Commit Graph

1488 Commits (674401ace1ec8071579497df27ad3f20fd2d8801)

Author SHA1 Message Date
Kubernetes Submit Queue dc0afb24d1
Merge pull request #65381 from ostromart/istio-fix-latest-label
Automatic merge from submit-queue (batch tested with PRs 65381, 65751). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Change prometheus versions from latest to tag

**What this PR does / why we need it:**
Istio 0.8.0 yaml references Prometheus components at :latest tag. This affects reproducability and means some versions may not be security scanned.  
https://github.com/kubernetes/kubernetes/issues/65160
2018-07-03 06:16:03 -07:00
Kubernetes Submit Queue df09802b60
Merge pull request #65627 from IvanovOleg/master
Automatic merge from submit-queue (batch tested with PRs 64758, 65627). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fixed the wrong elasticsearch node counter

**What this PR does / why we need it**:
I am experiencing the nasty bug during the deployment of the elasticsearch-logging statefulset on my custom Kubernetes in Azure (AzureDisk persistant storage). Let's imaging that we want two master nodes which our elasticsearch will try to find during the discovery procedure. Because of the delay between creation of two nodes (azure disk creation) there will be a situation when only one node exists in the service endpoint list and it will be enough to pass the elasticsearch logging discovery step. Only one node will be written to the elasticsearch.yml, but it expects two. Elasticsearch will not be able to find required two nodes. Then Kubernetes will terminate the first pod while the second pod is almost ready (remove that endpoint from service). Then it adds the ip of the second pod to the endpoint and discovery fails as well. This is the endless procedure.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
Fixes the wrong elasticsearch node counter

```
2018-06-30 04:41:59 -07:00
Oleg Ivanov ad381d885d Fixed the wrong elasticsearch node counter 2018-06-29 23:03:04 +03:00
Kubernetes Submit Queue b9237462ac
Merge pull request #65474 from davidebelloni/patch-1
Automatic merge from submit-queue (batch tested with PRs 65319, 64513, 65474, 65601, 65634). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Enable “Kubernetes Monitoring” and “PodSecurityPolicies” on the same cluster

Without that the daemonset "metadata-agent" return:

```pods "metadata-agent-" is forbidden: unable to validate against any pod security policy: [spec.containers[0].securityContext.containers[0].hostPort: Invalid value: 8799: Host port 8799 is not allowed to be used. Allowed ports: []]```

```release-note
NONE
```
2018-06-29 12:15:12 -07:00
Davide Belloni d8d894ae11
Renamed with psp-binding suffix 2018-06-29 12:23:29 +02:00
Davide Belloni 957b6ff187
FIX removed file 2018-06-29 12:21:48 +02:00
Davide Belloni 54573a3505
bugfix separated files 2018-06-29 12:16:46 +02:00
Davide Belloni 7fe017f848
Moved under podsecuritypolicies directory 2018-06-29 12:15:54 +02:00
Kubernetes Submit Queue 90f681be10
Merge pull request #65589 from rajansandeep/scrapeport
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add prometheus scrape port to CoreDNS service

**What this PR does / why we need it**:
Add prometheus scrape port

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #https://github.com/kubernetes/kubeadm/issues/955

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-06-29 02:13:13 -07:00
Kubernetes Submit Queue 5a185e0917
Merge pull request #60150 from MrHohn/kube-proxy-priority-beta
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Set pod priority on kube-proxy manifest by default

**What this PR does / why we need it**:
Follow up of https://github.com/kubernetes/kubernetes/pull/59237, set pod priority on kube-proxy by default and remove the unneeded logic in startup script.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #NONE 

**Special notes for your reviewer**:
/assign @bsalamat @bowei 
cc @tanshanshan

**Release note**:

```release-note
NONE
```
2018-06-28 18:54:52 -07:00
Kubernetes Submit Queue e81cbf5797
Merge pull request #65361 from xperimental/fix-detect-exceptions
Automatic merge from submit-queue (batch tested with PRs 65361, 64527). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix exception detection in new version of fluentd-gcp addon

**What this PR does / why we need it**:
The `detect_exceptions` plugin is used to group log entries that belong to a common exception together into one log message. A [recent change](1ca851baec/cluster/addons/fluentd-gcp/fluentd-gcp-configmap.yaml (L100)) to the configuration modified which field is used for the log message, but this change was not applied to the configuration of the `detect_exceptions` plugin, so currently no collation of exception lines is happening.

