Commit Graph

89291 Commits

Author SHA1 Message Date
Lubomir I. Ivanov
8943e443e8 kubeadm: deprecate the flag --use-api for cert renewal
The KCM is moving to means of only singing apiserver (kubelet) client
and kubelet serving certificates. See:
  https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/20190607-certificates-api.md#signers
Up until now the experimental kubeadm functionality '--use-api'
under "kubeadm alpha certs renew" was using the KCM to sign *any*
certficate as long as the KCM has the root CA cert/key.

Post discussions with the kubeadm maintainers, it was decided that
this functionality should be removed from kubeadm due to the
requirement to have external signers for renewing the common
control-plane certificates that kubeadm manages.
2020-03-05 03:37:00 +02:00
Kubernetes Prow Robot
d7e7136bbc
Merge pull request #88563 from mateuszlitwin/mlitwin-fix-permit-integration-test
fix TestCoSchedulinngWithPermitPlugin and test PermitPlugin
2020-03-04 17:26:37 -08:00
Julian V. Modesto
bacc2c4960 Set field manager for kubectl diff --server-side.
Bonus: check diff only dry-runs without persisting.

Co-authored-by: Takahiro HATORI <tahatori@zlab.co.jp>
2020-03-04 20:20:07 -05:00
Ben Swartzlander
e8b09d3644 Add AnyVolumeDataSource feature gate
Allow any custom resource to be the data source of a PVC, if the
AnyVolumeDataSource feature gate is enabled. This is an alpha feature.
2020-03-04 18:55:50 -05:00
Kubernetes Prow Robot
e865c0b219
Merge pull request #88686 from j-griffith/upgrade_cloning_to_ga
Mark PVCDataSource featuregate as GA
2020-03-04 13:19:06 -08:00
Kubernetes Prow Robot
5c5faed39b
Merge pull request #88287 from gab-satchi/master
Windows specific kubelet flags in kubeadm-flags.env
2020-03-04 13:18:52 -08:00
Kubernetes Prow Robot
e4e3d72f1c
Merge pull request #83572 from chendotjs/tc-fix
bandwidth: use regexp to handle tc output and add IPv6 support
2020-03-04 13:18:38 -08:00
Antoine Pelisse
389dd0a499 Don't log "SHOULD NOT HAPPEN" errors more than once per second 2020-03-04 11:21:52 -08:00
Monis Khan
167d6a2c8b
Use the same default namespace across event recorders
Signed-off-by: Monis Khan <mok@vmware.com>
2020-03-04 13:49:33 -05:00
Clayton Coleman
8bc5cb01a9
kubelet: Clear the podStatusChannel before invoking syncBatch
The status manager syncBatch() method processes the current state
of the cache, which should include all entries in the channel. Flush
the channel before we call a batch to avoid unnecessary work and
to unblock pod workers when the node is congested.

Discovered while investigating long shutdown intervals on the node
where the status channel stayed full for tens of seconds.

Add a for loop around the select statement to avoid unnecessary
invocations of the wait.Forever closure each time.
2020-03-04 13:34:25 -05:00
Clayton Coleman
8722c834e5
kubelet: Never restart containers in deleting pods
When constructing the API status of a pod, if the pod is marked for
deletion no containers should be started. Previously, if a container
inside of a terminating pod failed to start due to a container
runtime error (that populates reasonCache) the reasonCache would
remain populated (it is only updated by syncPod for non-terminating
pods) and the delete action on the pod would be delayed until the
reasonCache entry expired due to other pods.

This dramatically reduces the amount of time the Kubelet waits to
delete pods that are terminating and encountered a container runtime
error.
2020-03-04 13:34:25 -05:00
Yu-Ju Hong
2364c10e2e
kubelet: Don't delete pod until all container status is available
After a pod reaches a terminal state and all containers are complete
we can delete the pod from the API server. The dispatchWork method
needs to wait for all container status to be available before invoking
delete. Even after the worker stops, status updates will continue to
be delivered and the sync handler will continue to sync the pods, so
dispatchWork gets multiple opportunities to see status.

The previous code assumed that a pod in Failed or Succeeded had no
running containers, but eviction or deletion of running pods could
still have running containers whose status needed to be reported.

This modifies earlier test to guarantee that the "fallback" exit
code 137 is never reported to match the expectation that all pods
exit with valid status for all containers (unless some exceptional
failure like eviction were to occur while the test is running).
2020-03-04 13:34:25 -05:00
Clayton Coleman
ad3d8949f0
kubelet: Preserve existing container status when pod terminated
The kubelet must not allow a container that was reported failed in a
restartPolicy=Never pod to be reported to the apiserver as success.
If a client deletes a restartPolicy=Never pod, the dispatchWork and
status manager race to update the container status. When dispatchWork
(specifically podIsTerminated) returns true, it means all containers
are stopped, which means status in the container is accurate. However,
the TerminatePod method then clears this status. This results in a
pod that has been reported with status.phase=Failed getting reset to
status.phase.Succeeded, which is a violation of the guarantees around
terminal phase.

