Commit Graph

6061 Commits (806f6772c6ccc0d852a2120631f6938ae09a3118)

Author SHA1 Message Date
Jordan Liggitt 3fafdb7001
Detect backsteps correctly in base path detection
Avoid false positives with atomic writer ..<timestamp> directories
2018-03-13 02:23:06 -04:00
Kubernetes Submit Queue a1c693418c
Merge pull request #60994 from joejulian/add_remote_flag_option
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add missing container-runtime "remote" option

**What this PR does / why we need it**:
Added the "remote" option to the auto-generated documentation for the
`--container-runtime` flag.

The kubelet flag `--container-runtime` lists the possible values as part of the auto-generated documentation but is missing the "remote" possibility.

**Which issue(s) this PR fixes** :
Fixes #60992

**Release note**:

```release-note
NONE
```
2018-03-12 15:24:38 -07:00
Joe Julian 8f4438b869 Add missing container-runtime "remote" option
Add the "remote" option to the auto-generated documentation for the
`--container-runtime` flag.

Fixes #60992
2018-03-12 13:33:37 -07:00
Kubernetes Submit Queue 3d1331f297
Merge pull request #61044 from liggitt/subpath-master
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

subpath fixes

fixes #60813 for master / 1.10

```release-note
Fixes CVE-2017-1002101 - See https://issue.k8s.io/60813 for details
```
2018-03-12 11:51:59 -07:00
Kubernetes Submit Queue a3f40dd8df
Merge pull request #60856 from jiayingz/race-fix
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fixes the races around devicemanager Allocate() and endpoint deletion.

There is a race in predicateAdmitHandler Admit() that getNodeAnyWayFunc()
could get Node with non-zero deviceplugin resource allocatable for a
non-existing endpoint. That race can happen when a device plugin fails,
but is more likely when kubelet restarts as with the current registration
model, there is a time gap between kubelet restart and device plugin
re-registration. During this time window, even though devicemanager could
have removed the resource initially during GetCapacity() call, Kubelet
may overwrite the device plugin resource capacity/allocatable with the
old value when node update from the API server comes in later. This
could cause a pod to be started without proper device runtime config set.

To solve this problem, introduce endpointStopGracePeriod. When a device
plugin fails, don't immediately remove the endpoint but set stopTime in
its endpoint. During kubelet restart, create endpoints with stopTime set
for any checkpointed registered resource. The endpoint is considered to be
in stopGracePeriod if its stoptime is set. This allows us to track what
resources should be handled by devicemanager during the time gap.
When an endpoint's stopGracePeriod expires, we remove the endpoint and
its resource. This allows the resource to be exported through other channels
(e.g., by directly updating node status through API server) if there is such
use case. Currently endpointStopGracePeriod is set as 5 minutes.

Given that an endpoint is no longer immediately removed upon disconnection,
mark all its devices unhealthy so that we can signal the resource allocatable
change to the scheduler to avoid scheduling more pods to the node.
When a device plugin endpoint is in stopGracePeriod, pods requesting the
corresponding resource will fail admission handler.

Tested:
Ran GPUDevicePlugin e2e_node test 100 times and all passed now.



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes https://github.com/kubernetes/kubernetes/issues/60176

**Special notes for your reviewer**:

**Release note**:

```release-note
Fixes the races around devicemanager Allocate() and endpoint deletion.
```
2018-03-12 02:50:13 -07:00
Jiaying Zhang 5514a1f4dd Fixes the races around devicemanager Allocate() and endpoint deletion.
There is a race in predicateAdmitHandler Admit() that getNodeAnyWayFunc()
could get Node with non-zero deviceplugin resource allocatable for a
non-existing endpoint. That race can happen when a device plugin fails,
but is more likely when kubelet restarts as with the current registration
model, there is a time gap between kubelet restart and device plugin
re-registration. During this time window, even though devicemanager could
have removed the resource initially during GetCapacity() call, Kubelet
may overwrite the device plugin resource capacity/allocatable with the
old value when node update from the API server comes in later. This
could cause a pod to be started without proper device runtime config set.

