Commit Graph

1748 Commits (e4953081f743fe8b64d049f083fd35540f5360e0)

Author SHA1 Message Date
Kubernetes Submit Queue 7cd32aba17 Merge pull request #45775 from liggitt/mirror-pod-validation
Automatic merge from submit-queue (batch tested with PRs 44337, 45775, 45832, 45574, 45758)

Tighten validation of mirror pod annotations

Tightens validation for pods with a mirror pod annotation:
1. spec.nodeName must be set
2. makes the mirror pod annotation immutable
3. starts validating pod-specific annotations during pod status update

None of these changes affect usage of the mirror pod annotation by kubelets, which only set it on pod creation (verified this is true back to 1.5.x)

the second commit updates the pod validation tests to look for specific error messages (best reviewed ignoring whitespace changes)

This is the validation portion of https://github.com/kubernetes/community/blob/master/contributors/design-proposals/kubelet-authorizer.md and https://github.com/kubernetes/features/issues/279

```release-note
Mirror pods must now indicate the nodeName they are bound to on creation. The mirror pod annotation is now treated as immutable and cannot be added to an existing pod, removed from a pod, or modified.
```
2017-05-15 18:39:13 -07:00
Kubernetes Submit Queue 5563951887 Merge pull request #45830 from timothysc/sched_reviewers
Automatic merge from submit-queue

Update scheduler reviewers

**What this PR does / why we need it**:

Update Scheduler OWNERS to more accurately reflect reality.  

**Special notes for your reviewer**:

Are there others to add here?  

**Release note**:

```
NONE
```

/cc @kubernetes/sig-scheduling-pr-reviews
2017-05-15 15:58:05 -07:00
Kubernetes Submit Queue 3cede38922 Merge pull request #45591 from JonPulsifer/webhook-typo
Automatic merge from submit-queue (batch tested with PRs 41331, 45591, 45600, 45176, 45658)

Fixing typo in ImagePolicyWebhook admission.go

**What this PR does / why we need it**:
Noticed a typo in kubectl events when working with the ImagePolicyWebhook admission controller 

**Special notes for your reviewer**:
first time contributor
2017-05-15 13:25:44 -07:00
Timothy St. Clair 765281f5f1 Update scheduler reviewers 2017-05-15 12:48:22 -05:00
Derek Carr c20a33c5bd OwnerReferencesPermissionEnforcement ignores pods/status 2017-05-15 12:21:23 -04:00
Jordan Liggitt cd3a1187a1
Require nodeName for mirror pods, make mirror pod annotation immutable 2017-05-13 22:34:41 -04:00
Jonathan Pulsifer fd7a32d670
imagepolicy admission.go: typo fix 2017-05-10 09:08:14 -04:00
Klaus Ma c78faec4ff Initialize scheduler cache with assigned non-terminated pods before scheduling. 2017-05-10 01:50:38 +08:00
Kubernetes Submit Queue d13c42d339 Merge pull request #45472 from k82cn/rm_unused_func
Automatic merge from submit-queue (batch tested with PRs 41903, 45311, 45474, 45472, 45501)

Removed old scheduler constructor.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes # N/A

**Release note**:

```release-note-none
```
2017-05-08 15:46:41 -07:00
Kubernetes Submit Queue a3cf8b95da Merge pull request #45122 from ravisantoshgudimetla/priority_overflow#24720
Automatic merge from submit-queue (batch tested with PRs 44727, 45409, 44968, 45122, 45493)

Total priority overflow check

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #24720

**Special notes for your reviewer**:
@adohe. I have borrowed some parts of your code in the closed PR and created this one.

**Release note**:

```release-note
This fixes the overflow for priorityconfig-  valid range {1, 9223372036854775806}.
```
2017-05-08 14:54:40 -07:00
Klaus Ma 63d194b626 Removed old scheduler constructor. 2017-05-08 11:09:25 -04:00
ravisantoshgudimetla 7ae3136f5d Total priority buffer overflow check 2017-05-07 16:42:32 -04:00
Jamie Hannaford 9440a68744 Use dedicated Unix User and Group ID types 2017-05-05 14:07:38 +02:00
Chao Xu 47b410f58b Remove redundent GetObjectKind() defined on top-level types
TypeMeta is embedded in all these types and TypeMeta has GetObjectKind()
method to implement the runtime.Object interface.
2017-05-04 10:31:58 -07:00
Kubernetes Submit Queue 30cbdc01e5 Merge pull request #45152 from k82cn/ut_4_45098
Automatic merge from submit-queue (batch tested with PRs 45100, 45152, 42513, 44796, 45222)

Added InterPodAffinity unit test case with Namespace.

