Commit Graph

66167 Commits (ff6f4803d9b10ec0a1bfed5420eb354e8a71c59f)

Author SHA1 Message Date
Dr. Stefan Schimanski ff6f4803d9 apimachinery: adapt ObjectConvertor invariant
We avoid deepcopies in the codec/conversion stack by re-using data structures.
This means that the out object of a conversion must be deepcopied before mutation
in order to not mutate the in object as well.

This guarantees that e.g. runtime.Encode (which uses conversion from internal -> versioned)
does not mutate the input. This would be highly unexpected (and we do not mention possible
mutation of the input for runtime.Encode).
2018-06-01 22:31:27 +00:00
Kubernetes Submit Queue d02cf08e27
Merge pull request #64528 from MrHohn/gce-backend-service-beta
Automatic merge from submit-queue (batch tested with PRs 64364, 64369, 63819, 64528). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[gce provider] More wrappers for alpha/beta backend service

**What this PR does / why we need it**:
Sorry, some more wrapper functions I missed last time.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #NONE 

**Special notes for your reviewer**:
/assign @rramkumar1  

**Release note**:

```release-note
NONE
```
2018-05-30 22:54:15 -07:00
Kubernetes Submit Queue 374992a6fb
Merge pull request #63819 from mikedanese/svacctproj-api
Automatic merge from submit-queue (batch tested with PRs 64364, 64369, 63819, 64528). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add APIs for service account volume projection

ref https://github.com/kubernetes/kubernetes/issues/58790

designed in https://github.com/kubernetes/community/pull/1973

Release note will be included in the implementation.
```release-note
NONE
```
2018-05-30 22:54:11 -07:00
Kubernetes Submit Queue 483b6a6264
Merge pull request #64369 from idealhack/sub-benchmarks/apiserver/aes
Automatic merge from submit-queue (batch tested with PRs 64364, 64369, 63819, 64528). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

apiserver: update tests to use sub-benchmarks (aes_test.go)

**What this PR does / why we need it**:

Go 1.7 added the subtest feature which can make table-driven tests much easier to run and debug. Some tests are not using this feature.

Further reading: [Using Subtests and Sub-benchmarks](https://blog.golang.org/subtests)

/kind cleanup

**Release note**:

```release-note
NONE
```
2018-05-30 22:54:08 -07:00
Kubernetes Submit Queue a762ea1beb
Merge pull request #64364 from ravisantoshgudimetla/remove-rescheduler
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove rescheduler and corresponding tests from master

**What this PR does / why we need it**:
This is to remove rescheduler from master branch as we are promoting priority and preemption to beta.
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Part of #57471

**Special notes for your reviewer**:
/cc @bsalamat @aveshagarwal 
**Release note**:

```release-note
Remove rescheduler from master.
```
2018-05-30 22:20:26 -07:00
Kubernetes Submit Queue f5254dab8a
Merge pull request #58442 from m1093782566/ipvs-ga
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Declare IPVS-based kube-proxy GA and remove feature gateway

**What this PR does / why we need it**:

As discussed in sig-network meeting, we decided to target IPVS-based kube-proxy GA in 1.10.

This PR declares IPVS-based kube-proxy GA and remove feature gateway.

**Which issue(s) this PR fixes**:

Fixes: #58443

issue in feature repo: https://github.com/kubernetes/features/issues/265

**Special notes for your reviewer**:

**Release note**:

```release-note
Declare IPVS-based kube-proxy GA
```

@quinton-hoole
2018-05-30 21:21:42 -07:00
Kubernetes Submit Queue 87dfadb27a
Merge pull request #64347 from neolit123/kubeadm-docker-cgroup
Automatic merge from submit-queue (batch tested with PRs 64338, 64219, 64486, 64495, 64347). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm: conditionally set the kubelet cgroup driver for Docker

**What this PR does / why we need it**:
Add a new utility file - util/cgroupdriver.go.
Currently it only contains the public function GetCgroupDriverDocker().
The function uses 'docker info' to obtain the cgroup driver
for Docker.

On a later stage this file can contain more methods for different
CRI.

Use GetCgroupDriverDocker() in phases/kubelet/flags.go
to conditionally set the 'cgroup-driver' argument. On error
print a warning and don't set the argument value.