Ensure the Kubelet never reports that a container succeeded when it
hasn't run or been executed by guarding the terminate pod loop from
ever reporting 0 in the absence of container status.
2020-03-04 13:34:24 -05:00
Clayton Coleman
6d98b0a0f4
Test that an always-fail container can't report the pod Succeeded
The kubelet can race when a pod is deleted and report that a container succeeded
when it instead failed, and thus the pod is reported as succeeded. Create an e2e
test that demonstrates this failure.
2020-03-04 13:34:20 -05:00
Lee Verberne
e5b655938e Add kubectl debug alpha command
This first version of `kubectl alpha debug` is an import of the existing
kubectl-debug plugin, which supports adding ephemeral containers to
running pods. This attempts to follow patterns used by other kubectl
commands such as run, exec and scale.
2020-03-04 19:20:04 +01:00
Kubernetes Prow Robot
d682c83890
Merge pull request #88765 from brianpursley/kubectl-816-take2
Change kubectl cluster-info dump to not display output location message when output is stdout
2020-03-04 10:20:02 -08:00
Kubernetes Prow Robot
48676adba9
Merge pull request #88567 from answer1991/feature/close-connection-when-over-load
add a new filter goaway which could send GOAWAY probabilistically to help balance HTTP2 requests
2020-03-04 10:19:49 -08:00
j-griffith
9044fbfc5d Update VolumePVCDatasource to GA for 1.18
Updates the VolumePVCDataSource featuregate (cloning) to GA for the 1.18 k8s
release.
2020-03-04 10:48:30 -07:00
Mateusz Litwin
b93e3d18e9 fix scheduler.TestCoSchedulinngWithPermitPlugin and test scheduler.PermitPlugin
After moving Permit() to the scheduling cycle test PermitPlugin should
no longer wait inside Permit() for another pod to enter Permit() and become waiting pod.
In the past this was a way to make test work regardless of order in
which pods enter Permit(), but now only one Permit() can be executed at
any given moment and waiting for another pod to enter Permit() inside
Permit() leads to timeouts.

In this change waitAndRejectPermit and waitAndAllowPermit flags make first
pod to enter Permit() a waiting pod and second pod to enter Permit()
either rejecting or allowing pod.

Mentioned in #88469
2020-03-04 08:45:36 -08:00
Gab Satch
9fabafdbb1 Windows specific kubelet flags in kubeadm-flags.env
- Uses correct pause image for Windows
- Omits systemd specific flags
- Common build flags function to be used by Linux and Windows
- Uses user configured image repository for Windows pause image
2020-03-04 11:05:53 -05:00
Kubernetes Prow Robot
b5b675491b
Merge pull request #86173 from soltysh/cli_defaults
stop defaulting kubeconfig to http://localhost:8080
2020-03-04 07:23:47 -08:00
vpickard
61565b3f6c e2e-topology-manager: Wait for SR-IOV device plugin
Make sure the SR-IOV device plugin is ready, and that
there are enough SR-IOV devices allocatable before
spinning up test pods.

Signed-off-by: vpickard <vpickard@redhat.com>
2020-03-04 10:07:35 -05:00
Alvaro Aleman
212190e25e Utilerrors.Aggregate: Allow using with errors.Is() 2020-03-04 14:12:56 +01:00
Kubernetes Prow Robot
f692f5cfcd
Merge pull request #88049 from mtaufen/provider-info-agnhost
Update agnhost to test OIDC validation of JWT tokens
2020-03-04 03:43:47 -08:00
Jan Safranek
98b9c7b5e8 Fix GCE PD snapshot flakiness
It takes more than 5 minutes to restore a GCE PD snapshot + run a pod with
it. Therefore TestVolumeClientSlow is introduced.
2020-03-04 12:39:13 +01:00
Kubernetes Prow Robot
497a998ba6
Merge pull request #88654 from ddebroy/gmsa-disable1
Promote GMSA support for Windows to GA
2020-03-04 02:32:01 -08:00
Kubernetes Prow Robot
4d19c6f2ad
Merge pull request #87537 from uthark/oatamanenko/apiversion
Fixes #87506 Add apiVersion to involvedObject
2020-03-04 02:31:47 -08:00
Kubernetes Prow Robot
c2593d3fa7
Merge pull request #88669 from mkimuram/snapfromfile
Add FromFile and FromExistingClassName support for SnapshotClass in external storage e2e test
2020-03-04 01:10:00 -08:00
Kubernetes Prow Robot
71cfd2a3db
Merge pull request #88460 from soltysh/filename_exec
Wire --filename flag to exec
2020-03-04 01:09:47 -08:00
Kubernetes Prow Robot
bd6640a8e0
Merge pull request #88769 from deads2k/SNI
Support TLS Server Name overrides in kubeconfig file
2020-03-03 23:18:00 -08:00
Kubernetes Prow Robot
76245147f3
Merge pull request #88598 from jennybuckley/base-image
Update etcd debian base image to v2.0.0
2020-03-03 23:17:47 -08:00
Kubernetes Prow Robot
cadd51783b
Merge pull request #88783 from neolit123/1.18-fix-kubectl-auth-verbosity
client-go: use klog.V(3) for the cert-rotation controller start/stop
2020-03-03 21:06:09 -08:00
Kubernetes Prow Robot
0535520f6e
Merge pull request #88758 from soltysh/hide_last_applied
Hide kubectl.kubernetes.io/last-applied-configuration in describe
2020-03-03 21:06:01 -08:00
Kubernetes Prow Robot
cd23e78c3d
Merge pull request #88684 from saad-ali/updateMountLib
Update AzureFile and CephFS to use MountSensitive
2020-03-03 21:05:48 -08:00
Mike Spreitzer
2e97d3c873 Generalized NonResourcePolicyRule.NonResourceURLs impl
... to match the comment on that field.

