Commit Graph

66461 Commits

Author SHA1 Message Date
Jason DeTiberus
b8e8e35333
kubeadm - fix local etcd grpc gateway
- etcd 3.2 uses the server certificate as the client cert for the grpc
  gateway, this updates the generation of the etcd server certificate to
  add client usage to resolve the issue.
2018-06-12 11:24:29 -04:00
Jason DeTiberus
793a51cef0
kubeadm - local etcd configuration bugfixes
- Set peer urls for default etcd instance to avoid leaving peer port unsecured
- Update generated etcd peer certificate SANs to include localhost
- Use a proper CN for etcd server and peer certificates
- Increase the manifest update timeout
2018-06-11 21:29:11 -04:00
Kubernetes Submit Queue
f54593b740
Merge pull request #64795 from mikedanese/fixgke
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

auth: standalone kubelets shouldn't start a token manager

fixes https://github.com/kubernetes/kubernetes/issues/64789
2018-06-06 06:58:28 -07:00
Kubernetes Submit Queue
bf422b7b04
Merge pull request #64371 from CaoShuFeng/invalid_o
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix kubectl -o

Fix kubectl -o error message:
Before this change:
```
kubectl get pods -o foo
error: unable to match a printer suitable for the output format "" and the options specified: &get.PrintFlags{JSONYamlPrintFlags:(*genericclioptions.JSONYamlPrintFlags)(0x23aa610), NamePrintFlags:(*genericclioptions.NamePrintFlags)(0xc42058b4e0), TemplateFlags:(*printers.KubeTemplatePrintFlags)(0xc4206765e0), CustomColumnsFlags:(*printers.CustomColumnsPrintFlags)(0xc420676620), HumanReadableFlags:(*get.HumanPrintFlags)(0xc4204eb180), NoHeaders:(*bool)(0xc4206fefbc), OutputFormat:(*string)(0xc42058b4d0)}
```

After this change:
```
Kubectl get pods -o foo
error: unable to match a printer suitable for the output format "foo", allowed formats are: json,yaml,name,template,go-template,go-template-file,templatefile,jsonpath,jsonpath-file,custom-columns-file,custom-columns,wide
```



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
kubectl will list all allowed print formats when an invalid format is passed.
```
2018-06-06 04:15:56 -07:00
Anago GCB
c10e8bc4f0 Update CHANGELOG-1.10.md for v1.10.4. 2018-06-06 09:36:46 +00:00
Kubernetes Submit Queue
f4668d281c
Merge pull request #64800 from dashpole/cadvisor_godep
Automatic merge from submit-queue (batch tested with PRs 63717, 64646, 64792, 64784, 64800). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update cadvisor godeps to v0.30.0

**What this PR does / why we need it**:
cAdvisor godep update corresponding to 1.11

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #63204

**Release note**:
```release-note
Use IONice to reduce IO priority of du and find
cAdvisor ContainerReference no longer contains Labels. Use ContainerSpec instead.
Fix a bug where cadvisor failed to discover a sub-cgroup that was created soon after the parent cgroup.
```

/sig node
/kind bug
/priority critical-urgent

/assign @dchen1107
2018-06-06 01:24:26 -07:00
Kubernetes Submit Queue
a32e5b6a59
Merge pull request #64784 from jiayingz/status-ready
Automatic merge from submit-queue (batch tested with PRs 63717, 64646, 64792, 64784, 64800). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Reconcile extended resource capacity after kubelet restart.

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes https://github.com/kubernetes/kubernetes/issues/64632

**Special notes for your reviewer**:

**Release note**:

```release-note
Kubelet will set extended resource capacity to zero after it restarts. If the extended resource is exported by a device plugin, its capacity will change to a valid value after the device plugin re-connects with the Kubelet. If the extended resource is exported by an external component through direct node status capacity patching, the component should repatch the field after kubelet becomes ready again. During the time gap, pods previously assigned with such resources may fail kubelet admission but their controller should create new pods in response to such failures.
```
2018-06-06 01:24:21 -07:00
Kubernetes Submit Queue
7d782400db
Merge pull request #64792 from luxas/patch_node_crisocket
Automatic merge from submit-queue (batch tested with PRs 63717, 64646, 64792, 64784, 64800). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm: Upload CRISocket information in kubeadm init/join

**What this PR does / why we need it**:

As a side-effect, `kubeadm join` will become blocking on the kubelet doing the TLS bootstrap. This partially also fixes problems when users run `kubeadm join` and it returns successfully without anything happening as the kubelet is actually unhealthy. If that happens now `kubeadm join` will exit with a non-zero code.

What this PR does is it uploads the CRISocket information to the Node API object as a workaround until we have something like https://github.com/kubernetes/kubernetes/issues/64460 in place that will solve this problem for real. This way we won't lose the CRISocket information which we would otherwise do.
This can be used for `kubeadm upgrade` or `kubeadm reset` in future releases.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
Depends on https://github.com/kubernetes/kubernetes/pull/64624

**Release note**:

