Commit Graph

65409 Commits (a3a52a8cf725b2438606c2879f3dd3172a4a266b)

Author SHA1 Message Date
Dr. Stefan Schimanski a3a52a8cf7 Revert "Revert "scheduler: align with ctrl-managers and apiservers, add https+auth in options""
This reverts commit 7b93d81a97.
2018-05-15 13:09:55 +02:00
Kubernetes Submit Queue d0f4a8fa17
Merge pull request #62695 from CaoShuFeng/duplicated_status
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

avoid duplicate status in audit events

Fixes: https://github.com/kubernetes/kubernetes/issues/60108



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
/assign @sttts @tallclair 

**Release note**:

```
Action required: When Response is a metav1.Status, it is no longer copied into the audit.Event status. Only the "status", "reason" and "code" fields are set.
```
2018-05-15 03:44:36 -07:00
Kubernetes Submit Queue b71966acea
Merge pull request #62015 from feiskyer/container-log
Automatic merge from submit-queue (batch tested with PRs 63603, 63557, 62015). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

CRI: update documents for container logpath

**What this PR does / why we need it**:

The container log path has been changed from  `containername_attempt#.log` to `containername/attempt#.log` in #59906. This PR updates CRI documents for it.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
CRI: update documents for container logpath. The container log path has been changed from containername_attempt#.log to containername/attempt#.log 
```
2018-05-15 02:07:44 -07:00
Kubernetes Submit Queue 6aa6051fab
Merge pull request #63557 from apelisse/dry-run-path
Automatic merge from submit-queue (batch tested with PRs 63603, 63557, 62015). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

apiserver: Fail if dry-run query param is specified

Adds a dry-run query parameter now that does nothing but reject the request. The sooner we have this check in master, the safer it will be for clients to send dry-run requests that are not going to be applied nonetheless.

```release-note
Create a new `dryRun` query parameter for mutating endpoints. If the parameter is set, then the query will be rejected, as the feature is not implemented yet. This will allow forward compatibility with future clients; otherwise, future clients talking with older apiservers might end up modifying a resource even if they include the `dryRun` query parameter.
```
2018-05-15 02:07:41 -07:00
Kubernetes Submit Queue c4994e17d6
Merge pull request #63603 from resouer/clean-cache
Automatic merge from submit-queue (batch tested with PRs 63603, 63557, 62015). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Clean up equiv cache with a simple implementation instead of LRU

**What this PR does / why we need it**:

The original version of equiv cache use pod hash as cache key, also, the predicate order is not fixed. So I used a LRU cache to improve hit rate.

While now we've already refactored it to use predicates as keys, and its order was also fixed in scheduler, we can use a simplest cache instead now.

**Special notes for your reviewer**:

The question is brought up by @misterikkit

**Release note**:

```release-note
NONE
```
2018-05-15 02:07:38 -07:00
Kubernetes Submit Queue dc62a73742
Merge pull request #63812 from luxas/kubeadm_cut_kubelet_readonly_dep
Automatic merge from submit-queue (batch tested with PRs 57536, 63812). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm: Contact the kubelet on its healthz port instead of its readonly port

**What this PR does / why we need it**:
In order for us to disable the kubelet's readonly port in v1.11 (https://github.com/kubernetes/kubeadm/issues/732), we need to cut the dependency on that port being open. Instead, we can use the dedicated healthz port (using the defaults `--healthz-bind-address=127.0.0.1` and `--healthz-port=10248`, xref: https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/)

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Part of https://github.com/kubernetes/kubeadm/issues/732

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
@kubernetes/sig-cluster-lifecycle-pr-reviews @liztio
2018-05-14 19:44:11 -07:00
Kubernetes Submit Queue 0ae403d727
Merge pull request #57536 from linyouchong/linyouchong-20171222
Automatic merge from submit-queue (batch tested with PRs 57536, 63812). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix spelling error in comment
2018-05-14 19:44:07 -07:00
Kubernetes Submit Queue ab180d808e
Merge pull request #63807 from lalyos/kubeadm-consistent-generated-manifest
Automatic merge from submit-queue (batch tested with PRs 63492, 62379, 61984, 63805, 63807). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Sort arguments before joining them, for reproducible return string

**What this PR does / why we need it**:

This PR makes kubeadm static pod manifest generation consistent. Right now when `kubeadm init` is called repeatedly, the generated pod manifest files under /etc/kubernetes/manifest/ are changing. Its really hard to test how a configuration change effects the manifest files.

The current implementation is ranging over a map[string]string which will be happening in a random order, generating different pod manifests even without changing any configuration.

The suggested solution makes pom manifest generation idempotent. It opens up integration test possibilities, like testing whole yaml result of `kubeadm alpha phase controlplane`.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```

/sig cluster-lifecycle
/assign @luxas
2018-05-14 17:11:26 -07:00
Kubernetes Submit Queue 40f8c91e70
Merge pull request #63805 from losipiuk/lo/gpu-e2e-followup
Automatic merge from submit-queue (batch tested with PRs 63492, 62379, 61984, 63805, 63807). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add e2e test to verify that GPU pool is not scaled up if GPUs are not requested

**Release note**:
```release-note
NONE
```
2018-05-14 17:11:23 -07:00
Kubernetes Submit Queue 84914c6a38
Merge pull request #61984 from mikedanese/fix4
Automatic merge from submit-queue (batch tested with PRs 63492, 62379, 61984, 63805, 63807). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

validation: improve ProjectedVolume validation errors

* only report "may not specify more than 1 volume type" once
* fix incorrectly reported field paths
* continue to traverse into projections to report further errors.

@kubernetes/sig-storage-pr-reviews 

```release-note
NONE
```
2018-05-14 17:11:20 -07:00
Kubernetes Submit Queue cad48800c8
Merge pull request #62379 from hzxuzhonghu/e2e-fix
Automatic merge from submit-queue (batch tested with PRs 63492, 62379, 61984, 63805, 63807). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove PodPreset and enable resources for Priority admission plugins in e2e-gce

**What this PR does / why we need it**:
 e2e-gce start kube-apiserver without admission PodPreset and enable resources for Priority 

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #62377

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-05-14 17:11:17 -07:00
Kubernetes Submit Queue 8220171d8a
Merge pull request #63492 from liggitt/node-heartbeat-close-connections
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

track/close kubelet->API connections on heartbeat failure

xref #48638
xref https://github.com/kubernetes-incubator/kube-aws/issues/598

we're already typically tracking kubelet -> API connections and have the ability to force close them as part of client cert rotation. if we do that tracking unconditionally, we gain the ability to also force close connections on heartbeat failure as well. it's a big hammer (means reestablishing pod watches, etc), but so is having all your pods evicted because you didn't heartbeat.

this intentionally does minimal refactoring/extraction of the cert connection tracking transport in case we want to backport this

* first commit unconditionally sets up the connection-tracking dialer, and moves all the cert management logic inside an if-block that gets skipped if no certificate manager is provided (view with whitespace ignored to see what actually changed)
* second commit plumbs the connection-closing function to the heartbeat loop and calls it on repeated failures

follow-ups:
* consider backporting this to 1.10, 1.9, 1.8
* refactor the connection managing dialer to not be so tightly bound to the client certificate management

/sig node
/sig api-machinery

```release-note
kubelet: fix hangs in updating Node status after network interruptions/changes between the kubelet and API server
```
2018-05-14 16:56:35 -07:00
Kubernetes Submit Queue 141e4ee0ca
Merge pull request #63769 from liggitt/kubectl-taint-internal-object
Automatic merge from submit-queue (batch tested with PRs 55511, 63372, 63400, 63100, 63769). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

print result object from kubectl taint correctly

fixes #63767 

```release-note
NONE
```
2018-05-14 14:35:24 -07:00
Kubernetes Submit Queue a1b54f3c99
Merge pull request #63100 from ravisantoshgudimetla/priority-beta-api
Automatic merge from submit-queue (batch tested with PRs 55511, 63372, 63400, 63100, 63769). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Create pkg/scheduling/apis/v1beta1 and move priorityClass to beta 

**What this PR does / why we need it**:
This is for creating pkg/apis/scheduling/v1beta1 so that priorityClasses could be moved to beta.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Part of #57471

**Special notes for your reviewer**:
/cc @bsalamat @aveshagarwal 

**Release note**:

