github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
k3s/test
History
Kubernetes Submit Queue 5e444bbe12
Merge pull request #57613 from mtaufen/explicit-kubelet-flags 
Automatic merge from submit-queue (batch tested with PRs 57733, 57613, 57953). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Explicit kubelet flags

The Kubelet was using the global flag set.
Libraries also often use the global flag set.
There are flags in the Kubelet's usage statement for which the Kubelet does not control registration.
This is bad, we must have full control of our command-line API.
This PR puts a stop to it.

I worked through the Kubelet's usage printout and tracked down the flags. 

In the below list, flags with checkboxes are one of:
- explicitly **registered** in this PR
- thought about and outright **rejected**
- thought about and **registered-deprecated** for legacy reasons

For the others we need to figure out whether they should be **registered** or **rejected** or **registered-deprecated**. 

### cadvisor:
grep commands, for reference:
```
# flag definitions in cadvisor
git grep -E "\"application_metrics_count_limit\"|\"boot_id_file\"|\"container_hints\"|\"containerd\"|\"docker\"|\"docker_env_metadata_whitelist\"|\"docker_only\"|\"docker_root\"|\"docker-tls\"|\"docker-tls-ca\"|\"docker-tls-cert\"|\"docker-tls-key\"|\"enable_load_reader\"|\"event_storage_age_limit\"|\"event_storage_event_limit\"|\"global_housekeeping_interval\"|\"housekeeping_interval\"|\"log_cadvisor_usage\"|\"machine_id_file\"|\"storage_driver_buffer_duration\"|\"storage_driver_db\"|\"storage_driver_host\"|\"storage_driver_password\"|\"storage_driver_secure\"|\"storage_driver_table\"|\"storage_driver_user\"" -- vendor/github.com/google/cadvisor
# flag invocations
git grep -E "\--application_metrics_count_limit|--boot_id_file|--container_hints|--containerd|--docker|--docker_env_metadata_whitelist|--docker_only|--docker_root|--docker_tls|--docker_tls_ca|--docker_tls_cert|--docker_tls_key|--enable_load_reader|--event_storage_age_limit|--event_storage_event_limit|--global_housekeeping_interval|--housekeeping_interval|--log_cadvisor_usage|--machine_id_file|--storage_driver_buffer_duration|--storage_driver_db|--storage_driver_host|--storage_driver_password|--storage_driver_secure|--storage_driver_table|--storage_driver_user" -- ':(exclude)pkg/generated/bindata.go' ':(exclude)Godeps' ':(exclude)CHANGELOG*' ':(exclude)vendor'
# normalized flag invocations
git grep -E "\--application-metrics-count-limit|--boot-id-file|--container-hints|--containerd|--docker|--docker-env-metadata-whitelist|--docker-only|--docker-root|--docker-tls|--docker-tls-ca|--docker-tls-cert|--docker-tls-key|--enable-load-reader|--event-storage-age-limit|--event-storage-event-limit|--global-housekeeping-interval|--housekeeping-interval|--log-cadvisor-usage|--machine-id-file|--storage-driver-buffer-duration|--storage-driver-db|--storage-driver-host|--storage-driver-password|--storage-driver-secure|--storage-driver-table|--storage-driver-user" -- ':(exclude)pkg/generated/bindata.go' ':(exclude)Godeps' ':(exclude)CHANGELOG*' ':(exclude)vendor'
# flag names
git grep -E "application_metrics_count_limit|boot_id_file|container_hints|containerd|docker|docker_env_metadata_whitelist|docker_only|docker_root|docker_tls|docker_tls_ca|docker_tls_cert|docker_tls_key|enable_load_reader|event_storage_age_limit|event_storage_event_limit|global_housekeeping_interval|housekeeping_interval|log_cadvisor_usage|machine_id_file|storage_driver_buffer_duration|storage_driver_db|storage_driver_host|storage_driver_password|storage_driver_secure|storage_driver_table|storage_driver_user"  ':(exclude)pkg/generated/bindata.go' ':(exclude)Godeps' ':(exclude)CHANGELOG*' ':(exclude)vendor'
# normalized flag names
git grep -E "application-metrics-count-limit|boot-id-file|container-hints|containerd|docker|docker-env-metadata-whitelist|docker-only|docker-root|docker-tls|docker-tls-ca|docker-tls-cert|docker-tls-key|enable-load-reader|event-storage-age-limit|event-storage-event-limit|global-housekeeping-interval|housekeeping-interval|log-cadvisor-usage|machine-id-file|storage-driver-buffer-duration|storage-driver-db|storage-driver-host|storage-driver-password|storage-driver-secure|storage-driver-table|storage-driver-user"  ':(exclude)pkg/generated/bindata.go' ':(exclude)Godeps' ':(exclude)CHANGELOG*' ':(exclude)vendor'