This change fixes the issue by changing the field the `detect_exceptions` plugin is using.
**Special notes for your reviewer**:

**Release note**:

```release-note
Fixed exception detection in fluentd-gcp plugin.
```
2018-06-28 11:55:02 -07:00
Sandeep Rajan 8798640f21 add scrape port to service 2018-06-28 13:26:11 -04:00
Davide Belloni b24bf0c5e2
Enable “Kubernetes Monitoring” and “PodSecurityPolicies” on the same cluster
Without that the daemonset "metadata-agent" return:

```pods "metadata-agent-" is forbidden: unable to validate against any pod security policy: [spec.containers[0].securityContext.containers[0].hostPort: Invalid value: 8799: Host port 8799 is not allowed to be used. Allowed ports: []]```
2018-06-26 14:06:32 +02:00
Jeff Grafton 23ceebac22 Run hack/update-bazel.sh 2018-06-22 16:22:57 -07:00
Robert Jacob 8f340c6c6a Use correct field for exception detection. 2018-06-22 12:58:41 +02:00
Kubernetes Submit Queue a79de78dc1
Merge pull request #64372 from monotek/fluentd-elasticsearch
Automatic merge from submit-queue (batch tested with PRs 65064, 65218, 65260, 65241, 64372). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

updated fluentd in fluentd-es-image to version 1.2.2

**What this PR does / why we need it**: Updates fluentd in fluentd-es-image to version 1.2.2.
Also updates all other used gems to most recent versions.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-06-21 21:12:22 -07:00
Kubernetes Submit Queue bba28ecd6f
Merge pull request #65084 from x13n/fluentd-termination
Automatic merge from submit-queue (batch tested with PRs 65123, 65176, 65139, 65084, 65056). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Increase fluentd-gcp grace termination period to 1min

By default, all pods have 30s for graceful termination. This gives fluentd additional 30s to export logs e.g. when the node is shutting down.



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
fluentd-gcp grace termination period increased to 60s.
```

cc @vishh
2018-06-21 16:56:16 -07:00
Kubernetes Submit Queue 7888a34f47
Merge pull request #65176 from kawych/master
Automatic merge from submit-queue (batch tested with PRs 65123, 65176, 65139, 65084, 65056). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Pass cluster_location argument to Heapster

**What this PR does / why we need it**:
Fixes Stackdriver monitoring on GCE clusters where cluster location is not a single zone, for example regional clusters.

**Release note**:
```release-note
Pass cluster_location argument to Heapster
```
2018-06-21 16:56:10 -07:00
Martin Ostrowski 43fb801189 Change prometheus versions from latest to tag 2018-06-21 15:58:47 -07:00
Kubernetes Submit Queue ec518c5f56
Merge pull request #65022 from jingax10/calico_addon_branch
Automatic merge from submit-queue (batch tested with PRs 64140, 64898, 65022, 65037, 65027). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update Calico addon yamls to make it work for both 2.x and 3.x. versions.

**What this PR does / why we need it**:

Without this PR, one could not run Calico 3.0+.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #65045 

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-06-21 05:40:16 -07:00
André Bauer cee9deb12c updated gems and versions 2018-06-20 09:33:04 +02:00
Kubernetes Submit Queue fea9a3f1c5
Merge pull request #62910 from jklare/bump_addon_fluentd-es
Automatic merge from submit-queue (batch tested with PRs 64142, 64426, 62910, 63942, 64548). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

update fluentd-elasticsearch addon

**What this PR does / why we need it**:
Elastic now provides a fully opensource version for their prebuild
docker images (elasticsearch, kibana and so on). To avoid running into
licensing conflicts for this addon example, we should rather use these
images instead of the premium ones (were we also have to disable premium
features manually right now).

