Commit Graph

66585 Commits (dd5dccc7404304cd8d6b4d43b68c35400bf95e7f)

Author SHA1 Message Date
Pengfei Ni 6da502e016 Setup windows security context in CRI 2018-06-05 09:27:40 +08:00
Pengfei Ni eeec15a7d9 Add security context for Windows containers 2018-06-05 09:27:40 +08:00
lichuqiang 9a77899ee5 API changes for Topology aware dynamic provisioning 2018-06-05 09:27:02 +08:00
Mike Danese 91feb345aa implement service account token projection 2018-06-04 17:22:08 -07:00
Kubernetes Submit Queue 50178d3ed3
Merge pull request #64661 from liggitt/hostname-override
Automatic merge from submit-queue (batch tested with PRs 63453, 64592, 64482, 64618, 64661). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Clarify --hostname-override and --cloud-provider interaction

pairs with a PR to the website cloud provider page defining behavior for existing cloud providers: https://github.com/kubernetes/website/pull/8873

xref https://github.com/kubernetes/kubernetes/issues/64659 https://github.com/kubernetes/kubernetes/issues/62600 https://github.com/kubernetes/kubernetes/issues/61774 https://github.com/kubernetes/kubernetes/issues/54482

```release-note
NONE
```
2018-06-04 16:56:22 -07:00
Kubernetes Submit Queue 54eeca0912
Merge pull request #64618 from chuckha/loggin
Automatic merge from submit-queue (batch tested with PRs 63453, 64592, 64482, 64618, 64661). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Replace glog.Info{f,ln} with fmt.Print{f,ln}

Please see commit message.

Signed-off-by: Chuck Ha <ha.chuck@gmail.com>

**What this PR does / why we need it**:
This PR makes kubeadm's logging output consistent for the regular case and offers verbosity with glog.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes kubernetes/kubeadm#852

**Special notes for your reviewer**:
Unfortunately there is one call site in a dependency that uses a bare glog.Infof which we can't change without a bigger effort.

**Release note**:
```release-note
NONE
```
2018-06-04 16:56:18 -07:00
Kubernetes Submit Queue 819d51567f
Merge pull request #64482 from ericchiang/exec-plugin-beta
Automatic merge from submit-queue (batch tested with PRs 63453, 64592, 64482, 64618, 64661). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

client-go: promote exec plugin support to beta

/sig auth
/kind feature

Adds a "v1beta1" API group for client authentication. Because of a lack of usage with the input parameters, these have been dropped for the beta. Would like to re-introduce them as users feel they require them.

updates https://github.com/kubernetes/kubernetes/issues/61796

```release-note
client-go: credential exec plugins have been promoted to beta
```
2018-06-04 16:56:15 -07:00
Kubernetes Submit Queue 898831ad9d
Merge pull request #64592 from ravisantoshgudimetla/revert-64364-remove-rescheduler
Automatic merge from submit-queue (batch tested with PRs 63453, 64592, 64482, 64618, 64661). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Revert "Remove rescheduler and corresponding tests from master"

Reverts kubernetes/kubernetes#64364

After discussing with @bsalamat on how DS controllers(ref: https://github.com/kubernetes/kubernetes/pull/63223#discussion_r192277527) cannot create pods if the cluster is at capacity and they have to rely on rescheduler for making some space, we thought it is better to 

- Bring rescheduler back.
- Make rescheduler priority aware.
- If cluster is full and if **only** DS controller is not able to create pods, let rescheduler be run and let it evict some pods which have less priority.
- The DS controller pods will be scheduled now.

So, I am reverting this PR now. Step 2, 3 above are going to be in rescheduler.