Add unit tests in cgroupdriver_test.go.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes kubernetes/kubeadm#844

**Special notes for your reviewer**:
NONE

**Release note**:

```release-note
kubeadm: conditionally set the kubelet cgroup driver for Docker
```

/area kubeadm
/kind enhancement
@kubernetes/sig-cluster-lifecycle-pr-reviews 
@luxas
2018-05-30 20:17:25 -07:00
Kubernetes Submit Queue 7a2bc5c47b
Merge pull request #64495 from hanxiaoshuai/fix0530
Automatic merge from submit-queue (batch tested with PRs 64338, 64219, 64486, 64495, 64347). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove unused parameter in func buildFakeProxier

**What this PR does / why we need it**:
remove unused parameter in func buildFakeProxier
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-05-30 20:17:22 -07:00
Kubernetes Submit Queue 4df4a607cd
Merge pull request #64486 from mtaufen/cleanup-unused-status-message
Automatic merge from submit-queue (batch tested with PRs 64338, 64219, 64486, 64495, 64347). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove unused status per TODO

This should have been deleted in #63221, as it is now unused.

```release-note
NONE
```
2018-05-30 20:17:19 -07:00
Kubernetes Submit Queue 835268e6e7
Merge pull request #64219 from ixdy/hack-lib-golang-cgo-overrides
Automatic merge from submit-queue (batch tested with PRs 64338, 64219, 64486, 64495, 64347). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add KUBE_CGO_OVERRIDES env var to force enabling CGO

**What this PR does / why we need it**: as detailed in https://github.com/kubernetes/release/issues/469 (and elsewhere), there is a desire to have `kubectl` built with CGO enabled on mac OS.

There currently isn't a great way to do this in our official cross builds, but we should allow mac users to build their own kubectl with CGO enabled if they desire, e.g. through homebrew.

This change enables that; you can now do `KUBE_CGO_OVERRIDES=kubectl make WHAT=cmd/kubectl` and get a cgo-enabled `kubectl`.

The default build outputs remain unchanged.

**Release note**:

```release-note
kubectl built for darwin from darwin now enables cgo to use the system-native C libraries for DNS resolution. Cross-compiled kubectl (e.g. from an official kubernetes release) still uses the go-native netgo DNS implementation. 
```

/assign @BenTheElder @cblecker 
cc @bks7 @bitglue
2018-05-30 20:17:15 -07:00
Kubernetes Submit Queue 887f8ecf4e
Merge pull request #64338 from agau4779/deprecate-gce-addr-fakes
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[GCE] use fakeGCECloud instead of gce address fakes

**What this PR does / why we need it**:
Use the fakeGCECloud mock instead of FakeCloudAddressService.

**Release note**:
```release-note
NONE
```
2018-05-30 20:09:15 -07:00
Kubernetes Submit Queue a1c8d3f5f3
Merge pull request #64403 from jsafrane/aws-read-only-attach
Automatic merge from submit-queue (batch tested with PRs 57082, 64325, 64016, 64443, 64403). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Allow AWS EBS volumes to be attached as ReadOnly.

**Which issue(s) this PR fixes**
Fixes #64402

**Special notes for your reviewer**:
This follows logic e.g. in Cinder volume plugin.

**Release note**:

```release-note
AWS EBS volumes can be now used as ReadOnly in pods.
```

/sig storage
/sig aws
2018-05-30 18:49:23 -07:00
Kubernetes Submit Queue 305d053182
Merge pull request #64443 from deads2k/server-16-aggregate-tight
Automatic merge from submit-queue (batch tested with PRs 57082, 64325, 64016, 64443, 64403). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

services must listen on port 443 for aggregation

If a clusterIP service isn't listening on port 443, don't mark it as available.

@mfojtik you've got an issue, right?
@kubernetes/sig-api-machinery-bugs 
/assign @sttts 

/kind bug

```release-note
NONE
```
2018-05-30 18:49:20 -07:00
Kubernetes Submit Queue 0340864ae9
Merge pull request #64016 from stewart-yu/stewart-controller-manager-codeclean
Automatic merge from submit-queue (batch tested with PRs 57082, 64325, 64016, 64443, 64403). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

should not ignore err when convert api version

**What this PR does / why we need it**:
should not ignore err when convert api version

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-05-30 18:49:17 -07:00
Kubernetes Submit Queue 9d36590e80
Merge pull request #64325 from bart0sh/PR000015-remove-CrictlChecker
Automatic merge from submit-queue (batch tested with PRs 57082, 64325, 64016, 64443, 64403). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove CrictlChecker from preflight checks

**What this PR does / why we need it**:

CrictlChecker uses InPathCheck to check if crictl presents
in the PATH. The same check is done in CRICheck function.

