Commit Graph

336 Commits

Author SHA1 Message Date
David Zhu
028258244c Set up alternate mount point for SCSI/NVMe local SSD by UUID in /mnt/disks/by-uuid/, set up ability to have unformatted disk symlinked in /dev/disk/by-uuid/. Added tests. Preserved backwards compatibility. 2017-11-14 17:14:41 -08:00
Kubernetes Submit Queue
95b4312899
Merge pull request #55466 from x13n/addon-manager
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use results of kube-controller-manager leader election in addon manager

**What this PR does / why we need it**:
This adds leader election-like mechanism to addon manager. Currently, in a multi-master setup, upgrading one master will trigger a fight between addon managers on different masters, each forcing its own versions of addons. This leads to pod unavailability until all masters are upgraded to new version.

To avoid implementing leader election in bash, results of leader election in kube-controller-manager are used. Long term, addon manager probably should be rewritten in a real prgramming language (probably Go), and then, real leader election should be implemented there.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
I don't think there was an issue for this specifically, but this PR is related to https://github.com/kubernetes/kubernetes/issues/473

**Special notes for your reviewer**:

**Release note**:
```release-note
Addon manager supports HA masters.
```
2017-11-14 11:26:31 -08:00
Kubernetes Submit Queue
330a615466
Merge pull request #55243 from porridge/cert-errors
Automatic merge from submit-queue (batch tested with PRs 54602, 54877, 55243, 55509, 55128). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add some error handling in place of ilusory one.

**What this PR does / why we need it**:

TL;DR: "set -e" is ignored inside function foo when it's called like
"foo || something".

See https://github.com/kubernetes/kubernetes/issues/55229 for details.

This is a short-term hack that will hopefully let us at least see the
error messages whenever we hit intermittent certificate setup errors
next time. Once we know what fails there, we can start working on an
actual fix, which may very well involve rewriting this in a language
other than shell, with better error handling.

**Which issue(s) this PR fixes**
Partially addresses #55229

**Release note**:
```release-note
NONE
```
2017-11-14 03:03:27 -08:00
Daniel Kłobuszewski
ae6e506fdc
Merge branch 'master' into addon-manager 2017-11-14 09:36:20 +01:00
Sandeep Rajan
5c7392368f Add CoreDNS as an optional addon in kube-up 2017-11-13 18:38:51 -05:00
Kubernetes Submit Queue
4f91113075
Merge pull request #54826 from mindprince/addon-manager
Automatic merge from submit-queue (batch tested with PRs 54826, 53576, 55591, 54946, 54825). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Run nvidia-gpu device-plugin daemonset as an addon on GCE nodes that have nvidia GPUs attached

- Instead of the old `Accelerators` feature that added `alpha.kubernetes.io/nvidia-gpu` resource, use the new `DevicePlugins` feature that adds vendor specific resources. (In case of nvidia GPUs it will
add `nvidia.com/gpu` resource.)

- Add node label to GCE nodes with accelerators attached. This node label is the same as what GKE attaches to node pools with accelerators attached. (For example, for nvidia-tesla-p100 GPU, the label would be `cloud.google.com/gke-accelerator=nvidia-tesla-p100`) This will help us target accelerator specific
daemonsets etc. to these nodes.

- Run nvidia-gpu device-plugin daemonset as an addon on GCE nodes that have nvidia GPUs attached.

- Some minor documentation improvements in addon manager.

**Release note**:
```release-note
GCE nodes with NVIDIA GPUs attached now expose `nvidia.com/gpu` as a resource instead of `alpha.kubernetes.io/nvidia-gpu`.
```

/sig cluster-lifecycle
/sig scheduling
/area hw-accelerators

https://github.com/kubernetes/features/issues/368
2017-11-13 14:46:55 -08:00
Daniel Kłobuszewski
5e4692f784 Use results of kube-controller-manager leader election in addon manager 2017-11-13 14:54:37 +01:00
Marcin Owsiany
7b745e0016 Review comments addressed. 2017-11-10 09:39:02 +01:00
Marcin Owsiany
9c5a058708 fixup: remove useless errexit setting 2017-11-07 17:07:16 +01:00
Marcin Owsiany
dbcf0faa00 Add some error handling in place of ilusory one.
TL;DR: "set -e" is ignored inside function foo when it's called like
"foo || something".

See https://github.com/kubernetes/kubernetes/issues/55229 for details.

This is a short-term hack that will hopefully let us at least see the
error messages whenever we hit intermittent certificate setup errors
next time. Once we know what fails there, we can start working on an
actual fix, which may very well involve rewriting this in a language
other than shell, with better error handling.
2017-11-07 15:36:14 +01:00
Kubernetes Submit Queue
7a28aaffa7
Merge pull request #54964 from Random-Liu/add-containerd-e2e
Automatic merge from submit-queue (batch tested with PRs 54488, 54838, 54964). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add support to for alternative container runtime in `kube-up.sh`

For https://github.com/kubernetes/features/issues/286.