```release-note
[action required] TODO
```
@kubernetes/sig-cluster-lifecycle-pr-reviews
2018-06-06 01:24:17 -07:00
Kubernetes Submit Queue
0b8394a1f4
Merge pull request #64646 from freehan/pod-ready-plus2-new
Automatic merge from submit-queue (batch tested with PRs 63717, 64646, 64792, 64784, 64800). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add ContainersReady condition into Pod Status

**Last 3 commits are new**

Follow up PR of: https://github.com/kubernetes/kubernetes/pull/64057 and https://github.com/kubernetes/kubernetes/pull/64344

Have a single PR for adding ContainersReady per https://github.com/kubernetes/kubernetes/pull/64344#issuecomment-394038384

```release-note
Introduce ContainersReady condition in Pod Status
```


/assign yujuhong for review
/assign thockin for the tiny API change
2018-06-06 01:24:14 -07:00
Kubernetes Submit Queue
b6f75ac30e
Merge pull request #63717 from ingvagabund/promote-sysctl-annotations-to-fields
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Promote sysctl annotations to fields

#


**What this PR does / why we need it**:

Promoting experimental sysctl feature from annotations to API fields.

**Special notes for your reviewer**:

Following sysctl KEP: https://github.com/kubernetes/community/pull/2093

**Release note**:

```release-note
The Sysctls experimental feature has been promoted to beta (enabled by default via the `Sysctls` feature flag). PodSecurityPolicy and Pod objects now have fields for specifying and controlling sysctls. Alpha sysctl annotations will be ignored by 1.11+ kubelets. All alpha sysctl annotations in existing deployments must be converted to API fields to be effective.
```

**TODO**:

* [x] - Promote sysctl annotation in Pod spec
* [x] - Promote sysctl annotation in PodSecuritySpec spec
* [x] - Feature gate the sysctl
* [x] - Promote from alpha to beta
* [x] - docs PR - https://github.com/kubernetes/website/pull/8804
2018-06-06 00:47:36 -07:00
Kubernetes Submit Queue
d3a797a053
Merge pull request #64670 from stealthybox/feature/kubeadm_882-etcd-zero-probe
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm: When etcd is listening on all interfaces, set the etcd probe to use loopback

**What this PR does / why we need it**:
When constructing the etcd liveness probe, if the user passes an IPv4 or IPv6 address,
we set the `etcdctl` liveness probe to use the respective IPv4 or IPv6 loopback address for `--endpoints`.

The etcd probe is now always formatted with the https:// protocol and square brackets around the IP (required for IPv6 / compatible with IPv4).

`::1` is now also included in the etcd serving cert SAN by default.

/kind bug
/area kubeadm
/area etcd
/priority important-soon

/sig cluster-lifecycle
/assign @fabriziopandini

**Which issue(s) this PR fixes**
Fixes https://github.com/kubernetes/kubeadm/issues/882

**Special notes for your reviewer**:
```bash
root@vagrant:~# /vagrant/bin/882_kubeadm init --config /dev/stdin << EOF |& tail -n5
etcd:
  extraArgs:
    listen-client-urls: https://[::]:2379
EOF
I0603 19:52:15.666594   24743 tlsbootstrap.go:50] [bootstraptoken] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
I0603 19:52:15.671424   24743 tlsbootstrap.go:72] [bootstraptoken] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
I0603 19:52:15.674607   24743 tlsbootstrap.go:95] [bootstraptoken] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
I0603 19:52:15.677551   24743 clusterinfo.go:43] [bootstraptoken] creating the "cluster-info" ConfigMap in the "kube-public" namespace
[addons] Applied essential addon: CoreDNS
[addons] Applied essential addon: kube-proxy
root@vagrant:~# cat /etc/kubernetes/manifests/etcd.yaml |grep -C4 listen
spec:
  containers:
  - command:
    - etcd
    - --listen-client-urls=https://[::]:2379
    - --advertise-client-urls=https://127.0.0.1:2379
    - --cert-file=/etc/kubernetes/pki/etcd/server.crt
    - --client-cert-auth=true
    - --data-dir=/var/lib/etcd
root@vagrant:~# cat /etc/kubernetes/manifests/etcd.yaml |grep -C4 etcdctl
      exec:
        command:
        - /bin/sh
        - -ec
        - ETCDCTL_API=3 etcdctl --endpoints=https://[::1]:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt
          --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key
          get foo
      failureThreshold: 8
      initialDelaySeconds: 15
```

**Release note**:
```release-note
kubeadm now configures the etcd liveness probe correctly when etcd is listening on all interfaces
```
2018-06-05 23:22:48 -07:00
Kubernetes Submit Queue
34759c2dfb
Merge pull request #63650 from soltysh/issue62382
Automatic merge from submit-queue (batch tested with PRs 64009, 64780, 64354, 64727, 63650). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Never clean backoff in job controller

**What this PR does / why we need it**:
In https://github.com/kubernetes/kubernetes/pull/60985 I've added a mechanism which allows immediate job status update, unfortunately that broke the backoff logic seriously. I'm sorry for that. I've changed the `immediate` mechanism so that it NEVER cleans the backoff, but for the cases when we want fast status update it uses a zero backoff. 

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #62382

**Special notes for your reviewer**:
/assign @janetkuo 

**Release note**:
```release-note
None
```
2018-06-05 22:24:54 -07:00
Kubernetes Submit Queue
81b5db9dcd
Merge pull request #64727 from yguo0905/tpu-v1-api
Automatic merge from submit-queue (batch tested with PRs 64009, 64780, 64354, 64727, 63650). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

GCE: Update cloud provider to use TPU v1 API

**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
GCE: Update cloud provider to use TPU v1 API
```

