Commit Graph

856 Commits (58c95c136fc7e608cd154cc496568f547187b7d5)

Author SHA1 Message Date
Wojciech Tyczynski 58c95c136f Quick returns in predicates 2016-07-07 12:34:54 +02:00
k8s-merge-robot 0c696dc95b Merge pull request #27848 from liubin/fix-typos
Automatic merge from submit-queue

fix some typos

Just a minor typos fix.


Signed-off-by: bin liu <liubin0329@gmail.com>
2016-07-06 23:36:49 -07:00
k8s-merge-robot 4d91f0f763 Merge pull request #25137 from huang195/tls_user_emailaddress
Automatic merge from submit-queue

getting emailAddress from TLS cert

Kubernetes if using TLS cert to perform authentication will use the CommonName field of the cert as the authenticating user. In https://github.com/kubernetes/kubernetes/blob/master/plugin/pkg/auth/authenticator/request/x509/x509.go#L106, alternative methods are defined to use emailAddress or DNSName as the authenticating user. The method that uses the emailAddress is not comprehensive as this information can be encoded in different places of the certificate. This PR fixes this.
2016-07-06 19:45:01 -07:00
Hongchao Deng 7127915a66 selector: make sure value of GT and LT is integer 2016-07-04 20:18:17 -07:00
bin liu 426fdc431a Merge branch 'master' into fix-typos 2016-07-04 11:20:47 +08:00
k8s-merge-robot 038ac428f4 Merge pull request #28036 from ericchiang/oidc-auth-plugin-dont-error-if-provider-is-unavailable
Automatic merge from submit-queue

oidc auth plugin: don't hard fail if provider is unavailable

When using OpenID Connect authentication, don't cause the API
server to fail if the provider is unavailable. This allows
installations to run OpenID Connect providers after starting the
API server, a common case when the provider is running on the
cluster itself.

Errors are now deferred to the authenticate method.

cc @sym3tri @erictune @aaronlevy @kubernetes/sig-auth
2016-06-30 13:02:16 -07:00
k8s-merge-robot 61a9358dbd Merge pull request #26774 from xiangpengzhao/fix_predicatesnil
Automatic merge from submit-queue

Check nil pointer in predicates.go

Should check if the pointer is nil in func filterVolumes as is done in [func predicate](https://github.com/kubernetes/kubernetes/blob/master/plugin/pkg/scheduler/algorithm/predicates/predicates.go#L279).
2016-06-30 01:45:26 -07:00
Eric Chiang 2f6db37ff5 oidc auth plugin: don't hard fail if provider is unavailable
When using OpenID Connect authentication, don't cause the API
server to fail if the provider is unavailable. This allows
installations to run OpenID Connect providers after starting the
API server, a common case when the provider is running on the
cluster itself.

Errors are now deferred to the authenticate method.
2016-06-29 23:20:26 -07:00
k8s-merge-robot 9e0a2d3a6b Merge pull request #28203 from ping035627/ping035627-0629
Automatic merge from submit-queue

Add error log for Run function in server.go

When clientcmd.BuildConfigFromFlags and os.Hostname return error, there are no log information in Run function, neither did the upper function(main of scheduler), add it, I suggest.
2016-06-29 21:03:05 -07:00
David McMahon ef0c9f0c5b Remove "All rights reserved" from all the headers. 2016-06-29 17:47:36 -07:00
k8s-merge-robot e7f7a49bac Merge pull request #26016 from hongchaodeng/phantom
Automatic merge from submit-queue

scheduler: change phantom pod test from integration into unit test

This is an effort for #24440.