/cc @bsalamat @aveshagarwal @k82cn 

Please let me know your thoughts on this. 

```release-note
Revert #64364 to resurrect rescheduler. More info https://github.com/kubernetes/kubernetes/issues/64725 :)
```
2018-06-04 16:56:11 -07:00
Kubernetes Submit Queue edff14935e
Merge pull request #63453 from nitkon/master
Automatic merge from submit-queue (batch tested with PRs 63453, 64592, 64482, 64618, 64661). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add Makefile target to push fat manifest for multi-arch images

Signed-off-by: Nitesh Konkar <niteshkonkar@in.ibm.com>



**What this PR does / why we need it**:
This PR adds support to push fat manifest for multi-arch images. We need this
so that we can seamlessly pull and run the test images on multiple platforms. 

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note

```
2018-06-04 16:56:08 -07:00
Josh Horwitz c7fbcf35da Add support for enforcing read only host paths in PSPs. 2018-06-04 19:10:37 -04:00
David Zhu cc3fb7e861 staging godep update 2018-06-04 15:49:56 -07:00
Janet Kuo de622012a6
Test job backoffLimit correctly 2018-06-05 00:47:46 +02:00
Kubernetes Submit Queue 46d2b47156
Merge pull request #57963 from vikaschoudhary16/priorityclass
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Introduce priority class in the resource quota

**What this PR does / why we need it**:
Implements https://github.com/kubernetes/community/pull/933
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #48648 

**Special notes for your reviewer**:
Test Cases are still to be covered. Opening this PR to make discussion convenient with code references.
Will update test cases only after design PR has got merged.

**Release note**:

```release-note
Ability to quota resources by priority
```
/kind feature
/priority important-soon
/sig scheduling
/sig node
/cc @resouer @derekwaynecarr @sjenning @bsalamat @timstclair @aveshagarwal @ravisantoshgudimetla
2018-06-04 15:11:00 -07:00
Mehdy Bohlool dc7b36b333 Add mbohlool to apiextensions-apiserver reviewer list 2018-06-04 15:05:25 -07:00
Yang Guo a7474e8059 Update dependency 2018-06-04 14:54:06 -07:00
Yang Guo 5014881054 Update GCE cloud provider to use Cloud TPU v1 API 2018-06-04 14:53:54 -07:00
David Zhu 4ece3be08e Bazel BUILD fixes 2018-06-04 14:31:50 -07:00
Martin Ostrowski a8a24849c0 Modify security profile for proxy 2018-06-04 14:06:22 -07:00
Silvery Fu 8792f99bf8 Fix the handling of untagged images 2018-06-04 13:57:09 -07:00
Silvery Fu 73970a5027 Update generated bazel 2018-06-04 13:56:51 -07:00
Serguei Bezverkhi ea474cd99c New labelmanager package 2018-06-04 16:54:25 -04:00
David Zhu 103d5070f3 update golang/protobuf to v1.1.0 to satisfy CSI v0.3.0 hard requirement 2018-06-04 13:53:02 -07:00
Serguei Bezverkhi 1c05ca5575 Adding CSI driver registration 2018-06-04 16:47:24 -04:00
Sandeep Rajan ab0a421e8d coredns to gcr.io repo 2018-06-04 16:44:42 -04:00
David Zhu 62d42d7bbc Update container-storage-interface/spec vendor to v0.3.0 (and related dependencies) 2018-06-04 13:25:18 -07:00
vikaschoudhary16 3cfe6412c7 Introduce priority class in the resource quota 2018-06-04 16:14:54 -04:00
Jiaying Zhang c9e85ec309 Add gpu cluster upgrade test. 2018-06-04 12:54:30 -07:00
Kubernetes Submit Queue 1d10287d75
Merge pull request #63929 from losipiuk/lo/scheduler-priorities-ca-friendly
Automatic merge from submit-queue (batch tested with PRs 61610, 64591, 58143, 63929). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add parametrizable priority function mapping requested/capacity ratio to priority