This PR updates:
- fluentd from <=1.1.0 to ~>1.1.3
- elasticsearch and kibana from 5.6.2 to 6.2.4
- fluentd-elasticsearch-plugin from 2.4.1 to 2.9.1

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

https://github.com/fluent/fluentd/issues/1894

**Special notes for your reviewer**:

**Release note**:

```release-note

```
2018-06-20 00:05:14 -07:00
Kubernetes Submit Queue efd436bb07
Merge pull request #65053 from chanjarster/master
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix dead links in kube-dns/README.md

**What this PR does / why we need it**:

fix dead links in kube-dns/README.md

**Which issue(s) this PR fixes**

no issue

**Special notes for your reviewer**:

**Release note**:
2018-06-19 18:48:10 -07:00
Kubernetes Submit Queue f8b6ac6e97
Merge pull request #64871 from sebgl/patch-1
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix dead-link to dns-horizontal-autoscaler

**What this PR does / why we need it**:

It looks like dns-horizontal-autoscaler doesn't exist in the dns repository anymore, but one level higher.
This PR fixes the dead link.
2018-06-19 18:46:32 -07:00
Kubernetes Submit Queue bd0ce891e4
Merge pull request #64228 from tallclair/dashboard-owners
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update dashboard OWNERS

Update dashboard OWNERS based on @maciaszczykm 's comment: https://github.com/kubernetes/kubernetes/pull/62756#issuecomment-391453524

I pulled the list of reviewers from the @kubernetes/dashboard-maintainers list.

```release-note
NONE
```
2018-06-19 18:45:46 -07:00
Karol Wychowaniec eefdff659d Pass cluster_location argument to Heapster 2018-06-18 13:54:22 +02:00
Daniel Kłobuszewski 7773f8f5eb Increase fluentd-gcp grace termination period to 1min
By default, all pods have 30s for graceful termination. This gives fluentd additional 30s to export logs when the node is shutting down.
2018-06-14 10:44:13 +02:00
Daniel Qian 0ebcef241f fix dead links in kube-dns/README.md 2018-06-13 13:23:58 +08:00
Jing Ai b365408e88 A few cleanups (remove duplicated env vars & unnecessary comments) on yaml files. 2018-06-12 10:53:54 -07:00
Jing Ai 4383c7d648 Update Calico addon yamls to make it work for both 2.x and 3.x. versions.
Co-authored-by: Casey Davenport <casey@tigera.io>
2018-06-12 10:00:51 -07:00
Kubernetes Submit Queue ec434662bd
Merge pull request #64503 from kgolab/kg-ca-rbac
Automatic merge from submit-queue (batch tested with PRs 64503, 64903, 64643, 64987). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Create system:cluster-autoscaler account & role and introduce it to C…

**What this PR does / why we need it**:

This PR adds cluster-autoscaler ClusterRole & binding, to be used by the Cluster Autoscaler (kubernetes/autoscaler repository).
It also updates GCE scripts to make CA use the cluster-autoscaler user account.

User account instead of Service account is chosen to be more in line with kube-scheduler.

**Which issue(s) this PR fixes**:

Fixes [issue 383](https://github.com/kubernetes/autoscaler/issues/383) from kubernetes/autoscaler.

**Special notes for your reviewer**:

This PR might be treated as a security fix since prior to it CA on GCE was using system:cluster-admin account, assumed due to default handling of unsecured & unauthenticated traffic over plain HTTP.

**Release note**:

```release-note
A cluster-autoscaler ClusterRole is added to cover only the functionality required by Cluster Autoscaler and avoid abusing system:cluster-admin role.

action required: Cloud providers other than GCE might want to update their deployments or sample yaml files to reuse the role created via add-on.
```
2018-06-11 17:29:13 -07:00
Karol Gołąb f8fa60e9ea Limit access to configmaps 2018-06-08 18:02:37 +02:00
Karol Gołąb c70b554af9 Create system:cluster-autoscaler account & role and introduce it to CA start-up script 2018-06-08 14:15:52 +02:00
Casey Davenport eebc0767ae Don't specify a description for Calico CRDs 2018-06-07 15:00:29 -07:00
sebgl 1fd31bc12f
Fix dead-link to dns-horizontal-autoscaler
It looks like dns-horizontal-autoscaler doesn't exist in the dns repository anymore, but one level higher.
This PR fixes the dead link.
2018-06-07 12:01:30 +02:00
Kubernetes Submit Queue 7a9c05bd68
Merge pull request #64537 from ostromart/update-istio-0.8
Automatic merge from submit-queue (batch tested with PRs 64723, 64537). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update istio addon manifest to 0.8