```release-note
The `PriorityClass` API is promoted to `scheduling.k8s.io/v1beta1`
```
2018-05-14 14:35:21 -07:00
Kubernetes Submit Queue 44a1481859
Merge pull request #63400 from rajansandeep/corednsupgrade
Automatic merge from submit-queue (batch tested with PRs 55511, 63372, 63400, 63100, 63769). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Improve kubeadm upgrade path for CoreDNS

**What this PR does / why we need it**:
This PR achieves the following:
1. Retains the CoreDNS ConfigMap defined by the user during `kubeadm upgrade`.
2. Removes the CoreDNS deployment when user decides to install kube-dns during `kubeadm upgrade`.


**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-05-14 14:35:17 -07:00
Kubernetes Submit Queue 4605dc7c87
Merge pull request #63372 from agau4779/gce-ingress-backend-naming
Automatic merge from submit-queue (batch tested with PRs 55511, 63372, 63400, 63100, 63769). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[GCE] check for new backend naming scheme

**What this PR does / why we need it**:
Checks for both the old Backend naming scheme (Nodeport in the name) and the new naming scheme (same scheme used to name NEGs). We need to check for both, in order for both the tests against Ingress head (once https://github.com/kubernetes/ingress-gce/pull/239 gets merged) and tests against prior Ingress versions to pass. 

See https://github.com/kubernetes/ingress-gce/pull/239 .

**Release note**:
```release-note
NONE
```
2018-05-14 14:35:14 -07:00
Kubernetes Submit Queue 2ba4b63ef4
Merge pull request #55511 from ericchiang/remove-pflag-dep
Automatic merge from submit-queue (batch tested with PRs 55511, 63372, 63400, 63100, 63769). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

k8s.io/client-go/{kubernetes,rest}: remove dependency on pflag

This change removes an unused pflag utility which cuts a client-go transitive dependency on that library.

Verified using `go list`

```
go list -f '{{join .Deps "\n"}}' k8s.io/kubernetes/vendor/k8s.io/client-go/kubernetes \
    | xargs go list -f '{{if not .Standard}}{{.ImportPath}}{{end}}' \
    | grep pflag
```

/cc @sttts @kubernetes/sig-api-machinery-pr-reviews 

Edit: it looks like k8s.io/client-go/tools/clientcmd still imports this. So practically, if you're loading from a kubeconfig you're going to get the import. Might still be a good cleanup to make though.

```release-note
NONE
```
2018-05-14 14:35:11 -07:00
Kubernetes Submit Queue fc28745535
Merge pull request #62003 from m1093782566/fix-nodeport
Automatic merge from submit-queue (batch tested with PRs 63787, 62003). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix localport open with --nodeport-addresses specified

**What this PR does / why we need it**:

Fix localport open with --nodeport-addresses specified.

**Which issue(s) this PR fixes**:
Fixes #61953

**Special notes for your reviewer**:

@ephur

**Release note**:

```release-note
Services can listen on same host ports on different interfaces with --nodeport-addresses specified
```
2018-05-14 12:21:12 -07:00
Kubernetes Submit Queue cf298e6501
Merge pull request #63787 from luxas/kubeadm_use_apimachinery_marshal
Automatic merge from submit-queue (batch tested with PRs 63787, 62003). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm: Use the API machinery for marshalling

**What this PR does / why we need it**:
Similar to https://github.com/kubernetes/kubernetes/pull/63723, we should not use a generic `yaml` 
package for marshalling, but use the API machinery we have already in place. This now correctly includes `apiVersion` and `kind` when printing the configuration in the upgrade procedure.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Part of https://github.com/kubernetes/community/pull/2131

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
@kubernetes/sig-cluster-lifecycle-pr-reviews @liztio
2018-05-14 12:21:08 -07:00
Lucas Käldström d7e3e82fe5
kubeadm: Contact the kubelet on its healthz port 10248 instead of its readonly port 2018-05-14 19:27:13 +01:00
Kubernetes Submit Queue 2860bd595d
Merge pull request #63806 from detiber/externalEtcdCerts
Automatic merge from submit-queue (batch tested with PRs 63588, 63806). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm - do not generate etcd ca/certs for external etcd

**What this PR does / why we need it**:

Currently we generate an etcd CA and certificates even if we are specifying an external etcd cluster when running `kubeadm init`, this PR changes this behavior to skip generating the etcd CA and certificates if configured for an external etcd cluster.

**Which issue(s) this PR fixes** 
Fixes https://github.com/kubernetes/kubeadm/issues/807

**Release note**:
```release-note
kubeadm will no longer generate an unused etcd CA and certificates when configured to use an external etcd cluster.
```
2018-05-14 11:26:19 -07:00
Kubernetes Submit Queue 13f846f71a
Merge pull request #63588 from jsafrane/remove-fsgroup-feature-test
Automatic merge from submit-queue (batch tested with PRs 63588, 63806). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Run FSGroup tests by default.

There is no special feature flag for FSGroup and the tests can run in all test suites. They're reasonably fast too.

**Release note**:

```release-note
NONE
```

cc: @jeffvance
2018-05-14 11:26:15 -07:00
lalyos 5308957dbc Sort arguments before joining them, for reproducible return string 2018-05-14 20:24:39 +02:00
Jordan Liggitt 746bca241f
print result object from kubectl taint correctly 2018-05-14 14:21:52 -04:00
Antoine Pelisse 98613924ea apiserver: Fail if dry-run query param is specified 2018-05-14 11:20:57 -07:00
Kubernetes Submit Queue f5a91f4173
Merge pull request #62807 from rpothier/kubeadm-cidr
Automatic merge from submit-queue (batch tested with PRs 63735, 62807). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Kubeadm: Update comments and UT to remove /66 restriction

**What this PR does / why we need it**:
The comments in cmd/kubeadm/app/phases/controlplane/manifests.go mention the
IPv6 /66 restriction, and the UT also refers to this.
This restriction was removed in PR#60089
This removes those comments and updates the UT

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #62806 

**Special notes for your reviewer**:

**Release note**:

```release-note-none

```
2018-05-14 10:19:21 -07:00
Kubernetes Submit Queue f18e4d8b12
Merge pull request #63735 from neolit123/kubeadm-init-stdout-update
Automatic merge from submit-queue (batch tested with PRs 63735, 62807). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm-init: update note about failing containers

**What this PR does / why we need it**:

This PR was merged before all requested changes
were applied:
kubernetes/pull/59731

Update the note about failing containers as requested here:
https://github.com/kubernetes/kubernetes/pull/59731#pullrequestreview-119517427

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
NONE

**Special notes for your reviewer**:
NONE

**Release note**:

```release-note
NONE
```
2018-05-14 10:19:18 -07:00
Ashley Gau 054b4a7978 check for new backend naming scheme 2018-05-14 09:58:21 -07:00
Lucas Käldström 04a7ca557c
kubeadm: Use the API machinery for marshalling 2018-05-14 17:56:22 +01:00
Eric Chiang 66f2622bb7
client-go: remove dep on pflag 2018-05-14 09:48:36 -07:00
Łukasz Osipiuk ec0a9aae28 Add e2e test to verify that GPU pool is not scaled up if GPUs are not requested by pods 2018-05-14 18:16:37 +02:00
Kubernetes Submit Queue c9591ee6cb
Merge pull request #63734 from liztio/kubeadm-marshal-tests
Automatic merge from submit-queue (batch tested with PRs 63783, 63734). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Kubeadm marshal tests

**What this PR does / why we need it**:

Adds tests for the marshalling utilities in kubeadm.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes: kubernetes/kubeadm#802

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-05-14 09:12:12 -07:00
Kubernetes Submit Queue f3c84d71d8
Merge pull request #63783 from luxas/kubeadm_explicit_v1alpha1
Automatic merge from submit-queue (batch tested with PRs 63783, 63734). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Rename `kubeadmapiext` to the more explicit `kubeadmapiv1alpha1`

**What this PR does / why we need it**:

`kubeadmext` is somewhat confusing to those who read the code (although it means "the external API of kubeadm", which to some degree makes sense), so I'm swapping all references to it to the more explicit `kubeadmapiv1alpha1`. This change is needed given that we will support multiple external APIs.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Part of https://github.com/kubernetes/community/pull/2131

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
@kubernetes/sig-cluster-lifecycle-pr-reviews @liztio
2018-05-14 09:12:09 -07:00
Jason DeTiberus 187ef17ed8
kubeadm - do not generate etcd ca/certs for external etcd
Only generate the etcd CA and certificates if not configured for external
etcd.
2018-05-14 11:56:29 -04:00
Kubernetes Submit Queue ff7abf2705
Merge pull request #63649 from dixudx/kubectl_flags_binding
Automatic merge from submit-queue (batch tested with PRs 63761, 63794, 63649). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix missing flag value bindings in kubectl

**What this PR does / why we need it**:
When working #63644, I find there are still some flag not bound correctly.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
xref #60366

**Special notes for your reviewer**:
/cc soltysh deads2k 
/cc kubernetes/sig-cli-api-reviews 
**Release note**:

