Kubernetes Submit Queue 5e444bbe12 Merge pull request #57613 from mtaufen/explicit-kubelet-flags ... Automatic merge from submit-queue (batch tested with PRs 57733, 57613, 57953). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Explicit kubelet flags The Kubelet was using the global flag set. Libraries also often use the global flag set. There are flags in the Kubelet's usage statement for which the Kubelet does not control registration. This is bad, we must have full control of our command-line API. This PR puts a stop to it. I worked through the Kubelet's usage printout and tracked down the flags. In the below list, flags with checkboxes are one of: - explicitly **registered** in this PR - thought about and outright **rejected** - thought about and **registered-deprecated** for legacy reasons For the others we need to figure out whether they should be **registered** or **rejected** or **registered-deprecated**. ### cadvisor: grep commands, for reference: ``` # flag definitions in cadvisor git grep -E "\"application_metrics_count_limit\"|\"boot_id_file\"|\"container_hints\"|\"containerd\"|\"docker\"|\"docker_env_metadata_whitelist\"|\"docker_only\"|\"docker_root\"|\"docker-tls\"|\"docker-tls-ca\"|\"docker-tls-cert\"|\"docker-tls-key\"|\"enable_load_reader\"|\"event_storage_age_limit\"|\"event_storage_event_limit\"|\"global_housekeeping_interval\"|\"housekeeping_interval\"|\"log_cadvisor_usage\"|\"machine_id_file\"|\"storage_driver_buffer_duration\"|\"storage_driver_db\"|\"storage_driver_host\"|\"storage_driver_password\"|\"storage_driver_secure\"|\"storage_driver_table\"|\"storage_driver_user\"" -- vendor/github.com/google/cadvisor # flag invocations git grep -E "\--application_metrics_count_limit|--boot_id_file|--container_hints|--containerd|--docker|--docker_env_metadata_whitelist|--docker_only|--docker_root|--docker_tls|--docker_tls_ca|--docker_tls_cert|--docker_tls_key|--enable_load_reader|--event_storage_age_limit|--event_storage_event_limit|--global_housekeeping_interval|--housekeeping_interval|--log_cadvisor_usage|--machine_id_file|--storage_driver_buffer_duration|--storage_driver_db|--storage_driver_host|--storage_driver_password|--storage_driver_secure|--storage_driver_table|--storage_driver_user" -- ':(exclude)pkg/generated/bindata.go' ':(exclude)Godeps' ':(exclude)CHANGELOG*' ':(exclude)vendor' # normalized flag invocations git grep -E "\--application-metrics-count-limit|--boot-id-file|--container-hints|--containerd|--docker|--docker-env-metadata-whitelist|--docker-only|--docker-root|--docker-tls|--docker-tls-ca|--docker-tls-cert|--docker-tls-key|--enable-load-reader|--event-storage-age-limit|--event-storage-event-limit|--global-housekeeping-interval|--housekeeping-interval|--log-cadvisor-usage|--machine-id-file|--storage-driver-buffer-duration|--storage-driver-db|--storage-driver-host|--storage-driver-password|--storage-driver-secure|--storage-driver-table|--storage-driver-user" -- ':(exclude)pkg/generated/bindata.go' ':(exclude)Godeps' ':(exclude)CHANGELOG*' ':(exclude)vendor' # flag names git grep -E "application_metrics_count_limit|boot_id_file|container_hints|containerd|docker|docker_env_metadata_whitelist|docker_only|docker_root|docker_tls|docker_tls_ca|docker_tls_cert|docker_tls_key|enable_load_reader|event_storage_age_limit|event_storage_event_limit|global_housekeeping_interval|housekeeping_interval|log_cadvisor_usage|machine_id_file|storage_driver_buffer_duration|storage_driver_db|storage_driver_host|storage_driver_password|storage_driver_secure|storage_driver_table|storage_driver_user" ':(exclude)pkg/generated/bindata.go' ':(exclude)Godeps' ':(exclude)CHANGELOG*' ':(exclude)vendor' # normalized flag names git grep -E "application-metrics-count-limit|boot-id-file|container-hints|containerd|docker|docker-env-metadata-whitelist|docker-only|docker-root|docker-tls|docker-tls-ca|docker-tls-cert|docker-tls-key|enable-load-reader|event-storage-age-limit|event-storage-event-limit|global-housekeeping-interval|housekeeping-interval|log-cadvisor-usage|machine-id-file|storage-driver-buffer-duration|storage-driver-db|storage-driver-host|storage-driver-password|storage-driver-secure|storage-driver-table|storage-driver-user" ':(exclude)pkg/generated/bindata.go' ':(exclude)Godeps' ':(exclude)CHANGELOG*' ':(exclude)vendor' # normalized and underscore names combined git grep -E "application_metrics_count_limit|boot_id_file|container_hints|containerd|docker|docker_env_metadata_whitelist|docker_only|docker_root|docker_tls|docker_tls_ca|docker_tls_cert|docker_tls_key|enable_load_reader|event_storage_age_limit|event_storage_event_limit|global_housekeeping_interval|housekeeping_interval|log_cadvisor_usage|machine_id_file|storage_driver_buffer_duration|storage_driver_db|storage_driver_host|storage_driver_password|storage_driver_secure|storage_driver_table|storage_driver_user|application-metrics-count-limit|boot-id-file|container-hints|containerd|docker-env-metadata-whitelist|docker-only|docker-root|docker-tls|docker-tls-ca|docker-tls-cert|docker-tls-key|enable-load-reader|event-storage-age-limit|event-storage-event-limit|global-housekeeping-interval|housekeeping-interval|log-cadvisor-usage|machine-id-file|storage-driver-buffer-duration|storage-driver-db|storage-driver-host|storage-driver-password|storage-driver-secure|storage-driver-table|storage-driver-user" ':(exclude)pkg/generated/bindata.go' ':(exclude)Godeps' ':(exclude)CHANGELOG*' ':(exclude)vendor' ``` - [x] --docker-root (**registered** - this is used in `cluster/saltbase/salt/kubelet/default`) - [x] --housekeeping-interval (**registered** - e2e node tests rely on this (`test/e2e_node/resource_collector.go`)) - [x] --application-metrics-count-limit (**registered-deprecated** - temporarily register for legacy) - [x] --boot-id-file (**registered-deprecated** - temporarily register for legacy) - [x] --container-hints (**registered-deprecated** - temporarily register for legacy) - [x] --containerd (**registered-deprecated** - temporarily register for legacy) - [x] --docker (**registered-deprecated** - temporarily register for legacy) - [x] --docker-env-metadata-whitelist (**registered-deprecated** - temporarily register for legacy) - [x] --docker-only (**registered-deprecated** - temporarily register for legacy) - [x] --docker-tls (**registered-deprecated** - temporarily register for legacy) - [x] --docker-tls-ca (**registered-deprecated** - temporarily register for legacy) - [x] --docker-tls-cert (**registered-deprecated** - temporarily register for legacy) - [x] --docker-tls-key (**registered-deprecated** - temporarily register for legacy) - [x] --enable-load-reader (**registered-deprecated** - temporarily register for legacy) - [x] --event-storage-age-limit (**registered-deprecated** - the Kubelet overrides the default via the global flagset (`pkg/kubelet/cadvisor/cadvisor_linux.go`), but nothing else in core repo provides) - [x] --event-storage-event-limit (**registered-deprecated** - the Kubelet overrides the default via the global flagset (`pkg/kubelet/cadvisor/cadvisor_linux.go`), but nothing else in core repo provides) - [x] --global-housekeeping-interval (**registered-deprecated** - temporarily register for legacy) - [x] --log-cadvisor-usage (**registered-deprecated** - temporarily register for legacy) - [x] --machine-id-file (**registered-deprecated** - temporarily register for legacy) - [x] --storage-driver-user (**registered-deprecated** - temporarily register for legacy) - [x] --storage-driver-password (**registered-deprecated** - temporarily register for legacy) - [x] --storage-driver-host (**registered-deprecated** - temporarily register for legacy) - [x] --storage-driver-db (**registered-deprecated** - temporarily register for legacy) - [x] --storage-driver-table (**registered-deprecated** - temporarily register for legacy) - [x] --storage-driver-secure (**registered-deprecated** - temporarily register for legacy) - [x] --storage-driver-buffer-duration (**registered-deprecated** - temporarily register for legacy) ### pkg/apiserver/util/logs: - [x] --log-flush-frequency (**registered** - like the glog flags, this is probably useful) ### pkg/credentialprovider/azure/azure_credentials.go: - [x] --azure-container-registry-config (**registered** - This isn't quite as straightforward as --google-json-key, because the file it points to isn't static. For now we will just register, and we will deprecate it when there is an alternative. See below comments.) ### pkg/credentialprovider/gcp/jwt.go: - [x] --google-json-key (**registered-deprecated** - This is really old legacy stuff to allow kubelets to authenticate with gcr (see: d5e0054eb0). See @liggit's below comment for what should be used instead.) ### pkg/cloudprovider/providers/gce/gce_loadbalancer.go: - [x] --cloud-provider-gce-lb-src-cidrs (**rejected** - Kubelet doesn't need to know about the cidrs that were opened in the firewall for the load balancer) ### glog: I registered all of these, since this logging library is used pretty much everywhere in the Kubelet, and all of its toggles are probably useful. - [x] --logtostderr (**registered**) - [x] --alsologtostderr (**registered**) - [x] -v, --v (**registered**) - [x] --stderrthreshold (**registered**) - [x] --vmodule (**registered**) - [x] --log-backtrace-at (**registered**) - [x] --log-dir (**registered**) ### verflag: This is how you get the Kubelet's version, absolutely necessary to register this. - [x] --version (**registered**) ```release-note The Kubelet now explicitly registers all of its command-line flags with an internal flagset, which prevents flags from third party libraries from unintentionally leaking into the Kubelet's command-line API. Many unintentionally leaked flags are now marked deprecated, so that users have a chance to migrate away from them before they are removed. One previously leaked flag, --cloud-provider-gce-lb-src-cidrs, was entirely removed from the Kubelet's command-line API, because it is irrelevant to Kubelet operation. ``` Thanks to @liggitt for being surprised that we didn't already do this. Thanks to @dashpole for realizing cadvisor flags were leaked after seeing #55863. Thanks to @tallclair who recognized this problem a long time ago in #19432.		2018-01-09 21:51:37 -08:00
..
app	Merge pull request #57613 from mtaufen/explicit-kubelet-flags	2018-01-09 21:51:37 -08:00
BUILD	All Kubelet flags should be explicitly registered	2018-01-09 17:37:34 -08:00
OWNERS	Update OWNERS	2017-01-18 15:18:04 -08:00
kubelet.go	All Kubelet flags should be explicitly registered	2018-01-09 17:37:34 -08:00