```release-note
NONE
```
2018-06-04 12:26:24 -07:00
Kubernetes Submit Queue 08c15a6a38
Merge pull request #58143 from CaoShuFeng/audit_annotation_another_version
Automatic merge from submit-queue (batch tested with PRs 61610, 64591, 58143, 63929). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add PodSecurityPolicy information to audit logs

Depends on: https://github.com/kubernetes/kubernetes/pull/58806
Fix #56209

**Release note**:
```release-note
PodSecurityPolicy admission information is added to audit logs
```
2018-06-04 12:26:21 -07:00
Kubernetes Submit Queue 4f088e6263
Merge pull request #64591 from cadmuxe/custom_netd
Automatic merge from submit-queue (batch tested with PRs 61610, 64591, 58143, 63929). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add netd as an addon for GCP

**What this PR does / why we need it**:
Add netd as an addon for GKE.
The PR will add setup functions and var to help deploy netd daemon on GKE.
Please checkout more detail for netd at https://github.com/GoogleCloudPlatform/netd

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```
2018-06-04 12:26:16 -07:00
Kubernetes Submit Queue 36a3daa355
Merge pull request #61610 from rajansandeep/kubeupaddon
Automatic merge from submit-queue (batch tested with PRs 61610, 64591, 58143, 63929). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Create CoreDNS and kube-dns folders

**What this PR does / why we need it**:
Separate the CoreDNS and kube-dns manifests by creating their own folders (dns/coredns and dns/kube-dns) 

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #61435 

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
cc @MrHohn
2018-06-04 12:26:12 -07:00
Minhan Xia ac4e015e12 trigger kubelet sync pod on reconciliation 2018-06-04 12:17:04 -07:00
Minhan Xia d46cdbed6c Generate pod ready status with readiness gates 2018-06-04 12:16:56 -07:00
Michelle Au f3f1a04705 Only mount subpath as readonly if specified in volumeMount 2018-06-04 12:05:23 -07:00
Hemant Kumar 32b69193c6 Fix panic caused by no cloudprovider in test
We should not panic when no cloudprovider is present
2018-06-04 14:50:18 -04:00
liz b42564a5cb
Kubeadm-initialised kubelet uses provided hostname if present
If --node-name is passed in to `kubeadm init`, `--hostname-override` will be
passed to kubelet.
2018-06-04 14:25:56 -04:00
liz 3da1228186
Bazel artefacts 2018-06-04 14:04:02 -04:00
Michael Taufen 0a6db6b194 Fix test tag on dynamic config tests
The test accidentally got turned off when the NodeAlphaFeature tag was
added in #64125. This PR updates the tag to turn it back on.
2018-06-04 11:03:30 -07:00
Kubernetes Submit Queue 16c5804482
Merge pull request #64697 from sttts/sttts-fuzzer-no-empty-label-keys
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

apimachinery: do not fuzz ObjectMeta.{Labels/Annotation} with empty keys

Fixes flaking `TestReplicationControllerConversion`.
2018-06-04 10:53:57 -07:00
Maciej Szulik 5df2755399
Never clean backoff in job controller 2018-06-04 19:28:58 +02:00
Kubernetes Submit Queue 86ae84b10e
Merge pull request #64665 from stealthybox/feature/kubeadm_845-systemd-resolved
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm: Set the kubelet `--resolv-conf` flag conditionally on init

**What this PR does / why we need it**:
`kubeadm init` detects if systemd-resolved is running and configures the kubelet to use a working resolv.conf.
This patch also removes the warning message prompting manual user action for this configuration.

/area kubeadm
/area kubelet
/area dns
/kind bug
/priority important-soon

/sig cluster-lifecycle
/assign @timothysc

**Which issue(s) this PR fixes** 
Fixes https://github.com/kubernetes/kubeadm/issues/845

**Special notes for your reviewer**:
See the difference in `KUBELET_KUBEADM_ARGS` when running with this build and enabling the resolved daemon on Ubuntu 17.10:
```bash
root@vagrant:/vagrant/bin# bash << EOF
systemctl start systemd-resolved
./845_kubeadm init |& tail -n5
cat /var/lib/kubelet/kubeadm-flags.env