/assign @vishh 
/assign @cheftako
2018-06-05 22:24:51 -07:00
Kubernetes Submit Queue
0e44d8c40b
Merge pull request #64354 from mtaufen/dkcfg-safe-fields
Automatic merge from submit-queue (batch tested with PRs 64009, 64780, 64354, 64727, 63650). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

per-field dynamic config advice

Dynamic Kubelet config gives cluster admins and k8s-as-a-service providers a lot of flexibility around reconfiguring the Kubelet in live environments. With great power comes great responsibility. These comments intend to provide more nuanced guidance around using dynamic Kubelet config by adding items to consider when changing various fields and pointing out where cluster admins and k8s-as-service providers should maintain extra caution.

@kubernetes/sig-node-pr-reviews PLEASE provide feedback and help fill in the blanks here, I don't have domain expertise in all of these features.

https://github.com/kubernetes/features/issues/281

```release-note
NONE
```
2018-06-05 22:24:46 -07:00
Kubernetes Submit Queue
216009fbc4
Merge pull request #64780 from luxas/kubeadm_new_dropins
Automatic merge from submit-queue (batch tested with PRs 64009, 64780, 64354, 64727, 63650). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm: Update the dropin for the kubelet in v1.11

**What this PR does / why we need it**:
One of the final pieces of https://github.com/kubernetes/kubeadm/issues/851, https://github.com/kubernetes/kubeadm/issues/847 and https://github.com/kubernetes/kubeadm/issues/822

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
(partially)
Fixes https://github.com/kubernetes/kubeadm/issues/822

**Special notes for your reviewer**: Please check whether this release note makes sense to you.

**Release note**:

```release-note
[action required] The structure of the kubelet dropin in the kubeadm deb package has changed significantly.
Instead of hard-coding the parameters for the kubelet in the dropin, a structured configuration file
for the kubelet is used, and is expected to be present in `/var/lib/kubelet/config.yaml`.
For runtime-detected, instance-specific configuration values, a environment file with
dynamically-generated flags at `kubeadm init` or `kubeadm join` run time is used.
Finally, if the user wants to override something specific for the kubelet that can't be done via
the kubeadm Configuration file (which is preferred), they might add flags to the 
`KUBELET_EXTRA_ARGS` environment variable in either `/etc/default/kubelet`
or `/etc/sysconfig/kubelet`, depending on the system you're running on.
```
@kubernetes/sig-cluster-lifecycle-pr-reviews
2018-06-05 22:24:42 -07:00
Kubernetes Submit Queue
999b2da440
Merge pull request #64009 from feiskyer/windows-security-context
Automatic merge from submit-queue (batch tested with PRs 64009, 64780, 64354, 64727, 63650). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Kubelet: Add security context for Windows containers

**What this PR does / why we need it**:

This PR adds windows containers to Kubelet CRI and also implements security context setting for docker containers.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

RunAsUser from Kubernetes API only accept int64 today, which is not supported on Windows. It should be changed to intstr for working with both Windows and Linux containers in a separate PR.

