Commit Graph

1266 Commits

Author SHA1 Message Date
Taahir Ahmed
6a75e7c40c ClusterTrustBundles: Define types
This commit is the main API piece of KEP-3257 (ClusterTrustBundles).

This commit:

* Adds the certificates.k8s.io/v1alpha1 API group
* Adds the ClusterTrustBundle type.
* Registers the new type in kube-apiserver.
* Implements the type-specfic validation specified for
  ClusterTrustBundles:
  - spec.pemTrustAnchors must always be non-empty.
  - spec.signerName must be either empty or a valid signer name.
  - Changing spec.signerName is disallowed.
* Implements the "attest" admission check to restrict actions on
  ClusterTrustBundles that include a signer name.

Because it wasn't specified in the KEP, I chose to make attempts to
update the signer name be validation errors, rather than silently
ignored.

I have tested this out by launching these changes in kind and
manipulating ClusterTrustBundle objects in the resulting cluster using
kubectl.
2023-03-15 20:10:18 -07:00
Antonio Ojea
811c2f50a1 remove apiserver limitations
Change-Id: I97b35d912ba5d86857cf82d3eddd65b648030005
2023-03-14 22:58:11 +00:00
Patrick Ohly
29941b8d3e api: resource.k8s.io v1alpha1 -> v1alpha2
For Kubernetes 1.27, we intend to make some breaking API changes:
- rename PodScheduling -> PodSchedulingHints (https://github.com/kubernetes/kubernetes/issues/114283)
- extend ResourceClaimStatus (https://github.com/kubernetes/enhancements/pull/3802)

We need to switch from v1alpha1 to v1alpha2 for that.
2023-03-14 07:52:03 +01:00
Jiahui Feng
feb18b3f5f implmementing type checking
with multi-type support.
2023-03-07 15:49:19 -08:00
Kubernetes Prow Robot
2e3c5003b9
Merge pull request #115630 from Jefftree/agg-discovery-metrics
Add metrics for aggregated discovery
2023-03-10 07:44:41 -08:00
Kubernetes Prow Robot
c58c1efd03
Merge pull request #112882 from pintuiitbhi/comment
apiserver: grammar correction of comment
2023-03-09 21:32:54 -08:00
Jefftree
387d97605e Add metrics for aggregated discovery 2023-03-09 17:24:02 +00:00
Maksim Nabokikh
c1431af4f8
KEP-3325: Promote SelfSubjectReview to Beta (#116274)
* Promote SelfSubjectReview to Beta

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

* Fix whoami API

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

* Fixes according to code review

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

---------

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
2023-03-08 15:42:33 -08:00
Alexander Zielenski
c485cb2435 supply OpenAPIV3Config unconditionally
the handlers are still gated, but OpenAPIV3 is required for SSA
2023-02-28 13:29:57 -08:00
Monis Khan
754cb3d601
kubelet/client: collapse transport wiring onto standard approach
Signed-off-by: Monis Khan <mok@microsoft.com>
2023-02-06 20:34:49 -05:00
TommyStarK
527b905aaa cmd/kubeapiserver: Clean code, avoid unnecessary condition, avoid non-nil but zero-length slice
Signed-off-by: TommyStarK <thomasmilox@gmail.com>
2023-01-06 18:03:41 +01:00
Jordan Liggitt
78cb3862f1
Fix indentation/spacing in comments to render correctly in godoc 2022-12-17 23:27:38 -05:00
Andy Goldstein
0bdcb93b06 Create new conversion Factory interface
Create a new conversion Factory interface for CRDs, and split out
NewDelegatingConverter as a standalone package-level function, instead
of being part of CRConverterFactory.

Signed-off-by: Andy Goldstein <andy.goldstein@redhat.com>
2022-12-13 14:38:21 -05:00
Kubernetes Prow Robot
6d823a3815
Merge pull request #113823 from TommyStarK/unit-tests/cmd-kube-apiserver-app-options
cmd/kube-apiserver/app/options: Improving test coverage
2022-12-09 14:34:33 -08:00
TommyStarK
44c94f98b6 fix typo in cmd/kube-apiserver/app/options/validation_test.go
Put back test case that was dropped by mistake.

