github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-23 11:50:44 +00:00
Code Issues Projects Releases Wiki Activity
101,861 Commits 42 Branches 7,905 Tags 1.3 GiB
5c00024c70
Commit Graph

101861 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Lubomir I. Ivanov
5c00024c70 kubeadm: fix wrong check for keys/certs during "download-certs" 
During "join" of new control plane machines, kubeadm would
download shared certificates and keys from the cluster stored
in a Secret. Based on the contents of an entry in the Secret,
it would use helper functions from client-go to either write
it as public key, cert (mode 644) or as a private key (mode 600).

The existing logic is always writing both keys and certs with mode 600.
Allow detecting public readable data properly and writing some files
with mode 644.

First check the data with ParsePrivateKeyPEM(); if this passes
there must be at least one private key and the file should be written
with mode 600 as private. If that fails, validate if the data contains
public keys with ParsePublicKeysPEM() and write the file as public
(mode 644).

As a result of this new logic, and given the current set of managed
kubeadm files, .key files will end up with 600, while .crt and .pub
files will end up with 644.
 2021-06-29 23:42:04 +03:00
Kubernetes Prow Robot
01819dd322
Merge pull request #102028 from chrishenzie/read-write-once-pod-access-mode 
ReadWriteOncePod access mode for PVs and PVCs
 2021-06-29 10:04:40 -07:00
Kubernetes Prow Robot
756203fda0
Merge pull request #102576 from dobsonj/101911 
kubelet: do not call RemoveAll on volumes directory for orphaned pods
 2021-06-29 06:54:40 -07:00
Kubernetes Prow Robot
3d87fd6a9a
Merge pull request #103273 from XudongLiuHarold/fix-loadbalancerclass-test-name 
fix loadbalancerclass integration test funcation name
 2021-06-29 05:40:41 -07:00
Kubernetes Prow Robot
ebcb4a2d88
Merge pull request #103104 from pacoxu/npd-088 
update npd to v0.8.8
 2021-06-29 02:30:40 -07:00
Kubernetes Prow Robot
1151dc1ee5
Merge pull request #103138 from sbangari/winDsrLoadBalancerServiceFix 
Loadbalancer IngressIP policy should be configured as non-DSR to enable routing mesh by default
 2021-06-28 23:26:51 -07:00
Kubernetes Prow Robot
adf561fb96
Merge pull request #96699 from tengqm/kubelet-config-norm 
Tweak kubelet config comments for consistency and readability
 2021-06-28 23:26:40 -07:00
Chris Henzie
b7d732d3d6 Map PV access modes to CSI access modes 2021-06-28 21:25:38 -07:00
Chris Henzie
8db83c89aa CSI client helpers for NodeGetCapabilities 2021-06-28 21:25:37 -07:00
Chris Henzie
5f98f6cfa4 Update helper methods to print and parse ReadWriteOncePod access mode 2021-06-28 21:25:37 -07:00
Chris Henzie
2b98f8edc7 Enforce ReadWriteOncePod access mode during mount 2021-06-28 21:25:37 -07:00
Chris Henzie
7491d01651 Validate use of the ReadWriteOncePod access mode 
This will only work if the "ReadWriteOncePod" feature gate is enabled.
Additionally, this access mode will only work when used by itself. This
is because when ReadWriteOncePod is used on a PV or PVC, it renders all
other access modes useless since it is most restrictive.
 2021-06-28 21:25:37 -07:00
Chris Henzie
48ba5020a2 ReadWriteOncePod PV access mode and feature gate 2021-06-28 21:25:35 -07:00
Chris Henzie
358d2e0bd1 Export contains access mode helper method 
Will be used during validation of PVs and PVCs
 2021-06-28 21:24:56 -07:00
Chris Henzie
83e3ee780a Rename access mode contains helper method 
So it is consistent with other methods performing the same check (one
for internal and external types)
 2021-06-28 21:24:56 -07:00
Chris Henzie
dba8ee229e Add validation options for PersistentVolumeClaims 
These options provide an extensible way of configuring how PVCs are
validated
 2021-06-28 21:24:55 -07:00
Chris Henzie
9ba0eed7c5 Add validation options for PersistentVolumes 
These options provide an extensible way of configuring how PVs are
validated
 2021-06-28 21:24:55 -07:00
Kubernetes Prow Robot
d92f6c424d
Merge pull request #103099 from liggitt/podsecurity 
PodSecurity admission
 2021-06-28 20:46:52 -07:00
Kubernetes Prow Robot
db3a216fbb
Merge pull request #97238 from andrewsykim/kube-proxy-handle-terminating 
kube-proxy handle terminating endpoints
 2021-06-28 20:46:40 -07:00
Harold
477aef192f fix loadbalancerclass integration test funcation name 2021-06-28 20:07:02 -07:00
Kubernetes Prow Robot
9866f9364e
Merge pull request #103112 from fromanirh/cpumanager-e2e-fixes 
e2e: node: remove obsolete AlphaFeature tag
 2021-06-28 19:36:39 -07:00
pacoxu
ffdf3f5007 update node-problem-detector npd to v0.8.8 
Signed-off-by: pacoxu <paco.xu@daocloud.io>
Co-Authored-By: vteratipally <vteratipally@users.noreply.github.com>
 2021-06-29 09:35:32 +08:00
Kubernetes Prow Robot
ee459b8969
Merge pull request #103265 from fromanirh/e2e-node-fix-npd 
e2e: node: fix npd test failures bumping image
 2021-06-28 17:03:50 -07:00
Kubernetes Prow Robot
15d3c3a5e2
Merge pull request #102821 from ehashman/phase-fix 
Ensure kubelet statuses can handle loss of container runtime state
 2021-06-28 15:38:40 -07:00
Kubernetes Prow Robot
38f012320f
Merge pull request #101947 from cynepco3hahue/memory_manager_move_to_beta 
memory manager: move to beta
 2021-06-28 15:38:28 -07:00
Jordan Liggitt
6f9011a4ae PodSecurity: vendor: generated files 
Co-authored-by: Tim Allclair <timallclair@gmail.com>
 2021-06-28 17:46:00 -04:00
Jordan Liggitt
b8bdcf6441 PodSecurity: update dependencies 2021-06-28 17:46:00 -04:00
Jordan Liggitt
724fbfbb69 PodSecurity: test: generate fixture data 2021-06-28 17:46:00 -04:00
Jordan Liggitt
93c6f8969a PodSecurity: check: addCapabilities 2021-06-28 17:45:59 -04:00
Jordan Liggitt
3733e209c9 PodSecurity: check: allowPrivilegeEscalation 2021-06-28 17:45:36 -04:00
Jordan Liggitt
a8206ef58b PodSecurity: check: runAsNonRoot 2021-06-28 17:45:36 -04:00
Jordan Liggitt
12ea930aae PodSecurity: check: selinux 
Co-authored-by: Tim Allclair <timallclair@gmail.com>
 2021-06-28 17:45:36 -04:00
Jordan Liggitt
42dc070b47 PodSecurity: kube-apiserver integration test 2021-06-28 17:45:36 -04:00
Jordan Liggitt
f39bddd767 PodSecurity: kube-apiserver: admission wiring 2021-06-28 17:45:35 -04:00
Jordan Liggitt
65a42a483c PodSecurity: pkg/features: feature gate 2021-06-28 17:45:35 -04:00
Tim Allclair
02a6187757 PodSecurity: admission: admission library 
Co-authored-by: Jordan Liggitt <liggitt@google.com>
 2021-06-28 17:45:35 -04:00
Jordan Liggitt
29f5ebf1fe PodSecurity: test: framework 2021-06-28 17:45:35 -04:00
Tim Allclair
1436d35779 PodSecurity: policy: registry 
Co-authored-by: Jordan Liggitt <liggitt@google.com>
 2021-06-28 17:45:35 -04:00
Jordan Liggitt
5183ea0bf0 PodSecurity: metrics: stub interface 
Co-authored-by: Tim Allclair <timallclair@gmail.com>
 2021-06-28 17:45:35 -04:00
Jordan Liggitt
a3ba921b16 PodSecurity: admission/api: configuration API 
Admission configuration:
- user, namespace, runtimeclass exemptions
- default policy levels and versions
- defaulting
- load and serialization helpers