To solve this problem, introduce endpointStopGracePeriod. When a device
plugin fails, don't immediately remove the endpoint but set stopTime in
its endpoint. During kubelet restart, create endpoints with stopTime set
for any checkpointed registered resource. The endpoint is considered to be
in stopGracePeriod if its stoptime is set. This allows us to track what
resources should be handled by devicemanager during the time gap.
When an endpoint's stopGracePeriod expires, we remove the endpoint and
its resource. This allows the resource to be exported through other channels
(e.g., by directly updating node status through API server) if there is such
use case. Currently endpointStopGracePeriod is set as 5 minutes.

Given that an endpoint is no longer immediately removed upon disconnection,
mark all its devices unhealthy so that we can signal the resource allocatable
change to the scheduler to avoid scheduling more pods to the node.
When a device plugin endpoint is in stopGracePeriod, pods requesting the
corresponding resource will fail admission handler.
2018-03-09 17:00:57 -08:00
Michelle Au f6d97b5d2b Add feature gate for subpath 2018-03-05 09:14:44 +01:00
Jan Safranek 5110db5087 Lock subPath volumes
Users must not be allowed to step outside the volume with subPath.
Therefore the final subPath directory must be "locked" somehow
and checked if it's inside volume.

On Windows, we lock the directories. On Linux, we bind-mount the final
subPath into /var/lib/kubelet/pods/<uid>/volume-subpaths/<container name>/<subPathName>,
it can't be changed to symlink user once it's bind-mounted.
2018-03-05 09:14:44 +01:00
Kubernetes Submit Queue 47e6463bbb
Merge pull request #60159 from jingxu97/Feb/localephemeralBeta
Automatic merge from submit-queue (batch tested with PRs 60159, 60731, 60720, 60736, 60740). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Promote LocalStorageCapacityIsolation feature to beta

The LocalStorageCapacityIsolation feature added a new resource type ResourceEphemeralStorage "ephemeral-storage" so that this resource can be allocated, limited, and consumed as the same way as CPU/memory. All the features related to resource management (resource request/limit, quota, limitrange) are available for local ephemeral storage.

This local ephemeral storage represents the storage for root file system, which will be consumed by containers' writtable layer and logs. Some volumes such as emptyDir might also consume this storage.

Fixes issue #60160

This PR also fixes data race issues discovered after open the feature gate. Basically setNodeStatus function in kubelet could be called by multiple threads so the data needs lock protection. Put the fix with this PR for easy testing.

**Release note**:

```release-note
ACTION REQUIRED: LocalStorageCapacityIsolation feature is beta and enabled by default. 
```
2018-03-02 18:35:49 -08:00
Jing Xu b2e744c620 Promote LocalStorageCapacityIsolation feature to beta
The LocalStorageCapacityIsolation feature added a new resource type
ResourceEphemeralStorage "ephemeral-storage" so that this resource can
be allocated, limited, and consumed as the same way as CPU/memory. All
the features related to resource management (resource request/limit, quota, limitrange) are avaiable for local ephemeral storage.

This local ephemeral storage represents the storage for root file system, which will be consumed by containers' writtable layer and logs. Some volumes such as emptyDir might also consume this storage.
2018-03-02 15:10:08 -08:00
Mayank Kumar b888415ebf API Changes for RunAsGroup and Implementation and e2e 2018-02-28 22:09:56 -08:00
Kubernetes Submit Queue b63fab3aaf
Merge pull request #58036 from shlevy/cri-ImageStatus-info
Automatic merge from submit-queue (batch tested with PRs 58171, 58036, 60540). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

dockershim: Return Labels as Info in ImageStatus.

c6ddc749e8 added an Info field to
ImageStatusResponse when Verbose is true. This makes the image's
Labels available in that field, rather than unconditionally returning
an empty map.