**Release note**:

```release-note
Kubelet: Add security context for Windows containers
```

/cc @PatrickLang @taylorb-microsoft @michmike @JiangtianLi @yujuhong @dchen1107
2018-06-05 22:24:38 -07:00
leigh schrandt
76c04b9b13 kubeadm: When etcd is listening on all interfaces, set the etcd probe to use loopback
Fixes https://github.com/kubernetes/kubeadm/issues/882
2018-06-05 18:33:56 -06:00
Mike Danese
90ba15ee74 auth: standalone kubelets shouldn't start a token manager 2018-06-05 17:31:26 -07:00
Kubernetes Submit Queue
ad9722c453
Merge pull request #64732 from jingxu97/June/attachVolumeLimit
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Set GCE PD attachable volume limit based on machineType

This PR implements the function to return attachable volume limit based
on machineType for GCE PD. This is part of the design in kubernetes/community#2051/
2018-06-05 17:24:40 -07:00
David Ashpole
4afcccd225 disable process scheduler metrics 2018-06-05 17:12:56 -07:00
David Ashpole
4df5bd0917 update cadvisor godeps to v0.30.0 2018-06-05 17:05:35 -07:00
Kubernetes Submit Queue
c46e8a9248
Merge pull request #64706 from liztio/kubeadm-hostname-override
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm: Let the `--node-name` flag flow down to `--hostname-override` for the kubelet

**What this PR does / why we need it**:

Kubeadm-initialised kubelet uses provided hostname if present

If --node-name is passed in to `kubeadm init`, `--hostname-override` will be
passed to kubelet. This prevents timeout errors for `kubeadm init`.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes kubernetes/kubeadm#846

**Special notes for your reviewer**:
Depends on #64624 to work fully, but can safely merged before hand.

**Release note**:

```release-note
[action required] The `--node-name` flag for kubeadm now dictates the Node API object name the
kubelet uses for registration, in all cases but where you might use an in-tree cloud provider.
If you're not using an in-tree cloud provider, `--node-name` will set the Node API object name.
If you're using an in-tree cloud provider, you MUST make `--node-name` match the name the
in-tree cloud provider decides to use.
```
2018-06-05 16:26:59 -07:00
Kubernetes Submit Queue
f1bfde4900
Merge pull request #64728 from mbohlool/crd_versioning_f5
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add mbohlool to apiextensions-apiserver reviewer list

@deads2k @sttts @liggitt @lavalamp
2018-06-05 15:32:20 -07:00
Kubernetes Submit Queue
c615098a96
Merge pull request #63193 from lichuqiang/provision_0425
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Volume topology aware dynamic provisioning: work based on new API

**What this PR does / why we need it**:

The PR has been split to 3 parts:

Part1: https://github.com/kubernetes/kubernetes/pull/63232 for basic scheduler and PV controller plumbing
Part2: https://github.com/kubernetes/kubernetes/pull/63233 for API change

and the PR itself includes work based on the API change:

- Dynamic provisioning allowed topologies scheduler work
- Update provisioning interface to be aware of selected node and topology

**Which issue(s) this PR fixes** 
Feature: https://github.com/kubernetes/features/issues/561
Design: https://github.com/kubernetes/community/issues/2168

