Commit Graph

138 Commits (3fbdc8c32703a01261f8a37f2bf12242470926bb)

Author SHA1 Message Date
Jordan Liggitt 89b0b0b84b Clean up initializer-related comments, test data 2019-01-25 12:37:45 -05:00
Kubernetes Prow Robot d654b49c0e
Merge pull request #73097 from bsalamat/fix_taint_nodes
Add NotReady taint to new nodes during admission
2019-01-24 23:46:23 -08:00
Bobby (Babak) Salamat 763cb708d1 Autogenerated files 2019-01-24 10:31:23 -08:00
Bobby (Babak) Salamat c2a4d2cbdf Add a default admission controller to taint new nodes on creation. 2019-01-24 10:31:23 -08:00
Jordan Liggitt 1a15d80967 generated 2019-01-23 16:34:44 -05:00
Jordan Liggitt dc1fa870bf Remove alpha InitializerConfiguration types, Initializers admission plugin 2019-01-23 11:37:39 -05:00
lovejoy d437305cbf
Fix the authorization-policy-file description
Actually this is in a format like below not a csv format
```json
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group":"system:authenticated",  "namespace": "*", "resource": "*","apiGroup": "*"}}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group":"system:authenticated",  "namespace": "*", "resource": "ingresses","apiGroup": "extensions"}}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group":"system:authenticated",  "namespace": "*", "resource": "*","apiGroup": "apiextensions.k8s.io"}}
```
2018-12-24 14:54:34 +08:00
k8s-ci-robot bd2cb5a72d
Merge pull request #70831 from mikedanese/securesvcacct
add BoundServiceAccountTokenVolume feature
2018-11-13 08:54:25 -08:00
Mike Danese f4ff26679f add BoundServiceAccountTokenVolume feature
* require TokenRequest to be enabled and configured
* bind ca.crt publisher to this feature rather than to TokenRequest
2018-11-12 13:11:47 -08:00
Davanum Srinivas 954996e231
Move from glog to klog
- Move from the old github.com/golang/glog to k8s.io/klog
- klog as explicit InitFlags() so we add them as necessary
- we update the other repositories that we vendor that made a similar
change from glog to klog
  * github.com/kubernetes/repo-infra
  * k8s.io/gengo/
  * k8s.io/kube-openapi/
  * github.com/google/cadvisor
- Entirely remove all references to glog
- Fix some tests by explicit InitFlags in their init() methods

Change-Id: I92db545ff36fcec83afe98f550c9e630098b3135
2018-11-10 07:50:31 -05:00
walter 2af982abb9 Fixes lint errors in kubeapiserver packages
Fixes lint errors in kubeapiserver/admission, kubeapiserver/authorizer,
kubeapiserver/authenticator. Also enables lint testing of these
directories.
Fixed go format.
Fixed changes from config.
2018-11-04 17:22:41 -08:00
Mike Danese a13b48de94 default api audiences to service account token issuer if available
This is a sane default that users can choose to migrate away from later.
2018-10-29 16:40:06 -07:00
Mike Danese 371b1e7fed promote --service-account-api-audiences to top level kube-apiserver config
The service account authenticator isn't the only authenticator that
should respect API audience. The authentication config structure should
reflect that.
2018-10-22 18:21:37 -07:00
k8s-ci-robot cf3a930938
Merge pull request #69607 from mikedanese/audctx
tokenreview: add APIAudiences config to generic API server and augment context
2018-10-15 19:03:43 -07:00
k8s-ci-robot 793b8752d1
Merge pull request #68777 from stewart-yu/patch-1
remove unneed parameter in test struct
2018-10-12 16:01:23 -07:00
Mike Danese 21fd8f2041 tokenreview: add APIAudiences config to generic API server and augment context 2018-10-09 22:47:10 -07:00
Christoph Blecker 97b2992dc1
Update gofmt for go1.11 2018-10-05 12:59:38 -07:00
Stewart-YU 5ef8e41215 remove unneed parameter in test struct
remove unneed parameter in test struct
2018-09-26 08:59:42 +08:00
Chao Xu 1fb6b5aa69 Deprecation notice of storage-versions flag 2018-08-30 19:45:43 -07:00
yue9944882 f624a4efb8 externalize node admission
fixes internal pod annotation reference

