This change corrects RoleBindingBuilder to use the RBAC API group
with users and groups as subjects (service accounts use the empty
string since they are in the legacy core group). This is based on
the defaulting in pkg/apis/rbac/v1/defaults.go#SetDefaults_Subject.
This is required because the bootstrap RBAC data is built with these
helpers and does not go through defaulting, whereas the data
retrieved from the server has already gone through defaulting. This
can lead to the reconciliation code incorrectly adding duplicate
subjects because it believes that they are missing (since the API
groups do not match).
Signed-off-by: Monis Khan <mkhan@redhat.com>
Kubernetes-commit: 974991b1800fcc7136e28584c729f867582f0752
Volume mounting logic introduced in #43775 and #45623 checks
for subPath existence before attempting to create a directory,
should subPath not be present.
This breaks if subPath is a dangling symlink, os.Stat returns
"do not exist" status, yet `os.MkdirAll` can't create directory
as symlink is present at the given path.
This patch makes existence check to use os.Lstat which works for
normal files/directories as well as doesn't not attempt to follow
symlink, therefore it's "do not exist" status is more reliable when
making a decision whether to create directory or not.
subPath symlinks can be dangling in situations where kubelet is
running in a container itself with access to docker socket, such
as CoreOS's kubelet-wrapper script
Kubernetes-commit: d552dff164dfc7b91d21bd7d7881838babab2a63
This reverts commit b5eadb5d6b9ce34a673caeafe4fa0971c4b91139, reversing
changes made to 1889d654f5c76fcc6ce14c6d3702c06a6498695d.
Kubernetes-commit: b6e08ec39dde2a6f3c24648aa8867c6aee9853cb
This PR adds two features:
1. add support for isolating the emptyDir volume use. If user
sets a size limit for emptyDir volume, kubelet's eviction manager
monitors its usage
and evict the pod if the usage exceeds the limit.
2. add support for isolating the local storage for container overlay. If
the container's overly usage exceeds the limit defined in container
spec, eviction manager will evict the pod.
Kubernetes-commit: 0b13aee0c0f9bd06eb323ea249db29547b66bc46
An annotation in the pod spec of the form:
podpreset.admission.kubernetes.io/exclude: "true"
Will cause the admission controller to skip manipulating the pod spec,
no matter the labelling.
The annotation for a podpreset acting on a pod has also been slightly
modified to contain a podpreset prefix:
podpreset.admission.kubernetes.io/podpreset-{name} = resource version
Fixes#44161
Kubernetes-commit: 08a59530e196ab9b30d306fb0fac5979b07298a1
This commit updates the generated autoscaling files to be up-to-date
with the HPA status condition changes.
Kubernetes-commit: c8fdeb022fbd11c3ac5333a772192a0d4f8213bb