Co-authored-by: Tim Allclair <timallclair@gmail.com>
 2021-06-28 17:45:34 -04:00
Tim Allclair
9ce17c8773 PodSecurity: api: runtime API 
Label keys, values, and parsing helper functions

Co-authored-by: Jordan Liggitt <liggitt@google.com>
 2021-06-28 17:45:34 -04:00
Kubernetes Prow Robot
bb309b5706
Merge pull request #103249 from wangyysde/update-kubeadm-help-msg 
correct example command of kubeadm help
 2021-06-28 14:24:28 -07:00
Kubernetes Prow Robot
51e1969d9c
Merge pull request #103133 from marwanad/allow-scheduler-to-patch-conditions 
switch scheduler to generate the merge patch on pod status instead of the full pod
 2021-06-28 12:46:28 -07:00
Kubernetes Prow Robot
556f8500ff
Merge pull request #102859 from MikeSpreitzer/add-r-metrics 
Add APF metrics about R(t)
 2021-06-28 11:40:28 -07:00
Kubernetes Prow Robot
cd5d3e690e
Merge pull request #103153 from josephburnett/v2beta2 
Move HPA v2beta2 deprecation to 1.23.
 2021-06-28 10:33:25 -07:00
Marwan Ahmed
48dfa2a554 generate scheduler merge patches on the pod status instead of the full pod 2021-06-28 09:35:55 -07:00
Kubernetes Prow Robot
c2882f3142
Merge pull request #103158 from rajaskakodkar/sctp_test 
Fix "should not mistakenly treat 'protocol: SCTP' as 'protocol: TCP', even if the plugin doesn't support SCTP" test
 2021-06-28 07:59:37 -07:00
Kubernetes Prow Robot
5e06f173fb
Merge pull request #98866 from wzshiming/fix/termination_grace_period_seconds_is_negative 
Fix TerminationGracePeriodSeconds is negative (part 1)
 2021-06-28 07:59:25 -07:00
Francesco Romani
889dcb5b54 e2e: node: fix npd test failures bumping image 
The PR https://github.com/kubernetes/kubernetes/pull/100041 updated
node-problem-detector to v0.8.7, but unfortunately we didn't update
also the image using in the e2e_node tests.

As result, the tests were failing like

E2eNode Suite: [sig-node] NodeProblemDetector [NodeFeature:NodeProblemDetector] [Serial] SystemLogMonitor should generate node condition and events for corresponding errors
_output/local/go/src/k8s.io/kubernetes/test/e2e_node/node_problem_detector_linux.go:301
Timed out after 60.000s.
Expected success, but got an error:
    <*errors.errorString | 0xc0011f2600>: {
        s: "expected total number of events was 4, actual events counted was 7\nEvents

This in turn was one of the contributing factors in making the
pull-kubernetes-node-kubelet-serial lane constantly failing.

This patch updates the image used in the tests, fixing the failure.

Signed-off-by: Francesco Romani <fromani@redhat.com>
 2021-06-28 16:32:12 +02:00
Kubernetes Prow Robot
6010cbe593
Merge pull request #103040 from shu-mutou/sig-ui-leads 
Add shu-mutou to dashboard approvers
 2021-06-28 02:19:49 -07:00