**What this PR does / why we need it**:

This PR exposes an image's `Labels` through the CRI. In particular, I want this so I can write an `ImageService` wrapper that delegates all operations to a real `ImageService` but also, when the right `Labels`, ensures any needed [nix store](https://nixos.org/nix/) paths are present on the system when an image is pulled, enabling users to use nix for package distribution while still using containers for isolation and kubernetes for orchestration. In general, though, this should be useful for anything that wants to know about an image's `Labels`

**Special notes for your reviewer**:

I'd prefer to put this change into the `Image` protobuf type instead of putting it into `Info` (gated by `Verbose` or not, available in other requests like `ListImages` or not), but that would be a change to the protocol and it seems `Info` was introduced exactly for this purpose. If it's acceptable to put this into `Image`, I'll rework this.

If this change is acceptable, I will also do the work for `cri-o`, `rktlet`, `frakti`, and `cri-containerd` where applicable.

I have started the process for my employer to sign on to the CLA. I don't have reason to expect it to take long, but because there is more work to do if this change is desired I'd prefer if we can start review before that is completed.

**Release note**:

```release-note
dockershim now makes an Image's Labels available in the Info field of ImageStatusResponse
```
2018-02-28 09:48:23 -08:00
Kubernetes Submit Queue 47b1d72d47
Merge pull request #60505 from jsafrane/fix-logf
Automatic merge from submit-queue (batch tested with PRs 60342, 60505, 59218, 52900, 60486). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fixed log calls in VolumeManager

Use glog.Infof() instead of glog.Info()

**Release note**:

```release-note
NONE
```


/sig storage
/sig node
2018-02-28 06:07:24 -08:00
Kubernetes Submit Queue 5d0e7c1e31
Merge pull request #60358 from CaoShuFeng/make_test_load
Automatic merge from submit-queue (batch tested with PRs 60376, 55584, 60358, 54631, 60291). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix "make test"

Before this pr, we get this in linux:
```
$ make test
Running tests for APIVersion: v1,admissionregistration.k8s.io/v1alpha1,admissionregistration.k8s.io/v1beta1,admission.k8s.io/v1beta1,apps/v1beta1,apps/v1beta2,apps/v1,authentication.k8s.io/v1,authentication.k8s.io/v1beta1,authorization.k8s.io/v1,authorization.k8s.io/v1beta1,autoscaling/v1,autoscaling/v2beta1,batch/v1,batch/v1beta1,batch/v2alpha1,certificates.k8s.io/v1beta1,extensions/v1beta1,events.k8s.io/v1beta1,imagepolicy.k8s.io/v1alpha1,networking.k8s.io/v1,policy/v1beta1,rbac.authorization.k8s.io/v1,rbac.authorization.k8s.io/v1beta1,rbac.authorization.k8s.io/v1alpha1,scheduling.k8s.io/v1alpha1,settings.k8s.io/v1alpha1,storage.k8s.io/v1beta1,storage.k8s.io/v1,storage.k8s.io/v1alpha1,
+++ [0224 16:10:13] Running tests without code coverage
can't load package: package k8s.io/kubernetes/pkg/kubelet/winstats: build constraints exclude all Go files in /home/fujitsu/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/pkg/kubelet/winstats
!!! [0224 16:10:15] Call tree:
!!! [0224 16:10:15]  1: hack/make-rules/test.sh:402 runTests(...)
Makefile:182: recipe for target 'test' failed
make: *** [test] Error 1
```

```release-note
NONE
```
2018-02-28 03:37:29 -08:00
Kubernetes Submit Queue 907329e2eb
Merge pull request #55584 from zhangxiaoyu-zidif/move-check-pod-forward
Automatic merge from submit-queue (batch tested with PRs 60376, 55584, 60358, 54631, 60291). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

move pod-check forward

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-02-28 03:37:25 -08:00
Kubernetes Submit Queue b1ef631e59
Merge pull request #57408 from zouyee/kubelet-1
Automatic merge from submit-queue (batch tested with PRs 60236, 60332, 57375, 60451, 57408). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