This PR added 4 new environment variables in `kube-up.sh` to support alternative container runtime:
1) `KUBE_MASTER_EXTRA_METADATA` and `KUBE_NODE_EXTRA_METADATA`. Add extra metadata on master and node instance. With this we could specify different cloud-init for a different container runtime, and also add extra metadata for the new cloud-init, e.g. [master.yaml](7d73966214/test/e2e/master.yaml)
2) `KUBE_CONTAINER_RUNTIME_ENDPOINT`. Specify different sock for different container runtime. It's only used when it's not empty.
3) `KUBE_LOAD_IMAGE_COMMAND`. Specify different load image command for different container runtime.

An example for cri-containerd:
```
export KUBE_MASTER_EXTRA_METADATA="user-data=${GOPATH}/src/github.com/kubernetes-incubator/cri-containerd/test/e2e/master.yaml,cri-containerd-configure-sh=${GOPATH}/src/github.com/kubernetes-incubator/cri-containerd/test/configure.sh"
export KUBE_NODE_EXTRA_METADATA="user-data=${GOPATH}/src/github.com/kubernetes-incubator/cri-containerd/test/e2e/node.yaml,cri-containerd-configure-sh=${GOPATH}/src/github.com/kubernetes-incubator/cri-containerd/test/configure.sh"
export KUBE_CONTAINER_RUNTIME="remote"
export KUBE_CONTAINER_RUNTIME_ENDPOINT="/var/run/cri-containerd.sock"
export KUBE_LOAD_IMAGE_COMMAND="/home/cri-containerd/usr/local/bin/cri-containerd load"
export NETWORK_POLICY_PROVIDER="calico"
```

Signed-off-by: Lantao Liu <lantaol@google.com>

```release-note
none
```
/cc @yujuhong @dchen1107 @feiskyer @mikebrow @abhi @mrunalp @runcom 
/cc @kubernetes/sig-node-pr-reviews
2017-11-02 18:01:19 -07:00
Lantao Liu
8279916c65 Fix calico network policy for opensource.
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-11-02 21:56:46 +00:00
Rohit Agarwal
cf292754ba Run nvidia-gpu device-plugin daemonset as an addon on GCE nodes that have nvidia GPUs attached. 2017-11-02 12:58:29 -07:00
Lantao Liu
75293ac7a2 Add containerd e2e.
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-11-02 03:44:42 +00:00
Tim Allclair
88db819170
GCP PodSecurityPolicy configuration 2017-11-01 14:03:09 -07:00
Kubernetes Submit Queue
51652d1c23 Merge pull request #53816 from marun/remove-federation
Automatic merge from submit-queue (batch tested with PRs 54112, 54150, 53816, 54321, 54338). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove federation

This PR removes the federation codebase and associated tooling from the tree.

The first commit just removes the `federation` path and should be uncontroversial.  The second commit removes references and associated tooling and suggests careful review.

Requirements for merge:

- [x] Bazel jobs no longer hard-code federation as a target ([test infra #4983](https://github.com/kubernetes/test-infra/pull/4983))
- [x] `federation-e2e` jobs are not run by default for k/k

**Release note**:

```release-note
Development of Kubernetes Federation has moved to github.com/kubernetes/federation.  This move out of tree also means that Federation will begin releasing separately from Kubernetes.  The impact of this is Federation-specific behavior will no longer be included in kubectl, kubefed will no longer be released as part of Kubernetes, and the Federation servers will no longer be included in the hyperkube binary and image.
```

cc: @kubernetes/sig-multicluster-pr-reviews @kubernetes/sig-testing-pr-reviews
2017-10-26 17:07:28 -07:00
Kubernetes Submit Queue
abe9d2f736 Merge pull request #54150 from ihmccreery/mdc-e2e
Automatic merge from submit-queue (batch tested with PRs 54112, 54150, 53816, 54321, 54338). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Enable metadata concealment for tests

**What this PR does / why we need it**: Metadata concealment is going to beta for v1.9; enable it by default in tests.  Also, just use `ENABLE_METADATA_CONCEALMENT` instead of two different vars.  Work toward #8867.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: none

