124064 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Kubernetes Prow Robot	64ba17c605	Merge pull request #125571 from liggitt/filter-auth-02-sar ... add field and label selectors to authorization	2024-07-19 15:30:01 -07:00
Kubernetes Prow Robot	ec8015daac	Merge pull request #124273 from panoswoo/fix/124255 ... Remove missing extended resources from init containers	2024-07-19 15:29:53 -07:00
Kubernetes Prow Robot	fa15f12fb5	Merge pull request #126174 from dobsonj/corruptedmnt-enodev ... mount-utils: treat syscall.ENODEV as corrupted mount	2024-07-19 13:08:48 -07:00
Jordan Liggitt	5f22dd7c1a	Add integration test exercising webhook selector authz	2024-07-19 15:06:52 -04:00
Jordan Liggitt	9f8f36708a	Fixup lint warning	2024-07-19 15:06:52 -04:00
Jordan Liggitt	4d535db8be	Add selector authorization to the Node authorizer	2024-07-19 15:06:51 -04:00
Jordan Liggitt	a1398a8cca	Add structured labelSelector / fieldSelector to authorization webhook match conditions	2024-07-19 15:06:50 -04:00
Jordan Liggitt	83bd512861	Adjust CEL cost calculation and versioning for authorization library	2024-07-19 15:06:49 -04:00
David Eads	be2e32fa3e	Add CEL fieldSelector / labelSelector support to authorizer library	2024-07-19 15:06:49 -04:00
Jordan Liggitt	03d48b7683	Move CEL env initialization out of package init() ... This ensures compatibility version and feature gates can be initialized before cached CEL environments are created.	2024-07-19 15:06:48 -04:00
Jordan Liggitt	1d2ad282cf	Improve CEL cost tests to catch unhandled estimates or types	2024-07-19 15:06:47 -04:00
David Eads	92e3445e9d	add field and label selectors to authorization attributes ... Co-authored-by: Jordan Liggitt <liggitt@google.com>	2024-07-19 15:06:47 -04:00
Kubernetes Prow Robot	b3e769b72e	Merge pull request #126228 from googs1025/fix_informer ... chore(Job): make trivial improvements to job controller unit test	2024-07-19 12:03:24 -07:00
Kubernetes Prow Robot	6f3f115378	Merge pull request #126222 from macsko/dont_lock_activeq_twice_in_activate_in_scheduling_queue ... Don't lock activeQ twice when activating pod in scheduling queue	2024-07-19 12:03:10 -07:00
David Eads	f5e5bef2e0	generate	2024-07-19 14:35:37 -04:00
David Eads	90f0b88b6a	add subjectaccessreview field and label selectors ... Co-authored-by: Jordan Liggitt <liggitt@google.com>	2024-07-19 14:34:49 -04:00
Kubernetes Prow Robot	acaec0c23a	Merge pull request #126124 from cici37/feature/validating-admission-policy/metrics-improvement ... Feature/validating admission policy/metrics improvement	2024-07-19 10:34:58 -07:00
Kubernetes Prow Robot	ce961fdc84	Merge pull request #125165 from carlory/clean-volume-util ... remove unused functions in volume/util	2024-07-19 10:34:45 -07:00
googs1025	6626b9ce28	chore(Job): remove deprecated fake.NewSimpleClientset method	2024-07-19 23:46:29 +08:00
googs1025	75a4cfbd58	chore(Job): use ctx.Done() instead of stopCh	2024-07-19 23:43:36 +08:00
googs1025	af5b8bed70	chore(Job): use WaitForCacheSync method after sharedInformerFactory Start	2024-07-19 23:41:20 +08:00
bells17	e1aa8197ed	volumebinding: scheduler queueing hints - CSIStorageCapacity (#124961) ... * volumebinding: scheduler queueing hints - CSIStorageCapacity * Fixed points mentioned in the review * Fixed points mentioned in the review * Update pkg/scheduler/framework/plugins/volumebinding/volume_binding.go Co-authored-by: Kensei Nakada <handbomusic@gmail.com> * Update pkg/scheduler/framework/plugins/volumebinding/volume_binding_test.go Co-authored-by: Kensei Nakada <handbomusic@gmail.com> * Fixed points mentioned in the review * volume_binding.go を更新 Co-authored-by: Kensei Nakada <handbomusic@gmail.com> --------- Co-authored-by: Kensei Nakada <handbomusic@gmail.com>	2024-07-19 07:53:52 -07:00
Jonathan Dobson	4cec4e7422	mount-utils: treat syscall.ENODEV as corrupted mount	2024-07-19 08:14:30 -06:00
Kubernetes Prow Robot	01eb9f4754	Merge pull request #125929 from sanposhiho/requeueing-metrics ... add: implement event_handling_duration_seconds metric	2024-07-19 04:43:00 -07:00
Maciej Skoczeń	7421ded6f9	Don't lock activeQ twice when activating pod in scheduling queue	2024-07-19 09:18:42 +00:00
Kubernetes Prow Robot	77e12aeca9	Merge pull request #126207 from thockin/ingress-backend-port-atomic ... Make ServiceBackendPort an atomic struct	2024-07-18 19:24:26 -07:00
Kubernetes Prow Robot	7f2c167b9c	Merge pull request #126203 from danwinship/kube-proxy-bad-ips ... validate that kube-proxy handles "bad" IPs/CIDRs correctly	2024-07-18 19:24:18 -07:00
Kubernetes Prow Robot	25935965c5	Merge pull request #125782 from aborrero/master ... procMount: fix default value documentation	2024-07-18 19:24:11 -07:00
Kubernetes Prow Robot	27fa59a8af	Merge pull request #125656 from gyuho/recent-stats-check-error-for-error-level-logging ... feat(kubelet/stats): match cadvisor error to lower not found stats log level	2024-07-18 19:24:01 -07:00