Signed-off-by: TommyStarK <thomasmilox@gmail.com>
2022-11-16 19:25:31 +01:00
Kubernetes Prow Robot
d1c0171aed
Merge pull request #111023 from pohly/dynamic-resource-allocation
dynamic resource allocation
2022-11-11 16:21:56 -08:00
Alexander Zielenski
3c68fe6596 fix aggregated discovery version sorting
add test for level based priorities
2022-11-10 17:16:14 -08:00
Patrick Ohly
5cca60f0b8 api: dynamic resource allocation API
This adds a new resource.k8s.io API group with v1alpha1 as version. It contains
four new types: resource.ResourceClaim, resource.ResourceClass, resource.ResourceClaimTemplate, and
resource.PodScheduling.
2022-11-10 20:08:24 +01:00
TommyStarK
47fdbd97d3 cmd/kube-apiserver/app/options: Improving test coverage
Signed-off-by: TommyStarK <thomasmilox@gmail.com>
2022-11-10 16:20:20 +01:00
Kubernetes Prow Robot
8058e8eff8
Merge pull request #113171 from Jefftree/aggregated-discovery-generic
Aggregated discovery server changes
2022-11-09 00:08:12 -08:00
Kubernetes Prow Robot
e62cfabf93
Merge pull request #112050 from nilekhc/kms-hot-reload
Implements hot reload of the KMS `EncryptionConfiguration`
2022-11-08 17:24:12 -08:00
Alexander Zielenski
b64df605b4 add aggregated-apiservices to aggregated discovery
Co-authored-by: Jeffrey Ying <jeffrey.ying86@live.com>
2022-11-08 14:44:50 -08:00
Alexander Zielenski
6e83f67505 add new aggregated resourcemanager to genericapiserver
Co-authored-by: Jeffrey Ying <jeffrey.ying86@live.com>
2022-11-08 14:44:49 -08:00
Nilekh Chaudhari
761b7822fc
feat: implements kms encryption config hot reload
This change enables hot reload of encryption config file when api server
flag --encryption-provider-config-automatic-reload is set to true. This
allows the user to change the encryption config file without restarting
kube-apiserver. The change is detected by polling the file and is done
by using fsnotify watcher. When file is updated it's process to generate
new set of transformers and close the old ones.

Signed-off-by: Nilekh Chaudhari <1626598+nilekhc@users.noreply.github.com>
2022-11-08 21:47:59 +00:00
Kubernetes Prow Robot
3a99a5954d
Merge pull request #113629 from andrewsykim/apiserver-identity-beta
Promote APIServerIdentity to Beta
2022-11-08 12:43:10 -08:00
Kubernetes Prow Robot
595ea32411
Merge pull request #113314 from cici37/celIntegration
CEL validation in Admission chain
2022-11-07 17:08:33 -08:00
Andrew Sy Kim
02020b20e7 kube-apiserver: remove flags --identity-lease-duration-seconds and --identity-lease-renew-interval-seconds
Signed-off-by: Andrew Sy Kim <andrewsy@google.com>
2022-11-07 19:36:22 -05:00
Cici Huang
0486e06261 Adding new api version of admissionregistration.k8s.io v1alpha1 for CEL in Admission Control 2022-11-07 20:51:51 +00:00
Kubernetes Prow Robot
b1dd1cd2f1
Merge pull request #113529 from enj/enj/i/kms_single_healthz
kms: add wiring to support automatic encryption config reload
2022-11-07 11:20:42 -08:00
Monis Khan
22e540bc48
kms: add wiring to support automatic encryption config reload
This change adds a flag --encryption-provider-config-automatic-reload
which will be used to drive automatic reloading of the encryption
config at runtime.  While this flag is set to true, or when KMS v2
plugins are used without KMS v1 plugins, the /healthz endpoints
associated with said plugins are collapsed into a single endpoint at
/healthz/kms-providers - in this state, it is not possible to
configure exclusions for specific KMS providers while including the
remaining ones - ex: using /readyz?exclude=kms-provider-1 to exclude
a particular KMS is not possible.  This single healthz check handles
checking  all configured KMS providers.  When reloading is enabled
but no KMS providers are configured, it is a no-op.

k8s.io/apiserver does not support dynamic addition and removal of
healthz checks at runtime.  Reloading will instead have a single
static healthz check and swap the underlying implementation at
runtime when a config change occurs.

