kubernetes
diff --git a/‎pkg/kubelet/kubelet_resources.go
Lines changed: 21 additions & 7 deletions b/‎pkg/kubelet/kubelet_resources.go
Lines changed: 21 additions & 7 deletions
diff --git a/‎pkg/kubelet/kubelet_resources_test.go
Lines changed: 48 additions & 2 deletions b/‎pkg/kubelet/kubelet_resources_test.go
Lines changed: 48 additions & 2 deletions
diff --git a/‎staging/src/k8s.io/component-helpers/resource/helpers.go
Lines changed: 20 additions & 0 deletions b/‎staging/src/k8s.io/component-helpers/resource/helpers.go
Lines changed: 20 additions & 0 deletions
diff --git a/‎staging/src/k8s.io/component-helpers/resource/helpers_test.go
Lines changed: 52 additions & 0 deletions b/‎staging/src/k8s.io/component-helpers/resource/helpers_test.go
Lines changed: 52 additions & 0 deletions
diff --git a/‎test/e2e/common/node/downwardapi.go
Lines changed: 154 additions & 2 deletions b/‎test/e2e/common/node/downwardapi.go
Lines changed: 154 additions & 2 deletions
@@ -21,18 +21,21 @@ import (
 
 	"k8s.io/klog/v2"
 
-	"k8s.io/api/core/v1"
+	corev1 "k8s.io/api/core/v1"
+	utilfeature "k8s.io/apiserver/pkg/util/feature"
+	resourcehelper "k8s.io/component-helpers/resource"
 	"k8s.io/kubernetes/pkg/api/v1/resource"
+	kubefeatures "k8s.io/kubernetes/pkg/features"
 )
 
 // defaultPodLimitsForDownwardAPI copies the input pod, and optional container,
 // and applies default resource limits. it returns a copy of the input pod,
 // and a copy of the input container (if specified) with default limits
-// applied. if a container has no limit specified, it will default the limit to
-// the node allocatable.
-// TODO: if/when we have pod level resources, we need to update this function
-// to use those limits instead of node allocatable.
-func (kl *Kubelet) defaultPodLimitsForDownwardAPI(pod *v1.Pod, container *v1.Container) (*v1.Pod, *v1.Container, error) {
+// applied.
+// If a container has no limits specified, it defaults to the pod-level resources.
+// If neither container-level nor pod-level resources are specified, it defaults
+// to the node's allocatable resources.
+func (kl *Kubelet) defaultPodLimitsForDownwardAPI(pod *corev1.Pod, container *corev1.Container) (*corev1.Pod, *corev1.Container, error) {
 	if pod == nil {
 		return nil, nil, fmt.Errorf("invalid input, pod cannot be nil")
 	}
@@ -42,13 +45,24 @@ func (kl *Kubelet) defaultPodLimitsForDownwardAPI(pod *v1.Pod, container *v1.Con
 		return nil, nil, fmt.Errorf("failed to find node object, expected a node")
 	}
 	allocatable := node.Status.Allocatable
+	if utilfeature.DefaultFeatureGate.Enabled(kubefeatures.PodLevelResources) && resourcehelper.IsPodLevelLimitsSet(pod) {
+		allocatable = allocatable.DeepCopy()
+		for _, resource := range []corev1.ResourceName{corev1.ResourceCPU, corev1.ResourceMemory, corev1.ResourceEphemeralStorage} {
+			if val, exists := pod.Spec.Resources.Limits[resource]; exists && !val.IsZero() {
+				if _, exists := allocatable[resource]; exists {
+					allocatable[resource] = val.DeepCopy()
+				}
+			}
+		}
+	}
+
 	klog.InfoS("Allocatable", "allocatable", allocatable)
 	outputPod := pod.DeepCopy()
 	for idx := range outputPod.Spec.Containers {
 		resource.MergeContainerResourceLimits(&outputPod.Spec.Containers[idx], allocatable)
 	}
 
-	var outputContainer *v1.Container
+	var outputContainer *corev1.Container
 	if container != nil {
 		outputContainer = container.DeepCopy()
 		resource.MergeContainerResourceLimits(outputContainer, allocatable)
 