completely strip internal informers from authz initialization
2018-08-21 23:33:03 +08:00
Kubernetes Submit Queue b9544382ba
Merge pull request #67060 from sttts/sttts-unify-insecure-serving
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kube-{apiserver,ctrl-mgr}: unify into DeprecatedInsecureServingOptions

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:
```release-note

```
2018-08-17 08:50:36 -07:00
Dr. Stefan Schimanski c2724793e8 Update bazel 2018-08-17 08:57:21 +02:00
Dr. Stefan Schimanski d787213d1b kube-apiserver: switch apiserver's DeprecatedInsecureServingOptions 2018-08-17 08:56:47 +02:00
Dr. Stefan Schimanski 1d9a896066 apiserver: move controller-manager's insecure config into apiserver 2018-08-17 08:56:46 +02:00
hangaoshuai cacf18f859 add unit test for func ToAuthenticationConfig 2018-08-16 19:24:11 +08:00
hangaoshuai 4157f5a1ae add unit test for Authentication Validate 2018-08-16 18:13:58 +08:00
yue9944882 e8ae7887a5 This is a combination of 3 commits.
refactor storage factory options

review: minor changes

1. make storage factory config complete with options
2. make BuildGenericConfig private

review: move codes
2018-08-06 22:29:10 +08:00
Dr. Stefan Schimanski e15ac9eb72 kube-apiserver: disallow --secure-port 0 2018-07-09 14:03:08 +02:00
Dr. Stefan Schimanski 1575e17365 kube-apiserver: drop unused loopback token in insecure mode 2018-07-04 19:15:11 +02:00
ravisantoshgudimetla d5fa41b920 Build file generated 2018-07-02 22:25:45 -04:00
ravisantoshgudimetla f1c202d392 Add priority to defaultOn plugins list 2018-07-02 22:25:40 -04:00
Kubernetes Submit Queue 2da49321e6
Merge pull request #63653 from WanLinghao/token_expiry_limit
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add limit to the TokenRequest expiration time

**What this PR does / why we need it**:
A new API TokenRequest has been implemented.It improves current serviceaccount model from many ways.
This patch adds limit to TokenRequest expiration time.


**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #63575

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-06-27 00:31:08 -07:00
Jeff Grafton 23ceebac22 Run hack/update-bazel.sh 2018-06-22 16:22:57 -07:00
WanLinghao f16470c3f1 This patch adds limit to the TokenRequest expiration time. It constrains a TokenRequest's expiration time to avoid extreme value which could harm the cluster. 2018-06-14 09:31:50 +08:00
Kubernetes Submit Queue 9f280b6739
Merge pull request #64326 from andrewsykim/default-disable-pvl
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

disable PersistentVolumeLabel admission controller by default

**What this PR does / why we need it**:
Disables PersisntVolumeLabel admission controller by default. This was set for [deprecation since 1.8](https://github.com/kubernetes/kubernetes/pull/52618) so we can now disable it by default. PersisntVolumeLabel admission controller can still be explicitly enabled and can also run on external cloud controller manageres. 