**What this PR does / why we need it**:
Added InterPodAffinity unit test case with Namespace: unit test case for #45098

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes # N/A

**Release note**:

```release-note-none
```
2017-05-02 10:35:07 -07:00
Kubernetes Submit Queue 05fafe1525 Merge pull request #45091 from k82cn/update_weight_check
Automatic merge from submit-queue

Align Extender's validation with prioritizers.

**What this PR does / why we need it**:
Align Extender's validation with prioritizers.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes # N/A

**Release note**:

```release-note-none
```
2017-04-30 14:49:50 -07:00
Klaus Ma 91bd30dde2 Added InterPodAffinity unit test case with Namespace. 2017-04-30 12:18:03 +08:00
Kubernetes Submit Queue ef4b4acf1e Merge pull request #45098 from wojtek-t/fix_scheduler_pod_affinity
Automatic merge from submit-queue

Fixes and minor cleanups to pod (anti)affinity predicate
2017-04-28 23:24:09 -07:00
Kubernetes Submit Queue dc5744b6a1 Merge pull request #45112 from liggitt/quote-log-message
Automatic merge from submit-queue

Quote groups in deny log message

Helps distinguish cases where an external authenticator is incorrectly combining multiple groups into one.

Before:
> RBAC DENY: user "bob" groups [system:masters view system:authenticated] cannot "list" resource "pods" cluster-wide

After:
> RBAC DENY: user "bob" groups ["system:masters view" "system:authenticated"] cannot "list" resource "pods" cluster-wide
2017-04-28 19:18:22 -07:00
Kubernetes Submit Queue 88ad8b9cb9 Merge pull request #41985 from ericchiang/bootstrap-token-auth-logging
Automatic merge from submit-queue (batch tested with PRs 41530, 44814, 43620, 41985)

kube-apiserver: improve bootstrap token authentication error messages

This was requested by @jbeda as a follow up to https://github.com/kubernetes/kubernetes/pull/41281.

cc @jbeda @luxas @kubernetes/sig-auth-pr-reviews
2017-04-28 10:03:41 -07:00
Kubernetes Submit Queue 58aebcd61b Merge pull request #44814 from weizhanxu/controllerRef_no_Need_Check_nil_again
Automatic merge from submit-queue (batch tested with PRs 41530, 44814, 43620, 41985)

no need check is nil, because has checked before

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```
2017-04-28 10:03:35 -07:00
Jordan Liggitt e87bce1f8a
Quote groups in deny log message 2017-04-28 12:40:38 -04:00
Kubernetes Submit Queue 021f542f24 Merge pull request #42432 from shaynewang/test_types
Automatic merge from submit-queue