CrictlChecker is also called unconditionally, producing messages
that can confuse users. CRICheck is called only when needed, i.e.
when user specifies CRI socket.

**Release note**:
```release-note
NONE
```
2018-05-30 18:49:13 -07:00
Kubernetes Submit Queue 3e127ccbef
Merge pull request #57082 from tianshapjq/small-nit-container/os.go
Automatic merge from submit-queue (batch tested with PRs 57082, 64325, 64016, 64443, 64403). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

small nit in the annotations of pkg/kubelet/container/os.go

**What this PR does / why we need it**:
just a small nit in the annotations of container/os.go, but, it looks quite uncomfortable cause others all get right.
2018-05-30 18:49:10 -07:00
Kubernetes Submit Queue b5d21a92ad
Merge pull request #64339 from liztio/pronouns
Automatic merge from submit-queue (batch tested with PRs 61803, 64305, 64170, 64361, 64339). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove some unnecessarily gendered pronouns in comments

**What this PR does / why we need it**:

A bunch of comments are unnecessarily gendered. I've changed them to gender-neutral they/theirs.

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-05-30 17:34:25 -07:00
Kubernetes Submit Queue 2b1bfc3a17
Merge pull request #64361 from xlgao-zju/patch-1
Automatic merge from submit-queue (batch tested with PRs 61803, 64305, 64170, 64361, 64339). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Improve the help of kubeadm completion

**What this PR does / why we need it**:
Add note that 'bash-completion' is required on Linux too.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes [kubernetes/kubeadm/#860](https://github.com/kubernetes/kubeadm/issues/860)

**Special notes for your reviewer**:
cc @neolit123

**Release note**:
```release-note
NONE
```
2018-05-30 17:34:21 -07:00
Kubernetes Submit Queue e978c47f5e
Merge pull request #64170 from mtaufen/cap-node-num-images
Automatic merge from submit-queue (batch tested with PRs 61803, 64305, 64170, 64361, 64339). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add a flag to control the cap on images reported in node status

While I normally try to avoid adding flags, this is a short term
scalability fix for v1.11, and there are other long-term solutions in
the works, so we shouldn't commit to this in the v1beta1 Kubelet config.
Flags are our escape hatch here.

```release-note
NONE
```
2018-05-30 17:34:18 -07:00
Kubernetes Submit Queue 89dd3316d8
Merge pull request #64305 from hzxuzhonghu/fix-toleration-validation
Automatic merge from submit-queue (batch tested with PRs 61803, 64305, 64170, 64361, 64339). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix toleration validation invalid error

Fixes #64301

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-05-30 17:34:15 -07:00
Kubernetes Submit Queue f701b75299
Merge pull request #61803 from awly/client-auth-exec-tls
Automatic merge from submit-queue (batch tested with PRs 61803, 64305, 64170, 64361, 64339). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add TLS support to exec authenticator plugin

**What this PR does / why we need it**:
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/auth/kubectl-exec-plugins.md#tls-client-certificate-support

Allows exec plugin to return raw TLS key/cert data. This data populates
transport.Config.TLS field.
This requires a change to AuthProvider interface to expose TLS configs,
not only RoundTripper.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #61421

**Special notes for your reviewer**:

**Release note**:

```release-note
Exec authenticator plugin supports TLS client certificates.
```
2018-05-30 17:34:11 -07:00
Kubernetes Submit Queue ea92879fab
Merge pull request #62306 from freehan/pod-status-patch2
Automatic merge from submit-queue (batch tested with PRs 58920, 58327, 60577, 49388, 62306). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use Patch instead of Put to sync pod status

ref: https://github.com/kubernetes/community/blob/master/keps/sig-network/0007-pod-ready%2B%2B.md
```release-note
Use Patch instead of Put to sync pod status
```
2018-05-30 16:09:36 -07:00
Kubernetes Submit Queue 6b2fc7cb75
Merge pull request #49388 from HotelsDotCom/feature/Dynamic-env-in-subpath
Automatic merge from submit-queue (batch tested with PRs 58920, 58327, 60577, 49388, 62306). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Dynamic env in subpath - Fixes Issue 48677

