Automatic merge from submit-queue
Add wojtek to global approvers
**What this PR does / why we need it**:
Allows @wojtek-t to globally approve, as he was the right person to approve
https://github.com/kubernetes/kubernetes/pull/40176 and is a top contributor across the project.
In general, cross cutting code changes should probably allow an override by a maintainer "in the know", until a time where the approvers is fully populated.
**Special notes for your reviewer**:
Doesn't default him as a reviewer across the whole project, unless he thinks that is correct.
**Release note**:
```release-note
NONE
```
/cc @bgrant0607 @wojtek-t @kubernetes/sig-contributor-experience-bugs
Automatic merge from submit-queue
fix typo in describe.go
**What this PR does / why we need it**: fixes typo in `kubectl describe nodes` command
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: (none)
**Special notes for your reviewer**:
**Release note**:
```release-note
```
Automatic merge from submit-queue (batch tested with PRs 38739, 40480, 40495, 40172, 40393)
Rename controller pkg/registry/core/controller to pkg/registry/core/r…
…eplicationcontroller
**What this PR does / why we need it**:
Rename controller pkg/registry/core/controller to pkg/registry/core/replicationcontroller
This will clarify the purpose of the controller since intent is replicationcontroller
Please refer to
https://github.com/kubernetes/kubernetes/issues/17648
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
**Special notes for your reviewer**:
NONE
**Release note**:
```NONE
```
Automatic merge from submit-queue (batch tested with PRs 38739, 40480, 40495, 40172, 40393)
Use existing ABAC policy file when upgrading GCE cluster
When upgrading, continue loading an existing ABAC policy file so that existing system components continue working as-is
```
When upgrading an existing 1.5 GCE cluster using `cluster/gce/upgrade.sh`, an existing ABAC policy file located at /etc/srv/kubernetes/abac-authz-policy.jsonl (the default location in 1.5) will enable the ABAC authorizer in addition to the RBAC authorizer. To switch an upgraded 1.5 cluster completely to RBAC, ensure the control plane components and your superuser have been granted sufficient RBAC permissions, move the legacy ABAC policy file to a backup location, and restart the apiserver.
```
Automatic merge from submit-queue (batch tested with PRs 38739, 40480, 40495, 40172, 40393)
Use fnv hash in the CRI implementation
fnv is more stable than adler. This PR changes CRI implementation to
use fnv for generating container hashes, but leaving the old
implementation (dockertools/rkt). This is because hash is what kubelet
uses to identify a container -- changes to the hash will cause kubelet
to restart existing containers. This is ok for CRI implementation (which
requires a disruptive upgrade already), but not for older implementations.
#40140
Automatic merge from submit-queue (batch tested with PRs 38739, 40480, 40495, 40172, 40393)
Don't build //build/... with "make bazel-build".
This makes "make bazel-build" no longer build docker images and
release tars, which are the slowest and least incremental parts. They
will still be built in CI since we run //:ci-artifacts.
**Release note**:
```release-note
NONE
```
Automatic merge from submit-queue
Object r repeat close
**What this PR does / why we need it**:
Object r repeat close.
each end of the for loop, the object r has been closed. so omitting defer r.close(), to avoid repeat close.
**Special notes for your reviewer**:
**Release note**:
```release-note
```
Automatic merge from submit-queue
Prep node_e2e for GCI to COS name change
GCI will soon change name in etc/os-release from "gci" to "cos".
This prepares the node_e2e tests to deal with that change and also updates some comments/log messages/var names in anticipation.
Automatic merge from submit-queue
Add support of Keystone v3 'domain-name' to 'openstack-heat' cluster setup
**What this PR does / why we need it**:
Keystone v3 authentication by user name [requires the domain (name or ID)](http://developer.openstack.org/api-ref/identity/v3/index.html?expanded=password-authentication-with-scoped-authorization-detail). If `domain-name` is not provided kubelet fails as seen below:
```
kubelet: error: failed to run Kubelet: could not init cloud provider "openstack": You must provide exactly one of DomainID or DomainName to authenticate by Username
systemd: kubelet.service: main process exited, code=exited, status=1/FAILURE
systemd: Unit kubelet.service entered failed state.
systemd: kubelet.service failed.
```
To solve this I pass a new`OS_USER_DOMAIN_NAME` environment variable through openstack-heat's heat-templates to write it as `domain-name` in `/srv/kubernetes/openstack.conf`.
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes#39783
**Special notes for your reviewer**:
**Release note**:
```
domain-name support for Keystone v3 added to openstack-heat cluster setup
```
Automatic merge from submit-queue (batch tested with PRs 39538, 40188, 40357, 38214, 40195)
Use SecretManager when getting secrets for EnvFrom
Merges crossed in the night which missed this needed change.
Automatic merge from submit-queue (batch tested with PRs 39538, 40188, 40357, 38214, 40195)
test for host cleanup in unfavorable pod deletes
addresses issue #31272 with a new e2e test in _kubelet.go_
```release-note
NONE
```
Automatic merge from submit-queue (batch tested with PRs 39538, 40188, 40357, 38214, 40195)
genericapiserver: cut off more dependencies – episode 2
Compare commit subjects.
approved based on #40363
Automatic merge from submit-queue (batch tested with PRs 39538, 40188, 40357, 38214, 40195)
Decoupling scheduler creation from creation of scheduler.Config struc…
**What this PR does / why we need it**:
Adds functionality to the scheduler to initialize from an Configurator interface, rather then via a Config struct.
**Which issue this PR fixes**
Reduces coupling to `scheduler.Config` data structure format so that we can proliferate more interface driven composition of scheduler components.
Automatic merge from submit-queue
Add Microsoft OMS (Operations Management Suite) monitoring DaemonSet example
Adds example to deploy Microsoft OMS monitoring agents using Daemon Sets.
Automatic merge from submit-queue
Able to quick create a HA cluster by kube-up.sh centos provider
Make `kube-up.sh` `centos provider` support quick create a HA cluster, as I said above [#39430](https://github.com/kubernetes/kubernetes/issues/39430), it's more flexible than `kops` or `kubeadm` for some people in a limited network region.
I'm new to k8s dev, so if this pull request need to change, please let me know.
```release-note
Added support for creating HA clusters for centos using kube-up.sh.
```
Automatic merge from submit-queue
[OpenStack-Heat] Add link to the OpenStack CLI install documentation
**What this PR does / why we need it**:
More helpful diagnostic text
**Special notes for your reviewer**:
Trivial patch
**Release note**:
```release-note
NONE
```
Automatic merge from submit-queue
Add serviceaccount owners files
Poor @derekwaynecarr is the sole approver/reviewer for the entire admission package.
This adds OWNERS files for service account controller and admission packages
Automatic merge from submit-queue
dnsprovider: Add IsEmpty method
When batching changes, it is often handy to know whether a changeset
IsEmpty, and thus does not need to be Apply-ed.
```release-note
NONE
```
Leave the old implementation (dockertools/rkt) untouched so that
containers will not be restarted during kubelet upgrade. For CRI
implementation (kuberuntime), container restart is required for kubelet
upgrade.
Automatic merge from submit-queue (batch tested with PRs 40429, 40436)
plugin/pkg/admission/serviceaccount: prefer first referenced secret
When a pod uses a service account that references multiple secrets,
prefer the secrets in the order they're listed.
Without this change, the added test fails:
--- FAIL: TestMultipleReferencedSecrets (0.00s)
admission_test.go:832: expected first referenced secret to be mounted, got "token2"
Closes#40411
cc @kubernetes/sig-auth-pr-reviews
Automatic merge from submit-queue
Wait for the self-hosted control plane during kubeadm init.
**What this PR does / why we need it**:
Currently we are completing kubeadm init while the scheduler and
controller manager are likely still not yet up. In some cases if they
will fail, they won't ever come up.
Instead wait until each pod enters running state before exiting kubeadm.
**Release note**:
```release-note
NONE
```
This makes "make bazel-build" no longer build docker images and
release tars, which are the slowest and least incremental parts. They
will still be built in CI since we run //:ci-artifacts.
Automatic merge from submit-queue (batch tested with PRs 40428, 40176)
Cleaup Affinity post conversion from annotations to fields
**What this PR does / why we need it**:
Cleans up leftover work from the conversion of affinity from annotations to fields.
fixes#40016
related #25319
**Special notes for your reviewer**:
There are some TODO items left for @luxas or @errordeveloper b/c they were trying to use affinity in a way that is not possible.
**Release note**:
```release-note
NONE
```
/cc @kubernetes/sig-scheduling-misc @rrati
Automatic merge from submit-queue (batch tested with PRs 40428, 40176)
Re-enable test-cmd.sh tests
Wrapping `runTests` in a subshell was masking return code failures
Moved init to top-level to properly install stack traces on exit
Fixes https://github.com/kubernetes/kubernetes/issues/39168
When a pod uses a service account that references multiple secrets,
prefer the secrets in the order they're listed.
Without this change, the added test fails:
--- FAIL: TestMultipleReferencedSecrets (0.00s)
admission_test.go:832: expected first referenced secret to be mounted, got "token2"
Automatic merge from submit-queue (batch tested with PRs 38905, 40421)
Revert "Add the ability to edit fields within a config map."
Fixes#40396
This reverts commit 31eca372c9.
#38445 broke edit for all resources other than configmaps:
```
$ kubectl edit serviceaccount default
Error from server (NotFound): configmaps "serviceaccount" not found
```
also, `edit` is a generic command, we can't add subcommands that claim the `configmap` space and mess with the things resourcebuilder accepts
Automatic merge from submit-queue (batch tested with PRs 38905, 40421)
return typed json,yaml syntax errors
**Release note**:
```release-note
release-note-none
```
This patch creates error types for JSON and YAML syntax errors to make
it easier to handle these types of errors by callers of JSON and YAML
decoders.
@fabianofranz @AdoHe
Kubernetes Submit Queue