Improved code coverage for plugin/pkg/scheduler/algorithm

**What this PR does / why we need it**:
Part of #39559 , code coverage improved from 0% to 100%
**Special notes for your reviewer**:
Improved coverage for scheduler/algorithm to 100%
Test cover output:
```
make test WHAT=./plugin/pkg/scheduler/algorithm KUBE_COVER=y
Running tests for APIVersion: v1,apps/v1beta1,authentication.k8s.io/v1,authentication.k8s.io/v1beta1,authorization.k8s.io/v1,authorization.k8s.io/v1beta1,autoscaling/v1,autoscaling/v2alpha1,batch/v1,batch/v2alpha1,certificates.k8s.io/v1beta1,extensions/v1beta1,imagepolicy.k8s.io/v1alpha1,policy/v1beta1,rbac.authorization.k8s.io/v1beta1,rbac.authorization.k8s.io/v1alpha1,storage.k8s.io/v1beta1,federation/v1beta1
+++ [0302 10:43:05] Saving coverage output in '/tmp/k8s_coverage/v1,apps/v1beta1,authentication.k8s.io/v1,authentication.k8s.io/v1beta1,authorization.k8s.io/v1,authorization.k8s.io/v1beta1,autoscaling/v1,autoscaling/v2alpha1,batch/v1,batch/v2alpha1,certificates.k8s.io/v1beta1,extensions/v1beta1,imagepolicy.k8s.io/v1alpha1,policy/v1beta1,rbac.authorization.k8s.io/v1beta1,rbac.authorization.k8s.io/v1alpha1,storage.k8s.io/v1beta1,federation/v1beta1/20170302-104305'
skipped	k8s.io/kubernetes/cmd/libs/go2idl/generator
skipped	k8s.io/kubernetes/vendor/k8s.io/client-go/1.4/rest
ok  	k8s.io/kubernetes/plugin/pkg/scheduler/algorithm	0.061s	coverage: 100.0% of statements
+++ [0302 10:43:07] Combined coverage report: /tmp/k8s_coverage/v1,apps/v1beta1,authentication.k8s.io/v1,authentication.k8s.io/v1beta1,authorization.k8s.io/v1,authorization.k8s.io/v1beta1,autoscaling/v1,autoscaling/v2alpha1,batch/v1,batch/v2alpha1,certificates.k8s.io/v1beta1,extensions/v1beta1,imagepolicy.k8s.io/v1alpha1,policy/v1beta1,rbac.authorization.k8s.io/v1beta1,rbac.authorization.k8s.io/v1alpha1,storage.k8s.io/v1beta1,federation/v1beta1/20170302-104305/combined-coverage.html
```
2017-04-28 08:21:32 -07:00
Wojciech Tyczynski 15c492bb2e Fixes and minor cleanups to pod (anti)affinity predicate 2017-04-28 13:22:07 +02:00
Klaus Ma 64a7bdf641 Align Extender's validation with prioritizers. 2017-04-28 17:55:25 +08:00
Kubernetes Submit Queue b2d714a7ca Merge pull request #44888 from caesarxuchao/clean-deepcopy-init
Automatic merge from submit-queue

Prepare for move zz_generated_deepcopy.go to k8s.io/api

This is in preparation to move deep copies to with the types to the types repo (see https://github.com/kubernetes/gengo/pull/47#issuecomment-296855818). The init() function is referring the `SchemeBuilder` defined in the register.go in the same packge, so we need to revert the dependency.

This PR depends on https://github.com/kubernetes/gengo/pull/49, otherwise verification will fail.
2017-04-27 18:48:28 -07:00
Chao Xu d0b94538b9 make it possible to move SchemeBuilder with zz_generated.deepcopy.go 2017-04-27 16:57:29 -07:00
Kubernetes Submit Queue 14a557b1a2 Merge pull request #44346 from mikedanese/build-static
Automatic merge from submit-queue (batch tested with PRs 41106, 44346, 44929, 44979, 45027)

bazel: statically link dockerized components
2017-04-27 12:11:00 -07:00
Shayne Wang a5d86270d3 added coverage for scheduler/algorithm/types_test.go 2017-04-26 23:55:22 -07:00
yupengzte 1cb74f246c fix typo
Signed-off-by: yupengzte <yu.peng36@zte.com.cn>
2017-04-26 14:10:13 +08:00
Kubernetes Submit Queue 1c315c64ba Merge pull request #44482 from k82cn/use_new_bind_api
Automatic merge from submit-queue (batch tested with PRs 44607, 44472, 44482)

Used Pods interface for binding.

Used Pods interface for binding in scheduler.
2017-04-25 14:47:41 -07:00
Eric Chiang f5fa115536 kube-apiserver: improve bootstrap token authentication error messages 2017-04-25 12:59:48 -07:00
Kubernetes Submit Queue 8488c939da Merge pull request #44797 from FengyunPan/fix-logProviders
Automatic merge from submit-queue (batch tested with PRs 44741, 44853, 44572, 44797, 44439)

Check errors before logging providers

The logProviders() should check errors firstly, and do not log
providers when providers is null.
2017-04-25 01:56:41 -07:00
Kubernetes Submit Queue fc6eb52d05 Merge pull request #44147 from FengyunPan/update-return
Automatic merge from submit-queue (batch tested with PRs 44862, 42241, 42101, 43181, 44147)

Update limitedByDefault() which does not return error

The limitedByDefault() just get the set of resources names, no error.
2017-04-24 19:39:46 -07:00
weizhanxu a7dd554ce3 no need check is nil, because has check before here 2017-04-23 21:08:24 +08:00
FengyunPan 3856b5d76c Check errors before logging providers
The logProviders() should check errors firstly, and do not log
providers when providers is null.
2017-04-22 16:55:32 +08:00
Kubernetes Submit Queue a121d1c674 Merge pull request #44404 from bsalamat/config_fix
Automatic merge from submit-queue

Scheduler configurator looks for a specific key in ConfigMap.Data

**What this PR does / why we need it**: Changes scheduler configurator to look for a specific key in ConfigMap.Data instead of the old logic which expected only one entry to exist in the map. The key is a constant whose value is "policy.cfg".

