RATATOSKRATATOSK
로그인

Volcano

v1.16.0Orchestration & Management
2026년 10월 14일

ACTION 2CHECK 9OTHER 89

멀티 테넌트 공정성, 토폴로지 인식 스케줄링, 성능과 관측성, 플랫폼 및 가속기 지원, Helm과 CLI 기능 확장을 아우르는 기능 중심 릴리스입니다. 새 동작은 대부분 기본적으로 활성화되지 않거나 기존 동작을 크게 바꾸지 않지만, 업그레이드 전에 보안과 호환성 요구 사항을 함께 검토해야 합니다.

조치 필요 (2)

  • security보안 권고 대응을 위한 의존성 업데이트

    Prometheus, golang.org/x/crypto, x/net, x/text와 압축, OpenTelemetry, etcd, gRPC, 모듈 검증 라이브러리를 비롯한 여러 간접 의존성이 상위 보안 권고에 대응하도록 업데이트되었습니다.

  • breaking--csi-storage 기본값 변경

    --csi-storage의 기본값이 true로 변경됩니다.

영향 확인 (9)

  • securityDRA 용량 집계의 과도한 반복 수정

    이 변경은 DRA 용량 집계를 실행하는 경우에 적용됩니다.

    DRA 용량 집계에서 테넌트가 지정한 디바이스 수나 최소 작업 수가 반복을 과도하게 늘릴 수 있던 문제가 수정되었습니다. 관련 보안 권고는 GHSA-j38h-7pfq-cxmw입니다.

  • breakingNamespaceQueue 연결 권한 규칙 변경

    이 변경은 NamespaceQueue를 사용하는 경우에 적용됩니다.

    클러스터 Queue의 spec.allowedNamespaces가 NamespaceQueue 연결 권한을 결정합니다. 목록을 생략하거나 비워 두면 연결이 거부되고, ["*"]를 지정하면 모든 네임스페이스를 허용합니다.

  • breakingNamespaceQueue 생성 순서와 준비 상태 확인

    이 변경은 NamespaceQueue를 사용하는 경우에 적용됩니다.

    NamespaceQueue를 만들기 전에 네임스페이스와 권한이 있는 상위 Queue가 존재해야 하며, 테넌트에는 네임스페이스 범위의 namespacequeues RBAC 권한이 필요합니다. 생성 후에는 Ready=True와 Authorized=True 조건이 확인된 뒤 워크로드가 제출됩니다.

  • breakingHyperNode 컨트롤러 모드 전환 순서

    이 변경은 custom.hypernode_controller_mode를 설정하는 경우에 적용됩니다.

    기존 통합 설치를 standalone 모드로 전환할 때는 먼저 custom.hypernode_controller_mode=disabled로 설정하고 controller-manager 롤아웃이 끝난 뒤 standalone을 활성화해야 합니다. 이 순서로 한 프로세스만 HyperNode를 조정합니다.

  • breaking사용자 정의 HyperNode 토폴로지 플러그인 재빌드

    이 변경은 HyperNodeGradientForJobFn, HyperNodeGradientForSubJobFn, HyperNodeCandidateFn을 사용하는 경우에 적용됩니다.

    사용자 정의 토폴로지 플러그인은 HyperNodeGradientForJobFn, HyperNodeGradientForSubJobFn, HyperNodeCandidateFn의 변경에 맞춰 수정하고 다시 빌드해야 합니다.

  • breaking소스 빌드의 Go 1.26 요구

    이 변경은 Go 1.26을 사용하지 않는 경우에 적용됩니다.

    Kubernetes 1.36.1을 기준으로 빌드하며, 소스에서 빌드하려면 Go 1.26이 필요합니다.

  • breakingKubernetes 1.23 배포 지원 중단

    이 변경은 Kubernetes 1.23을 사용하는 경우에 적용됩니다.

    Kubernetes 1.23 배포는 지원되지 않습니다.

  • breakingHyperNode 그래디언트 반환 형식 변경

    이 변경은 HyperNode gradient return types를 사용하는 경우에 적용됩니다.

    새로운 HyperNode gradient return types에 맞춰 사용자 정의 토폴로지 플러그인을 다시 빌드해야 합니다.

