Commit Graph

54319 Commits

Author SHA1 Message Date
Cao Shufeng
1c3dc52531 audit real impersonated user info
Log the newest impersonated user info in the second audit event. This
will help users to debug rbac problems.
2017-09-01 11:27:23 +08:00
Kubernetes Submit Queue
0f2c2bd847 Merge pull request #50404 from apelisse/http-cache
Automatic merge from submit-queue (batch tested with PRs 51480, 49616, 50123, 50846, 50404)

Kubectl to use http caching to cache openapi responses from the server

**What this PR does / why we need it**: 

This PR is trying to address the problems raised in #50254 

> * uses a disk-based cache that is not safe between processes (does not use atomic fs operations)
> * writes get/list responses to disk that should not be cached (like kubectl get secrets)
> * is vulnerable to partially written cache responses being used as responses to future requests
> * breaks uses of the client transport that make use of websockets
> * defaults to enabling the cache for any client builder using RecommendedConfigOverrideFlags or DefaultClientConfig which affects more components than just kubectl

All of these points are addressed by this pull-request:
1. It now uses atomic fs operations
2. Doesn't cache by default, only if requested by the client (and it's only done by openapi client)
3. Fixed because of atomic fs operations
4. Found the reason for the bug: Cache wrapper couldn't be unwrapped. I implemented the `WrappedRoundTripper` interface.
5. Since 2. is fixed, I think that should be fine

@smarterclayton @liggitt 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #50254

**Special notes for your reviewer**:

**Release note**:

```release-note
Allows kubectl to use http caching mechanism for the OpenAPI schema. The cache directory can be configured through `--cache-dir` command line flag to kubectl. If set to empty string, caching will be disabled.
```
2017-08-31 20:08:46 -07:00
Kubernetes Submit Queue
b5fad6eb1b Merge pull request #50846 from FengyunPan/change-log-level
Automatic merge from submit-queue (batch tested with PRs 51480, 49616, 50123, 50846, 50404)

Use 'Infof' instead of 'Errorf' for a debug log

Outputing error log for a debug is confused.

**Release note**:
```release-note
NONE
```
2017-08-31 20:08:42 -07:00
Kubernetes Submit Queue
00846fc794 Merge pull request #50123 from WIZARD-CXY/fixlog
Automatic merge from submit-queue (batch tested with PRs 51480, 49616, 50123, 50846, 50404)

make get pod log with follow option as CONNECT verb

**What this PR does / why we need it**:
Don't make the get log with follow option request mix with GET pods request. Make it reported as a WATCH pod log request.
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
Fixes #49998 

```release-note
Pod log attempts are now reported in apiserver prometheus metrics with verb `CONNECT` since they can run for very long periods of time.
```
2017-08-31 20:08:40 -07:00
Kubernetes Submit Queue
a8a505b767 Merge pull request #49616 from sakeven/feature/found_HashEquivalencePod
Automatic merge from submit-queue (batch tested with PRs 51480, 49616, 50123, 50846, 50404)

getHashEquivalencePod should return if equivalence pod is found

Signed-off-by: sakeven <jc5930@sina.cn>



**What this PR does / why we need it**:

getHashEquivalencePod should return if equivalence pod is found, rather than simply check equivalenceHash equals to 0 later.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```
NONE
```
2017-08-31 20:08:37 -07:00
Kubernetes Submit Queue
9a3a578cd8 Merge pull request #51480 from mml/timeout-flag
Automatic merge from submit-queue (batch tested with PRs 51480, 49616, 50123, 50846, 50404)

Add KUBE_APISERVER_REQUEST_TIMEOUT_SEC env var.

Cluster startup support for the flag added by #51415.  I won't merge until that PR merges.

Bug: #51355

cc @jpbetz
2017-08-31 20:08:35 -07:00
Dong Liu
032a6d9441 Fix providerID update validation 2017-09-01 11:01:26 +08:00
Kubernetes Submit Queue
4af900b43f Merge pull request #51633 from deads2k/controller-03-wait
Automatic merge from submit-queue (batch tested with PRs 51707, 51662, 51723, 50163, 51633)

update GC controller to wait until controllers have been initialized …

fixes #51013

Alternative to https://github.com/kubernetes/kubernetes/pull/51492 which keeps those few controllers (only one) from starting the informers early.
2017-08-31 18:43:41 -07:00
Kubernetes Submit Queue
8679a8f5fe Merge pull request #50163 from jingxu97/Aug/sizeLimit
Automatic merge from submit-queue (batch tested with PRs 51707, 51662, 51723, 50163, 51633)

Change SizeLimit to a pointer

This PR fixes issue #50121