**Special notes for your reviewer**:

**Release note**:

```release-note
Metadata concealment on GCE is now controlled by the `ENABLE_METADATA_CONCEALMENT` env var.  See cluster/gce/config-default.sh for more info.
```
2017-10-26 17:07:24 -07:00
Maru Newby
adc338d330 Remove all traces of federation 2017-10-26 13:37:37 -07:00
Wojciech Tyczynski
2fbe39fc8f Fix etcd hostnames 2017-10-23 13:49:28 +02:00
Isaac Hollander McCreery
6c1f63ab79 Use PROVIDER_VARS 2017-10-19 14:17:46 -07:00
Isaac Hollander McCreery
3ee03fd033 Enable metadata concealment for tests 2017-10-18 08:31:18 -07:00
Joe Betz
2e362ea142 Add 'ETCD_DOCKER_REPOSITORY' environment variable override to 'cluster/' scripts.
This allows the etcd docker registry that is currently hard coded to
`gcr.io/google_containers/etcd` in the `etcd.manifest` template to be
overridden.  This can be used to test new versions of etcd with
kubernetes that have not yet been published to
`gcr.io/google_containers/etcd` and also enables cluster operators to
manage the etcd images used by their cluster in an internal
repository.
2017-10-10 12:38:18 -07:00
Kubernetes Submit Queue
7b8d7dee52 Merge pull request #51367 from cjcullen/abacaway
Automatic merge from submit-queue (batch tested with PRs 48970, 52497, 51367, 52549, 52541). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>..

Default ABAC to off in GCE (for new clusters).

**What this PR does / why we need it**:
Disables the legacy ABAC authorizer by default on GCE/GKE clusters using kube-up.sh. Existing clusters upgrading to 1.8 will keep their existing configuration.

**Release note**:
```release-note
New GCE or GKE clusters created with `cluster/kube-up.sh` will not enable the legacy ABAC authorizer by default. If you would like to enable the legacy ABAC authorizer, export ENABLE_LEGACY_ABAC=true before running `cluster/kube-up.sh`.
```
2017-09-19 01:17:45 -07:00
Jacob Simpson
ca48fca127 Add configuration support for signing duration.
Add CLUSTER_SIGNING_DURATION environment variable to cluster
configuration scripts to allow configuration of signing duration of
certificates issued via the Certificate Signing Request API.
2017-09-15 10:22:19 -07:00
Kubernetes Submit Queue
0c1dcb01c5 Merge pull request #52115 from jcbsmpsn/flag-enable-kubelet-certificate-rotation
Automatic merge from submit-queue (batch tested with PRs 52452, 52115, 52260, 52290)

Add env var to enable kubelet rotation in kube-up.sh.

Fixes https://github.com/kubernetes/kubernetes/issues/52114

```release-note
Adds ROTATE_CERTIFICATES environment variable to kube-up.sh script for GCE
clusters. When that var is set to true, the command line flag enabling kubelet
client certificate rotation will be added to the kubelet command line.
```
2017-09-15 01:59:59 -07:00
Kubernetes Submit Queue
b3e641d7f3 Merge pull request #51824 from ihmccreery/oss-mdc
Automatic merge from submit-queue (batch tested with PRs 51824, 50476, 52451, 52009, 52237)

Allow metadata firewall & proxy on in GCE, off by default

**What this PR does / why we need it**: Add necessary variables in kube-env to allow a user to turn on metadata firewall and proxy for K8s on GCE.

Ref #8867.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: 

**Special notes for your reviewer**:

**Release note**:

```release-note
GCE users can enable the metadata firewall and metadata proxy with KUBE_FIREWALL_METADATA_SERVER and ENABLE_METADATA_PROXY, respectively.
```
2017-09-15 01:07:58 -07:00
Jacob Simpson
0ac34781c8 Add env var to enable kubelet rotation in kube-up.sh. 2017-09-14 11:30:03 -07:00
Isaac Hollander McCreery
6930f5ac31 Allow metadata firewall & proxy on in GCE, off by default 2017-09-13 09:58:51 -07:00
Mik Vyatskov
ccf40abd50 Make advanced audit policy on GCP configurable 2017-09-13 14:36:26 +02:00
Eric Chiang
cd3c8770c5 Revert "Add cluster up configuration for certificate signing duration."
This reverts commit bd0c16cc8e.
2017-09-11 16:28:17 -07:00
Jacob Simpson
bd0c16cc8e Add cluster up configuration for certificate signing duration. 2017-09-05 15:56:33 -07:00
Nick Sardo
8ac7bb5fb2 Use different project id for network ops & always set subnet 2017-09-04 09:55:56 -07:00
Kubernetes Submit Queue
ffed1d3408 Merge pull request #51792 from piosz/metrics-server
Automatic merge from submit-queue (batch tested with PRs 49727, 51792)