Also generalized the test case generator to exercise the new
generality.
2020-03-04 00:00:39 -05:00
Deep Debroy
16d221e407 Promote GMSA to GA
Signed-off-by: Deep Debroy <ddebroy@docker.com>
2020-03-04 02:56:21 +00:00
Kubernetes Prow Robot
aeb88b6ecd
Merge pull request #88587 from cmluciano/cml/v1beta1paths
Adding PathType to Ingress
2020-03-03 18:13:47 -08:00
fengzixu
076132e38a cleanup: move the test of TaintBasedEvictions features to sig-node
1. move the integration test of TaintBasedEvictions to test/integration/node
2. move the e2e test of TaintBasedEvictions e2e test/e2e/node
3. modify the conformance file to adapt the TaintBasedEviction test
2020-03-04 10:28:00 +09:00
Lubomir I. Ivanov
b2677b1e57 client-go: use klog.V(3) for the cert-rotation controller start/stop
Introduce a verbosity level for the start and stop notifications,
so that regular calls to commands such as:
  "kubectl auth ..."
would only contain the "yes" / "no" output.
2020-03-04 01:35:17 +02:00
Kubernetes Prow Robot
25d241eda2
Merge pull request #85642 from claudiubelu/tests/guestbook-workers-update-image
test images: Updates agnhost guestbook subcommand
2020-03-03 15:33:47 -08:00
Charles Eckman
5ceecd3ba3 Update agnhost to test OIDC validation of JWT tokens
Extends agnhost with the capability to validate a mounted token against
the API server's OIDC endpoints.

Co-authored-by: Michael Taufen <mtaufen@google.com>
2020-03-03 15:27:47 -08:00
Masaki Kimura
401b85e547 Add FromFile and FromExistingClassName support for SnapshotClass in external storage e2e test 2020-03-03 20:28:32 +00:00
Kubernetes Prow Robot
861c918a44
Merge pull request #88761 from aleksandra-malinowska/cluster-autoscaler-1.18.0-beta.0
Update Cluster Autoscaler version to 1.18.0-gke.0
2020-03-03 12:18:31 -08:00
Kubernetes Prow Robot
0773f108c7
Merge pull request #88710 from SataQiu/ipvs-readme-20200302
kube-proxy: small cleanup for ipvs readme
2020-03-03 12:18:22 -08:00
Kubernetes Prow Robot
9d0cbb7503
Merge pull request #88673 from jsafrane/block-feature-ga
Promote block volumes to GA
2020-03-03 12:17:12 -08:00
Kubernetes Prow Robot
b9696133ff
Merge pull request #88655 from soltysh/deprecate_generator
Deprecate --generator flag from kubectl create commands
2020-03-03 12:17:01 -08:00
Kubernetes Prow Robot
481b04cf7c
Merge pull request #88487 from zioproto/issues/69314-tier-config-support
Use compute v1 api to specify network tier
2020-03-03 12:16:52 -08:00
Kubernetes Prow Robot
bfb3fb54b4
Merge pull request #88240 from soltysh/pod_conditions
Present more concrete information about pod readiness
2020-03-03 12:15:42 -08:00
Kubernetes Prow Robot
62dc3ea6d1
Merge pull request #87368 from 928234269/fix_staticcheck01
fix staticcheck errors in pkg/controller/daemon.
2020-03-03 12:15:28 -08:00
Tim Allclair
db3392ed12
Always include remoteAddr in source IP list for audit (#87167)
* Always include remoteAddr in source IP list for audit

Since the remoteAddr is much harder to spoof than headers, always include it in
the list of source IPs used in audit logs.

* Add v6 tests
2020-03-03 12:15:14 -08:00