  • breakingHelm admission-init 작업의 TTL 정리

    이 변경은 Helm admission-init 작업을 사용하는 경우에 적용됩니다.

    Helm admission-init 작업은 성공한 훅을 즉시 삭제하는 대신 TTL 정리를 사용합니다. 관련 설정은 custom.admission_init_ttl입니다.

그 외 기록된 변경 89건 전체security fixes 1 · additions 33 · fixes 32 · value changes 12 · constraints 8 · defaults 2 · removals 1

security fixes (1)

  • Adds release SBOM generation and Security Insights metadata

additions (33)

  • The UnschedulableJobCache records why a Job could not be scheduled and uses plugin-provided event hints to decide when it should be evaluated again.
  • The feature is disabled by default. Enable it with the scheduler feature gate: bash helm upgrade --install volcano volcano-sh/volcano \ --namespace volcano-system --create-namespace --version 1.16.0 \ --set custom.scheduler_feature_gates="UnschedulableJobCache=true"
  • NamespaceQueue introduces namespace-local queue management while preserving administrator control over the cluster-level resource hierarchy.
  • Controller-maintained authorization and readiness conditions, with final scheduler readiness checks before admission.
  • The new fairshare plugin tracks cumulative resource-seconds per namespace within a queue and applies exponential half-life decay.
  • Optional enqueue gating and ConfigMap persistence across scheduler restarts.
  • PodGroup anti-affinity expresses isolation at the workload-group level. It selects peer PodGroups by labels and namespace selectors and applies the separation rule at a named or numbered HyperNode tier.
  • The standalone controller provides an independent deployment and operational boundary while retaining the same HyperNode API, discovery configuration, and implementation.
  • A dedicated vc-hypernode-controller-manager binary, image, Deployment, RBAC, and Helm configuration.
  • Adds hami-vnpu-core integration for Ascend memory virtualization and compute time slicing.
  • Checks Ascend health using allocatable devices and adds vGPU UUID-based allowlist/denylist constraints.
  • Adds inqueue resource metrics, queue workload-state metrics, and volcano_eviction_transactions_total{action}.
  • Makes scheduler job/task updater concurrency configurable
  • logs loaded scheduler configuration for troubleshooting
  • Adds namespace columns and stable sorting to vcctl pod list
  • release automation for Linux/macOS amd64/arm64 CLI archives, checksums, and SLSA provenance
  • Adds scheduling.volcano.sh/v1beta1 NamespaceQueue
  • Adds spec.topologyAffinity.podGroupAntiAffinity
  • Adds Numatopology.spec.podAllocations
  • Adds Session.AddHintProvider and QueueingHint-style event registration for unschedulable-job retries
  • Adds the Queue annotation volcano.sh/nodegroup-resource-limits
  • Adds the fairshare.* arguments
  • Adds Job plugin option svc: ["--inject-hosts-env=false"]
  • Adds Pod annotations volcano.sh/vgpu-use-gpuuuid and volcano.sh/vgpu-nouse-gpuuuid
  • Adds --job-updater-worker-num and --task-updater-worker-num
  • Adds custom.hypernode_controller_mode
  • Adds custom.admission_init_ttl (default 3600 seconds)
  • retention annotations for the existing Volcano CRDs
  • Configures GOMAXPROCS using container CPU quotas across Volcano components.
  • Update CRDs and RBAC together with the control-plane components
  • Gang-aware gangPreempt and gangReclaim remain explicit actions
  • Caps how much a queue can allocate from each nodegroup while allowing placement in other permitted groups.
  • Adds pod-level resource settings and accounts for restartable init containers/native sidecars and Pod overhead in effective requests used by the Volcano agent.

fixes (32)

