Commit Graph

1886 Commits (2cc0ecdf0fbd4149ce39a8ca71500fec9f093277)

Author SHA1 Message Date
Brendan Burns dcb9b4b591 By default block service proxy to external IP addresses.
Service proxy uses redirects to Pods instead of direct access.
2018-01-24 04:13:15 +00:00
Jordan Liggitt b4fb25261e
return reason for allowed rbac authorizations
includes the binding, role, and subject that allowed a request so audit can make use of it
2018-01-19 14:32:39 -05:00
Kubernetes Submit Queue 3256546a79
Merge pull request #56948 from MrHohn/esipp-remove-feature-gate
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove ExternalTrafficLocalOnly from kube_feature gate

*What this PR does / why we need it**:
This PR is for v1.10.

External Source IP Preservation (ESIPP) had been promoted to GA since 1.7. Following the proposal on https://github.com/kubernetes/kubernetes/issues/46404#issuecomment-303939180, we should be able to remove it from feature gate now.

Added release note to announce this.

Also ref the previous attempt: https://github.com/kubernetes/kubernetes/pull/45857.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #56645

**Special notes for your reviewer**:

**Release note**:

```release-note
"ExternalTrafficLocalOnly" has been removed from feature gate. It has been a GA feature since v1.7.
```
2018-01-19 00:35:01 -08:00
Kubernetes Submit Queue 44d0ba29d3
Merge pull request #56960 from islinwb/remove_unused_code_ut_pkg
Automatic merge from submit-queue (batch tested with PRs 53631, 56960). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove unused code in UT files in pkg/

**What this PR does / why we need it**:
Remove unused code in UT files in pkg/ .

**Release note**:

```release-note
NONE
```
2018-01-18 02:41:29 -08:00
Jordan Liggitt 0a1b76cb11
Limit all category to apps group for ds/deployment/replicaset 2018-01-15 14:41:42 -05:00
linweibin fa8afc1d39 Remove unused code in UT files in pkg/ 2018-01-15 16:02:35 +08:00
Christoph Blecker 80e344644e
Regenerate all generated code 2018-01-02 00:21:07 -08:00
Jeff Grafton efee0704c6 Autogenerate BUILD files 2017-12-23 13:12:11 -08:00
Kubernetes Submit Queue 9f78ee56bf
Merge pull request #56409 from porridge/trim-trailing-newline
Automatic merge from submit-queue (batch tested with PRs 56161, 56324, 55685, 56409, 55296). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Do not log trailing whitespace.

**What this PR does / why we need it**:

Gets rid of useless spaces, makes log parser verification slightly
easier.

**Release note**:
```release-note
NONE
```
2017-12-15 04:33:46 -08:00
Kubernetes Submit Queue dd4f84f7f5
Merge pull request #54304 from frodenas/repair-events
Automatic merge from submit-queue (batch tested with PRs 56308, 54304, 56364, 56388, 55853). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Send events on certain service repair controller errors

**What this PR does / why we need it**:

This PR enables sending events when the api-server service IP and port allocator repair controllers find an error repairing a cluster ip or a port respectively.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #54303

**Special notes for your reviewer**:

In case of an error, events will be emitted [every 3 minutes](https://github.com/kubernetes/kubernetes/blob/master/pkg/master/controller.go#L93) for each failed Service. Even so, event spam protection has been merged (#47367) to mitigate the risk of excessive events.

**Release note**:

```release-note
api-server provides specific events when unable to repair a service cluster ip or node port
```
2017-12-15 02:04:37 -08:00
Zihong Zheng 9ab98d9f69 Remove ExternalTrafficLocalOnly from kube_feature gate 2017-12-07 21:25:11 -08:00
Dr. Stefan Schimanski 5b214bbac5 admission: do not require v1alph1 for v1beta1 2017-12-01 14:14:39 +01:00
Marcin Owsiany f9ff53d06e Do not log trailing whitespace. 2017-11-27 14:49:17 +01:00
Ferran Rodenas 8ed0bc1250 Send events on ip and port allocator repair controller errors
Signed-off-by: Ferran Rodenas <rodenasf@vmware.com>
2017-11-24 19:10:06 +01:00
Kubernetes Submit Queue 2db7c41cfa
Merge pull request #56252 from deads2k/rbac-04-migrate
Automatic merge from submit-queue (batch tested with PRs 56249, 56118, 56255, 56252, 56256). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

clear resourceversion for migrated cluster roles

Fixes #56248

Need to clear the resource version.  Alternatively, we could clear it in storage when we clear and stomp other fields.