**What this PR does / why we need it:**
Update Istio addon version to latest stable 0.8.0.
Changes from vanilla istio[-auth].yaml include:
 - k8s addon Reconcile labels
 - add all available Istio addons (grafana)
 - mirror docker images to gcr.io
 - add auto-injection in default namespace (not reconciled to allow Istio uninstall)
 - remove instance counts to prevent addon reconcile reverting any manual scaling
**Release note**:
```release-note
Update version of Istio addon from 0.6.0 to 0.8.0.
See https://istio.io/about/notes/0.8.html for full Isto release notes.
```
2018-06-06 11:35:13 -07:00
Kubernetes Submit Queue 2f011d01fa
Merge pull request #64473 from nberlee/master
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Drop capabilities of CoreDNS container and run in read-only

**What this PR does / why we need it**: Make the CoreDNS container more secure by dropping (root) capabilities. Improve the integrity of the of the container by running the whole container in read-only.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
Same [changes](aba0245609) as in the CoreDNS deployment repository.
**Release note**:

```release-note
Kubeadm: Make CoreDNS run in read-only mode and drop all unneeded privileges 
```
2018-06-05 10:23:19 -07:00
Kubernetes Submit Queue 5f5ac2e3ff
Merge pull request #64717 from rajansandeep/corednsimage
Automatic merge from submit-queue (batch tested with PRs 64344, 64709, 64717, 63631, 58647). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

CoreDNS pull image from gcr.io

**What this PR does / why we need it**:
CoreDNS now pulls image from gcr.io
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-06-05 02:16:13 -07:00
Nico Berlee 7ee5729eba
Run CoreDNS container only with CAP_NET_BIND_SERVICE, drop all other (root) privileges.
Run filesystem of container and config in read-only mode.
2018-06-05 08:22:47 +02:00
Kubernetes Submit Queue 898831ad9d
Merge pull request #64592 from ravisantoshgudimetla/revert-64364-remove-rescheduler
Automatic merge from submit-queue (batch tested with PRs 63453, 64592, 64482, 64618, 64661). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Revert "Remove rescheduler and corresponding tests from master"

Reverts kubernetes/kubernetes#64364

After discussing with @bsalamat on how DS controllers(ref: https://github.com/kubernetes/kubernetes/pull/63223#discussion_r192277527) cannot create pods if the cluster is at capacity and they have to rely on rescheduler for making some space, we thought it is better to 

- Bring rescheduler back.
- Make rescheduler priority aware.
- If cluster is full and if **only** DS controller is not able to create pods, let rescheduler be run and let it evict some pods which have less priority.
- The DS controller pods will be scheduled now.

So, I am reverting this PR now. Step 2, 3 above are going to be in rescheduler.

/cc @bsalamat @aveshagarwal @k82cn 

Please let me know your thoughts on this. 

```release-note
Revert #64364 to resurrect rescheduler. More info https://github.com/kubernetes/kubernetes/issues/64725 :)
```
2018-06-04 16:56:11 -07:00
Martin Ostrowski a8a24849c0 Modify security profile for proxy 2018-06-04 14:06:22 -07:00
Sandeep Rajan ab0a421e8d coredns to gcr.io repo 2018-06-04 16:44:42 -04:00
Kubernetes Submit Queue 36a3daa355
Merge pull request #61610 from rajansandeep/kubeupaddon
Automatic merge from submit-queue (batch tested with PRs 61610, 64591, 58143, 63929). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Create CoreDNS and kube-dns folders

**What this PR does / why we need it**:
Separate the CoreDNS and kube-dns manifests by creating their own folders (dns/coredns and dns/kube-dns) 