@@ -25,6 +25,9 @@ import (
 	apiequality "k8s.io/apimachinery/pkg/api/equality"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	utilfeature "k8s.io/apiserver/pkg/util/feature"
+	featuregatetesting "k8s.io/component-base/featuregate/testing"
+	kubefeatures "k8s.io/kubernetes/pkg/features"
 )
 
 func TestPodResourceLimitsDefaulting(t *testing.T) {
@@ -46,8 +49,9 @@ func TestPodResourceLimitsDefaulting(t *testing.T) {
 		},
 	}
 	cases := []struct {
-		pod      *v1.Pod
-		expected *v1.Pod
+		pod                      *v1.Pod
+		expected                 *v1.Pod
+		podLevelResourcesEnabled bool
 	}{
 		{
 			pod:      getPod("0", "0"),
@@ -65,9 +69,35 @@ func TestPodResourceLimitsDefaulting(t *testing.T) {
 			pod:      getPod("0", "1Mi"),
 			expected: getPod("6", "1Mi"),
 		},
+		{
+			pod:                      getPodWithPodLevelResources("0", "1Mi", "0", "0"),
+			expected:                 getPodWithPodLevelResources("0", "1Mi", "6", "1Mi"),
+			podLevelResourcesEnabled: true,
+		},
+		{
+			pod:                      getPodWithPodLevelResources("1", "0", "0", "0"),
+			expected:                 getPodWithPodLevelResources("1", "0", "1", "4Gi"),
+			podLevelResourcesEnabled: true,
+		},
+		{
+			pod:                      getPodWithPodLevelResources("1", "1Mi", "", ""),
+			expected:                 getPodWithPodLevelResources("1", "1Mi", "1", "1Mi"),
+			podLevelResourcesEnabled: true,
+		},
+		{
+			pod:                      getPodWithPodLevelResources("1", "5Mi", "0", "1Mi"),
+			expected:                 getPodWithPodLevelResources("1", "5Mi", "1", "1Mi"),
+			podLevelResourcesEnabled: true,
+		},
+		{
+			pod:                      getPodWithPodLevelResources("1", "5Mi", "1", "1Mi"),
+			expected:                 getPodWithPodLevelResources("1", "5Mi", "1", "1Mi"),
+			podLevelResourcesEnabled: true,
+		},
 	}
 	as := assert.New(t)
 	for idx, tc := range cases {
+		featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, kubefeatures.PodLevelResources, tc.podLevelResourcesEnabled)
 		actual, _, err := tk.kubelet.defaultPodLimitsForDownwardAPI(tc.pod, nil)
 		as.NoError(err, "failed to default pod limits: %v", err)
 		if !apiequality.Semantic.DeepEqual(tc.expected, actual) {
@@ -98,3 +128,19 @@ func getPod(cpuLimit, memoryLimit string) *v1.Pod {
 		},
 	}
 }
+
+func getPodWithPodLevelResources(plCPULimit, plMemoryLimit, clCPULimit, clMemoryLimit string) *v1.Pod {
+	pod := getPod(clCPULimit, clMemoryLimit)
+	resources := v1.ResourceRequirements{}
+	if plCPULimit != "" || plMemoryLimit != "" {
+		resources.Limits = make(v1.ResourceList)
+	}
+	if plCPULimit != "" {
+		resources.Limits[v1.ResourceCPU] = resource.MustParse(plCPULimit)
+	}
+	if plMemoryLimit != "" {
+		resources.Limits[v1.ResourceMemory] = resource.MustParse(plMemoryLimit)
+	}
+	pod.Spec.Resources = &resources
+	return pod
+}
@@ -114,6 +114,26 @@ func IsPodLevelRequestsSet(pod *v1.Pod) bool {
 	return false
 }
 
+// IsPodLevelLimitsSet checks if pod-level limits are set. It returns true if
+// Limits map is non-empty and contains at least one supported pod-level resource.
+func IsPodLevelLimitsSet(pod *v1.Pod) bool {
+	if pod.Spec.Resources == nil {
+		return false
+	}
+
+	if len(pod.Spec.Resources.Limits) == 0 {
+		return false
+	}
+
+	for resourceName := range pod.Spec.Resources.Limits {
+		if IsSupportedPodLevelResource(resourceName) {
+			return true
+		}
+	}
+
+	return false
+}
+
 // PodRequests computes the total pod requests per the PodResourcesOptions supplied.
 // If PodResourcesOptions is nil, then the requests are returned including pod overhead.
 // If the PodLevelResources feature is enabled AND the pod-level resources are set,
 