Why this PR?
- Integration test is hard to debug. We could model the test as a unit test similar to [TestSchedulerForgetAssumedPodAfterDelete()](132ebb091a/plugin/pkg/scheduler/scheduler_test.go (L173)). Currently the test is testing expiring case, we can change that to delete.
- Add a test similar to TestSchedulerForgetAssumedPodAfterDelete() to test phantom pod.
- refactor scheduler tests to share the code between TestSchedulerNoPhantomPodAfterExpire() and TestSchedulerNoPhantomPodAfterDelete()
- Decouple scheduler tests from scheduler events: not to use events
2016-06-29 12:09:49 -07:00
k8s-merge-robot 7f3da674f7 Merge pull request #26680 from olegshaldybin/fake-clientset-registry
Automatic merge from submit-queue

Track object modifications in fake clientset

Fake clientset is used by unit tests extensively but it has some
shortcomings:

- no filtering on namespace and name: tests that want to test objects in
  multiple namespaces end up getting all objects from this clientset,
  as it doesn't perform any filtering based on name and namespace;

- updates and deletes don't modify the clientset state, so some tests
  can get unexpected results if they modify/delete objects using the
  clientset;

- it's possible to insert multiple objects with the same
  kind/name/namespace, this leads to confusing behavior, as retrieval is
  based on the insertion order, but anchors on the last added object as
  long as no more objects are added.

This change changes core.ObjectRetriever implementation to track object
adds, updates and deletes.

Some unit tests were depending on the previous (and somewhat incorrect)
behavior. These are fixed in the following few commits.
2016-06-29 06:04:33 -07:00
k8s-merge-robot 1a1a4709b9 Merge pull request #28093 from dubstack/dubstack-refactor-qos2
Automatic merge from submit-queue

[Refactor] Make QoS naming consistent across the codebase

@derekwaynecarr @vishh PTAL. Can one of you please attach a LGTM.
2016-06-29 02:36:22 -07:00
PingWang 989416b329 Add error log for Run function in server.go
Signed-off-by: PingWang <wang.ping5@zte.com.cn>
2016-06-29 11:11:52 +08:00
Oleg Shaldybin 3b15d5be19 Use correct namespace in unit tests that use fake clientset
Fake clientset no longer needs to be prepopulated with records: keeping
them in leads to the name conflict on creates. Also, since fake
clientset now respects namespaces, we need to correctly populate them.
2016-06-28 11:26:34 -07:00
deads2k a28cf3963b refactor quota evaluation to cleanly abstract the quota access 2016-06-28 11:38:18 -04:00
k8s-merge-robot b6f966f8f5 Merge pull request #27690 from resouer/fix-affinity
Automatic merge from submit-queue

Omit invalid affinity error in admission

Fixes #27645  cc @smarterclayton 

Not sure if this is too aggressive, but user should expect failure if they disable validation after all.
2016-06-28 02:24:22 -07:00
xiangpengzhao 5b69688b4b Check nil for pointer 2016-06-27 22:55:20 -04:00
Buddha Prakash 4acb64f8bd Make Qos naming consistent across the codebase 2016-06-26 16:19:47 -07:00
k8s-merge-robot d64333419c Merge pull request #27749 from dubstack/dubstack-refactor-qos
Automatic merge from submit-queue

[Refactor] QOS to have QOS Class type for QoS classes

This PR adds a QOSClass type and initializes QOSclass constants for the three QoS classes.
It would be good to use this in all future QOS related features. 
This would be good to have for the (Pod level cgroups isolation proposal)[https://github.com/kubernetes/kubernetes/pull/26751] that i am working on aswell.
@vishh PTAL
 
Signed-off-by: Buddha Prakash <buddhap@google.com>
2016-06-26 06:23:23 -07:00
k8s-merge-robot 4e6e4ee1f9 Merge pull request #25934 from ping035627/ping035627-patch-3
Automatic merge from submit-queue

Fix  #25606: Add the length detection of the "predicateFuncs" in generic_scheduler.go

Fix  #25606

The PR add the length detection of the "predicateFuncs" for "findNodesThatFit" function of generic_scheduler.go. 
In “findNodesThatFit” function, if the length of the "predicateFuncs" parameter is 0, it can set filtered equals nodes.Items, and needn't to traverse the nodes.Items.
2016-06-25 03:04:44 -07:00
k8s-merge-robot 19650207a2 Merge pull request #24678 from ericchiang/log_webhook_error
Automatic merge from submit-queue

plugin/pkg/auth/authorizer/webhook: log request errors

Currently the API server only checks the errors returned by an
authorizer plugin, it doesn't return or log them[0]. This makes
incorrectly configuring the wehbook authorizer plugin extremely
difficult to debug.