# normalized and underscore names combined
git grep -E "application_metrics_count_limit|boot_id_file|container_hints|containerd|docker|docker_env_metadata_whitelist|docker_only|docker_root|docker_tls|docker_tls_ca|docker_tls_cert|docker_tls_key|enable_load_reader|event_storage_age_limit|event_storage_event_limit|global_housekeeping_interval|housekeeping_interval|log_cadvisor_usage|machine_id_file|storage_driver_buffer_duration|storage_driver_db|storage_driver_host|storage_driver_password|storage_driver_secure|storage_driver_table|storage_driver_user|application-metrics-count-limit|boot-id-file|container-hints|containerd|docker-env-metadata-whitelist|docker-only|docker-root|docker-tls|docker-tls-ca|docker-tls-cert|docker-tls-key|enable-load-reader|event-storage-age-limit|event-storage-event-limit|global-housekeeping-interval|housekeeping-interval|log-cadvisor-usage|machine-id-file|storage-driver-buffer-duration|storage-driver-db|storage-driver-host|storage-driver-password|storage-driver-secure|storage-driver-table|storage-driver-user"  ':(exclude)pkg/generated/bindata.go' ':(exclude)Godeps' ':(exclude)CHANGELOG*' ':(exclude)vendor'
```
- [x]      --docker-root (**registered** - this is used in `cluster/saltbase/salt/kubelet/default`)
- [x]      --housekeeping-interval (**registered** - e2e node tests rely on this (`test/e2e_node/resource_collector.go`))
- [x]      --application-metrics-count-limit (**registered-deprecated** - temporarily register for legacy)
- [x]      --boot-id-file (**registered-deprecated** - temporarily register for legacy)
- [x]      --container-hints (**registered-deprecated** - temporarily register for legacy)
- [x]      --containerd (**registered-deprecated** - temporarily register for legacy)
- [x]      --docker (**registered-deprecated** - temporarily register for legacy)
- [x]      --docker-env-metadata-whitelist (**registered-deprecated** - temporarily register for legacy)
- [x]      --docker-only (**registered-deprecated** - temporarily register for legacy)
- [x]      --docker-tls (**registered-deprecated** - temporarily register for legacy)
- [x]      --docker-tls-ca (**registered-deprecated** - temporarily register for legacy)
- [x]      --docker-tls-cert (**registered-deprecated** - temporarily register for legacy)
- [x]      --docker-tls-key (**registered-deprecated** - temporarily register for legacy)
- [x]      --enable-load-reader (**registered-deprecated** - temporarily register for legacy)
- [x]      --event-storage-age-limit (**registered-deprecated** - the Kubelet overrides the default via the global flagset (`pkg/kubelet/cadvisor/cadvisor_linux.go`), but nothing else in core repo provides)
- [x]      --event-storage-event-limit (**registered-deprecated** - the Kubelet overrides the default via the global flagset (`pkg/kubelet/cadvisor/cadvisor_linux.go`), but nothing else in core repo provides)
- [x]      --global-housekeeping-interval (**registered-deprecated** - temporarily register for legacy)
- [x]      --log-cadvisor-usage (**registered-deprecated** - temporarily register for legacy)
- [x]      --machine-id-file (**registered-deprecated** - temporarily register for legacy)
- [x]      --storage-driver-user (**registered-deprecated** - temporarily register for legacy)
- [x]      --storage-driver-password (**registered-deprecated** - temporarily register for legacy)
- [x]      --storage-driver-host (**registered-deprecated** - temporarily register for legacy)
- [x]      --storage-driver-db (**registered-deprecated** - temporarily register for legacy)
- [x]      --storage-driver-table (**registered-deprecated** - temporarily register for legacy)
- [x]      --storage-driver-secure (**registered-deprecated** - temporarily register for legacy)
- [x]      --storage-driver-buffer-duration (**registered-deprecated** - temporarily register for legacy)