@@ -1554,6 +1554,58 @@ func TestIsPodLevelResourcesSet(t *testing.T) {
 
 }
 
+func TestIsPodLevelLimitsSet(t *testing.T) {
+	testCases := []struct {
+		name         string
+		podResources *v1.ResourceRequirements
+		expected     bool
+	}{
+		{
+			name:     "nil resources struct",
+			expected: false,
+		},
+		{
+			name:         "empty resources struct",
+			podResources: &v1.ResourceRequirements{},
+			expected:     false,
+		},
+		{
+			name: "only resource requests set",
+			podResources: &v1.ResourceRequirements{
+				Requests: v1.ResourceList{v1.ResourceMemory: resource.MustParse("100Mi")},
+			},
+			expected: false,
+		},
+		{
+			name: "only unsupported resource limits set",
+			podResources: &v1.ResourceRequirements{
+				Limits: v1.ResourceList{v1.ResourceEphemeralStorage: resource.MustParse("1Mi")},
+			},
+			expected: false,
+		},
+		{
+			name: "unsupported and suported resources limits set",
+			podResources: &v1.ResourceRequirements{
+				Limits: v1.ResourceList{
+					v1.ResourceEphemeralStorage: resource.MustParse("1Mi"),
+					v1.ResourceCPU:              resource.MustParse("1m"),
+				},
+			},
+			expected: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			testPod := &v1.Pod{Spec: v1.PodSpec{Resources: tc.podResources}}
+			if got := IsPodLevelLimitsSet(testPod); got != tc.expected {
+				t.Errorf("got=%t, want=%t", got, tc.expected)
+			}
+		})
+	}
+
+}
+
 func TestPodLevelResourceRequests(t *testing.T) {
 	restartAlways := v1.ContainerRestartPolicyAlways
 	testCases := []struct {
 
@@ -20,18 +20,20 @@ import (
 	"context"
 	"fmt"
 
+	"github.com/onsi/ginkgo/v2"
+	"github.com/onsi/gomega"
+
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/uuid"
 	"k8s.io/kubernetes/test/e2e/feature"
 	"k8s.io/kubernetes/test/e2e/framework"
 	e2enetwork "k8s.io/kubernetes/test/e2e/framework/network"
+	e2epod "k8s.io/kubernetes/test/e2e/framework/pod"
 	e2epodoutput "k8s.io/kubernetes/test/e2e/framework/pod/output"
 	imageutils "k8s.io/kubernetes/test/utils/image"
 	admissionapi "k8s.io/pod-security-admission/api"
-
-	"github.com/onsi/ginkgo/v2"
 )
 
 var _ = SIGDescribe("Downward API", func() {
@@ -414,6 +416,156 @@ var _ = SIGDescribe("Downward API", framework.WithSerial(), framework.WithDisrup
 
 })
 