Add a logging statement if the request to the remove service fails
as this indicates misconfiguration.

[0] https://goo.gl/9zZFv4

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/24678)
<!-- Reviewable:end -->
2016-06-24 21:43:36 -07:00
k8s-merge-robot 2d35871569 Merge pull request #24385 from Clarifai/fixes
Automatic merge from submit-queue

golint fixes for AWS cloudprovider

Among other things, golint doesn't like receivers that are inconsistently named or called "self". Or structs named aws.AWSservices, aws.AWSCloud, etc.
2016-06-24 20:58:49 -07:00
Hongchao Deng 8cd55e8e52 refactor scheduler test and include phantom test 2016-06-24 16:11:59 -07:00
Buddha Prakash c3551ae6cd Refactor qos package
Signed-off-by: Buddha Prakash <buddhap@google.com>
2016-06-24 15:36:04 -07:00
Rudi Chiarito 8db551f674 golint fixes for aws cloudprovider 2016-06-24 17:06:38 -04:00
k8s-merge-robot a405df4391 Merge pull request #25710 from xiangpengzhao/fix_predicate
Automatic merge from submit-queue

No need to log empty string in predicates.go

If `pvcName` is empty, we don't need to log it.
2016-06-24 13:56:26 -07:00
CJ Cullen 38a1042199 Add a 5x exponential backoff on 429s & 5xxs to the webhook Authenticator/Authorizer. 2016-06-23 18:15:39 -07:00
CJ Cullen ae67a4e209 Check HTTP Status code in webhook authorizer/authenticator. 2016-06-22 11:15:33 -07:00
k8s-merge-robot cd66fb7a55 Merge pull request #27772 from jsafrane/kubelet-volume-not-found
Automatic merge from submit-queue

Rephrase 'pv not found in cache' warnings.

When kubelet starts a pod that refers to non-existing PV, PVC or Node, it should clearly show that the requested element does not exist.

Previous `PersistentVolumeClaim 'default/ceph-claim-wm' is not in cache` looks like random kubelet hiccup, while `PersistentVolumeClaim 'default/ceph-claim-wm' not found` suggests that the object may not exist at all and it might be an user error.

Fixes #27523
2016-06-22 05:16:02 -07:00
bin liu fd27cd47f7 fix some typos
Signed-off-by: bin liu <liubin0329@gmail.com>
2016-06-22 18:14:26 +08:00
k8s-merge-robot 07471cf90f Merge pull request #27553 from justinsb/pvc_zone_spreading_2
Automatic merge from submit-queue

AWS/GCE: Spread PetSet volume creation across zones, create GCE volumes in non-master zones

Long term we plan on integrating this into the scheduler, but in the
short term we use the volume name to place it onto a zone.
    
We hash the volume name so we don't bias to the first few zones.
    
If the volume name "looks like" a PetSet volume name (ending with
-<number>) then we use the number as an offset.  In that case we hash
the base name.
2016-06-22 01:22:16 -07:00
Harry Zhang 49fe9d1b41 Add unit test to ensure no error thrown 2016-06-21 22:23:37 -04:00
Jan Safranek c9a60e2d2c Rephrase 'pv not found in cache' warnings.
When kubelet starts a pod that refers to non-existing PV, PVC or Node, it
should clearly show that the requested element does not exist.

Previous "PersistentVolumeClaim 'default/ceph-claim-wm' is not in cache"
looks like random kubelet hiccup, while "PersistentVolumeClaim
'default/ceph-claim-wm' not found" suggests that the object may not exist at
all and it might be an user error.

Fixes #27523
2016-06-21 14:56:11 +02:00
Harry Zhang 080b49276e Omit invalid affinity error in admission 2016-06-21 11:06:34 +08:00
k8s-merge-robot 6fbf99b11a Merge pull request #26753 from ericchiang/rbac-authorizer-tests
Automatic merge from submit-queue

add unit and integration tests for rbac authorizer

This PR adds lots of tests for the RBAC authorizer. 