improve code comment

**What this PR does / why we need it**:
improve code comment
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```NONE

```
2018-02-28 01:12:36 -08:00
Kubernetes Submit Queue 1aee9fd9ff
Merge pull request #60332 from yguo0905/sched
Automatic merge from submit-queue (batch tested with PRs 60236, 60332, 57375, 60451, 57408). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kube-scheduler: Support extender managed extended resources in kube-scheduler

**What this PR does / why we need it**:

This is the continuation of https://github.com/kubernetes/kubernetes/pull/58851.

- This PR adds new extender configurations in scheduler policy config.
    - A set of extended resource names can be specified in an extender config. They are the resources that are managed by the extender. The scheduler will only send pods to the extender if the pod requests at least one of the extended resources in the set.
    - An `IgnoredByScheduler` flag can be set along with each of such resources. If this flag is set to true, the scheduler will not check the resource in the `PodFitsResources` predicate.
- This PR also changes the default behavior of the `PodFitsResources` predicate. Now, by default, `PodFitsResources` will ignore the extended resources that are not in node status. This is required to support extender managed extended resources (including cluster-level resources) on node. Note that in kube-scheduler we override the default behavior by not ignoring such missing extended resources.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes https://github.com/kubernetes/kubernetes/issues/53616 https://github.com/kubernetes/kubernetes/issues/58850 

**Special notes for your reviewer**:

**Release note**:

```
Support extender managed extended resources in kube-scheduler
```
2018-02-28 01:12:24 -08:00
Kubernetes Submit Queue aa13f3fa2a
Merge pull request #59289 from rmmh/semantic-check
Automatic merge from submit-queue (batch tested with PRs 53689, 56880, 55856, 59289, 60249). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 Add test/typecheck, a fast typecheck for all build platforms.

Add test/typecheck, a fast typecheck for all build platforms.

Most of the time spent compiling is spent optimizing and linking
binary code. Most errors occur at the syntax or semantic (type) layers.
Go's compiler is importable as a normal package, so we can do fast
syntax and type checking for the 10 platforms we build on.

This currently takes ~6 minutes of CPU time (parallelized).

This makes presubmit cross builds superfluous, since it should catch
most cross-build breaks (generally Unix and 64-bit assumptions).

Example output:

```$ time go run test/typecheck/main.go
type-checking:  linux/amd64, windows/386, darwin/amd64, linux/arm, 
    linux/386, windows/amd64, linux/arm64, linux/ppc64le, linux/s390x, darwin/386
ERROR(windows/amd64) pkg/proxy/ipvs/proxier.go:1708:27: ENXIO not declared by package unix
ERROR(windows/386) pkg/proxy/ipvs/proxier.go:1708:27: ENXIO not declared by package unix

real    0m45.083s
user    6m15.504s
sys     1m14.000s
```


```release-note
NONE
```
2018-02-28 00:00:36 -08:00
Kubernetes Submit Queue f45f4a4ec0
Merge pull request #56880 from MrHohn/kube-proxy-ipv6-fix
Automatic merge from submit-queue (batch tested with PRs 53689, 56880, 55856, 59289, 60249). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Harden kube-proxy for unmatched IP versions

**What this PR does / why we need it**:
This PR makes kube-proxy omits & logs & emits event for unmatched IP versions configuration (IPv6 address in IPv4 mode or IPv4 address in IPv6 mode). 

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #57219

**Special notes for your reviewer**:

**Release note**:

```release-note
Fix the issue in kube-proxy iptables/ipvs mode to properly handle incorrect IP version.
```
2018-02-28 00:00:29 -08:00
Kubernetes Submit Queue 231874c74c
Merge pull request #53689 from foxyriver/fix-defer
Automatic merge from submit-queue (batch tested with PRs 53689, 56880, 55856, 59289, 60249). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

simplify defer statement

**What this PR does / why we need it**:

simplify defer statement
2018-02-28 00:00:25 -08:00
Kubernetes Submit Queue a21a750249
Merge pull request #59333 from feiskyer/win
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubelet: setup WindowsContainerResources for windows containers

**What this PR does / why we need it**:

This PR setups WindowsContainerResources for windows containers. It implements proposal here: https://github.com/kubernetes/community/pull/1510.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #56734

**Special notes for your reviewer**:

**Release note**:

```release-note
WindowsContainerResources is set now for windows containers
```
2018-02-27 20:34:13 -08:00
Pengfei Ni b0a49e1970 Update unit tests and bazel files 2018-02-28 09:56:46 +08:00
Pengfei Ni 18c55a1d8e Setup docker hostconfig for windows containers 2018-02-28 09:56:46 +08:00
Pengfei Ni 3c5e493482 Setup windows container config to kubelet CRI 2018-02-28 09:56:41 +08:00
Yang Guo 8d880506fe Support cluster-level extended resources in kubelet and kube-scheduler
Co-authored-by: Yang Guo <ygg@google.com>
Co-authored-by: Chun Chen <chenchun.feed@gmail.com>
2018-02-27 17:25:30 -08:00
Ryan Hitchman 0067002db8 Make a few code paths compile cleanly with 32-bit Go. 2018-02-27 13:53:32 -08:00
Kubernetes Submit Queue b79fe10730
Merge pull request #54739 from xiangpengzhao/handleerr
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add FailedPostStartHook error message.

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #54671

**Special notes for your reviewer**:
/cc @derekwaynecarr 
cc @lovejoy @OJezu

**Release note**:

```release-note
NONE
```
2018-02-27 13:11:39 -08:00
Kubernetes Submit Queue 729f691d74
Merge pull request #60246 from mtaufen/backoff-pleg
Automatic merge from submit-queue (batch tested with PRs 60157, 60337, 60246, 59714, 60467). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

backoff runtime errors in kubelet sync loop

The runtime health check can race with PLEG's first relist, and this
often results in an unnecessary 5 second wait during Kubelet bootstrap.

This change aims to improve the performance.

```release-note
NONE
```
2018-02-27 12:05:37 -08:00
Zihong Zheng 6004452bed Auto-updated BUILD files 2018-02-27 11:18:11 -08:00
Zihong Zheng dfbec1a63a [kube-proxy] Move ipv6 related funcs to utils pkg 2018-02-27 11:12:45 -08:00
Kubernetes Submit Queue c7b3e163d3
Merge pull request #60448 from Random-Liu/image-cache-return-copy
Automatic merge from submit-queue (batch tested with PRs 59365, 60446, 60448, 55019, 60431). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Let image manager return a copy of image list.

Fixes https://github.com/kubernetes/kubernetes/issues/60443.
/cc @kubernetes/sig-node-pr-reviews 

**Release note**:

```release-note
none
```
2018-02-27 10:50:41 -08:00
Jan Safranek e8a85fc0d3 Fixed log calls in VolumeManager
Use glog.Infof() instead of glog.Info()
2018-02-27 15:48:16 +01:00
wackxu b3ba80b223 update bazel 2018-02-27 20:23:36 +08:00
wackxu f737ad62ed update import 2018-02-27 20:23:35 +08:00
Kubernetes Submit Queue 1eb1c00c44
Merge pull request #59674 from jennybuckley/codegen
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

code-gen: output golint compliant 'Generated by' comment

New PR instead of reopening #58115 because /reopen did not work.
This won't be ready to merge until the upstream https://github.com/kubernetes/gengo/pull/94 merges. Once that merges, the second commit will be changed to godep-save.sh and update-staging-godeps.sh, and the last commit will be changed to update-all.sh

The failing test is due to the upstream changes not being merged yet

```devel-release-note
Go code generated by the code generators will now have a comment which allows them to be easily identified by golint
```

Fixes #56489
2018-02-27 02:47:05 -08:00
Kubernetes Submit Queue 3039a7792e
Merge pull request #60328 from Random-Liu/fix-pod-stats
Automatic merge from submit-queue (batch tested with PRs 60011, 59256, 59293, 60328, 60367). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add CPU/Memory pod stats for CRI stats.

For https://github.com/kubernetes/features/issues/286.

Add CPU and memory stats for pod.

@kubernetes/sig-node-pr-reviews 
/cc @dashpole @yujuhong @abhi @yguo0905 
Signed-off-by: Lantao Liu <lantaol@google.com>



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
Summary API will include pod CPU and Memory stats for CRI container runtime.
```
2018-02-26 23:47:56 -08:00
Kubernetes Submit Queue 89e433fca1
Merge pull request #59404 from ohmystack/docker-mem-swap
Automatic merge from submit-queue (batch tested with PRs 50724, 59025, 59710, 59404, 59958). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

dockertools: disable MemorySwap on Linux

In this commit, set `MemorySwap` the same with `Memory` to prevent using swap on Linux.