Kubernetes Prow Robot	f2428d66cc	Merge pull request #125163 from pohly/dra-kubelet-api-version-independent-no-rest-proxy ... DRA: make kubelet independent of the resource.k8s.io API version	2024-07-18 17:47:48 -07:00
Kubernetes Prow Robot	5fc7032a0e	Merge pull request #126156 from pohly/kubelet-test-enhancements ... kubelet test enhancements	2024-07-18 14:50:54 -07:00
Kubernetes Prow Robot	fa7fcde5a4	Merge pull request #125813 from aojea/node_csr_ips ... Node Request Certificates require to have IPs	2024-07-18 14:50:48 -07:00
Patrick Ohly	a7396fdd3f	kubelet: grant permission for DeleteCollection also with RBAC ... If the node authorizer is active, RBAC rules are not needed. But if it's disabled, kubelet needs to get permission through RBAC. In contrast to the authorizer code which is a bit more flexible and isn't directly tied to the current kubelet implementation (i.e. it allows list+delete instead of just deletecollection), the RBAC entry is just for what the current kubelet does because it's a bit easier to change.	2024-07-18 23:30:09 +02:00
Patrick Ohly	7701a48bd6	dra kubelet: bump gRPC API to v1alpha4 ... The previous changes are an API break, therefore we need a new version.	2024-07-18 23:30:09 +02:00
Patrick Ohly	ee3205804b	dra e2e: demonstrate how to use RBAC + VAP for a kubelet plugin ... In reality, the kubelet plugin of a DRA driver is meant to be deployed as a daemonset with a service account that limits its permissions. https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#additional-metadata-in-pod-bound-tokens ensures that the node name is bound to the pod, which then can be used in a validating admission policy (VAP) to ensure that the operations are limited to the node. In E2E testing, we emulate that via impersonation. This ensures that the plugin does not accidentally depend on additional permissions.	2024-07-18 23:30:09 +02:00
Kubernetes Prow Robot	f82030111f	Merge pull request #126198 from aojea/flaku_lb ... e2e: fix flake on loadbalancer tests	2024-07-18 13:41:45 -07:00
Kubernetes Prow Robot	d040043edb	Merge pull request #124736 from MikeSpreitzer/exempt-borrows-more ... More assertive borrowing by exempt	2024-07-18 13:41:38 -07:00
Tim Hockin	7313990f61	Make ServiceBackendPort an atomic struct ... This allows different actors to force ownership of it without having to explicitly unset the other field.	2024-07-18 13:20:33 -07:00
Kubernetes Prow Robot	c4bd05df1c	Merge pull request #126181 from bitoku/refactor-kubeletseparatediskgc ... [sig-testing] refactor KubeletSeparateDiskGC nodefeature	2024-07-18 10:39:25 -07:00
Kubernetes Prow Robot	595927da21	Merge pull request #125660 from saschagrunert/oci-volumesource-api ... [KEP-4639] Add `ImageVolumeSource` API	2024-07-18 10:39:15 -07:00
Kubernetes Prow Robot	601eb7e9cf	Merge pull request #122922 from marosset/windows-memory-eviction ... Add support for Windows memory-pressure eviction	2024-07-18 10:39:06 -07:00
Kubernetes Prow Robot	3adafc6a50	Merge pull request #126194 from mimowo/job-e2e-tests-cleanup ... Format helper scripts in Job e2e tests as multiline for readability	2024-07-18 09:33:39 -07:00
Kubernetes Prow Robot	73198f893c	Merge pull request #124859 from morlay/master ... Remove json:",omitempty" where json:",inline" specified.	2024-07-18 09:33:33 -07:00
Sascha Grunert	f7ca3131e0	Add ImageVolumeSource API ... Adding the required Kubernetes API so that the kubelet can start using it. This patch also adds the corresponding alpha feature gate as outlined in KEP 4639. Signed-off-by: Sascha Grunert <sgrunert@redhat.com>	2024-07-18 17:25:54 +02:00
Dan Winship	30bc1b59d7	Add unit tests to validate "bad IP/CIDR" handling in kube-proxy ... Also, fix the handling of bad EndpointSlice IPs!	2024-07-18 10:55:13 -04:00
Dan Winship	f762e5c8de	Remove an unnecessary comment in nftables output ... (It's redundant with the chain name.)	2024-07-18 10:54:30 -04:00
Dan Winship	11f55eae96	Reduce some duplication in nftables unit tests	2024-07-18 10:53:36 -04:00
Kubernetes Prow Robot	dda657b598	Merge pull request #126191 from p0lyn0mial/upstream-revert-promote-watch-list-to-beta ... Revert "Promote WatchList feature to Beta"	2024-07-18 07:39:28 -07:00
Kubernetes Prow Robot	eb58e5e002	Merge pull request #125976 from vrutkovs/apf-typemeta-print-type ... flowcontrol: print object type when bootstrapping flowschemas	2024-07-18 07:39:19 -07:00
Antonio Ojea	fdbe6912d2	e2e: fix flake on loadbalancer tests ... validating that one endpoint is reachable from one part of the cluster is not enough condition to consider it will be reachable from any node, as different Services proxies on different nodes will have different propagation delays for the EndpointSlices and Services information.	2024-07-18 12:54:54 +00:00