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #61435 

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
cc @MrHohn
2018-06-04 12:26:12 -07:00
Martin Ostrowski 25a1cdbfc5 Set deployment security profile to docker/default 2018-06-01 17:11:32 -07:00
Martin Ostrowski 30714148c8 Update istio addon manifest to 0.8 2018-06-01 17:11:32 -07:00
RaviSantosh Gudimetla 872addf9e3
Revert "Remove rescheduler and corresponding tests from master" 2018-05-31 22:18:49 -04:00
Kubernetes Submit Queue a762ea1beb
Merge pull request #64364 from ravisantoshgudimetla/remove-rescheduler
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove rescheduler and corresponding tests from master

**What this PR does / why we need it**:
This is to remove rescheduler from master branch as we are promoting priority and preemption to beta.
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Part of #57471

**Special notes for your reviewer**:
/cc @bsalamat @aveshagarwal 
**Release note**:

```release-note
Remove rescheduler from master.
```
2018-05-30 22:20:26 -07:00
André Bauer 807047a792 updated versions 2018-05-30 23:04:54 +02:00
Kubernetes Submit Queue 6ea7763c40
Merge pull request #64281 from wangzhen127/es-seccomp
Automatic merge from submit-queue (batch tested with PRs 64281, 62991). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use default seccomp profile for flutend-elasticsearch addons

**What this PR does / why we need it**:
This PR sets the default seccomp profile to 'docker/default' for:
- fluentd-es daemon set.
- kibana-logging deployment.

The elasticsearch-logging stateful set is still unconfined because it uses gce:podsecuritypolicy:privileged.

This PR is a followup of #62662. We are using 'docker/default' instead of 'runtime/default' in addons in order to handle node version skew. When seccomp profile is applied automatically by default later, we can remove those annotations.

This is PR is part of #39845.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-05-30 13:24:05 -07:00
ravisantoshgudimetla aeccffc339 Phase out rescheduler in favor of priority and preemption 2018-05-29 19:52:06 -04:00
Sandeep Rajan 753632d85b create coredns and kube-dns folders 2018-05-29 11:52:57 -04:00
Kubernetes Submit Queue af45e9cdc4
Merge pull request #64258 from rajansandeep/bumpmanifest
Automatic merge from submit-queue (batch tested with PRs 64258, 63068). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update the CoreDNS version and manifest

**What this PR does / why we need it**:
Bumps CoreDNS to 1.1.3 and updates manifest

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
CoreDNS is now v1.1.3
```
2018-05-29 06:58:10 -07:00
André Bauer 1f7a61b6aa raised version tag to 2.1.0 2018-05-27 13:54:27 +02:00
André Bauer d4d7976b05 updated fluentd in fluentd-es-image to version 1.2.1 2018-05-27 13:50:01 +02:00
Kubernetes Submit Queue 8306b0b1a4
Merge pull request #64296 from mindprince/nvidia-gpu-device-plugin-update-strategy
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update nvidia-gpu-device-plugin to apps/v1 and use RollingUpdate updateStrategy.

Even though RollingUpdate is the default updateStrategy, we need to
specify it explicitly here because otherwise updating from
extensions/v1beta1 to apps/v1 doesn't change the updateStrategy.

Related to #57125 and #63634

```release-note
NONE
```

/assign @vishh @jiayingz 
/cc @janetkuo
2018-05-25 11:33:15 -07:00
Rohit Agarwal 5139bb580a Update nvidia-gpu-device-plugin to apps/v1 and use RollingUpdate updateStrategy.
Even though RollingUpdate is the default updateStrategy, we need to
specify it explicitly here because otherwise updating from
extensions/v1beta1 to apps/v1 doesn't change the updateStrategy.
2018-05-24 17:53:13 -07:00
Zhen Wang e9c7fe57d3 Use default seccomp profile for flutend-elasticsearch addon 2018-05-24 11:22:17 -07:00
Zhen Wang c875690d0d Use default seccomp profile for DNS addons. 2018-05-24 10:55:40 -07:00
Sandeep Rajan 8d8b47596e update manifest
fix test
2018-05-24 09:02:16 -04:00
Kubernetes Submit Queue ca62aa1ee2
Merge pull request #62756 from wangzhen127/seccomp-in-addon
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use default seccomp profile for unprivileged addons

**What this PR does / why we need it**:
This PR sets the default seccomp profile of unprivileged addons to 'docker/default'. This PR is a followup of [#62662](https://github.com/kubernetes/kubernetes/pull/62662) and [#62671](https://github.com/kubernetes/kubernetes/pull/62671). We are using 'docker/default' instead of 'runtime/default' in addons in order to handle node version skew. When seccomp profile is applied automatically by default later, we can remove those annotations.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #39845

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-05-23 17:29:16 -07:00
Tim Allclair 6352230631 Update dashboard OWNERS 2018-05-23 13:30:14 -07:00
Kubernetes Submit Queue f105ae3e6d
Merge pull request #63918 from cezarygerard/sd-event-exporter
Automatic merge from submit-queue (batch tested with PRs 63569, 63918, 63980, 63295, 63989). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

New event exporter config with support for new stackdriver resources

New event exporter, with support for use new and old stackdriver resource model.

This should also be cherry-picked to release-1.10 branch, as all  fluentd-gcp components support new and stackdriver resource model.