**What this PR does / why we need it**:

In #39731, @pires tried to disable swap on Linux by setting `MemorySwap` to 0.
However, according to [Docker's docs](https://docs.docker.com/config/containers/resource_constraints/#--memory-swap-details), setting `MemorySwap` to 0 is treated as unset, and its [default behavior](https://github.com/moby/moby/blob/v17.05.0-ce/daemon/daemon_unix.go#L266-L269) is to set to twice the size of `Memory`, which can still cause the container to use the swap.

**Which issue(s) this PR fixes** :

This issue was mentioned in this comment: https://github.com/kubernetes/kubernetes/issues/7294#issuecomment-362722637

**Special notes for your reviewer**:

1. For the case on Windows, we can still use the 0 because [Windows does not support `MemorySwap`](https://github.com/moby/moby/blob/v17.05.0-ce/daemon/daemon_windows.go#L185-L187).
2. There is another place using the `DefaultMemorySwap()` is for [sandbox](https://github.com/kubernetes/kubernetes/blob/v1.9.2/pkg/kubelet/dockershim/docker_sandbox.go#L505).
Maybe setting the sandbox's `MemorySwap` to 0 is fine. I didn't change that.

**Release note**:

```release-note
dockertools: disable memory swap on Linux.
```
2018-02-26 21:34:42 -08:00
Kubernetes Submit Queue 68f496d50f
Merge pull request #59710 from sailingwithoutwind/fix/some-typo
Automatic merge from submit-queue (batch tested with PRs 50724, 59025, 59710, 59404, 59958). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

some typo

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note

```
2018-02-26 21:34:38 -08:00
Kubernetes Submit Queue 97b9271abd
Merge pull request #59025 from ggaaooppeenngg/add-err-in-ensure-check
Automatic merge from submit-queue (batch tested with PRs 50724, 59025, 59710, 59404, 59958). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add detailed err in ensure docker process error

Signed-off-by: Peng Gao <peng.gao.dut@gmail.com>



**What this PR does / why we need it**:
Add detailed error.
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-02-26 21:34:32 -08:00
Kubernetes Submit Queue 2966cdaa12
Merge pull request #58559 from mlmhl/volumemanager_cleanup
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

use GetUniqueVolumeNameFromSpec instead of implementing it manually for kubelet volume manager

**What this PR does / why we need it**:

`volumeName` is only used for attachable plugin, so we should resolve it inside the `if` statement. Besides, we can use the already exist `GetUniqueVolumeNameFromSpec` mthod instead of invoking `GetVolumeName` and `GetUniqueVolumeName` manually.

**Release note**:

```release-note
NONE
```

/sig storage
/kind cleanup
2018-02-26 19:34:22 -08:00
Kubernetes Submit Queue 1902a18c88
Merge pull request #59301 from dcbw/dockershim-stop-sandbox-no-ip
Automatic merge from submit-queue (batch tested with PRs 60435, 60334, 60458, 59301, 60125). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

dockershim: don't check pod IP in StopPodSandbox

We're about to tear the container down, there's no point.  It also suppresses
an annoying error message due to kubelet stupidity that causes multiple
parallel calls to StopPodSandbox for the same sandbox.

docker_sandbox.go:355] failed to read pod IP from plugin/docker: NetworkPlugin cni failed on the status hook for pod "docker-registry-1-deploy_default": Unexpected command output nsenter: cannot open /proc/22646/ns/net: No such file or directory

1) A first StopPodSandbox() request triggered by SyncLoop(PLEG) for
a ContainerDied event calls into TearDownPod() and thus the network
plugin.  Until this completes, networkReady=true for the
sandbox.

2) A second StopPodSandbox() request triggered by SyncLoop(REMOVE)
calls PodSandboxStatus() and calls into the network plugin to read
the IP address because networkReady=true

3) The first request exits the network plugin, sets networReady=false,
and calls StopContainer() on the sandbox.  This destroys the network
namespace.

4) The second request finally gets around to running nsenter but
the network namespace is already destroyed.  It returns an error
which is logged by getIP().