```release-note
None
```
2018-05-14 07:59:11 -07:00
Kubernetes Submit Queue 1b1defb060
Merge pull request #63794 from hzxuzhonghu/tmp-5-14
Automatic merge from submit-queue (batch tested with PRs 63761, 63794, 63649). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove unused PrintFlags.Scheme

PrintFlags.Scheme is unused, remove it.

**Release note**:

```release-note
NONE
```
2018-05-14 07:59:08 -07:00
Kubernetes Submit Queue d5a930bed4
Merge pull request #63761 from liggitt/aggregated-bootstrap-race
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Avoid copying aggregated admin/edit/view roles during bootstrap

Fixes #63760

At apiserver startup, prior to reconciling cluster roles, the following roles (if they exist) are copied:
* admin -> system:aggregate-to-admin
* edit -> system:aggregate-to-edit
* view -> system:aggregate-to-view

This was added in 1.9 as part of role aggregation to ensure custom permissions added to the admin/edit/view roles were preserved, prior to making the admin/edit/view roles aggregated (since the permissions of an aggregated role are controller-managed)

When starting multiple members of a new HA cluster simultaneously, the following race can occur:
* t=0, server 1,2,3 start up
* t=1, server 1 finds no admin/edit/view roles exist, begins role reconciliation and creates the aggregated `admin` role
* t=2, server 2 finds and copies the `admin` role created by server 1 to `system:aggregate-to-admin`

If this race is encountered, it results in `system:aggregate-to-admin` being an aggregated role, and its permissions subject to being overwritten by the aggregating controller. To prevent this from happening, the permission-preserving copy should only copy over roles that are not yet aggregated.

To correct this in clusters that have already encountered it, role reconciliation should remove aggregation from a role that is not expected to be aggregated at all.

```release-note
corrects a race condition in bootstrapping aggregated cluster roles in new HA clusters
```
2018-05-14 07:34:41 -07:00
xuzhonghu 7e4014e02b remove unused PrintFlags.Scheme 2018-05-14 20:49:19 +08:00
Kubernetes Submit Queue 773def0194
Merge pull request #62563 from devdattakulkarni/client-go-details
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Updated README to include client-go<->controller diagram

The sample-controller makes extensive use of various mechanisms
available in client-go. For writing custom controllers/operators
it will be helpful if there is precise description of how the
client-go library works and how/where it interfaces with
custom controller code.

Recently we published a blog post with these details here:

https://medium.com/@cloudark/kubernetes-custom-controllers-b6c7d0668fdf

This patch includes the diagram from the post, as was recommended
by @sttts on https://github.com/kubernetes/sample-controller/issues/13



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note

```
2018-05-14 05:23:12 -07:00
Lucas Käldström 68c68dfadc
Rename kubeadmapiext to the more explicit kubeadmapiv1alpha1 2018-05-14 12:31:48 +03:00
m1093782566 029a16a1eb fix review comments 2018-05-14 16:07:13 +08:00
Kubernetes Submit Queue e34df0a26c
Merge pull request #63585 from islinwb/ipset_comment
Automatic merge from submit-queue (batch tested with PRs 62833, 63585). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add comments for ipset entries in kube-proxy

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #63584 

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-05-14 00:49:05 -07:00
Kubernetes Submit Queue 0989967374
Merge pull request #62833 from charrywanganthony/log_rotation
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add necessary explanation for container log rotation.