Introducing metrics-server

ref https://github.com/kubernetes/features/issues/271

There is still some work blocked on problems with repo synchronization:
- migrate to `v1beta1` introduced in #51653 
- bump deps to HEAD
Will do it in a follow up PRs once the issue is resolved.

```release-note
Introduced Metrics Server
```
2017-09-04 03:37:59 -07:00
Piotr Szczesniak
55c21ac801 Introduced Metrics Server 2017-09-03 22:13:59 +02:00
Kubernetes Submit Queue
9637f46122 Merge pull request #51725 from nicksardo/gce-plumb-netvars
Automatic merge from submit-queue (batch tested with PRs 51805, 51725, 50925, 51474, 51638)

GCE: Plumb network & subnetwork to master

**Which issue this PR fixes** *
Fixes #51714

/assign @bowei 

**Release note**:
```release-note
NONE
```
2017-09-03 11:10:00 -07:00
Kubernetes Submit Queue
5632613c5b Merge pull request #51069 from MrHohn/kube-proxy-pod-priority
Automatic merge from submit-queue (batch tested with PRs 51553, 51538, 51663, 51069, 51737)

Allow enable pod priority feature gate for GCE and configure priority for kube-proxy

**What this PR does / why we need it**:
From #23225, this PR adds an option for user to enable pod priority feature gate using GCE startup scripts, and configure pod priority for kube-proxy when enabled.

The setup `priorityClassName: system` derives from: ce1485c626/staging/src/k8s.io/api/core/v1/types.go (L2536-L2542)

The plan is to configure pod priority for kube-proxy daemonset (https://github.com/kubernetes/kubernetes/pull/50705) in the same way.

**Special notes for your reviewer**:
cc @bsalamat @davidopp @thockin 

**Release note**:

```release-note
When using kube-up.sh on GCE, user could set env `ENABLE_POD_PRIORITY=true` to enable pod priority feature gate.
```
2017-09-02 21:58:04 -07:00
Kubernetes Submit Queue
28d0077688 Merge pull request #51649 from mml/sh-test
Automatic merge from submit-queue (batch tested with PRs 49971, 51357, 51616, 51649, 51372)

Add some initial shell parsing tests.

These just test to see if there is a bash syntax error in these shell
libraries.

For #51642

```release-note
NONE
```
2017-09-01 01:12:45 -07:00
Nick Sardo
506064376b Set NODE_NETWORK and NODE_SUBNETWORK in kube-up 2017-08-31 17:23:30 -07:00
Matt Liggett
ef0503b834 Add KUBE_APISERVER_REQUEST_TIMEOUT_SEC env var.
If set, connect it to kube-apiserver's --request-timeout flag.
2017-08-31 14:33:10 -07:00
Matt Liggett
9a21343b20 Make cluster/common.sh work even if ${HOME} is unset. 2017-08-31 14:32:01 -07:00
Zihong Zheng
09e2e251a8 Set up ENABLE_POD_PRIORITY env for GCE and common.sh 2017-08-29 09:58:20 -07:00
Kubernetes Submit Queue
04b3ab9aba Merge pull request #50705 from MrHohn/kube-proxy-ds
Automatic merge from submit-queue (batch tested with PRs 50932, 49610, 51312, 51415, 50705)

Allow running kube-proxy as a DaemonSet when using kube-up.sh on GCE

**What this PR does / why we need it**:
From #23225, this PR adds an option for user to run kube-proxy as a DaemonSet instead of static pods using GCE startup scripts. By default, kube-proxy will run as static pods.

This is the first step for moving kube-proxy into a DaemonSet in GCE, remaining tasks will be tracked on #23225.

**Special notes for your reviewer**:
The last commit are purely for testing out kube-proxy as daemonset via CIs.

cc @kubernetes/sig-network-misc @kubernetes/sig-cluster-lifecycle-misc 

**Release note**:

```release-note
When using kube-up.sh on GCE, user could set env `KUBE_PROXY_DAEMONSET=true` to run kube-proxy as a DaemonSet. kube-proxy is run as static pods by default.
```
2017-08-29 01:17:45 -07:00
Zihong Zheng
1102656c88 Set up KUBE_PROXY_DAEMONSET env for GCE and common.sh. 2017-08-28 13:31:01 -07:00
CJ Cullen
e44c876276 Default ABAC to off in GCE/GKE (for new clusters). 2017-08-25 13:58:40 -07:00
Kubernetes Submit Queue
b2f3244032 Merge pull request #51166 from verult/COSFlexDir
Automatic merge from submit-queue (batch tested with PRs 51113, 46597, 50397, 51052, 51166)

Changing Flexvolume plugin directory to a location reachable by containerized k8s components.

**What this PR does / why we need it**: Testing Flexvolume requires plugins to be installed at a location which is accessible by containerized k8s components (such as controller-manager).