### pkg/apiserver/util/logs:
- [x]      --log-flush-frequency (**registered** - like the glog flags, this is probably useful)

### pkg/credentialprovider/azure/azure_credentials.go:
- [x]      --azure-container-registry-config (**registered** - This isn't quite as straightforward as --google-json-key, because the file it points to isn't static. For now we will just register, and we will deprecate it when there is an alternative. See below comments.)

### pkg/credentialprovider/gcp/jwt.go:
- [x]      --google-json-key (**registered-deprecated** - This is really old legacy stuff to allow kubelets to authenticate with gcr (see: d5e0054eb0). See @liggit's below comment for what should be used instead.)

### pkg/cloudprovider/providers/gce/gce_loadbalancer.go:
- [x]      --cloud-provider-gce-lb-src-cidrs (**rejected** - Kubelet doesn't need to know about the cidrs that were opened in the firewall for the load balancer)

### glog:
I registered all of these, since this logging library is used pretty much everywhere in the Kubelet, and all of its toggles are probably useful.
- [x]      --logtostderr (**registered**)
- [x]      --alsologtostderr (**registered**)
- [x]  -v, --v (**registered**)
- [x]      --stderrthreshold (**registered**)
- [x]      --vmodule (**registered**)
- [x]      --log-backtrace-at (**registered**)
- [x]      --log-dir (**registered**)

### verflag:
This is how you get the Kubelet's version, absolutely necessary to register this.
- [x]      --version (**registered**)

```release-note
The Kubelet now explicitly registers all of its command-line flags with an internal flagset, which prevents flags from third party libraries from unintentionally leaking into the Kubelet's command-line API. Many unintentionally leaked flags are now marked deprecated, so that users have a chance to migrate away from them before they are removed. One previously leaked flag, --cloud-provider-gce-lb-src-cidrs, was entirely removed from the Kubelet's command-line API, because it is irrelevant to Kubelet operation.
```

Thanks to @liggitt for being surprised that we didn't already do this.
Thanks to @dashpole for realizing cadvisor flags were leaked after seeing #55863.
Thanks to @tallclair who recognized this problem a long time ago in #19432.
 		2018-01-09 21:51:37 -08:00
..
conformance Autogenerate BUILD files 2017-12-23 13:12:11 -08:00
e2e Merge pull request #57613 from mtaufen/explicit-kubelet-flags 2018-01-09 21:51:37 -08:00
e2e_node Merge pull request #57976 from Random-Liu/node-e2e-non-docker-specific 2018-01-09 17:26:40 -08:00
fixtures Revert k8s.gcr.io vanity domain 2017-12-22 14:36:16 -08:00
images Add owners file for test images 2017-12-26 20:44:45 +05:30
integration Fix build and test errors from etcd 3.2.13 upgrade 2018-01-07 08:22:08 -08:00
kubemark Revert k8s.gcr.io vanity domain 2017-12-22 14:36:16 -08:00
list Autogenerate BUILD files 2017-12-23 13:12:11 -08:00
soak Autogenerate BUILD files 2017-12-23 13:12:11 -08:00
utils Merge pull request #57762 from ihmccreery/mdp-ver-017 2018-01-05 17:52:44 -08:00
BUILD Add conformance test regression test. 2017-10-27 15:31:20 -07:00
OWNERS fabiano no longer a thing 2017-12-19 16:37:12 -02:00
test_owners.csv Move scheduler code out of plugin directory. 2018-01-05 15:05:01 -08:00
test_owners.json Remove all traces of federation 2017-10-26 13:37:37 -07:00