```release-note
The `emptyDir.sizeLimit` field is now correctly omitted from API requests and responses when unset.
```
2017-08-31 18:43:38 -07:00
Kubernetes Submit Queue
1152938297 Merge pull request #51723 from bowei/cluster-gce-owner
Automatic merge from submit-queue (batch tested with PRs 51707, 51662, 51723, 50163, 51633)

Add bowei to the OWNER for cluster/gce

```release-note
NONE
```
2017-08-31 18:43:36 -07:00
Kubernetes Submit Queue
98619a6842 Merge pull request #51662 from vishh/test-e2e-owners
Automatic merge from submit-queue (batch tested with PRs 51707, 51662, 51723, 50163, 51633)

Adding vishh to test/ reviewers and approvers

Rationale: Reviewing/Shepherding lots of features/PRs around node and resource management.
2017-08-31 18:43:34 -07:00
Kubernetes Submit Queue
cd004bb14c Merge pull request #51707 from liggitt/unit-race
Automatic merge from submit-queue (batch tested with PRs 51707, 51662, 51723, 50163, 51633)

Make feature gate threadsafe

Fixes #51548 caused by #51436
2017-08-31 18:43:31 -07:00
Nick Sardo
506064376b Set NODE_NETWORK and NODE_SUBNETWORK in kube-up 2017-08-31 17:23:30 -07:00
Manjunath A Kumatagi
ee4d54c70c Port e2e tests for multi architecture 2017-09-01 05:40:52 +05:30
Manjunath A Kumatagi
22c3a590d1 Fix bazel 2017-09-01 05:39:00 +05:30
Manjunath A Kumatagi
87e23212ba Update the yaml file with multiarch images 2017-09-01 05:39:00 +05:30
Manjunath A Kumatagi
6f55de1bdf Test image utils for multi arch test images 2017-09-01 05:39:00 +05:30
Cheng Xing
52a77aaccd Added basic Flexvolume dynamic plugin discovery e2e test; added Flexvolume prober unit tests. 2017-08-31 16:50:02 -07:00
Clayton Coleman
824f04f86a
Simplify describe events table
The describe table for events is not easy to read and violates other
output guidelines. Change to use spaces (we don't use tabs in formal
output for tables). Remove columns that are not normally needed or
available on events.

Example for pods:

```
...
QoS Class:       BestEffort
Node-Selectors:  role=app
Tolerations:     <none>
Events:
  Type     Reason      Age                 From                         Message
  ----     ------      ----                ----                         -------
  Normal   Pulling     1h (x51 over 5h)    kubelet, origin-ci-ig-n-gj0x pulling image "registry.svc.ci.openshift.org/experiment/commenter:latest"
  Normal   BackOff     8m (x1274 over 5h)  kubelet, origin-ci-ig-n-gj0x Back-off pulling image "registry.svc.ci.openshift.org/experiment/commenter:latest"
  Warning  FailedSync  3m (x1359 over 5h)  kubelet, origin-ci-ig-n-gj0x Error syncing pod
```

Puts the type first (separate important from not), then reason (which is
the most impactful scanning field). Collapses first seen, last seen, and
times into a single field, since most of the time you care about the
last time the event happened, not the first time.
2017-08-31 19:11:01 -04:00
Matt Liggett
ef0503b834 Add KUBE_APISERVER_REQUEST_TIMEOUT_SEC env var.
If set, connect it to kube-apiserver's --request-timeout flag.
2017-08-31 14:33:10 -07:00
Matt Liggett
0271687533 Add some initial shell parsing tests.
These just test to see if there is a bash syntax error in these shell
libraries.

For #51642
2017-08-31 14:32:01 -07:00
Matt Liggett
9a21343b20 Make cluster/common.sh work even if ${HOME} is unset. 2017-08-31 14:32:01 -07:00
Alexander Kanevskiy
19cb090381 Generate deb and rpms package with correct versions. 2017-09-01 00:20:29 +03:00
Zihong Zheng
690ca9550d Edit owner files for kube-proxy 2017-08-31 13:56:47 -07:00
Kubernetes Submit Queue
6597f1ed4a Merge pull request #51724 from foxish/fix-changelog
Automatic merge from submit-queue

Improve 1.7.5 changelog

- Fix changelog to add discovery and controller-manager fixes
- Add more detail to entries that said "automated cherrypick"
2017-08-31 13:49:38 -07:00
Dawn Chen
55cb667b9e Merge pull request #51720 from kubernetes/revert-51465-cronjob_beta
Revert "Enable batch/v1beta1.CronJobs by default"
2017-08-31 10:42:16 -07:00
foxish
cd1c2340b5 Fix changelog to add discovery/controller-manager fixes.
Improve release notes for entries that say "automated cherrypick".
2017-08-31 10:31:19 -07:00
Bowei Du
f14cc276b0 Add bowei to the OWNER for cluster/gce 2017-08-31 10:29:19 -07:00
Kenneth Owens
8ad18bf2ec Ensures that the DaemonSet controller does not launch a Pod on a Node while waiting for a Pod that it has previously created to terminate. 2017-08-31 10:29:03 -07:00
Nick Turner
e0ab0b57ab Adds check for external CA
We allow a kubeadm user to use an external CA by checking to see if ca.key is missing and skipping cert checks and kubeconfig generation if ca.key is missing.
2017-08-31 17:12:24 +00:00
Antoine Pelisse
d7eec6b51d Revert "Enable batch/v1beta1.CronJobs by default" 2017-08-31 09:54:16 -07:00
Edmund Rhudy
0d0591046c Update Bazel configuration for flag.go and overrides_test.go 2017-08-31 11:11:38 -04:00
Edmund Rhudy
33dff7275d Add tests for stripping "namespaces/" from passed-in namespace 2017-08-31 11:11:30 -04:00
Nikhita Raghunath
6750d38e9b apiextensions: add maximum for validation 2017-08-31 20:07:41 +05:30
Jordan Liggitt
d3546434b7
Make feature gate threadsafe 2017-08-31 10:11:11 -04:00
zhangxiaoyu-zidif
90cb1c16eb Fix local storage code to follow go style 2017-08-31 22:09:41 +08:00
Chenxingyu
e49315f2db make api request verb can be overrided and make "GET" pod log request reported as "CONNECT" pod log request for metrics 2017-08-31 21:39:10 +08:00
David Eads
253b047d89 update GC controller to wait until controllers have been initialized once 2017-08-31 09:01:38 -04:00
Wojciech Tyczynski
721923924d Update CHANGELOG.md for v1.7.5. 2017-08-31 14:41:10 +02:00
David Eads
de4006b810 generated 2017-08-31 08:05:00 -04:00
deads2k
462a657e48 add information for subresource kind determination: 2017-08-31 08:05:00 -04:00
Maciej Szulik
9fef244d4c
Allow audit to log authorization failures 2017-08-31 12:33:52 +02:00
Bowei Du
b145beb3da Create a secondary range for the services instead of a subnetwork
GCE now supports >1 secondary ranges / subnetwork.
2017-08-31 01:33:17 -07:00
Di Xu
8a6a25f5f0 add tests 2017-08-31 16:31:02 +08:00
Di Xu
be0cadde2e enforce include-uninitialized in several kubectl commands 2017-08-31 16:30:56 +08:00
Di Xu
a76f538304 add tests for apps/v1beta2 conversion 2017-08-31 16:23:19 +08:00
m1093782566
96882713b4 rsync iptables 2017-08-31 14:54:22 +08:00
Connor Doyle
50674ec614 Added cpu-manager-reconcile-period config.
- Defaults to sync-frequency.
2017-08-30 23:42:32 -07:00
Kubernetes Submit Queue
4a6bbb9f50 Merge pull request #50961 from wackxu/bugfix
Automatic merge from submit-queue

fix some bad URL in the /cluster/uju/layers/kubernetes-e2e/README.md

**What this PR does / why we need it**:

There are some bad URL when I read the file and I have fix it.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```
NONE
```
2017-08-30 23:26:07 -07:00
hzxuzhonghu
b80a8db6d3 update Deprecated code and fix bug not return when list pod failed 2017-08-31 14:14:51 +08:00