```release-note
NONE
```
@yujuhong @freehan
2018-02-26 17:48:50 -08:00
jennybuckley c8dacd8e63 Run hack/update-all.sh 2018-02-26 17:16:14 -08:00
Lantao Liu 3688650a6b Add CPU/Memory pod stats for CRI stats.
Signed-off-by: Lantao Liu <lantaol@google.com>
2018-02-26 19:29:47 +00:00
Lantao Liu 1fb91cc8be Let image manager return a copy of image list. 2018-02-26 19:19:18 +00:00
Kubernetes Submit Queue 52b7aab09a
Merge pull request #59849 from yue9944882/forcibly-lower-staticpod-name
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

lowercase node name in generated static pod name 

**What this PR does / why we need it**:
Cast appended node name to lowercase when generating static pod name on kubelet starting.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #59801 

**Special notes for your reviewer**:
Not sure about how to deal with other illegal node names e.g. containing invalid no-alphabetic characters. Maybe just let it fail-hard is not a bad idea.
But considering that containing uppercase letter in the hostname is somehow a usual case even in the production environment of some companies, tolerating uppercase and cast it implicitly should be good.

**Release note**:

```release-note
force node name lowercase on static pod name generating
```
2018-02-25 18:29:51 -08:00
yue9944882 fdd36017f4 add unit test for static pod name generation 2018-02-26 00:01:09 +08:00
Kubernetes Submit Queue 1e95c7f856
Merge pull request #52640 from mYmNeo/ut
Automatic merge from submit-queue (batch tested with PRs 60346, 60135, 60289, 59643, 52640). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Correct TestUpdatePod comment

Signed-off-by: mYmNeo <thomassong2012@gmail.com>

**What this PR does / why we need it**:
Correct TestUpdatePod comment

**Which issue this PR fixes**

The original one wants to check whether all updates has been caught by podWorker, but podWorker can guarantee only the first event and the last one will processed. Correct the comment if others misunderstand the unit test.
2018-02-24 23:40:01 -08:00
Kubernetes Submit Queue 531f63c1ba
Merge pull request #59643 from CaoShuFeng/docker_1.24
Automatic merge from submit-queue (batch tested with PRs 60346, 60135, 60289, 59643, 52640). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

clean up sysctl code

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```
NONE
```
2018-02-24 23:39:57 -08:00
Kubernetes Submit Queue 5106ba31e3
Merge pull request #60289 from Pingan2017/imagegc
Automatic merge from submit-queue (batch tested with PRs 60346, 60135, 60289, 59643, 52640). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix freespace for image GC

**What this PR does / why we need it**:
use 'continue' in the loop instead of 'break'
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-02-24 23:39:54 -08:00
Kubernetes Submit Queue e31c8a2252
Merge pull request #60318 from jiayingz/api-change
Automatic merge from submit-queue (batch tested with PRs 59159, 60318, 60079, 59371, 57415). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Made a couple API changes to deviceplugin/v1beta1 to avoid future

incompatible API changes:
- Add GetDevicePluginOptions rpc call. This is needed when we switch
  from Registration service to probe-based plugin watcher.
- Change AllocateRequest and AllocateResponse to allow device requests
  from multiple containers in a pod. Currently only made mechanical
  change on the devicemanager and test code to cope with the API but
  still issues an Allocate call per container. We can modify the
  devicemanager in 1.11 to issue a single Allocate call per pod.
  The change will also facilitate incremental API change to communicate
  pod level information through Allocate rpc if there is such future
  need.



**What this PR does / why we need it**:
Made a couple API changes to deviceplugin/v1beta1 to avoid future incompatible API changes.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes https://github.com/kubernetes/kubernetes/issues/59370

**Special notes for your reviewer**:

**Release note**:

```release-note

```
2018-02-24 21:19:33 -08:00