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #51123

```release-note
NONE
```

/assign @wongma7 @msau42
/release-note-none
/sig storage
2017-08-23 23:16:34 -07:00
Cheng Xing
94c667b719 Changing Flexvolume plugin directory to a location reachable by containerized kubelet. 2017-08-22 17:50:47 -07:00
Marian Lobur
d48e2d338d Add flags for prometheus-to-sd components.
Configure prometheus-to-sd-endpoint and prometheus-to-sd-prefix base on
the environment.
2017-08-22 08:30:08 +02:00
gmarek
54f43f5f56 Allow configuration of logrorate in GCE 2017-08-01 17:07:44 +02:00
Christian Bell
ad365b3479 Fix typo 2017-07-12 11:38:14 -07:00
Kubernetes Submit Queue
7001b9d9d1 Merge pull request #48425 from kawych/master
Automatic merge from submit-queue

Pass cluster name to Heapster with Stackdriver sink.

**What this PR does / why we need it**:
Passes cluster name as argument to Heapster when it's used with Stackdriver sink to allow setting resource label 'cluster_name' in exported metrics.

**Release note**:
```release-note
NONE
```
2017-07-12 10:51:09 -07:00
Cheng Xing
01fd6219cf Setting default FlexVolume driver directory on COS images. 2017-07-10 11:17:23 -07:00
Wojciech Tyczynski
37b5a214bc Add ability to enable patch conversion detector 2017-07-04 14:33:24 +02:00
Karol Wychowaniec
ca5581edcc Pass cluster name to Heapster with Stackdriver sink. 2017-07-03 11:55:57 +02:00
Kubernetes Submit Queue
c0337c92cc Merge pull request #47881 from cadmuxe/endpoint
Automatic merge from submit-queue (batch tested with PRs 47918, 47964, 48151, 47881, 48299)

Add ApiEndpoint support to GCE config.

**What this PR does / why we need it**:
Add the ability to change ApiEndpoint  for GCE.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:
```release-note
None
```
2017-06-30 18:42:40 -07:00
Koonwah Chen
c4e84e263c Change KUBE_GCE_API_ENDPOINT to GCE_API_ENDPOINT 2017-06-29 10:04:53 -07:00
Koonwah Chen
b3956a689e Add KUBE_GCE_API_ENDPOINT for GCE API endpoint config. 2017-06-28 16:03:18 -07:00
Yang Guo
50d49d9c51 Enables memcg notification in cluster/node e2e tests 2017-06-26 11:40:22 -07:00
Marcin Wielgus
8d801d918d Set price expander in Cluster Autoscaler for gce 2017-06-19 23:52:47 +02:00
Walter Fender
e06795533f Working on fixing #43716.
This will create the necessary certificates.
On GCE is will upload those certificates to Metadata.
They are then pulled down on to the kube-apiserver.
They are written to the /etc/src/kubernetes/pki directory.
Finally they are loaded vi the appropriate command line flags.
The requestheader-client-ca-file can be seen by running the following:-
kubectl get ConfigMap extension-apiserver-authentication
--namespace=kube-system -o yaml
Minor bug fixes.
Made sure AGGR_MASTER_NAME is set up in all configs.
Clean up variable names.
Added additional requestheader configuration parameters.
Added check so that if there is no Aggregator CA contents we won't start
the aggregator with the relevant flags.
2017-06-15 10:48:34 -07:00
Dawn Chen
d6e1e21230 Revert "Set up proxy certs for Aggregator." 2017-06-14 13:44:34 -07:00
Walter Fender
46e179b422 Set up proxy certs for Aggregator.
Working on fixing https://github.com/kubernetes/kubernetes/issues/43716.
This will create the necessary certificates.
On GCE is will upload those certificates to Metadata.
They are then pulled down on to the kube-apiserver.
They are written to the /etc/src/kubernetes/pki directory.
Finally they are loaded vi the appropriate command line flags.
The requestheader-client-ca-file can be seen by running the following:-
kubectl get ConfigMap extension-apiserver-authentication
--namespace=kube-system -o yaml
Minor bug fixes.
Made sure AGGR_MASTER_NAME is set up in all configs.
Clean up variable names.
Added additional requestheader configuration parameters.
2017-06-09 16:20:58 -07:00
Tim St. Clair
a604d34c21
Add GCE configuration parameter for webhook audit logging 2017-06-06 10:56:19 -07:00
Kubernetes Submit Queue
822e29dd3c Merge pull request #46524 from ajitak/npd_version
Automatic merge from submit-queue (batch tested with PRs 46239, 46627, 46346, 46388, 46524)

Configure NPD version through env variable

This lets user specify NPD version to be installed with kubernetes.
2017-06-02 23:37:45 -07:00
Ajit Kumar
d8237597c9 Configure NPD version through env variable 2017-05-31 16:40:09 -07:00
Tim St. Clair
f62b5e69cf
Set up basic test configuration for AdavencedAuditing 2017-05-31 09:52:54 -07:00
Kubernetes Submit Queue
03c9c48c81 Merge pull request #44062 from ixdy/semver-regexes
Automatic merge from submit-queue

Support arbitrary alphanumeric strings as prerelease identifiers

**What this PR does / why we need it**: this is basically an extension of #43642, but supports more general prerelease identifiers, per the spec at http://semver.org/#spec-item-9.

