Merge #153000 #153008 #153042 #153053 #153166

153000: sql: fix incorrect min timestamp error check r=mgartner a=mgartner

This commit fixes a check for a min timestamp error that would always
return false.

Release note: None


153008: kvserver: invoke callback when SetMaxSize drops replicas  r=wenyihu6 a=wenyihu6

Epic: none
Release note: none

---

**kvserver: invoke callback when dropping replicas in bq.SetMaxSize**

Previously, when SetMaxSize shrank the queue, replicas were dropped from the
priority queue without invoking their callbacks. This commit ensures callbacks
are properly invoked when SetMaxSize drops replicas. Replicas removed via
removeFromReplicaSetLocked (such as when a replica is destroyed) still don’t
always have their callbacks invoked. While the natural place to invoke the
callback would be at removeFromReplicaSetLocked, invoking callbacks while
holding a lock risks blocking for too long. (We are doing this already for
addInternal though.) This PR focuses specifically on handling the SetMaxSize
case since this PR is intended to be backported. We can follow up with a more
complex but more principled approach on master if needed in the future.


153042: sql: fix single descriptor lookup r=bghal a=bghal

The LLM bug-finder found this bug introduced in #150188. This addresses
the issue.

Epic: none

Release note: None


153053: server: add SucceedsSoon to some CheckRestartSafe tests r=dhartunian a=dhartunian

These tests are often waiting on internal signals which are asynchronous and hence should not fail immediately.

Resolves: #152143
Resolves: #152198
Resolves: #151676

Epic: None

Release note: None

153166: cloud/kubernetes: update manifests and enhance security r=shreyaskm623 a=shreyaskm623

  This commit updates the Kubernetes deployment manifests by removing deprecated APIs, enhancing security with IMDSv2, improving ARM compatibility, and cleaning up legacy files.

  Key changes:

  Update PodDisruptionBudget API from policy/v1beta1 to policy/v1
  Replace byrnedo/alpine-curl:0.1 with 3.20 for ARM64 support
  Implement IMDSv2 for secure AWS metadata access in EKS deployments
  Remove deprecated v1.6 and v1.7 directories (22 legacy files)
  Regenerate all manifest files from updated templates

  Release notes: none

  Epic: CRDB-49252

Co-authored-by: Marcus Gartner <[email protected]>
Co-authored-by: wenyihu6 <[email protected]>
Co-authored-by: Brendan Gerrity <[email protected]>
Co-authored-by: David Hartunian <[email protected]>
Co-authored-by: Shreyas KM <[email protected]>

Author: 6 people

cloud/kubernetes/README.md

@@ -25,9 +25,9 @@ kubectl run cockroachdb --image=cockroachdb/cockroach --restart=Never -- start-s
 ### Kubernetes version
 
 The minimum Kubernetes version to successfully run the examples in this
-directory without modification is `1.8`. If you want to run them on an older
+directory without modification is `1.21`. If you want to run them on an older
 version of Kubernetes, use the files from the appropriate subdirectory (e.g. the
-`v1.7` directory for Kubernetes 1.7 or the `v1.6` directory for Kubernetes 1.6).
+`v1.20` directory for Kubernetes 1.20).
 Older Kubernetes versions that don't have their own directory are no longer
 supported.
 

cloud/kubernetes/bring-your-own-certs/cockroachdb-statefulset.yaml

@@ -111,7 +111,7 @@ spec:
   selector:
     app: cockroachdb
 ---
-apiVersion: policy/v1beta1
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: cockroachdb-budget

cloud/kubernetes/cockroachdb-statefulset-secure.yaml

@@ -125,7 +125,7 @@ spec:
   selector:
     app: cockroachdb
 ---
-apiVersion: policy/v1beta1
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: cockroachdb-budget

cloud/kubernetes/cockroachdb-statefulset.yaml

@@ -57,7 +57,7 @@ spec:
   selector:
     app: cockroachdb
 ---
-apiVersion: policy/v1beta1
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: cockroachdb-budget

cloud/kubernetes/multiregion/cockroachdb-statefulset-secure.yaml

@@ -125,7 +125,7 @@ spec:
   selector:
     app: cockroachdb
 ---
-apiVersion: policy/v1beta1
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: cockroachdb-budget

cloud/kubernetes/multiregion/eks/cockroachdb-statefulset-secure-eks.yaml

@@ -125,7 +125,7 @@ spec:
   selector:
     app: cockroachdb
 ---
-apiVersion: policy/v1beta1
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: cockroachdb-budget
@@ -172,9 +172,13 @@ spec:
       - command:
         - sh
         - -ecx
-        - echo "aws-$(curl http://169.254.169.254/latest/meta-data/placement/availability-zone/)"
-          > /etc/cockroach-env/zone
-        image: byrnedo/alpine-curl:0.1
+        - |
+          TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
+            -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
+          echo "aws-$(curl -H "X-aws-ec2-metadata-token: $TOKEN" \
+            http://169.254.169.254/latest/meta-data/placement/availability-zone/)" \
+            > /etc/cockroach-env/zone
+        image: byrnedo/alpine-curl:3.20
         imagePullPolicy: IfNotPresent
         name: locality-container
         resources: {}

cloud/kubernetes/performance/cockroachdb-daemonset-insecure.yaml

@@ -35,7 +35,7 @@ spec:
   selector:
     app: cockroachdb
 ---
-apiVersion: policy/v1beta1
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: cockroachdb-budget

cloud/kubernetes/performance/cockroachdb-daemonset-secure.yaml

@@ -106,7 +106,7 @@ spec:
   selector:
     app: cockroachdb
 ---
-apiVersion: policy/v1beta1
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: cockroachdb-budget

cloud/kubernetes/performance/cockroachdb-statefulset-insecure.yaml

@@ -83,7 +83,7 @@ spec:
   selector:
     app: cockroachdb
 ---
-apiVersion: policy/v1beta1
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: cockroachdb-budget

cloud/kubernetes/performance/cockroachdb-statefulset-secure.yaml

@@ -145,7 +145,7 @@ spec:
   selector:
     app: cockroachdb
 ---
-apiVersion: policy/v1beta1
+apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   name: cockroachdb-budget