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```
2017-04-21 19:50:08 -07:00
Kubernetes Submit Queue 7b43f922aa Merge pull request #42176 from enisoc/controller-ref-job
Automatic merge from submit-queue (batch tested with PRs 42177, 42176, 44721)

Job: Respect ControllerRef

**What this PR does / why we need it**:

This is part of the completion of the [ControllerRef](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/controller-ref.md) proposal. It brings Job into full compliance with ControllerRef. See the individual commit messages for details.

**Which issue this PR fixes**:

This ensures that Job does not fight with other controllers over control of Pods.

Ref: #24433

**Special notes for your reviewer**:

**Release note**:

```release-note
Job controller now respects ControllerRef to avoid fighting over Pods.
```
cc @erictune @kubernetes/sig-apps-pr-reviews
2017-04-20 12:57:06 -07:00
Kubernetes Submit Queue f25a657574 Merge pull request #42177 from enisoc/controller-ref-cronjob
Automatic merge from submit-queue (batch tested with PRs 42177, 42176, 44721)

CronJob: Respect ControllerRef

**What this PR does / why we need it**:

This is part of the completion of the [ControllerRef](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/controller-ref.md) proposal. It brings CronJob into compliance with ControllerRef. See the individual commit messages for details.

**Which issue this PR fixes**:

This ensures that other controllers do not fight over control of objects that a CronJob owns.

**Special notes for your reviewer**:

**Release note**:

```release-note
CronJob controller now respects ControllerRef to avoid fighting with other controllers.
```
cc @erictune @kubernetes/sig-apps-pr-reviews
2017-04-20 12:57:03 -07:00
Jordan Liggitt 67360883bc
Switch to pointer to policy rule, visit and short circuit during authorization 2017-04-20 10:52:53 -04:00
Anthony Yeh be1fe95534 CronJob: Use PATCH to adopt Jobs. 2017-04-19 15:42:34 -07:00
Anthony Yeh aa7bc25812 Job: Add PATCH Pods permission.
This is needed to update ControllerRef during adopt/release.
2017-04-19 14:03:36 -07:00
Klaus Ma 47dbb8bbc9 Used Pods interface for binding. 2017-04-19 21:32:38 +08:00
Mike Danese 32735173df allow the token controller to get, update secrets
we need this on secret rotation here:

2c1c0f3f72/pkg/controller/serviceaccount/tokens_controller.go (L478-L481)
2017-04-18 17:40:42 -07:00
Kubernetes Submit Queue a1684fea80 Merge pull request #42085 from cblecker/gofmt-fix
Automatic merge from submit-queue (batch tested with PRs 40055, 42085, 44509, 44568, 43956)

Fix gofmt errors

**What this PR does / why we need it**:
There were some gofmt errors on master. Ran the following to fix:
```
hack/verify-gofmt.sh | grep ^diff | awk '{ print $2 }' | xargs gofmt -w -s
```

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: none

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-04-17 15:39:07 -07:00
Chao Xu 4f9591b1de move pkg/api/v1/ref.go and pkg/api/v1/resource.go to subpackages. move some functions in resource.go to pkg/api/v1/node and pkg/api/v1/pod 2017-04-17 11:38:11 -07:00
Mike Danese 3757e8bb5c bazel: statically link dockerized components
and remove libc from docker images when it's not needed.
2017-04-14 15:51:54 -07:00
Chao Xu d4850b6c2b move pkg/api/v1/helpers.go to subpackage 2017-04-14 14:25:11 -07:00
Mike Danese a05c3c0efd autogenerated 2017-04-14 10:40:57 -07:00
Bobby Salamat 6e4484e928 Change scheduler configurator to look for a specific key in ConfigMap.Data 2017-04-13 23:50:39 -07:00