**Special notes for your reviewer**:
/sig storage
/sig scheduling
/assign @msau42 @jsafrane @saad-ali @bsalamat

@kubernetes/sig-storage-pr-reviews
@kubernetes/sig-scheduling-pr-reviews

**Release note**:

```release-note
Volume topology aware dynamic provisioning
```
2018-06-05 15:31:58 -07:00
Lucas Käldström
0cb6f0f0fc
autogenerated 2018-06-06 01:31:20 +03:00
Jan Chaloupka
b1b28f0fce Switch to Beta 2018-06-06 00:23:16 +02:00
Seth Jennings
6729add11c sysctls: create feature gate to track promotion 2018-06-06 00:23:11 +02:00
Jan Chaloupka
3cc15363bc Run make update 2018-06-06 00:12:40 +02:00
Lucas Käldström
041858232c
kubeadm: Upload CRISocket information and hence make kubeadm join blocking 2018-06-06 01:05:49 +03:00
Jiaying Zhang
35efc4f96a Reconcile extended resource capacity after kubelet restart. 2018-06-05 14:38:49 -07:00
Kubernetes Submit Queue
2d629ce500
Merge pull request #64777 from HotelsDotCom/bug/failing-test-events
Automatic merge from submit-queue (batch tested with PRs 63322, 64718, 64708, 64775, 64777). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove event handler to satisfy alpha tests

**What this PR does / why we need it**:
An original assumption of time out did not fix issue. The events look masked by lubelet flags so reducing test
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #64578 
/cc @msau42 

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```
2018-06-05 14:31:19 -07:00
Kubernetes Submit Queue
c8cecdea2f
Merge pull request #64775 from rajansandeep/imgcoredns
Automatic merge from submit-queue (batch tested with PRs 63322, 64718, 64708, 64775, 64777). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

CoreDNS to use gcr.io repo 

**What this PR does / why we need it**:
Switch CoreDNS to use the gcr.io in kubeadm

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
CoreDNS deployment configuration now uses k8s.gcr.io imageRepository
```
2018-06-05 14:31:15 -07:00
Kubernetes Submit Queue
11f00d1794
Merge pull request #64708 from chuckha/v1alpha1-fix
Automatic merge from submit-queue (batch tested with PRs 63322, 64718, 64708, 64775, 64777). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix kubeadm for v1alpha1 configs

Signed-off-by: Chuck Ha <ha.chuck@gmail.com>

**What this PR does / why we need it**:
This PR allows v1alpha1 configurations to still work when running `kubeadm init`.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes kubernetes/kubeadm#884

**Special notes for your reviewer**:

```release-note
NONE
```
2018-06-05 14:31:12 -07:00
Kubernetes Submit Queue
148458a6df
Merge pull request #64718 from liztio/kubeadm-downcase-fqdn
Automatic merge from submit-queue (batch tested with PRs 63322, 64718, 64708, 64775, 64777). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kubeadm lowercases all domain names passed as additional SANs

**What this PR does / why we need it**:

Some domains, like ELBs, output a domain name with uppercase letters. To
accept these, we lowercase all arguments passed to ----apiserver-cert-extra-sans

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #[kubeadm/827](https://github.com/kubernetes/kubeadm/issues/827)

```release-note
NONE
```
2018-06-05 14:31:09 -07:00
Jan Chaloupka
ab616a88b9 Promote sysctl annotations to API fields 2018-06-05 23:17:00 +02:00
Maciej Szulik
d80ed537e5
Rate limit only when an actual error happens, not on update conflicts 2018-06-05 22:53:09 +02:00
Jing Xu
8b31fcf3a2 Set GCE PD attachable volume limit based on machineType
This PR implements the function to return attachable volume limit based
on machineType for GCE PD. This is part of the design in kubernetes/community#2051/
2018-06-05 13:47:38 -07:00
Kubernetes Submit Queue
2bb6fdc675
Merge pull request #63322 from verult/pv-attach-repd
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

GCE PD plugin now prevents attaching a regional PD PV with pdName of …

…a regular PD



**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #63317 

/sig storage
/sig gcp
/assign @msau42 @saad-ali
2018-06-05 13:40:39 -07:00
Kubernetes Submit Queue
17a50d1c86
Merge pull request #64756 from ghuntley/patch-1
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

housekeeping: improved language used in ISSUE_TEMPLATE.md

**What this PR does / why we need it**:

Improves language seen/experienced by developers that raise issues on GitHub.

**Special notes for your reviewer**:

If you have better ideas - edit my PR and 🚢 

**Release note**:
```release-note
NONE
```
2018-06-05 12:42:11 -07:00
Kubernetes Submit Queue
b672d2ee3c
Merge pull request #64750 from vikaschoudhary16/fix-quota-sync
Automatic merge from submit-queue (batch tested with PRs 64276, 64094, 64719, 64766, 64750). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix quota sync

**What this PR does / why we need it**:
In quota sync, scope selectors were being missed to match and thus at the time of sync, incorrect usage stats were getting updated.


**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
None
```