```release-note
Update event-exporter to version v0.2.0  that supports old (gke_container/gce_instance) and new (k8s_container/k8s_node/k8s_pod) stackdriver resources.
```
2018-05-18 09:54:16 -07:00
Cezary Zawadka d611aeac80 new event exporter config with support for new stackdriver resource types 2018-05-18 10:37:47 +02:00
Zhen Wang 6351e25203 Use runtime/default as default seccomp profile for unprivileged PodSecurityPolicy 2018-05-15 09:39:37 -07:00
Kubernetes Submit Queue b617748f7b
Merge pull request #62905 from serathius/event-exporter-region
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[fluentd-gcp addon] Pass region in seperate field

This PR makes location passed to event-exporter based on `MULTIZONE` env.

Fixes https://github.com/kubernetes/kubernetes/issues/62399
```release-note
NONE
```
/cc @loburm
2018-05-11 06:00:44 -07:00
Marek Siarkowicz f351b00a99 [fluentd-gcp addon] Pass region in seperate field 2018-05-11 09:50:07 +02:00
Kubernetes Submit Queue 0c3edc6f96
Merge pull request #62166 from mbert/master
Automatic merge from submit-queue (batch tested with PRs 57954, 62166). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fluentd-elasticsearch addon: allow graceful shutdown in fluentd-es image.

This PR contains an optimisation to the fluentd-elasticsearch addon. Restarting fluentd pods took unnecessarily long because the start script in the image did not support propagating signals to the actual fluentd process. This patch fixes this behaviour.

```release-note
NONE
```
2018-05-09 07:17:12 -07:00
Kubernetes Submit Queue ba0b90e031
Merge pull request #63535 from serathius/heapster-v1.5.3
Automatic merge from submit-queue (batch tested with PRs 63535, 63528). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Bump Heapster to v1.5.3

This PR updates heapster version in all cluster-monitoring addons

Heapster Changelog:
* Fix stackdriver metrics for node memory using wrong metric type

```release-note
Bump Heapster to v1.5.3
```
/cc @kawych
2018-05-08 19:38:08 -07:00
Kubernetes Submit Queue a743392937
Merge pull request #63353 from bmoyles0117/fix-stackdriver-metadata-agent-url-for-fluentd
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use the logging agent's node name as the metadata agent URL.

The Stackdriver Logging agent should use the node's hostname when it constructs the Stackdriver Metadata Agent's URL, currently, it's using the GKE Master's hostname, which is a bug.

**Release note:**
```release-note
[fluentd-gcp addon] Use the logging agent's node name as the metadata agent URL.
```
2018-05-08 16:20:43 -07:00
Marek Siarkowicz ea3f98deb7 Bump Heapster to v1.5.3 2018-05-08 11:06:41 +02:00
Zhen Wang 27da26754f Use default seccomp profile for addons 2018-05-02 22:50:29 -07:00
Kubernetes Submit Queue b5f61ac129
Merge pull request #62657 from matthyx/master
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update all script shebangs to use /usr/bin/env interpreter instead of /bin/interpreter

This is required to support systems where bash doesn't reside in /bin (such as NixOS, or the *BSD family) and allow users to specify a different interpreter version through $PATH manipulation.
https://www.cyberciti.biz/tips/finding-bash-perl-python-portably-using-env.html
```release-note
Use /usr/bin/env in all script shebangs to increase portability.
```
2018-05-02 19:44:32 -07:00
Bryan Moyles a0a7686e38 Use the logging agent's node name as the metadata agent URL. 2018-05-02 10:12:35 +02:00
Kubernetes Submit Queue dd1d5c74f2
Merge pull request #63152 from mikedanese/break
Automatic merge from submit-queue (batch tested with PRs 63152, 63253). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Revert "Revert "gce: move etcd dir cleanup to manifests""

This reverts commit 2d6b4d0fa0.