These regular expressions are still a bit more restrictive than the SemVer spec allows (we disallow hyphens, and we require the format `-foo.N` instead of arbitrary `-foo.X.bar.Y.bazZ`), but this should support our needs without changing too much more logic or breaking other assumptions.

**Release note**:

```release-note
NONE
```
2017-05-01 12:54:44 -07:00
Yang Guo
0d66fc97cd Makes cluster/gce/ubuntu to be a symlink to cluster/gce/gci and changes the gci's [master|node].yaml to enable kubernetes.target.
This enables Ubuntu to use the same provisioning scripts as GCI's. The
change for enabling kubernetes.target is needed for Ubuntu but a no-op
for GCI.
2017-04-25 16:19:00 -07:00
Chris Glass
cf23d4c939 Add Ubuntu as a platform for e2e tests on GCE
Using Ubuntu on GCE to run cluster e2e tests requires slightly different
node.yaml and master.yaml files than GCI, because Ubuntu uses systemd as
PID 1, wheras GCI uses upstart with a systemd delegate. Therefore the
e2e tests fail using those files since the kubernetes services are not
brought back up after a node/master reboot.
2017-04-20 17:40:51 -07:00
Kubernetes Submit Queue
ceccd305ce Merge pull request #42147 from bowei/ip-alias-2
Automatic merge from submit-queue

Add support for IP aliases for pod IPs (GCP alpha feature)

```release-note
Adds support for allocation of pod IPs via IP aliases.

# Adds KUBE_GCE_ENABLE_IP_ALIASES flag to the cluster up scripts (`kube-{up,down}.sh`).

KUBE_GCE_ENABLE_IP_ALIASES=true will enable allocation of PodCIDR ips
using the ip alias mechanism rather than using routes. This feature is currently
only available on GCE.

## Usage
$ CLUSTER_IP_RANGE=10.100.0.0/16 KUBE_GCE_ENABLE_IP_ALIASES=true bash -x cluster/kube-up.sh

# Adds CloudAllocator to the node CIDR allocator (kubernetes-controller manager).

If CIDRAllocatorType is set to `CloudCIDRAllocator`, then allocation
of CIDR allocation instead is done by the external cloud provider and
the node controller is only responsible for reflecting the allocation
into the node spec.

- Splits off the rangeAllocator from the cidr_allocator.go file.
- Adds cloudCIDRAllocator, which is used when the cloud provider allocates
  the CIDR ranges externally. (GCE support only)
- Updates RBAC permission for node controller to include PATCH
```
2017-04-11 22:09:24 -07:00
Bowei Du
345c65847f Add KUBE_GCE_ENABLE_IP_ALIASES flag to the cluster turn up scripts.
KUBE_GCE_ENABLE_IP_ALIASES=true will enable allocation of PodCIDR ips
using the ip alias mechanism rather than using routes.

NODE_IP_RANGE will control the node instance IP cidr
KUBE_GCE_IP_ALIAS_SIZE controls the size of each podCIDR
IP_ALIAS_SUBNETWORK controls the name of the subnet created for the cluster
2017-04-11 14:07:50 -07:00
Kubernetes Submit Queue
b9a5a5c9b3 Merge pull request #42748 from dcbw/cfssl-localup
Automatic merge from submit-queue (batch tested with PRs 43866, 42748)

hack/cluster: download cfssl if not present

hack/local-up-cluster.sh uses cfssl to generate certificates and
will exit it cfssl is not already installed.  But other cluster-up
mechanisms (GCE) that generate certs just download cfssl if not
present.  Make local-up-cluster.sh do that too so users don't have
to bother installing it from somewhere.
2017-04-10 14:27:11 -07:00
Kubernetes Submit Queue
b41e415ebd Merge pull request #43137 from shashidharatd/federation-domain
Automatic merge from submit-queue

[Federation] Remove FEDERATIONS_DOMAIN_MAP references

Remove all references to FEDERATIONS_DOMAIN_MAP as this method is no longer is used and is replaced by adding federation domain map to kube-dns configmap.