/priority important-soon
/sig scheduling
/sig node
/cc @resouer @derekwaynecarr @sjenning @bsalamat @timstclair @aveshagarwal @smarterclayton
2018-06-05 11:35:25 -07:00
Kubernetes Submit Queue
c279578862
Merge pull request #64766 from nikhita/allow-description-at-root
Automatic merge from submit-queue (batch tested with PRs 64276, 64094, 64719, 64766, 64750). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

apiextensions: allow Description at root with status subresource

Allows `Description` at the root of the schema when the status subresource is enabled.

**Release note**:
I'll update the original PR, which allowed `Required`, to de-duplicate the release notes.


```release-note
NONE
```

/assign sttts
2018-06-05 11:35:21 -07:00
Kubernetes Submit Queue
d12d8bd64b
Merge pull request #64719 from davidz627/feature/CSIv0.3
Automatic merge from submit-queue (batch tested with PRs 64276, 64094, 64719, 64766, 64750). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Upgrade container-storage-interface/spec dependency to v0.3.0

Also updated golang/protobuf to v1.1.0 to satisfy hard requirement of new CSI Spec version

/sig storage
/kind enhancement
/assign @saad-ali

```release-note
Updated Container Storage Interface specification version to v0.3.0
```
2018-06-05 11:35:17 -07:00
Kubernetes Submit Queue
0b90c414c5
Merge pull request #64094 from vladimirvivien/block-MapDeviceFunc-Refactor
Automatic merge from submit-queue (batch tested with PRs 64276, 64094, 64719, 64766, 64750). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Delegate map operation to BlockVolumeMapper plugin 

**What this PR does / why we need it**:
This PR refactors the volume controller's operation generator, for block mapping, to delegate core block mounting sequence to the `volume.BlockVolumeMapper` plugin instead of living in the operation generator.  This is to ensure better customization of block volume logic for existing internal volume plugins.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #64093

```release-note
NONE
```
/sig storage
2018-06-05 11:35:13 -07:00
Kubernetes Submit Queue
e2d997cfea
Merge pull request #64276 from wangzhen127/manifests-seccomp
Automatic merge from submit-queue (batch tested with PRs 64276, 64094, 64719, 64766, 64750). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use default seccomp profile for GCE manifests

**What this PR does / why we need it**:
This PR sets the default seccomp profile of unprivileged addons to 'docker/default' for GCE manifests. This PR is a followup of #62662. We are using 'docker/default' instead of 'runtime/default' in addons in order to handle node version skew. When seccomp profile is applied automatically by default later, we can remove those annotations.

This is PR is part of #39845.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-06-05 11:35:10 -07:00
Minhan Xia
370268f123 Inject ContainersReady 2018-06-05 11:10:38 -07:00
Minhan Xia
176f34ea07 Generate ContainersReady condition 2018-06-05 11:10:38 -07:00
Minhan Xia
6b08ef575f add ContainersReady condition 2018-06-05 11:10:38 -07:00
Kubernetes Submit Queue
2f011d01fa
Merge pull request #64473 from nberlee/master
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Drop capabilities of CoreDNS container and run in read-only

**What this PR does / why we need it**: Make the CoreDNS container more secure by dropping (root) capabilities. Improve the integrity of the of the container by running the whole container in read-only.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
Same [changes](aba0245609) as in the CoreDNS deployment repository.
**Release note**:

```release-note
Kubeadm: Make CoreDNS run in read-only mode and drop all unneeded privileges 
```
2018-06-05 10:23:19 -07:00
Lucas Käldström
b930d7f915
kubeadm: Update the dropin for the kubelet in v1.11 2018-06-05 20:16:40 +03:00
Kubernetes Submit Queue
c178c7fd65
Merge pull request #62005 from mikedanese/svcacctproj
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

implement ServiceAccountTokenProjection

design here: https://github.com/kubernetes/community/pull/1973

part of https://github.com/kubernetes/kubernetes/pull/61858

```release-note
Add a volume projection that is able to project service account tokens.
```

part of https://github.com/kubernetes/kubernetes/issues/48408

@kubernetes/sig-auth-pr-reviews @kubernetes/sig-storage-pr-reviews
2018-06-05 09:30:56 -07:00