.0 // indirect
+	golang.org/x/oauth2 v0.35.0 // indirect
 	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.40.0 // indirect
-	golang.org/x/term v0.39.0 // indirect
-	golang.org/x/text v0.33.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
+	golang.org/x/term v0.40.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
 	golang.org/x/time v0.9.0 // indirect
-	golang.org/x/tools v0.40.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
+	golang.org/x/tools v0.41.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect