Commit Graph

1689 Commits (5ba21e83b9f3c50dab929ed6eb2ad5147fb0ff75)

Author SHA1 Message Date
Kubernetes Submit Queue 949440b43a Merge pull request #43698 from sttts/sttts-non-global-admission-plugin-registry
Automatic merge from submit-queue

Non global admission plugin registry

For testing the global state is a problem. This PR turns the actual registry into a struct that must be instantiated. For the beginning, we do this in `pkg/kubeapiserver/admission`. In some follow-up (where we hunt down all globals some day), we will move this into the genericapiserver.
2017-04-12 04:12:11 -07:00
Kubernetes Submit Queue 1ba9202cd8 Merge pull request #42781 from spzala/conversionlint
Automatic merge from submit-queue

Conversionlint

**What this PR does / why we need it**:
This PR adds a comment placeholder for the exported or public functions in conversion generator files. Such functions without a comment results into golint failure in various generated files. The changes in this patch takes care of about 36 related lint failures. 
Given below is an example lint error, 
zz_generated.conversion.go:91:1: exported function Convert_v1alpha1_Binding_To_servicecatalog_Binding should have comment or be unexported

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
Considering minor changes no issue is created. 

**Special notes for your reviewer**:
Hello, I am trying to fix golint failures as we see them in the kubernetes-incubator/service-catalog project. I have separate PRs opened for lint issues related to other generator code which are in separate libraries like gengo. Thanks! 

**Release note**:

```release-note
```
2017-04-12 03:02:26 -07:00
Dr. Stefan Schimanski 63f547e1b1 pkg/admission: make plugin registry non-global 2017-04-12 11:37:25 +02:00
Kubernetes Submit Queue abd92fab1e Merge pull request #44296 from caesarxuchao/move-api-helpers.go
Automatic merge from submit-queue

Move api helpers.go to a subpackage

Part of https://github.com/kubernetes/kubernetes/issues/44065.

This PR moves the pkg/api/helpers.go to its own subpackage. It's mostly a mechanic move, except that
* I removed ConversionError in helpers.go, it's not used by anyone
* I moved the 3 methods of Taint and Toleration to pkg/api/methods.go, and left a TODO saying refactoring these methods to functions.

I'll send a few more PRs to make the k8s.io/kubernetes/pkg/api package only contains the code we want in the k8s.io/api repo, then we can run a [script](a0015fd1be (diff-7a2fbb4371972350ee414c6b88aee1c8)) to cut the new repo.
2017-04-11 23:46:04 -07:00
Kubernetes Submit Queue ceccd305ce Merge pull request #42147 from bowei/ip-alias-2
Automatic merge from submit-queue

Add support for IP aliases for pod IPs (GCP alpha feature)

```release-note
Adds support for allocation of pod IPs via IP aliases.

# Adds KUBE_GCE_ENABLE_IP_ALIASES flag to the cluster up scripts (`kube-{up,down}.sh`).

KUBE_GCE_ENABLE_IP_ALIASES=true will enable allocation of PodCIDR ips
using the ip alias mechanism rather than using routes. This feature is currently
only available on GCE.

## Usage
$ CLUSTER_IP_RANGE=10.100.0.0/16 KUBE_GCE_ENABLE_IP_ALIASES=true bash -x cluster/kube-up.sh

# Adds CloudAllocator to the node CIDR allocator (kubernetes-controller manager).

If CIDRAllocatorType is set to `CloudCIDRAllocator`, then allocation
of CIDR allocation instead is done by the external cloud provider and
the node controller is only responsible for reflecting the allocation
into the node spec.

- Splits off the rangeAllocator from the cidr_allocator.go file.
- Adds cloudCIDRAllocator, which is used when the cloud provider allocates
  the CIDR ranges externally. (GCE support only)
- Updates RBAC permission for node controller to include PATCH
```
2017-04-11 22:09:24 -07:00
Chao Xu 08aa712a6c move helpers.go to helper 2017-04-11 15:49:11 -07:00
Bowei Du f61590c221 Adds support for PodCIDR allocation from the GCE cloud provider
If CIDRAllocatorType is set to `CloudCIDRAllocator`, then allocation
of CIDR allocation instead is done by the external cloud provider and
the node controller is only responsible for reflecting the allocation
into the node spec.

- Splits off the rangeAllocator from the cidr_allocator.go file.
- Adds cloudCIDRAllocator, which is used when the cloud provider allocates
  the CIDR ranges externally. (GCE support only)
- Updates RBAC permission for node controller to include PATCH
2017-04-11 14:07:54 -07:00
Sahdev P. Zala 08639023d0 Conversion generated code changes for golint fix
The exported or public functions requires a doc comment to pass golint.
This commit has changes of conversion generated code. The actual doc
changes are added into a separate commit for a clean review.
2017-04-11 15:34:51 -04:00
Kubernetes Submit Queue 67f2a7cc00 Merge pull request #43888 from liggitt/unsecured-port-user
Automatic merge from submit-queue (batch tested with PRs 43545, 44293, 44221, 43888)

Avoid nil user special-casing in unsecured endpoint

The unsecured handler currently adds no `user.Info` to the request context.  That means that anything that tries to authorize actions in the API server currently has to special case nil users to ensure the unsecured localhost endpoint remains capable of performing all actions. 

This PR changes the unsecured localhost endpoint to be treated as a privileged user internally, so that no special casing is required by code inside the authentication layer

I'm not particularly attached to the username. It doesn't bother me for it to have a slightly uncomfortable sounding name.
2017-04-11 12:18:24 -07:00
Kubernetes Submit Queue 3c461095cc Merge pull request #44152 from NickrenREN/scheduler-bind
Automatic merge from submit-queue (batch tested with PRs 43900, 44152, 44324)

Fix: check "ok" first to avoid panic

Check "ok" and then check if "currState.pod.Spec.NodeName != pod.Spec.NodeName", here if currState is nil, it will panic.

**Release note**:
```release-note
NONE
```
2017-04-11 07:57:16 -07:00
Kubernetes Submit Queue e58d3dbf06 Merge pull request #40800 from k82cn/topology_compare
Automatic merge from submit-queue

Empty label is equal for topologies.

fixes #40799
2017-04-11 00:39:04 -07:00
Kubernetes Submit Queue 39e2d8e58f Merge pull request #41914 from mikedanese/bzl-version
Automatic merge from submit-queue (batch tested with PRs 43887, 41914, 44170)

bazel: implement git build stamping
2017-04-10 19:46:14 -07:00
Kubernetes Submit Queue d2e4f54791 Merge pull request #30302 from aveshagarwal/master-project-node-selector-taints-tolerations
Automatic merge from submit-queue (batch tested with PRs 43870, 30302, 42722, 43736)

Admission plugin to merge pod and namespace tolerations for restricting pod placement on nodes

```release-note
This admission plugin checks for tolerations on the pod being admitted and its namespace, and verifies if there is any conflict. If there is no conflict, then it merges the pod's namespace tolerations with the the pod's tolerations and it verifies them against its namespace' whitelist of tolerations and returns. If a namespace does not have its default or whitelist tolerations specified, then cluster level default and whitelist is used. An example of its versioned config:

apiVersion: apiserver.k8s.io/v1alpha1
kind: AdmissionConfiguration
plugins:
- name: "PodTolerationRestriction"
  configuration:
    apiVersion: podtolerationrestriction.admission.k8s.io/v1alpha1
    kind: Configuration
    default:
     - Key: key1
       Value: value1
     - Key: key2
       Value: value2
    whitelist:
    - Key: key1
      Value: value1
    - Key: key2
      Value: value2
```
2017-04-10 13:33:13 -07:00
Kubernetes Submit Queue 9a9f622b3d Merge pull request #44256 from NickrenREN/scheduler-event
Automatic merge from submit-queue

Scheduler event: nit: when bind fails, send warning event

**Release note**:
```release-note
NONE
```
2017-04-10 11:09:57 -07:00
NickrenREN 609ddac855 Nit: when bind fails, send warning event 2017-04-10 10:50:13 +08:00
Kubernetes Submit Queue 6e3bd081d5 Merge pull request #43892 from bsalamat/sched_conf1
Automatic merge from submit-queue

Scheduler can recieve its policy configuration from a ConfigMap

**What this PR does / why we need it**: This PR adds the ability to scheduler to receive its policy configuration from a ConfigMap. Before this, scheduler could receive its policy config only from a file. The logic to watch the ConfigMap object will be added in a subsequent PR.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```Add the ability to the default scheduler to receive its policy configuration from a ConfigMap object.
```
2017-04-08 23:19:43 -07:00
NickrenREN 26482e3cfc Fix small bug to avoid panic 2017-04-08 14:35:41 +08:00
Kubernetes Submit Queue fed535e199 Merge pull request #42524 from k82cn/used_ports_per_node
Automatic merge from submit-queue (batch tested with PRs 41775, 39678, 42629, 42524, 43028)

Aggregated used ports at the NodeInfo level.

fixes #42523

```release-note
Aggregated used ports at the NodeInfo level for `PodFitsHostPorts` predicate.
```
2017-04-07 17:44:19 -07:00
Bobby Salamat f9d1333144 Addressed reviewers comments 2017-04-07 17:31:45 -07:00
Bobby Salamat d1bc320b44 Scheduler can recieve its policy configuration from a ConfigMap 2017-04-07 17:03:12 -07:00
Kubernetes Submit Queue 1ce438d953 Merge pull request #41780 from ddongchen/release-1.5
Automatic merge from submit-queue (batch tested with PRs 43373, 41780, 44141, 43914, 44180)

fix scheduling metrics error for E2eSchedulingLatency
2017-04-07 09:57:37 -07:00
Avesh Agarwal 0a9cdbb587 Auto-generated stuff. 2017-04-06 16:15:34 -04:00
Avesh Agarwal af53794854 Pod toleration restriction plugin with taints and tolerations. 2017-04-06 16:15:34 -04:00
Kubernetes Submit Queue 54f38688d7 Merge pull request #42961 from wanghaoran1988/fix_39032
Automatic merge from submit-queue

leader election lock based on scheduler name

**What this PR does / why we need it**:
This pr changed the leader election lock based on scheduler name.
**Which issue this PR fixes** :
fixes #39032

**Special notes for your reviewer**:

**Release note**:
```
[scheduling]Fix a bug for multiple-schedulers that you cannot start a second scheduler without disabling leader-elect if the default scheduler has leader-elect enabled(default). We changed the leader election lock based on scheduler name.
```
2017-04-06 09:12:11 -07:00
Kubernetes Submit Queue e3e44b77ff Merge pull request #42964 from k82cn/update_defalt_toleration_sec
Automatic merge from submit-queue (batch tested with PRs 44084, 42964)

Updated AddOrUpdateTolerationInPod to return bool only.

Updated AddOrUpdateTolerationInPod to return bool only, as there's no case to generate error (the error was used for annotation, it'll not return error after moving to field); and also update admission & daemonset accordingly.
2017-04-05 20:45:20 -07:00
Mike Danese ba5c2855b3 bazel: implement git build stamping 2017-04-05 11:47:39 -07:00
Andy Goldstein 9f95cf7b4f serviceaccount admission: return correct tokens
Fix a bug in serviceaccount admission introduced when we switched
everything to use shared informers. That change accidentally reused the
list of secrets instead of creating a new one, resulting in all secrets
in the namespace being returned as possible service account tokens,
instead of limiting it only to the actual service account tokens, as it
did before the shared informer conversion. This also adds a unit test to
ensure there is no future regression here.
2017-04-05 12:59:04 -04:00
Haoran Wang fcc73d355d Multiple scheduler leader election support 2017-04-05 22:36:13 +08:00
ddongchen e1c23e9628 fix scheduling metrics error for E2eSchedulingLatency
If we get the scheduling metrics, which is "SchedulingAlgorithmLatency, E2eSchedulingLatency, BindingLatency". The E2eSchedulingLatency should be the sum of SchedulingAlgorithmLatency and BindingLatency, while we found E2eSchedulingLatency is almost the same as E2eSchedulingLatency for some optimization.
2017-04-05 02:49:05 -04:00
Kubernetes Submit Queue 85dfdc1274 Merge pull request #43885 from zhangxiaoyu-zidif/master
Automatic merge from submit-queue

Fix a typo

Fix a typo



**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```
2017-04-02 17:17:26 -07:00
Jordan Liggitt 5d839d0d0b
Avoid nil user special-casing in unsecured endpoint 2017-03-31 13:28:59 -04:00
Kubernetes Submit Queue cc571d1833 Merge pull request #42360 from liggitt/psp-namespaced-use-check
Automatic merge from submit-queue (batch tested with PRs 42360, 43109, 43737, 43853)

Include pod namespace in PSP 'use' authorization check

Follow up to https://github.com/kubernetes/kubernetes/pull/33080/files#diff-291b8dd7d08cc034975ddb3925dbb08fR341

Prior to this PR, when PodSecurityPolicy admission is active, you must be authorized to use a covering PodSecurityPolicy cluster-wide in order to create a pod. This PR changes that to only require a covering PodSecurityPolicy within the pod's namespace.

When used in concert with mechanisms that limits pods within a namespace to a particular set of nodes, this can be used to allow users to create privileged pods within specific namespaces only.

```release-note
Permission to use a PodSecurityPolicy can now be granted within a single namespace by allowing the `use` verb on the `podsecuritypolicies` resource within the namespace.
```
2017-03-31 00:34:22 -07:00
Kubernetes Submit Queue b56b4b71c3 Merge pull request #41473 from jamiehannaford/bump-ir-cov
Automatic merge from submit-queue (batch tested with PRs 42379, 42668, 42876, 41473, 43260)

Bump test coverage for initialresources

**What this PR does / why we need it**:

Increases test coverage for `plugin/pkg/admission/initialresources` to 80.2%.

**Which issue this PR fixes** 

https://github.com/kubernetes/kubernetes/issues/39559

**Special notes for your reviewer**:

Some of these features require E2E tests to achieve 100% coverage, the tests here are just unit tests, so I've tried to delineate as much as possible. I also saw that we might be exporting a lot of this to Heapster in the future.

**Release note**:

```release-note
Test coverage for initialresources increased to 80.2% percent.
```
2017-03-30 23:36:28 -07:00
Xiaoyu Zhang e3d534b2c4 Fix a type
Fix a type
2017-03-31 10:17:19 +08:00
Kubernetes Submit Queue 7331d9ed83 Merge pull request #42578 from ravisantoshgudimetla/selector-spreading
Automatic merge from submit-queue (batch tested with PRs 42662, 43035, 42578, 43682)

Selector spreading - improving code readability.

**What this PR does / why we need it**:
To improve code readability in selector spreading.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #42577





```release-note
```
2017-03-30 11:00:33 -07:00
Klaus Ma a92766d0c7 Update comments for golint. 2017-03-29 09:36:45 +08:00
ravisantoshgudimetla 55d3c82782 Selector spreading improving code readability 2017-03-28 15:41:43 -04:00
Harry Zhang 63197e53a1 Update generated BUILD files 2017-03-28 13:25:48 +02:00
Harry Zhang 2c4514c325 Enable equivalence cache in generic scheduler 2017-03-28 13:25:47 +02:00
Harry Zhang 819554f514 Update equivalence cache to use predicate as key
Remove Invalid field from host predicate
2017-03-28 13:25:01 +02:00
Kubernetes Submit Queue b6d187d5f2 Merge pull request #42087 from cblecker/scheduler-lint
Automatic merge from submit-queue

Add plugin/pkg/scheduler to linted packages

**What this PR does / why we need it**:
Adds plugin/pkg/scheduler to linted packages to improve style correctness.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #41868 

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-03-27 15:14:15 -07:00
Kubernetes Submit Queue 2d7ecce878 Merge pull request #43008 from ravisantoshgudimetla/taints_small_changes
Automatic merge from submit-queue (batch tested with PRs 43681, 40423, 43562, 43008, 43381)

Changes for removing deadcode in taint_tolerations

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #43007
2017-03-27 12:49:27 -07:00
Kubernetes Submit Queue d368148deb Merge pull request #41297 from gyliu513/admit
Automatic merge from submit-queue

Improved test code coverage for plugin/pkg/admission/admit.

**What this PR does / why we need it**:'
part of #39559 , code coverage improved from 60% to 80%
2017-03-25 18:08:20 -07:00
Kubernetes Submit Queue 02ed99ac05 Merge pull request #40849 from k82cn/adm_exec
Automatic merge from submit-queue (batch tested with PRs 42672, 42770, 42818, 42820, 40849)

Improved the code coverage of plugin/pkg/admission/exec.

part of #39559 

refer to the attachment for code coverage: [combined-coverage.html.gz](https://github.com/kubernetes/kubernetes/files/746891/combined-coverage.html.gz)
2017-03-25 14:27:29 -07:00
Guangya Liu c99a2a2b0f Improved test code coverage for plugin/pkg/admission/admit. 2017-03-25 10:27:18 +08:00
ravisantoshgudimetla 043f39b496 Changes for removing deadcode in taint_tolerations
Code cleanup with some modifications and a test-case in taints and tolerations

Code cleanup with some modifications and a test-case in taints and tolerations

Removed unnecessary code from my last commit

Code cleanup with some modifications and a test-case in taints and tolerations

SUggested changes for taints_tolerations

Changes for removing deadcode in taint_tolerations

small changes again

small changes again

Small changes for clear documentation.
2017-03-24 17:03:21 -04:00
Jordan Liggitt 829e6f6cfb
Include pod namespace in PSP 'use' authorization check 2017-03-24 15:14:52 -04:00
Kubernetes Submit Queue 9169eda66a Merge pull request #41404 from k82cn/correct_comments
Automatic merge from submit-queue

Updated comments for admission/storageclass.

Correct comments to reflect fun's feature.
2017-03-24 10:26:33 -07:00
Jordan Liggitt dd7561801a
Authorize PSP usage for pods without service accounts 2017-03-21 19:54:39 -04:00
Jordan Liggitt 939ca532aa
generated files 2017-03-20 23:57:38 -04:00