Commit Graph

56197 Commits

Author SHA1 Message Date
Kubernetes Submit Queue
c65b4b6df4 Merge pull request #54006 from deads2k/rbac-03-proto
Automatic merge from submit-queue (batch tested with PRs 48665, 52849, 54006, 53755). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

start generating rbac serialization for v1

At some point we lost our protobuf generation for rbac/v1.  This adds it back.
2017-10-16 18:09:46 -07:00
Kubernetes Submit Queue
97808e5a86 Merge pull request #52849 from liggitt/psp-defaulting-order
Automatic merge from submit-queue (batch tested with PRs 48665, 52849, 54006, 53755). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Order PSP by name, prefer non-mutating PSPs

Fixes #36184
Fixes #23217
Related to #23217

Removes unnecessary mutation of pods:
* Determines effective security context for pods using a wrapper containing the pod and container security context, rather than building/setting a combined struct on every admission
* Does not set `privileged:&false` on security contexts with `privileged:nil`
* Does not set `runAsNonRoot:&true` on security contexts that already have a non-nil, non-0 `runAsUser`
* Does not mutate/normalize container capabilities unless changes are required (missing  defaultAddCapabilities or requiredDropCapabilities)

Defines behavior when multiple PSP objects allow a pod:
* PSPs which allow the pod as-is (no defaulting/mutating) are preferred
* If the pod must be defaulted/mutated to be allowed, the first PSP (ordered by name) to allow the pod is selected
* During update operations, when mutations to pod specs are disallowed, only non-mutating PSPs are used to validate the pod

```release-note
PodSecurityPolicy: when multiple policies allow a submitted pod, priority is given to ones which do not require any fields in the pod spec to be defaulted. If the pod must be defaulted, the first policy (ordered by name) that allows the pod is used.
```
2017-10-16 18:09:41 -07:00
Kubernetes Submit Queue
d24d368845 Merge pull request #48665 from praseodym/add-short-names-help-text
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add missing short names to kubectl help text

**What this PR does / why we need it**:
This PR adds two short names that exist but are not listed in the help text that `kubectl get` produces.

**Special notes for your reviewer**:
🍰 

**Release note**:
```release-note
NONE
```
2017-10-16 17:45:26 -07:00
Kubernetes Submit Queue
03cb11f020 Merge pull request #52275 from mattjmcnaughton/mattjmcnaughton/18155-hpa-tolerance-should-be-flag
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Make HPA tolerance a flag

**What this PR does / why we need it**:
Make HPA tolerance configurable as a flag. This change allows us to use
different tolerance values in production/testing.

**Which issue this PR fixes**: 
Fixes #18155

**Release note:**
```release-note
Control HPA tolerance through the `horizontal-pod-autoscaler-tolerance` flag.
```

Signed-off-by: mattjmcnaughton <mattjmcnaughton@gmail.com>
2017-10-16 16:47:43 -07:00
Kubernetes Submit Queue
74cd0f0766 Merge pull request #53861 from pwittrock/resource-validation-deps
Automatic merge from submit-queue (batch tested with PRs 53106, 52193, 51250, 52449, 53861). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Move version-conversion code out of shared kubectl resource package

```release-note
NONE
```
2017-10-16 14:47:28 -07:00
Kubernetes Submit Queue
2956c16328 Merge pull request #52449 from crimsonfaith91/rs-upgrade
Automatic merge from submit-queue (batch tested with PRs 53106, 52193, 51250, 52449, 53861). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add replicaset upgrade test

**What this PR does / why we need it**:
This PR adds existing replicaset upgrade test.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: xref #52118

**Release note**:

```release-note
NONE
```
2017-10-16 14:47:26 -07:00
Kubernetes Submit Queue
855551dc80 Merge pull request #51250 from dixudx/bump_cni_v0.6.0
Automatic merge from submit-queue (batch tested with PRs 53106, 52193, 51250, 52449, 53861). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

bump CNI to v0.6.0

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #49480

**Special notes for your reviewer**:
/assign @luxas @bboreham @feiskyer 

**Release note**:

```release-note
bump CNI to v0.6.0
```
2017-10-16 14:47:23 -07:00
Kubernetes Submit Queue
ef87482923 Merge pull request #52193 from StevenACoffman/kube-dns-anti-affinity
Automatic merge from submit-queue (batch tested with PRs 53106, 52193, 51250, 52449, 53861). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

kube-dns-anti-affinity: kube-dns never-co-located-in-the-same-node

**What this PR does / why we need it**:

This is upstreaming the kubernetes/kops#2705 pull request by @jamesbucher that was originally against [kops](github.com/kubernetes/kops).
Please see kubernetes/kops#2705 for more details, including a lengthy discussion.

Briefly, given the constraints of how the system works today:

+ if you need multiple DNS pods primarily for availability, then requiredDuringSchedulingIgnoredDuringExecution makes sense because putting more than one DNS pod on the same node isn't useful
+ if you need multiple DNS pods primarily for performance, then
preferredDuringScheduling IgnoredDuringExecution makes sense because it will allow the DNS pods to schedule even if they can't be spread across nodes

**Which issue this PR fixes**

fixes kubernetes/kops#2693

**Release note**:


```release-note
Improve resilience by annotating kube-dns addon with podAntiAffinity to prefer scheduling on different nodes.
```
2017-10-16 14:47:20 -07:00
Kubernetes Submit Queue
27b3560226 Merge pull request #53106 from vmware/E2EvSphereInvalidUserInputsKubernetes
Automatic merge from submit-queue (batch tested with PRs 53106, 52193, 51250, 52449, 53861). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

E2E test cases for Invalid user inputs for vSphere

Add E2E test cases to invalid inputs for vSphere

- Invalid FS Type in Storage Class.
- Invalid datastoreName in Storage Class.
- Invalid disksize for a persistent volume.