  • Registers upstream PreFilter hooks for CSI limits, node affinity, and volume-zone checks
  • avoiding phantom reservations when a later plugin rejects admission
  • Includes gate-reserved resources from descendant queues in ancestor quota checks
  • Preserves Completed state after finished Pods are deleted
  • Returns Closed queues to Closing on resync when PodGroups remain
  • Uses PodGroup MinResources for Volcano Jobs that do not yet have Pods
  • closes a remaining overflow path so large device counts cannot wrap into negative quota usage
  • preventing false NUMA policy failures
  • preventing Pods such as Spark executors with newly created PVCs from remaining permanently outside scheduler consideration
  • restores node state after unsuccessful updates
  • Adds missing nil checks for PodGroup-related cache paths
  • Honors NeedContinueAllocating after PrePredicate failures
  • Retains the allocation-rate policy default range when its arguments are omitted.
  • Formats effectively unlimited resource values consistently in scheduler resource strings.
  • Corrects UpdateHyperNode rebuild logic
  • Honors nominated HyperNodes without hard topology mode
  • Guards annotation patches by Pod UID when Pods are recreated
  • Avoids deleting the PodGroup for targeted Pod restarts
  • Falls back to replica count when partition minPartitions is omitted.
  • Returns status-update failures for retry
  • Synchronizes TaskInfo allocation annotations across binding and rollback
  • Prevents idle-memory underflow
  • Fixes large-cluster vGPU scheduling coordination.
  • Corrects allocation resource accounting
  • Rechecks device feasibility after tentative evictions before committing a reclaim decision.
  • Completes or requeues popped Pods on early exits
  • Rejects non-positive worker counts
  • Matches CNI plugins by type rather than display name.
  • Deduplicates Pod lists by namespace and name
  • reports all invalid subgroup and hierarchical-weight entries
  • preserves the existing Volcano CRDs and their custom resources on uninstall
  • avoiding scheduler stalls for very large counts

value changes (12)

  • Bounded retries**: A configurable watchdog retries cached Jobs after a maximum skip duration, defaulting to five minutes. The cache is in memory and is cleared on scheduler restart.
  • Historical usage ordering within a queue, with a default four-hour half-life.
  • Fairshare influences pending-job ordering and optional enqueue admission. It does not preempt or reclaim already-running jobs. Persistence is disabled by default.
  • The usage plugin now maintains a session-level shadow load cache for assigned Pods whose usage is not yet visible in metrics.
  • The metrics.interval setting defines the monitoring delay window and defaults to 30 seconds.
  • Reuses the session NodeMap, batches nodeorder PreScore/Score work, and executes active score plugins in one parallel node traversal before plugin-owned normalization and aggregation.
  • Updates Kubernetes dependencies to 1.36.1, the Go toolchain requirement to 1.26
  • Applies upstream DynamicResources Score and plugin-owned NormalizeScore to prioritized device requests
  • Uses the upstream VolumeBinding implementation in place of Volcano's fork
  • Updates golang.org/x/crypto to v0.56.0, x/net to v0.58.0, x/text to v0.41.0, and Prometheus to v0.311.3
  • Updates CNI, cgroups, filesystem notifications, Elasticsearch, Prometheus common, and the OTLP trace exporter
  • Updates e2e-framework, Ginkgo, Gomega, and gomonkey.

constraints (8)

  • Namespace-local parent/child hierarchies, with cluster/<name> references for cluster Queue parents.
  • Explicit workload references through spec.queue: namespace/<name>, resolved within the workload's namespace. Bare queue names continue to reference cluster Queues.
  • NamespaceQueue hierarchies allow five levels below a cluster Queue by default. Set --max-namespacequeue-depth on both the controller manager and admission webhook to change that limit.
  • Each term must specify exactly one of topologyTierName and topologyTier. Preferred terms additionally require a weight from 1 to 100. Required terms omit weight.
  • Enforcement applies to allocate. BestEffort Pods placed through backfill do not receive this isolation guarantee.
  • Kubernetes 1.36 support
  • Fairshare must precede DRF for historical-usage ordering to take effect.
  • update resource-exporter to a version supporting spec.podAllocations

defaults (2)

  • controller-manager, standalone, and disabled deployment modes, with integrated mode retained as the default.
  • NamespaceQueue and UnschedulableJobCache are disabled by default.

removals (1)

  • The final implementation no longer injects a PostStart hook.
Volcano 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 보안 패치와 브레이킹 체인지 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗Volcano 릴리스 전체 →