./845_kubeadm reset --force |& tail -n2
systemctl stop systemd-resolved
echo nameserver 8.8.8.8 > /etc/resolv.conf

./845_kubeadm init |& tail -n5
cat /var/lib/kubelet/kubeadm-flags.env

EOF
You can now join any number of machines by running the following on each node
as root:

  kubeadm join 10.0.2.15:6443 --token 77q84j.0342evur7rrfrwwx --discovery-token-ca-cert-hash sha256:190040f9c3adf8410bc6766dac79f8679870190564e15e8f8d1704fafa03f678

KUBELET_KUBEADM_ARGS=--cgroup-driver=cgroupfs --cni-bin-dir=/opt/cni/bin --cni-conf-dir=/etc/cni/net.d --network-plugin=cni --resolv-conf=/run/systemd/resolve/resolv.conf
I0603 06:49:16.592482   14106 reset.go:276] [reset] deleting contents of config directories: [/etc/kubernetes/manifests /etc/kubernetes/pki]
I0603 06:49:16.592858   14106 reset.go:290] [reset] deleting files: [/etc/kubernetes/admin.conf /etc/kubernetes/kubelet.conf /etc/kubernetes/bootstrap-kubelet.conf /etc/kubernetes/controller-manager.conf /etc/kubernetes/scheduler.conf]
You can now join any number of machines by running the following on each node
as root:

  kubeadm join 10.0.2.15:6443 --token 8mdart.gp67vq3nh9urq4z5 --discovery-token-ca-cert-hash sha256:da6b2e5841546eae134524b045e782f0dd91a6b53becc8d69c15d9eab9c88758

KUBELET_KUBEADM_ARGS=--cgroup-driver=cgroupfs --cni-bin-dir=/opt/cni/bin --cni-conf-dir=/etc/cni/net.d --network-plugin=cni
```

**Release note**:
```release-note
`kubeadm init` detects if systemd-resolved is running and configures the kubelet to use a working resolv.conf.
```
2018-06-04 08:20:31 -07:00
Kevin Taylor 1b1f5cc654 Remove event handler to satisfy alpha tests 2018-06-04 16:11:28 +01:00
Dr. Stefan Schimanski 808bd3703a apimachinery: do not fuzz ObjectMeta.{Labels/Annotation} with empty keys 2018-06-04 14:58:40 +00:00
Di Xu 9a2e58b5e7 kubeadm: use nodeselector instead of affinity in kube-dns 2018-06-04 22:48:48 +08:00
Di Xu d1949261ab kubeadm: use nodeSelector to only run kube-proxy on architecture consistent nodes 2018-06-04 22:48:04 +08:00
Chuck Ha 125f5ac61a
Replace glog.Info{f,ln} with fmt.Print{f,ln}
This follows the pattern `kubectl` uses for logging.

There are two remaining glog.Infof call that cannot be removed easily.

One glog call comes from kubelet validation which calls features.SetFromMap.
The other comes from test/e2e during kernel validation.

Mostly fixes kubernetes/kubeadm#852

Signed-off-by: Chuck Ha <ha.chuck@gmail.com>
2018-06-04 10:34:31 -04:00
Cao Shufeng 241422879d Log policy name from pod security policy 2018-06-04 19:24:25 +08:00
Cao Shufeng c38a704fb7 add WithAudit admission decorator
WithAudit admission decorator log annotations to audit events set by
the decorated admission controller
2018-06-04 19:24:22 +08:00
Cao Shufeng 72ef2dc724 support AddAnnotation in admission attributes 2018-06-04 19:24:18 +08:00
Łukasz Osipiuk 98041d0925 Allow parametrization of RequestedToCapacityRatio priority function via policy config 2018-06-04 12:28:54 +02:00