Works locally for me.
2017-11-23 00:23:26 -08:00
Kubernetes Submit Queue 60c2090191
Merge pull request #49112 from gmarek/eventAPI
Automatic merge from submit-queue (batch tested with PRs 55952, 49112, 55450, 56178, 56151). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

New API group for Events.

Fix kubernetes/features#383

cc @shyamjvs 

```release-note
Add events.k8s.io api group with v1beta1 API containing redesigned Event type.
```
2017-11-22 21:48:42 -08:00
Kubernetes Submit Queue 00b2d95c86
Merge pull request #55148 from dixudx/controller_defaultGC_DeleteDependents
Automatic merge from submit-queue (batch tested with PRs 52767, 55065, 55148, 56228, 56221). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

change DefaultGarbageCollectionPolicy to DeleteDependents for workloads controllers

**What this PR does / why we need it**:
As part of the apps/v1 GA effort (kubernetes/features#353) for v1.9. For core controllers, like `Deployment`, `DaemonSet`, `ReplicaSet`, and `StatefulSet`, changing the `DefaultGarbageCollectionPolicy` from `OrphanDependents` to `DeleteDependents` will make these objects consistent with the default behavior for all new objects.

For legacy API versions, the `DefaultGarbageCollectionPolicy` remains `OrphanDependents`.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
ref #55027

**Special notes for your reviewer**:
/cc @enisoc @caesarxuchao @kow3ns
/assign @kubernetes/sig-apps-api-reviews 

**Release note**:

```release-note
The default garbage collection policy for Deployment, DaemonSet, StatefulSet, and ReplicaSet has changed from OrphanDependents to DeleteDependents when the deletion is requested through an `apps/v1` endpoint. Clients using older endpoints will be unaffected. This change is only at the REST API level and is independent of the default behavior of particular clients (e.g. this does not affect the default for the kubectl `--cascade` flag).

If you upgrade your client-go libs and use the `AppsV1()` interface, please note that the default garbage collection behavior is changed.
```
2017-11-22 19:49:37 -08:00
David Eads c22fbadc0f clear resourceversion for migrated cluster roles 2017-11-22 16:16:01 -05:00
Marek Grabowski ef6f0b8c6e generated 2017-11-22 18:40:09 +00:00
gmarek 69e2a9cb48 Add new Events API group 2017-11-22 18:40:09 +00:00
Di Xu 344fe56ed3 change DefaultGarbageCollectionPolicy to DeleteDependents for workload controllers 2017-11-22 10:09:44 +08:00
Chao Xu fcf4f15c89 update-all generated 2017-11-21 13:00:40 -08:00
Chao Xu 3ad49765d6 change storage, registry, discovery version for admissionregistration 2017-11-21 13:00:39 -08:00
Kubernetes Submit Queue bebb9c9175
Merge pull request #55963 from sttts/sttts-drop-registrytester-scheme
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

apiserver: remove unneeded scheme from registry tester

Follow-up of https://github.com/kubernetes/kubernetes/pull/55622, removing an unused scheme.
2017-11-20 07:04:39 -08:00
Dr. Stefan Schimanski d4d53c0e2a apiserver: remove unneeded scheme from registry tester 2017-11-20 09:39:44 +01:00
Scott Creeley de4138d828 generated code for VolumeMode api change 2017-11-18 12:03:33 -05:00
Scott Creeley 36f30bc689 Add VolumeType api to PV and PVC 2017-11-18 11:25:27 -05:00
Dr. Stefan Schimanski 0b100cb69b registry: move generic registry tester into k8s.io/apiserver 2017-11-16 09:03:42 +01:00
Dr. Stefan Schimanski 3410f536f4 registry: cut-off kube dependencies from registrytest 2017-11-16 08:57:58 +01:00
Michelle Au b60bd37114 StorageClass API changes for VolumeBindingMode 2017-11-15 09:19:47 -08:00
Kubernetes Submit Queue ebe8ea73fd
Merge pull request #54463 from saad-ali/volumeAttachmentAPI
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Introduce new `VolumeAttachment` API Object