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:

https://github.com/kubernetes/kubernetes/issues/52617

**Special notes for your reviewer**:

**Release note**:

```release-note
(ACTION REQUIRED) PersisntVolumeLabel admission controller is now disabled by default. If you depend on this feature (AWS/GCE) then ensure it is added to the `--enable-admission-plugins` flag on the kube-apiserver.
```
2018-05-28 03:19:17 -07:00
Hemant Kumar 0dd6e75567 Move volume resizing to beta
Update bootstrap policies
2018-05-25 15:32:38 -04:00
andrewsykim 4c3fa4f9ba disable PersistentVolumeLabel admission controller by default 2018-05-25 12:37:56 -04:00
David Eads c5445d3c56 simplify api registration 2018-05-08 18:33:50 -04:00
David Eads a68c57155e remove KUBE_API_VERSIONS 2018-04-26 08:27:49 -04:00
Kubernetes Submit Queue 3e6f27f021
Merge pull request #62621 from hzxuzhonghu/kube-api-show-deprecated-flags
Automatic merge from submit-queue (batch tested with PRs 58784, 62057, 62621, 62652, 62656). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Show deprecated kube-apiserver flags

**What this PR does / why we need it**:

This PR unhides deprecated kube-apiserver flags, so that the deprecation notice is clearly visible in --help.

Fixes #62617

**Release note**:

```release-note
NONE
```
2018-04-16 12:58:17 -07:00
Kubernetes Submit Queue 229ab73ada
Merge pull request #58784 from wackxu/reminit
Automatic merge from submit-queue (batch tested with PRs 58784, 62057, 62621, 62652, 62656). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove deprecated initresource admission plugin

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:

xref https://github.com/kubernetes/kubernetes/pull/55375#issuecomment-360329586

**Special notes for your reviewer**:
/assign @piosz @deads2k 

**Release note**:

```release-note
remove deprecated initresource admission plugin
```
2018-04-16 12:58:11 -07:00
hzxuzhonghu 8f98af9459 Show deprecated kube-apiserver flags 2018-04-16 21:20:06 +08:00
rithu john 444bbd2654 pkg/kubeapiserver/options: update Bazel files 2018-04-10 12:03:54 -07:00
rithu john dd433b595f oidc authentication: Required claims support 2018-04-10 12:02:54 -07:00
Kubernetes Submit Queue 2fdcfeae51
Merge pull request #61166 from hzxuzhonghu/authz-flag-validate
Automatic merge from submit-queue (batch tested with PRs 60519, 61099, 61218, 61166, 61714). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kube-apiserver add BuiltInAuthorizationOptions validation

Validate BuiltInAuthorizationOptions after flags parsed. 

**Release note**:

```release-note
NONE
```
2018-03-26 23:20:14 -07:00
hzxuzhonghu 755df0461d validate authorization flags in BuiltInAuthorizationOptions.Validate 2018-03-26 20:37:02 +08:00
Kubernetes Submit Queue a0ea7f3857
Merge pull request #61453 from hzxuzhonghu/kube-api-cleanup
Automatic merge from submit-queue (batch tested with PRs 61453, 61393, 61379, 61373, 61494). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove kube-apiserver `--storage-version` flag

#`--storage-version` has been deprecated more than a year ago, should remove it.

**Release note**:

```release-note
Remove kube-apiserver `--storage-version` flag, use `--storage-versions` instead.
```
2018-03-22 06:20:15 -07:00
Kubernetes Submit Queue e6bd4ffbe9
Merge pull request #61213 from junxu/remove-deprecate-authorization-rbac-super-user
Automatic merge from submit-queue (batch tested with PRs 61087, 61075, 61213, 61149, 60826). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove deprecated paramter "authorization-rbac-super-user"

**What this PR does / why we need it**: As RBAC is v1 now, we need remove the deprecated  "authorization-rbac-super-user" paramter for RBAC alpha

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note

```
2018-03-21 06:41:30 -07:00
hzxuzhonghu 9789f24744 remove kube-apiserver unused storage-version flag 2018-03-21 11:26:48 +08:00
Kubernetes Submit Queue ca56628912
Merge pull request #60710 from NickrenREN/admission-pv-dir-change
Automatic merge from submit-queue (batch tested with PRs 60710, 60855, 60873, 60895, 60862). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Move `persistentvolume` into `storage` package under `plugin/pkg/admission` 

Sorry for omitting this in the previous PR #60367

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Following #60367

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```

/assign @jsafrane @thockin
2018-03-20 10:34:33 -07:00