Signed-off-by: Monis Khan <mok@microsoft.com>
2022-11-07 12:03:18 -05:00
Jordan Liggitt
318b089918
Stop creating three copies of admission plugins 2022-11-04 13:35:15 -04:00
Kubernetes Prow Robot
021e2d394c
Merge pull request #113361 from SataQiu/fix-20221026
kube-apiserver: keep the types of LeaseEndpointReconcilerType and NoneEndpointReconcilerType the same as MasterCountReconcilerType
2022-10-27 11:24:33 -07:00
Rita Zhang
c3df726c7b
Enable encryption for custom resources
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>
2022-10-26 13:37:11 -07:00
SataQiu
ecfae2bebe kube-apiserver: keep the types of LeaseEndpointReconcilerType and NoneEndpointReconcilerType the same as MasterCountReconcilerType 2022-10-26 21:49:31 +08:00
Monis Khan
f507bc2553
Load encryption config once
This change updates the API server code to load the encryption
config once at start up instead of multiple times.  Previously the
code would set up the storage transformers and the etcd healthz
checks in separate parse steps.  This is problematic for KMS v2 key
ID based staleness checks which need to be able to assert that the
API server has a single view into the KMS plugin's current key ID.

Signed-off-by: Monis Khan <mok@microsoft.com>
2022-10-13 10:52:29 -04:00
pintuiitbhi
970d19b4ee update apiserver to APIServer 2022-10-06 00:20:03 +05:30
pintuiitbhi
cec1c71fbc apiserver: grammar correction of comment 2022-10-06 00:17:42 +05:30
Kubernetes Prow Robot
9720af2ba3
Merge pull request #112306 from tkashem/v1beta3
add v1beta3 for Priority And Fairness
2022-10-03 10:06:14 -07:00
Kubernetes Prow Robot
3af1e5fdf6
Merge pull request #112707 from enj/enj/i/https_links
Use https links for k8s KEPs, issues, PRs, etc
2022-09-29 12:34:40 -07:00
Han Kang
e95179ffb6 Wire up feature_gate.go with metrics via AddMetrics method
wire up feature_gate.go with metrics via AddMetrics method

Change-Id: I9b4f6b04c0f4eb9bcb198b16284393d21c774ad8

wire in metrics to kubernetes components

Change-Id: I6d4ef8b26f149f62b03f32d1658f04f3056fe4dc

rename metric since we're using the value to determine if enabled is true or false

Change-Id: I13a6b6df90a5ffb4b9c5b34fa187562413bea029

Update staging/src/k8s.io/component-base/featuregate/feature_gate.go

Co-authored-by: Jordan Liggitt <jordan@liggitt.net>
2022-09-26 08:44:42 -07:00
Monis Khan
b738be9b46
Use https links for k8s KEPs, issues, PRs, etc
Signed-off-by: Monis Khan <mok@microsoft.com>
2022-09-23 23:36:24 +00:00
Abu Kashem
6dc81c3280
update api enablement for flowcontrol v1beta3 2022-09-21 18:54:20 -04:00
Abu Kashem
0a99e6ebb1
apiserver: update apf logic to use v1beta3 2022-09-21 18:54:20 -04:00
Abu Kashem
e1a764d635
apiserver: enable v1beta3 for apf 2022-09-21 18:54:19 -04:00
Kubernetes Prow Robot
80edf6d1a4
Merge pull request #112532 from ldsdsy/modify4
Eliminate unnecessary string conversions in options.go
2022-09-19 07:53:29 -07:00
ldsdsy
bd339b9c9c Eliminate unnecessary string conversions in options.go 2022-09-17 10:01:15 +08:00
Kubernetes Prow Robot
4c3a7d767d
Merge pull request #112448 from SataQiu/improve-apiserver-20220914
Using simpler wrapper function capabilities.Setup instead of calling Initialize directly
2022-09-15 16:41:26 -07:00
m.nabokikh
00dfba473b Add auth API to get self subject attributes
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
2022-09-14 18:00:26 +02:00
SataQiu
baade6c730 using simpler wrapper function capabilities.Setup instead of calling Initialize directly 2022-09-14 23:37:32 +08:00
Kubernetes Prow Robot
a7936658ba
Merge pull request #112193 from jindijamie/master
Add an option for aggregator
2022-09-08 17:21:24 -07:00