cc @madhusudancs @kubernetes/sig-federation-pr-reviews 

**Release note**:
```
[Federation] Mechanism of adding `federation domain maps` to kube-dns deployment via `--federations` flag is superseded by adding/updating `federations` key in `kube-system/kube-dns` configmap. If user is using kubefed tool to join cluster federation, adding federation domain maps to kube-dns is already taken care by `kubefed join` and does not need further action.
```
2017-04-06 02:05:42 -07:00
Jeff Grafton
37b07dfe62 Support arbitrary alphanumeric strings as prerelease identifiers 2017-04-04 16:30:54 -07:00
Dan Williams
f20437a822 hack/cluster: download cfssl if not present
hack/local-up-cluster.sh uses cfssl to generate certificates and
will exit it cfssl is not already installed.  But other cluster-up
mechanisms (GCE) that generate certs just download cfssl if not
present.  Make local-up-cluster.sh do that too.
2017-04-03 23:31:16 -05:00
Kubernetes Submit Queue
d1dd73e9f6 Merge pull request #42668 from ixdy/build-silence-docker-rmi
Automatic merge from submit-queue (batch tested with PRs 42379, 42668, 42876, 41473, 43260)

Silence error messages from the docker rmi call we expect to fail

**What this PR does / why we need it**: when we removed `docker tag -f` in #34361 we added a bunch of `docker rmi` calls to preserve behavior for older docker versions. That step is usually a no-op, however, and results in confusing messages like
```
Tagging docker image gcr.io/google_containers/kube-proxy:c8d0b2e7a06b451117a8ac58fc3bb3d3 as gcr.io/kubernetes-release-test/kube-proxy-amd64:v1.5.4
Error response from daemon: No such image: gcr.io/kubernetes-release-test/kube-proxy-amd64:v1.5.4
```

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #42665

**Special notes for your reviewer**: I could probably remove the `docker rmi` calls entirely, though I don't know if folks are still using docker < 1.10. (I think Jenkins still has 1.9.1.)

**Release note**:

```release-note
NONE
```

cc @jessfraz
2017-03-30 23:36:24 -07:00
Dan Williams
b3705b6e35 hack/cluster: consolidate cluster/ utils to hack/lib/util.sh
Per Clayton's suggestion, move stuff from cluster/lib/util.sh to
hack/lib/util.sh.  Also consolidate ensure-temp-dir and use the
hack/lib/util.sh implementation rather than cluster/common.sh.
2017-03-30 22:34:46 -05:00
Kubernetes Submit Queue
be4452cfce Merge pull request #42994 from Shawyeok/features/full-tls-etcd-cluster
Automatic merge from submit-queue

Centos provider: generate SSL certificates for etcd cluster.

**What this PR does / why we need it**:
Support secure etcd cluster for centos provider, generate SSL certificates for etcd in default. Running it w/o SSL is exposing cluster data to everyone and is not recommended. [#39462](https://github.com/kubernetes/kubernetes/pull/39462#issuecomment-271601547)

/cc @jszczepkowski @zmerlynn 

**Release note**:
```release-note
Support secure etcd cluster for centos provider.
```
2017-03-28 09:02:26 -07:00
Jeff Grafton
e39978e6bf Update a few regex patterns to support release candidates 2017-03-24 14:38:04 -07:00
shawyeok
c692b55b57 Centos provider: generate SSL certificates for etcd cluster.
Making download-cfssl reusable.

Extract generate-etcd-cert method up to common.sh.
2017-03-24 09:15:57 +08:00
Jordan Liggitt
b95f5286c1
Default to enabling legacy ABAC policy in non-test GCE kube-up.sh environments 2017-03-22 22:20:09 -04:00
shashidharatd
b09b20b598 Remove FEDERATIONS_DOMAIN_MAP references 2017-03-15 23:06:16 +05:30
Mike Danese
1b8084fc2f descriminate more when parsing kube-env :(
I HATE BASH
2017-03-09 15:33:43 -08:00
Jeff Grafton
836b59962a Silence error messages from docker rmi calls we expect to fail 2017-03-07 12:49:57 -08:00
Mike Danese
90b26465d7 fix upgrades 2017-02-28 14:52:37 -08:00
Kubernetes Submit Queue
b18bad156d Merge pull request #40634 from Crassirostris/use-docker-log-rotation
Automatic merge from submit-queue

Use docker log rotation mechanism instead of logrotate

This is a solution for https://github.com/kubernetes/kubernetes/issues/38495.

Instead of rotating logs using logrotate tool, which is configured quite rigidly, this PR makes docker responsible for the rotation and makes it possible to configure docker logging parameters. It solves the following problems:

* Logging agent will stop loosing lines upon rotation
* Container's logs size will be more strictly constrained. Instead of checking the size hourly, size will be checked upon write, preventing https://github.com/kubernetes/kubernetes/issues/27754

It's still far from ideal, for example setting logging options per pod, as suggested in https://github.com/kubernetes/kubernetes/issues/15478 would be much more flexible, but latter approach requires deep changes, including changes in API, which may be in vain because of CRI and long-term vision for logging.