```release-note
NONE
```
2018-05-01 07:36:09 -07:00
Kubernetes Submit Queue 699209db2a
Merge pull request #55971 from asottile/patch-1
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

`exec` away the shell for node-problem-detector
2018-04-30 15:13:59 -07:00
Marek Siarkowicz f39b60824a [prometheus addon] Fix missing storage class in alertmanager PVC 2018-04-30 12:30:20 +02:00
Kubernetes Submit Queue f8fea90d8d
Merge pull request #62852 from serathius/prometheus-statefulset
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[Prometheus addon] Use StatefulSet

This PR changes prometheus server manifest from deployment to statefulset. 
Version label is removed from pods because statefulset disallows updating selectors.

```release-note
NONE
```
/cc @branch @kawych
2018-04-29 04:34:36 -07:00
Marek Siarkowicz b691f2ab1d Add other prometheus monitoring components 2018-04-26 17:14:49 +02:00
Mike Danese 6817494424 Revert "Revert "gce: move etcd dir cleanup to manifests""
This reverts commit 2d6b4d0fa0.
2018-04-25 08:57:02 -07:00
Kubernetes Submit Queue aab5cb4c34
Merge pull request #63142 from serathius/prometheus-readme
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[prometheus addon] Add readme

This PR adds README file that warns users about it's intended use, and redirects to more mature projects.

```release-note
NONE
```
/cc @brancz
2018-04-25 08:50:47 -07:00
Marek Siarkowicz e2c5bd3711 [prometheus addon] Add readme 2018-04-25 15:06:25 +02:00
Shyam Jeedigunta 2d6b4d0fa0 Revert "gce: move etcd dir cleanup to manifests"
This reverts commit ae73bed1d0.
2018-04-25 12:54:12 +02:00
Jan Klare a7ed23be8e
update fluentd-elasticsearch addon
* elastic now provides a fully opensource version for their prebuild
docker images (elasticsearch, kibana and so on). To avoid running into
licensing conflicts for this addon example, we should rather use these
images instead of the premium ones (were we also have to disable premium
features manually right now)
* remove disable flags for xpack, since *-oss images do not include this anymore
* bump elasticsearch and kibana version from 5.6.4 to 6.2.4
* use oss version from elastic as baseimg for kibana and elasticsearch
* bump fluentd version to ~>1.1.3
* bump gem 'fluent-plugin-elasticsearch' to '~>2.9.1' to allow usage of elasticsearch 6.x
* bump fluentd-es-image to v2.1.0
* fix elasticserach run.sh to align with new elasticsearch upstream container structure
2018-04-25 10:04:40 +02:00
Kubernetes Submit Queue 5b0df3656e
Merge pull request #63000 from kawych/versions
Automatic merge from submit-queue (batch tested with PRs 62590, 62818, 63015, 62922, 63000). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove METADATA_AGENT_VERSION config option

**What this PR does / why we need it**:
Remove METADATA_AGENT_VERSION configuration option. To keep Metadata Agent version consistent across Kubernetes deployments.

**Release note**:
```release-note
Remove METADATA_AGENT_VERSION configuration option.
```
2018-04-24 14:22:23 -07:00
Kubernetes Submit Queue 7105964f62
Merge pull request #63015 from mikedanese/etcd-empty-dir
Automatic merge from submit-queue (batch tested with PRs 62590, 62818, 63015, 62922, 63000). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

gce: move etcd dir cleanup to manifests

we deploy it as a manifest, not an addon so locate it with the other
master manifests.

This is the last "bare pod addon", which needs to be remove to improve the situation in https://github.com/kubernetes/kubernetes/issues/62808.
 