**What this PR does / why we need it**:
#59898
> Container log manager only starts when the container runtime is remote (not docker), because we can't implement ReopenContainerLog for docker.

**Release note**:
```release-note
NONE
```
2018-05-14 00:07:15 -07:00
Di Xu e8ef744493 fix missing flag value bindings in kubectl 2018-05-14 14:38:54 +08:00
Kubernetes Submit Queue e24fd8efb1
Merge pull request #62040 from ianychoi/korean-translation
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Adds initial Korean translations for kubectl

**What this PR does / why we need it**:
This PR provides a first attempt to translate kubectl in Korean (related to #51867, #40645, #45573, #45562, #40591, #46559, #50155).

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
No issues

**Special notes for your reviewer**:
This PR requires Korean people to assist in the review. I am native in Korean and also a translator & reviewer in Korean in OpenStack I18n team (http://stackalytics.com/?metric=translations&user_id=ianychoi ).

**Release note**:
```release-note
Adding initial Korean translation for kubectl
```
2018-05-13 22:27:40 -07:00
Kubernetes Submit Queue 9f7348ed50
Merge pull request #63230 from WanLinghao/sa_util_fix
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

clean duplicate test function

**What this PR does / why we need it**:
As the patch shows, the function it tests has been moved to 
b87a392b1a/staging/src/k8s.io/apiserver/pkg/authentication/serviceaccount/util.go (L43)
 The make/split function has been tested on file b87a392b1a/staging/src/k8s.io/apiserver/pkg/authentication/serviceaccount/util_test.go (L21)

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-05-13 20:07:24 -07:00
Jordan Liggitt a674335ccc
Avoid copying aggregated admin/edit/view roles during bootstrap 2018-05-13 15:21:05 -04:00
Kubernetes Submit Queue 2fd9d8654e
Merge pull request #63740 from dims/control-exactly-what-we-use-in-kubeadm
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Control exactly what we use in kubeadm

**What this PR does / why we need it**:

we recently got rid of extra arg validation for preflight check:
9f21f5dd1e

the import-boss configuration will help us control exactly what
gets added/used in kubeadm. In this PR, we add a white-list of
the exact packages we use currently.

We will need to review these, make new PR(s) to  eliminate things
we don't want to be depending on (just like the cloud provider related code).

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note

```
2018-05-13 11:29:36 -07:00
Davanum Srinivas 00aeecd712 Control exactly what we use in kubeadm
we recently got rid of extra arg validation for preflight check:
9f21f5dd1e

the import-boss configuration will help us control exactly what
gets added/used in kubeadm. In this PR, we add a white-list of
the exact packages we use currently.

We will need to review these, make new PR(s) to  eliminate things
we don't want to be depending on (just like the cloud provider related code).
2018-05-12 21:55:56 -04:00
Kubernetes Submit Queue feeee50363
Merge pull request #63551 from luxas/revisit_kubeadm_owners
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Revisit the OWNERS file for kubeadm

**What this PR does / why we need it**:

The OWNERS file for kubeadm is getting a little bit stale. As discussed in today's SIG Cluster Lifecycle meeting, we're gonna update it with the currently active contributors.

**Special notes for your reviewer**:

Every person that is involved here, please ACK and LGTM the change.

@jbeda removed from approvers
@krousey removed from approvers/reviewers
@fabriziopandini graduated to an approver
@dmmcquay removed from reviewers
@jamiehannaford removed from reviewers
@kargakis removed from reviewers
@liztio added to reviewers
@chuckha added to reviewers
@detiber added to reviewers
@stealthybox added to reviewers
@dixudx added to reviewers

Thank you everyone for your contributions 👏 (no one can't maintain something forever), and congratulations and welcome everyone with a new role, happy to have you here 👍!

**Release note**:

```release-note
NONE
```
cc @kubernetes/sig-cluster-lifecycle-pr-reviews
2018-05-12 00:58:12 -07:00