**What this PR does / why we need it**:

Introduce a new `VolumeAttachment` API Object. This object will be used by the CSI volume plugin to enable external attachers (see design [here](https://github.com/kubernetes/community/pull/1258). In the future, existing volume plugins can be refactored to use this object as well.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*:  Part of issue https://github.com/kubernetes/features/issues/178

**Special notes for your reviewer**:
None

**Release note**:

```release-note
NONE
```
2017-11-14 22:05:27 -08:00
Saad Ali 9f294c1ad0 Generated files for new VolumeAttachemnt object 2017-11-14 17:08:49 -08:00
Saad Ali d96c105d71 Introduce storage v1alpha1 and VolumeAttachment
Introduce the v1alpha1 version to the Kubernetes storage API. And add a
new VolumeAttachment object to that version. This object will initially
be used only by the new CSI Volume Plugin. Eventually existing volume
plugins can be refactored to use it too.
2017-11-14 17:08:48 -08:00
David Eads f34fb9b0ab handle clusterrole migration 2017-11-13 08:18:00 -05:00
David Eads a53e5de3db generated 2017-11-13 08:18:00 -05:00
David Eads 0f0a5223df rbac api changes for aggregation 2017-11-13 08:14:37 -05:00
Kubernetes Submit Queue 91615e4fd9
Merge pull request #49258 from xiangpengzhao/fix-dup-port-panic
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Check dup NodePort with protocols when update services

**What this PR does / why we need it**:
As the title says.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #48579 fixes: #54898 fixes: #55327

**Special notes for your reviewer**:
/assign @freehan 
/cc @cblecker 

**Release note**:

```release-note
NONE
```
2017-11-12 22:53:38 -08:00
Dr. Stefan Schimanski 1e79dfb959 Update generated code 2017-11-10 18:26:46 +01:00
Kubernetes Submit Queue ae2edc439e
Merge pull request #55413 from liggitt/internal-autoscaling
Automatic merge from submit-queue (batch tested with PRs 53047, 54861, 55413, 55395, 55308). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Switch internal scale type to autoscaling, enable apps/v1 scale subresources

xref #49504

* Switch workload internal scale type to autoscaling.Scale (internal-only change)
* Enable scale subresources for apps/v1 deployments, replicasets, statefulsets

```release-note
NONE
```
2017-11-10 07:00:44 -08:00
mbohlool 4568e0530c Update generated files for MutatingWebhookConfiguration 2017-11-09 15:33:50 -08:00
mbohlool fc5a613c17 Add MutatingWebhookConfiguration type 2017-11-09 14:00:14 -08:00
mbohlool cb43840492 Update generated files 2017-11-09 11:39:52 -08:00
mbohlool 9ddea83a2c Rename ExternalAdmissionHookConfiguration to ValidatingWebhookConfiguration 2017-11-09 11:39:50 -08:00
Jordan Liggitt f9e2e406ba
Enable scale subresources for apps/v1 2017-11-09 13:42:15 -05:00
Jordan Liggitt f927f2ab89
generated files 2017-11-09 13:42:15 -05:00
Jordan Liggitt 9c1be33ee1
Switch to autoscaling.Scale internally 2017-11-09 13:42:14 -05:00
Dr. Stefan Schimanski bec617f3cc Update generated files 2017-11-09 12:14:08 +01:00
Dr. Stefan Schimanski 012b085ac8 pkg/apis/core: mechanical import fixes in dependencies 2017-11-09 12:14:08 +01:00
Dr. Stefan Schimanski d13b936a2a pkg/apis/core: fixup conversion func names in dependencies 2017-11-09 12:14:07 +01:00
Kubernetes Submit Queue d33077526a
Merge pull request #53273 from mikedanese/authtristate
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add support for short-circuit deny in union authorizer

This change has no behavioral changes.

Fixes https://github.com/kubernetes/kubernetes/issues/51862

```release-note
Add support for the webhook authorizer to make a Deny decision that short-circuits the union authorizer and immediately returns Deny. 
```
2017-11-07 09:25:37 -08:00