Changes include:

* Change in salt. It's possible to configure docker log parameters, using variables in pillar. They're exported from env variables on `gce`, but for different cloud provider they have to be exported first.
* Change in `configure-helper.sh` scripts for those os on `gce` that don't use salt + default values exposed via env variables

This change may be problematic for kubelet logs functionality with CRI enabled, that will be tackled in the follow-up PR, if confirmed.

CC @piosz @Random-Liu @yujuhong @dashpole @dchen1107 @vishh @kubernetes/sig-node-pr-reviews

```release-note
On GCI by default logrotate is disabled for application containers in favor of rotation mechanism provided by docker logging driver.
```
2017-02-26 20:39:34 -08:00
Kubernetes Submit Queue
409d7d0a91 Merge pull request #41326 from ncdc/ci-cache-mutation
Automatic merge from submit-queue (batch tested with PRs 41364, 40317, 41326, 41783, 41782)

Add ability to enable cache mutation detector in GCE

Add the ability to enable the cache mutation detector in GCE. The current default behavior (disabled) is retained.

When paired with https://github.com/kubernetes/test-infra/pull/1901, we'll be able to detect shared informer cache mutations in gce e2e PR jobs.
2017-02-21 07:45:42 -08:00
Random-Liu
d40c0a7099 Add standalone npd on GCI. 2017-02-17 16:18:08 -08:00
Andy Goldstein
688c19ec71 Allow cache mutation detector enablement by PRs
Allow cache mutation detector enablement by PRs in an attempt to find
mutations before they're merged in to the code base. It's just for the
apiserver and controller-manager for now. If/when the other components
start using a SharedInformerFactory, we should set them up just like
this as well.
2017-02-17 10:03:13 -05:00
Wojciech Tyczynski
3695e85b34 Expose storage media type as env variable 2017-02-17 14:16:55 +01:00
Kubernetes Submit Queue
33aedca59d Merge pull request #41332 from jszczepkowski/etcd-cluster-state-16
Automatic merge from submit-queue

Added configurable etcd initial-cluster-state to kube-up script.

Added configurable etcd initial-cluster-state to kube-up script. This
allows creation of multi-master cluster from scratch. This is a
cherry-pick of #41320 from 1.5 branch.

```release-note
Added configurable etcd initial-cluster-state to kube-up script.
```
2017-02-15 10:04:31 -08:00
Mik Vyatskov
cabb9890ac Use docker log rotation mechanism instead of logrotate 2017-02-15 16:22:29 +01:00
Kubernetes Submit Queue
80be6a259f Merge pull request #41430 from mikedanese/preserve-key
Automatic merge from submit-queue (batch tested with PRs 41360, 41423, 41430, 40647, 41352)

preserve kube-master-cert metadata over upgrades
2017-02-15 05:06:10 -08:00
Anthony Yeh
7500746e7f cluster/gce: Add env var to enable apiserver basic audit log.
For now, this is focused on a fixed set of flags that makes the audit
log show up under /var/log/kube-apiserver-audit.log and behave similarly
to /var/log/kube-apiserver.log. Allowing other customization would
require significantly more complex changes.

Audit log rotation is handled externally by the wildcard /var/log/*.log
already configured in configure-helper.sh.
2017-02-14 15:18:10 -08:00
Mike Danese
e17e4e110e preserve kube-master-cert metadata over upgrades 2017-02-14 11:02:11 -08:00
Jerzy Szczepkowski
80e57b7016 Added configurable etcd initial-cluster-state to kube-up script.
Added configurable etcd initial-cluster-state to kube-up script. This
allows creation of multi-master cluster from scratch. This is a
cherry-pick of #41320 from 1.5 branch.
2017-02-13 16:10:47 +01:00
Mike Danese
c8ce55fef4 Revert "Merge pull request #41132 from kubernetes/revert-40893-kubelet-auth"
This reverts commit fd56078298, reversing
changes made to d953402cdf.
2017-02-09 15:55:12 -08:00
Aleksandra Malinowska
1841e5b2e0 Revert "remove second CA used for kubelet auth in favor of webhook auth" 2017-02-08 13:22:10 +01:00
Mike Danese
86d9493747 remove second CA used for kubelet auth in favor of webhook auth 2017-02-07 13:22:01 -08:00
Andy Lindeman
afb5e8ceb7
Exports KUBE_TEMP for use in Vagrantfile 2017-01-30 22:05:07 -05:00
Matt Liggett
0a4981ebf4 Only run gcloud as root if we plan to change something. 2017-01-20 17:18:05 -08:00