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #48677

**Special notes for your reviewer**:

**Release note**:

```release-note
Adds the VolumeSubpathEnvExpansion alpha feature to support environment variable expansion
Sub-paths cannot be mounted with a dynamic volume mount name.
This fix provides environment variable expansion to sub paths
This reduces the need to manage symbolic linking within sidecar init containers to achieve the same goal  
```
2018-05-30 16:09:31 -07:00
Kubernetes Submit Queue 5cf652d899
Merge pull request #60577 from timchenxiaoyu/fixpersist
Automatic merge from submit-queue (batch tested with PRs 58920, 58327, 60577, 49388, 62306). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix persist typo

I wonder this pr should pull to kubernetes/kubernetes  or  kubernetes/client-go ?

```
NONE
```
2018-05-30 16:09:28 -07:00
Kubernetes Submit Queue 53fd4cd46d
Merge pull request #58327 from sharmaansh/patch-2
Automatic merge from submit-queue (batch tested with PRs 58920, 58327, 60577, 49388, 62306). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Replace error string with const
2018-05-30 16:09:24 -07:00
Kubernetes Submit Queue 22919ae7e1
Merge pull request #58920 from victorgp/master
Automatic merge from submit-queue (batch tested with PRs 58920, 58327, 60577, 49388, 62306). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Possible cipher suites values and tls versions in help for apiserver and kubelet

**What this PR does / why we need it**:
Addresses a suggestion made by @lavalamp to list the possible TLS cipher suites in the kubelet and apiserver helps: https://github.com/kubernetes/kubernetes/pull/48859#discussion_r162413223

**Which issue(s) this PR fixes** 
NONE

**Special notes for your reviewer**:
This pull request only adds to the help message the possible values of the TLS Cipher suites for Kubelet and api server.
It is an addition to the already merged PR https://github.com/kubernetes/kubernetes/pull/48859

The help output looks like this:

```
      --tls-cert-file string                                    File containing the default x509 Certificate for HTTPS. (CA cert, if any, concatenated after server cert). If HTTPS serving is enabled, and --tls-cert-file and --tls-private-key-file are not provided, a self-signed certificate and key are generated for the public address and saved to the directory specified by --cert-dir.
      --tls-cipher-suites strings                               Comma-separated list of cipher suites for the server. Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). If omitted, the default Go cipher suites will be use.  Possible values: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
      --tls-min-version string                                  Minimum TLS version supported. Value must match version names from https://golang.org/pkg/crypto/tls/#pkg-constants.
      --tls-private-key-file string                             File containing the default x509 private key matching --tls-cert-file.

```

**Release note**:
```release-note
NONE
```
2018-05-30 16:09:20 -07:00
Andrew Lytvynov cd89f9473f Add TLS support to exec authenticator plugin
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/auth/kubectl-exec-plugins.md#tls-client-certificate-support

Allows exec plugin to return raw TLS key/cert data. This data populates
transport.Config.TLS fields.
transport.Config.TLS propagates custom credentials using
tls.Config.GetClientCertificate callback.
On key/cert rotation, all connections using old credentials are
closed
2018-05-30 14:03:32 -07:00
Kubernetes Submit Queue 595059bb65
Merge pull request #62991 from tomoe/cronjob-prune
Automatic merge from submit-queue (batch tested with PRs 64281, 62991). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Whitelist CronJob for kubectl apply --prune

**What this PR does / why we need it**:
Support CronJob for kubectl apply --prune

**Special notes for your reviewer**: N/A

**Release note**:

```release-note
kubectl apply --prune supports CronJob resource. 
```
2018-05-30 13:24:09 -07:00
Kubernetes Submit Queue 6ea7763c40
Merge pull request #64281 from wangzhen127/es-seccomp
Automatic merge from submit-queue (batch tested with PRs 64281, 62991). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use default seccomp profile for flutend-elasticsearch addons

**What this PR does / why we need it**:
This PR sets the default seccomp profile to 'docker/default' for:
- fluentd-es daemon set.
- kibana-logging deployment.

The elasticsearch-logging stateful set is still unconfined because it uses gce:podsecuritypolicy:privileged.

This PR is a followup of #62662. We are using 'docker/default' instead of 'runtime/default' in addons in order to handle node version skew. When seccomp profile is applied automatically by default later, we can remove those annotations.

