Volcano
v1.14.2Orchestration & Managementv1.14.2 patches a denial-of-service CVE in the webhook server plus a dense cluster of scheduler correctness bugs — upgrade immediately if you're on any 1.12/1.13/1.14 branch.
securityPatch CVE-2026-44247 now — all prior 1.12/1.13/1.14 versions are affected
Any pod with network access to the Volcano webhook endpoint can send an arbitrarily large request body and OOM-kill the webhook server, blocking all workload admission. CVSS 6.8 (Moderate) but the blast radius is high — a downed webhook halts job submission cluster-wide. Upgrade to v1.14.2, v1.13.3, or v1.12.4 depending on your branch. If you cannot upgrade immediately, consider restricting network access to the webhook service via NetworkPolicy to limit which pods can reach the endpoint.
breakingCheck for scheduler panic-on-install if you recently deployed 1.14.x
A race condition caused the scheduler to panic and restart during initial install. If you observed unexplained scheduler CrashLoopBackOffs after a fresh 1.14.x deployment, this is the fix. Upgrade and verify the scheduler pod stabilizes. No config changes needed, but review your monitoring alerts — silent restarts in production may have caused missed scheduling cycles.
enhancementMulti-queue preemption and queue ordering are now reliable — re-validate your preemption policies
Two distinct bugs in multi-queue preemption (preemptorTasks overwrite and QueueOrderFn not being honored) are fixed. If you rely on preemption across queues with custom ordering functions, the scheduler was likely not behaving as configured. After upgrading, run a validation cycle against your preemption scenarios to confirm jobs are being preempted in the priority order you expect. No configuration changes are required, but the behavioral change is real.
主な変更 (5)
- CVE-2026-44247 fixed: unbounded HTTP request body in the webhook server could be exploited to trigger OOM and take down the webhook process
- Concurrent map write panics in the scheduler resolved — these caused random restarts and were likely hitting production clusters silently
- Scheduler snapshot deep-copy logic overhauled: shared mutable objects in clones were a latent data-race bug affecting scheduling correctness
- Multi-queue preemption fixed: preemptorTasks could be overwritten, causing incorrect preemption decisions across queues
- highestTierName in partitionPolicy/subGroupPolicy now actually enforces HyperNode tier constraints as intended