```release-note

```
2018-04-24 14:22:16 -07:00
Mike Danese ae73bed1d0 gce: move etcd dir cleanup to manifests
we deploy it as a manifest, not an addon so locate it with the other
master manifests.
2018-04-24 08:02:32 -07:00
Bryan Moyles e2beef533f Fix bash command for liveness probes in the metadata agents. 2018-04-23 15:47:05 -04:00
Kubernetes Submit Queue 5f1793e3dc
Merge pull request #62728 from php-coder/psp_update_addons_manifests
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update addon manifests to use policy/v1beta1

**What this PR does / why we need it:**
This is a part of the PSP migration from extensions to policy API group. This PR updates addon manifests to use policy/v1beta1 and grant permissions in policy API group.

**Which issue(s) this PR fixes:**
Addressed to https://github.com/kubernetes/features/issues/5
2018-04-23 10:05:35 -07:00
Karol Wychowaniec 6fb42aea4a Remove METADATA_AGENT_VERSION config option 2018-04-23 12:15:48 +02:00
Kubernetes Submit Queue 9b7439d77d
Merge pull request #62909 from kawych/master
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Manage Metadata Agent Config with Addon Manager

**What this PR does / why we need it**:
Fixes error where config map for Metadata Agent was not created by addon manager.

**Release note**:
```release-note
Fix error where config map for Metadata Agent was not created by addon manager.
```
2018-04-23 02:52:06 -07:00
Kubernetes Submit Queue 77f5324223
Merge pull request #62409 from rajansandeep/corednsscaler
Automatic merge from submit-queue (batch tested with PRs 62409, 62856). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

DNS-Autoscaler support for CoreDNS

**What this PR does / why we need it**:
This PR provides the dns-horizontal autoscaler for CoreDNS in kube-up, enabling the tests to pass once CoreDNS is the default. 

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #61176 

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-04-23 01:35:07 -07:00
Karol Wychowaniec ffa84b5c08 Manage Metadata Agent Config with Addon Manager 2018-04-20 16:16:49 +02:00
Marek Siarkowicz c0bc700c3f [Prometheus addon] Use StatefulSet 2018-04-19 16:05:22 +02:00
Matthias Bertschy 9b15af19b2 Update all script to use /usr/bin/env bash in shebang 2018-04-19 13:20:13 +02:00
Marek Siarkowicz 2e3258fb13 [prometheus addon] Use secure kubelet port 2018-04-19 10:48:32 +02:00
Marek Siarkowicz a0724ae389 [prometheus addon] Add OWNERS file 2018-04-18 13:40:08 +02:00
Kubernetes Submit Queue bb8f58b6e6
Merge pull request #62195 from serathius/prometheus
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add prometheus cluster monitoring addon.

This PR adds new cluster monitoring addon based on prometheus.
It adds prometheus deployment with e2e tests.
Additional components will be added iterativly in future.
Manifests based on current Helm chart.
At current state it's not intended for production use.

cc @piosz @kawych @miekg
```release-note
Add prometheus cluster monitoring addon to kube-up
```
/sig instrumentation
/kind feature
/priority important-soon
2018-04-18 02:17:48 -07:00
Kubernetes Submit Queue 01c061c158
Merge pull request #62685 from freehan/allow-default-backend-scale
Automatic merge from submit-queue (batch tested with PRs 62436, 62499, 62664, 62685, 62660). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

allow user to scale default backends

```release-note
Allow user to scale l7 default backend deployment
```
2018-04-17 17:31:20 -07:00
Kubernetes Submit Queue 9261a1ca82
Merge pull request #62418 from mindprince/remove-hostnetwork-from-device-plugin
Automatic merge from submit-queue (batch tested with PRs 62448, 59317, 59947, 62418, 62352). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove hostNetwork and hostPID from nvidia-gpu-device-plugin manifest.

They are not needed.

Fixes https://github.com/kubernetes/kubernetes/issues/62357

```release-note
NONE
```

/assign @jiayingz @vishh 
cc @kodieGlosser
2018-04-17 16:31:24 -07:00
Slava Semushin 044bf2e415 Update addon manifests to use policy/v1beta1 and grant permissions in policy API group. 2018-04-17 14:56:55 +02:00