This is PR is part of #39845.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-05-30 13:24:05 -07:00
Michael Taufen 0539086ff3 add a flag to control the cap on images reported in node status
While I normally try to avoid adding flags, this is a short term
scalability fix for v1.11, and there are other long-term solutions in
the works, so we shouldn't commit to this in the v1beta1 Kubelet config.
Flags are our escape hatch.
2018-05-30 12:54:30 -07:00
Zihong Zheng fdc58eb891 [gce provider] More wrappers for alpha/beta backend service 2018-05-30 12:29:42 -07:00
Minhan Xia 85e0d05ac7 add utils for pod condition 2018-05-30 11:33:55 -07:00
Minhan Xia 78b86333c1 make update 2018-05-30 11:33:55 -07:00
Minhan Xia cb9ac04777 fix unit tests using Patch in fake client 2018-05-30 11:33:55 -07:00
Minhan Xia 8b3b4e4dea add Patch support in fake kubeClient 2018-05-30 11:33:51 -07:00
Kubernetes Submit Queue f3d54f3f95
Merge pull request #64311 from liggitt/min-startup-pods
Automatic merge from submit-queue (batch tested with PRs 64318, 64269, 64438, 64516, 64311). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Revert "Change default min-startup-pods value"

This reverts commit de0bf05f46.

The number of pods to require is a cluster-dependent setting, and should be set by the invoker, not defaulted here

https://github.com/kubernetes/test-infra/pull/8135 must be merged first

```release-note
NONE
```
2018-05-30 11:25:29 -07:00
Kubernetes Submit Queue 65573739fe
Merge pull request #64516 from soltysh/fix_error
Automatic merge from submit-queue (batch tested with PRs 64318, 64269, 64438, 64516, 64311). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix error message to be consistent with others

**Special notes for your reviewer**:
/assign @juanvallejo 

**Release note**:
```release-note
NONE
```
2018-05-30 11:25:25 -07:00
Kubernetes Submit Queue 990892184f
Merge pull request #64438 from dixudx/cli_rollout_name
Automatic merge from submit-queue (batch tested with PRs 64318, 64269, 64438, 64516, 64311). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

include rollout object name in cli message

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #64331

**Special notes for your reviewer**:
/cc soltysh 
 
**Release note**:

```release-note
None
```
2018-05-30 11:25:21 -07:00
Kubernetes Submit Queue dd13969924
Merge pull request #64269 from kad/kubeadm-834
Automatic merge from submit-queue (batch tested with PRs 64318, 64269, 64438, 64516, 64311). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

UX improvement for preflight check for external etcd client certificates

**What this PR does / why we need it**:
UX improvement for preflight check for external etcd client certificates

By using same preflight check label for all etcd client certificates, it will
allow user to use single identifier, and as result shorter command line
arguments to kubeadm, in case multiple issues found with those files.

Fixes: 

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes kubernetes/kubeadm#834

**Special notes for your reviewer**:

**Release note**:
```release-note
Label ExternalEtcdClientCertificates can be used for ignoring all preflight check issues related to client certificate files for external etcd.
```
2018-05-30 11:25:16 -07:00
Kubernetes Submit Queue 5aa513429b
Merge pull request #64318 from gonzolino/os-lbaas-addresses
Automatic merge from submit-queue (batch tested with PRs 64318, 64269, 64438, 64516, 64311). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Ensure that only IPs are used as node addresses in OpenStack LBs

**What this PR does / why we need it**:
ATM, when no InternalIP can be found for a node, the openstack cloud provider tries to create a LB with whatever is the first address it can find for the node. This could also be the hostname or a dns name.
However, LBaaS will reject anything that is not an IP address for pool members. Therefore a meaningful error should be returned instead of just returning the first address of the node, even if it is clear that this will lead to an error in LBaaS.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #64317

**Special notes for your reviewer**:

**Release note**:

```release-note
Provide a meaningful error message in openstack cloud provider when no valid IP address can be found for a node
```
2018-05-30 11:25:12 -07:00
Minhan Xia 35777c31ea change kubelet status manager to use patch instead of put to update pod status 2018-05-30 11:15:47 -07:00
Minhan Xia 9fe2c53624 include patch permission for kubelets 2018-05-30 11:15:47 -07:00
Minhan Xia 212a16eccc add utils to patch pod status 2018-05-30 11:15:47 -07:00
Mike Danese 514d280e2f autogenerated 2018-05-30 11:06:58 -07:00
Yang Li 19026bf962 apiserver: update tests to use sub-benchmarks (aes_test.go) 2018-05-31 01:34:14 +08:00
Lubomir I. Ivanov 2a63ba1db6 kubeadm: conditionally set the kubelet cgroup driver for Docker
Add a new utility file - util/cgroupdriver.go.
Currently it only contains the public function GetCgroupDriverDocker().
The function uses 'docker info' to obtain the cgroup driver
for Docker.