+var _ = SIGDescribe("Downward API", feature.PodLevelResources, func() {
+	f := framework.NewDefaultFramework("downward-api")
+	f.NamespacePodSecurityLevel = admissionapi.LevelPrivileged
+
+	ginkgo.Context("Downward API tests for pod level resources", func() {
+		ginkgo.It("should provide default limits.cpu/memory from pod level resources", func(ctx context.Context) {
+			podName := "downward-api-" + string(uuid.NewUUID())
+			env := []v1.EnvVar{
+				{
+					Name: "CPU_LIMIT",
+					ValueFrom: &v1.EnvVarSource{
+						ResourceFieldRef: &v1.ResourceFieldSelector{
+							Resource: "limits.cpu",
+						},
+					},
+				},
+				{
+					Name: "MEMORY_LIMIT",
+					ValueFrom: &v1.EnvVarSource{
+						ResourceFieldRef: &v1.ResourceFieldSelector{
+							Resource: "limits.memory",
+						},
+					},
+				},
+			}
+
+			expectations := []string{
+				"CPU_LIMIT=2",
+				"MEMORY_LIMIT=67108864",
+			}
+			pod := &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   podName,
+					Labels: map[string]string{"name": podName},
+				},
+				Spec: v1.PodSpec{
+					Resources: &v1.ResourceRequirements{
+						Limits: v1.ResourceList{
+							v1.ResourceCPU:    resource.MustParse("1250m"),
+							v1.ResourceMemory: resource.MustParse("64Mi"),
+						},
+					},
+					Containers: []v1.Container{
+						{
+							Name:    "dapi-container",
+							Image:   imageutils.GetE2EImage(imageutils.BusyBox),
+							Command: []string{"sh", "-c", "env"},
+							Env:     env,
+						},
+					},
+					RestartPolicy: v1.RestartPolicyNever,
+				},
+			}
+			testDownwardAPIUsingPod(ctx, f, pod, env, expectations)
+		})
+
+		ginkgo.It("should provide default limits.cpu/memory from pod level resources or node allocatable", func(ctx context.Context) {
+			podName := "downward-api-" + string(uuid.NewUUID())
+			cName := "dapi-container"
+			env := []v1.EnvVar{
+				{
+					Name: "CPU_LIMIT",
+					ValueFrom: &v1.EnvVarSource{
+						ResourceFieldRef: &v1.ResourceFieldSelector{
+							Resource: "limits.cpu",
+						},
+					},
+				},
+				{
+					Name: "MEMORY_LIMIT",
+					ValueFrom: &v1.EnvVarSource{
+						ResourceFieldRef: &v1.ResourceFieldSelector{
+							Resource: "limits.memory",
+						},
+					},
+				},
+			}
+
+			pod := &v1.Pod{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:   podName,
+					Labels: map[string]string{"name": podName},
+				},
+				Spec: v1.PodSpec{
+					Resources: &v1.ResourceRequirements{
+						Limits: v1.ResourceList{
+							v1.ResourceCPU: resource.MustParse("1250m"),
+						},
+					},
+					Containers: []v1.Container{
+						{
+							Name:    cName,
+							Image:   imageutils.GetE2EImage(imageutils.BusyBox),
+							Command: []string{"sh", "-c", "env"},
+							Env:     env,
+						},
+					},
+					RestartPolicy: v1.RestartPolicyNever,
+				},
+			}
+
+			// Before the Pod Level Resources feature was introduced, if container-level
+			// resource limits were not set, the Downward API would return the node's
+			// allocatable resources instead of 0. So, it was sufficient to simply check
+			// that the value set in the environment variable was non-zero.
+			// However, after the Pod Level Resources feature was introduced, the node's
+			// allocatable resources are used as a fallback when pod-level resource limits
+			// are not specified. Therefore, we now need to verify that the value
+			// in the environment variable matches the node's allocatable resources.
+			// Because we need to dynamically retrieve the node's allocatable resources,
+			// we cannot simply use e2epodoutput.TestContainerOutputRegexp here.
+			podClient := e2epod.NewPodClient(f)
+			createdPod := podClient.Create(ctx, pod)
+			ginkgo.DeferCleanup(func(ctx context.Context) {
+				ginkgo.By("delete the pods")
+				podClient.DeleteSync(ctx, createdPod.Name, metav1.DeleteOptions{}, f.Timeouts.PodDelete)
+			})
+
+			// Wait for client pod to complete.
+			err := e2epod.WaitForPodSuccessInNamespaceTimeout(ctx, f.ClientSet, createdPod.Name, f.Namespace.Name, f.Timeouts.PodStart)
+			framework.ExpectNoError(err)
+
+			// Grab its logs.  Get host first.
+			podStatus, err := podClient.Get(ctx, createdPod.Name, metav1.GetOptions{})
+			framework.ExpectNoError(err)
+
+			// Get the node allocatable resources
+			nodeName := podStatus.Spec.NodeName
+			node, err := f.ClientSet.CoreV1().Nodes().Get(ctx, nodeName, metav1.GetOptions{})
+			framework.ExpectNoError(err)
+			// Prepare expectations based on node allocatable resources
+			expectations := []string{
+				"CPU_LIMIT=2",
+				fmt.Sprintf("MEMORY_LIMIT=%d", node.Status.Allocatable.Memory().Value()),
+			}
+
+			logs, err := e2epod.GetPodLogs(ctx, f.ClientSet, f.Namespace.Name, podStatus.Name, cName)
+			framework.ExpectNoError(err)
+
+			ginkgo.By(fmt.Sprintf("Checking logs from node %s pod %s container %s", nodeName, podStatus.Name, cName))
+			for _, expected := range expectations {
+				m := gomega.MatchRegexp(expected)
+				matches, err := m.Match(logs)
+				framework.ExpectNoError(err)
+				gomega.Expect(matches).To(gomega.BeTrue(), "expected %q in container output: %s", expected, logs)
+			}
+		})
+	})
+})
+
 func testDownwardAPI(ctx context.Context, f *framework.Framework, podName string, env []v1.EnvVar, expectations []string) {
 	pod := &v1.Pod{
 		ObjectMeta: metav1.ObjectMeta{