The plan over the next couple days is to add a lot more test cases.

Updates #23396

cc @erictune
2016-06-19 19:19:08 -07:00
k8s-merge-robot 090e6ff660 Merge pull request #27625 from goltermann/spell2
Automatic merge from submit-queue

Fix several spelling errors in comments

What the title says
2016-06-18 23:08:28 -07:00
Justin Santa Barbara 9c2566572d GCE Multizone: Allow volumes to be created in non-master zone
We had a long-lasting bug which prevented creation of volumes in
non-master zones, because the cloudprovider in the volume label
admission controller is not initialized with the multizone setting
(issue #27656).

This implements a simple workaround: if the volume is created with the
failure-domain zone label, we look for the volume in that zone.  This is
more efficient, avoids introducing a new semantic, and allows users (and
the dynamic provisioner) to create volumes in non-master zones.

Fixes #27657
2016-06-17 23:27:41 -04:00
k8s-merge-robot 8b7d842203 Merge pull request #27227 from abhgupta/issue_27198
Automatic merge from submit-queue

Counting pod volume towards PV limit even if PV/PVC is missing

Fixes #27198 

Implements option 3 from https://github.com/kubernetes/kubernetes/issues/27198#issuecomment-225298492

/cc @smarterclayton @markturansky @childsb
2016-06-17 12:40:51 -07:00
goltermann 218645b346 Fix several spelling errors in comments. 2016-06-17 10:41:18 -07:00
k8s-merge-robot f830a2ceec Merge pull request #27237 from xiangpengzhao/fix_priorityscoreinfo
Automatic merge from submit-queue

Make priority score info clearer

When I trace the scheduler workflow, the log info makes me a bit confused:
Taint Toleration Priority Score info is lacking.
The values of Absolute and Requested resources are in the reverse order.
The values of resources have no type and unit.

This PR tries to make the log info clearer.

before:
```
I0609 15:18:17.978739   32560 node_affinity.go:92] mongo -> vm: NodeAffinityPriority, Score: (0)
I0609 15:18:17.978756   32560 priorities.go:69] mongo -> vm: Least Requested Priority, Absolute/Requested: (100, 209715200) / (4000, 8372678656) Score: (9, 9)
I0609 15:18:17.978896   32560 priorities.go:262] mongo -> vm: Balanced Resource Allocation, Absolute/Requested: (100, 209715200) / (4000, 8372678656) Score: (9)
I0609 15:18:17.978971   32560 selector_spreading.go:233] mongo -> vm: SelectorSpreadPriority, Score: (10)
I0609 15:18:17.979043   32560 generic_scheduler.go:301] Host vm Score 38
```

after:
```
I0611 06:58:23.132306   28814 taint_toleration.go:108] mongo -> vm: Taint Toleration Priority, Score: (10)
I0611 06:58:23.132326   28814 priorities.go:69] mongo -> vm: Least Requested Priority, Absolute/Requested(CPU:millicores, memory:bytes): (4000, 8372678656) / (100, 209715200) Score: (9, 9)
I0611 06:58:23.132367   28814 node_affinity.go:92] mongo -> vm: NodeAffinityPriority, Score: (0)
I0611 06:58:23.132400   28814 priorities.go:262] mongo -> vm: Balanced Resource Allocation, Absolute/Requested(CPU:millicores, memory:bytes): (4000, 8372678656) / (100, 209715200) Score: (9)
I0611 06:58:23.132544   28814 selector_spreading.go:233] mongo -> vm: SelectorSpreadPriority, Score: (10)
I0611 06:58:23.132567   28814 generic_scheduler.go:301] Host vm Score 38
```
2016-06-17 00:56:55 -07:00
Eric Chiang d13e351028 add unit and integration tests for rbac authorizer 2016-06-14 11:07:48 -07:00
Wojciech Tyczynski 5d702a32c1 Fix race in informer 2016-06-14 16:40:12 +02:00
Abhishek Gupta 20ce8b71ab Improving error messages and naming to be clear 2016-06-13 15:23:17 -07:00
Abhishek Gupta 07bc06ba50 Counting pod volume towards PV limit even if PV/PVC is missing 2016-06-13 15:17:42 -07:00
derekwaynecarr ce44b3b98a Quota can look for a previous object from admission rather than do a lookup 2016-06-13 09:50:53 -04:00
xiangpengzhao f1d98ba961 Make priority score info more clear 2016-06-12 02:31:41 -04:00
k8s-merge-robot 9a2ad73cee Merge pull request #22568 from abhgupta/abhgupta-dev
Automatic merge from submit-queue