On a later stage this file can contain more methods for different
CRI.

Use GetCgroupDriverDocker() in phases/kubelet/flags.go
to conditionally set the 'cgroup-driver' argument. On error
print a warning and don't set the argument value.

Add unit tests in cgroupdriver_test.go.
2018-05-30 20:29:21 +03:00
Kubernetes Submit Queue 99ebcd94c9
Merge pull request #64370 from idealhack/sub-benchmarks/apiserver/secretbox
Automatic merge from submit-queue (batch tested with PRs 64322, 64210, 64458, 64232, 64370). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

apiserver: update tests to use sub-benchmarks (secretbox_test.go)

**What this PR does / why we need it**:

Go 1.7 added the subtest feature which can make table-driven tests much easier to run and debug. Some tests are not using this feature.

Further reading: [Using Subtests and Sub-benchmarks](https://blog.golang.org/subtests)

/kind cleanup

**Release note**:

```release-note
NONE
```
2018-05-30 10:09:18 -07:00
Kubernetes Submit Queue 897a4b4968
Merge pull request #64232 from luxas/kubeadm_config_migrate
Automatic merge from submit-queue (batch tested with PRs 64322, 64210, 64458, 64232, 64370). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm: Add a 'kubeadm config migrate' command

**What this PR does / why we need it**:

This is an UX improvement so users may easier "upgrade" their **configuration files** from the an old version (e.g. `v1alpha1`) version to a new one (e.g. `v1alpha2`), can do this **locally and seamlessly without touching a cluster**. We talked about this in the SIG meeting; getting the users to be able to convert their checked-in configuration files to new API versions will be crucial.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
kubeadm: Add a 'kubeadm config migrate' command to convert old API types to their newer counterparts in the new, supported API types. This is just a client-side tool, it just executes locally without requiring a cluster to be running. You can think about this as an Unix pipe that upgrades config files.
```
@kubernetes/sig-cluster-lifecycle-pr-reviews @liztio
2018-05-30 10:09:15 -07:00
Kubernetes Submit Queue 75517f60b9
Merge pull request #64458 from mrogers950/reconcile-dryrun-additive
Automatic merge from submit-queue (batch tested with PRs 64322, 64210, 64458, 64232, 64370). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add dry-run flag to auth reconcile

```release-note
The --dry-run flag has been enabled for kubectl auth reconcile
```
/assign @juanvallejo 
cc @enj
2018-05-30 10:09:11 -07:00
Kubernetes Submit Queue 31815fc81e
Merge pull request #64210 from luxas/kubeadm_kubelet_extraargs
Automatic merge from submit-queue (batch tested with PRs 64322, 64210, 64458, 64232, 64370). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm: Move .NodeName and .CRISocket to a common sub-struct

**What this PR does / why we need it**:
Regroups some common fields for `kubeadm init` and `kubeadm join` only used for the initial node registration.
Lets the user specify ExtraArgs to the kubelet.
Now also runs the dynamic env file creation for `kubeadm join`.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes https://github.com/kubernetes/kubeadm/issues/847
Follows-up https://github.com/kubernetes/kubernetes/pull/63887
Related to kubernetes/kubeadm#822

**Special notes for your reviewer**: WIP, but please review so we can finalize the direction of the PR

**Release note**:

```release-note
[action required] `.NodeName` and `.CRISocket` in the `MasterConfiguration` and `NodeConfiguration` v1alpha1 API objects are now `.NodeRegistration.Name` and `.NodeRegistration.CRISocket` respectively in the v1alpha2 API. The `.NoTaintMaster` field has been removed in the v1alpha2 API.
```
@kubernetes/sig-cluster-lifecycle-pr-reviews @liztio
2018-05-30 10:09:07 -07:00