Considering all nodes for the scheduler cache to allow lookups

Fixes the actual issue that led me to create https://github.com/kubernetes/kubernetes/issues/22554

Currently the nodes in the cache provided to the predicates excludes the unschedulable nodes using field level filtering for the watch results. This results in the above issue as the `ServiceAffinity` predicate uses the cached node list to look up the node metadata for a peer pod (another pod belonging to the same service). Since this peer pod could be currently hosted on a node that is currently unschedulable, the lookup could potentially fail, resulting in the pod failing to be scheduled.

As part of the fix, we are now including all nodes in the watch results and excluding the unschedulable nodes using `NodeCondition`

@derekwaynecarr PTAL
2016-06-11 12:22:46 -07:00
k8s-merge-robot 4793372a85 Merge pull request #25888 from rootfs/attacher-aws-cinder
Automatic merge from submit-queue

implement EBS and Cinder attacher/detacher 

follow up with #21709

@kubernetes/sig-storage
2016-06-10 05:39:22 -07:00
k8s-merge-robot ade299c18f Merge pull request #27146 from mikedanese/nil-ptr
Automatic merge from submit-queue

oidc: fix test nil pointer

```
2016-06-09 13:12:37.262983 I | http: TLS handshake error from 127.0.0.1:32814: remote error: bad certificate
PASS
--- FAIL: TestNewOIDCAuthProvider (0.87s)
panic: runtime error: invalid memory address or nil pointer dereference [recovered]
        panic: runtime error: invalid memory address or nil pointer dereference
[signal 0xb code=0x1 addr=0x0 pc=0x5d91ca]

goroutine 12 [running]:
panic(0x124bd00, 0xc8200101f0)
        /usr/local/google/home/mikedanese/.gimme/versions/go1.6.1.linux.amd64/src/runtime/panic.go:464 +0x3e6
testing.tRunner.func1(0xc820023b90)
        /usr/local/google/home/mikedanese/.gimme/versions/go1.6.1.linux.amd64/src/testing/testing.go:467 +0x192
panic(0x124bd00, 0xc8200101f0)
        /usr/local/google/home/mikedanese/.gimme/versions/go1.6.1.linux.amd64/src/runtime/panic.go:426 +0x4e9
k8s.io/kubernetes/plugin/pkg/auth/authenticator/token/oidc/testing.(*OIDCProvider).AddMinimalProviderConfig(0xc820020580, 0x0)
        /usr/local/google/home/mikedanese/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/plugin/pkg/auth/authenticator/token/oidc/testing/provider.go:85 +0x2a
k8s.io/kubernetes/plugin/pkg/client/auth/oidc.TestNewOIDCAuthProvider(0xc820023b90)
        /usr/local/google/home/mikedanese/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/plugin/pkg/client/auth/oidc/oidc_test.go:51 +0x367
testing.tRunner(0xc820023b90, 0x1d0a360)
        /usr/local/google/home/mikedanese/.gimme/versions/go1.6.1.linux.amd64/src/testing/testing.go:473 +0x98
created by testing.RunTests
        /usr/local/google/home/mikedanese/.gimme/versions/go1.6.1.linux.amd64/src/testing/testing.go:582 +0x892
FAIL    k8s.io/kubernetes/plugin/pkg/client/auth/oidc   3.081s
```

cc @bobbyrullo @yifan-gu
2016-06-10 00:12:28 -07:00