@divyenpatel @rohitjogvmw
2017-10-16 14:47:17 -07:00
David Eads
5a709021ab start generating rbac serialization for v1 2017-10-16 16:15:17 -04:00
Jun Xiang Tee
db2c027154 add replicaset upgrade test 2017-10-16 12:10:04 -07:00
Phillip Wittrock
7ab3f96100 Move kubectl type conversion libs out of the resource & util package and into the conversion command.
Kubectl shouldn't have code that does type conversion.  This should be in the server.
2017-10-16 11:54:31 -07:00
Balu Dontu
dfc6fd5f75 E2E test cases for Invalid user inputs - disksize, datastore, fstype 2017-10-16 11:42:05 -07:00
Kubernetes Submit Queue
88975e98d6 Merge pull request #53919 from apelisse/fix-new-apply-crash
Automatic merge from submit-queue (batch tested with PRs 53694, 53919). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Do not crash when groupVersion doesn't have a group

**What this PR does / why we need it**: fixes a crash when the group is empty, because it assumes that split will return a two element array. Which it doesn't.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes kubernetes/kubectl#78

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```
2017-10-16 10:58:30 -07:00
Kubernetes Submit Queue
6118a4b9af Merge pull request #53694 from andyzhangx/azure-avset-nil-fix
Automatic merge from submit-queue (batch tested with PRs 53694, 53919). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix controller manager crash issue on a manually created k8s cluster

**What this PR does / why we need it**:
fix controller manager crash issue on a manually created k8s cluster, it's due to availability set nil issue in azure loadbalancer

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
In the testing of a manually created k8s cluster, I found controller manager on master would crash in current scenario:
1. Use acs-engine to set up k8s 1.7.7 cluster (it's with an availability set)
2. Manually add a node to the k8s cluster (without an availibity set in this VM)
3. Set up a service and schedule the pod onto this newly added node
4. controller manager would crash on master because although this k8s cluster has an availability set, the newly added node's `machine.AvailabilitySet` is nil which would cause controller manager crash

**Special notes for your reviewer**:
@brendanburns @karataliu @JiangtianLi 

**Release note**:

```
fix controller manager crash issue on a manually created k8s cluster
```
/sig azure
2017-10-16 10:58:27 -07:00
Kubernetes Submit Queue
8b1bdd8e8e Merge pull request #53985 from sttts/sttts-mac-fixes
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix build scripts on Mac
2017-10-16 09:22:12 -07:00
Kubernetes Submit Queue
a6625085f5 Merge pull request #52473 from tianshapjq/typo
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

typo in annotations

**What this PR does / why we need it**: just typo in annotations

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Release note**:

```release-note
none
```
2017-10-16 08:28:09 -07:00
Kubernetes Submit Queue
35a105af9f Merge pull request #53966 from fabiand/sampleApiserverNsManifest
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add sample-apiserver namespace manifest

**What this PR does / why we need it**:
Adds a manifest to also create the required namespace for the api server example.

It was previously proposed here kubernetes/sample-apiserver#11

```release-note
```
2017-10-16 08:27:56 -07:00
Kubernetes Submit Queue
328fa9aba2 Merge pull request #53980 from aleksandra-malinowska/scale-from-0-gke
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Enable autoscaling test of scale from 0 in GKE

This enables scale from zero test scenario in GKE jobs.
2017-10-16 07:36:22 -07:00
Kubernetes Submit Queue
6f003eb265 Merge pull request #53974 from shyamjvs/auto-calculate-kubemark-disk
Automatic merge from submit-queue (batch tested with PRs 53862, 53974). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Auto-calculate master disksize and cluster IP range in kubemark

/cc @wojtek-t
2017-10-16 07:35:32 -07:00
Kubernetes Submit Queue
1a80501fab Merge pull request #53862 from jianglingxia/jlx-quantity
Automatic merge from submit-queue (batch tested with PRs 53862, 53974). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

unused para useInfDec  in quantity_test

**What this PR does / why we need it**:
the para useInfDec  unused and some comment error,so fix it!
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-10-16 07:35:28 -07:00
Kubernetes Submit Queue
4a6fec738b Merge pull request #53977 from shyamjvs/kubemark-events-pd
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Make EVENT_PD variable useful for kubemark

/cc @wojtek-t
2017-10-16 05:48:27 -07:00
Dr. Stefan Schimanski
4156ec979b build/common.sh: silence kube::build::has_ip on Mac 2017-10-16 14:44:39 +02:00
Dr. Stefan Schimanski
4673f6b558 update-bazel.sh: fix on Mac 2017-10-16 14:44:38 +02:00
Aleksandra Malinowska
f59d66546e enable scale from 0 test in GKE 2017-10-16 13:52:10 +02:00
Shyam Jeedigunta
40c245e53e Make EVENT_PD variable useful for kubemark 2017-10-16 13:35:41 +02:00
Shyam Jeedigunta
6e610296b9 Auto-calculate master disksize and cluster IP range in kubemark 2017-10-16 13:06:04 +02:00
Fabian Deutsch
14c347f931
Add sample-apiserver namespace manifest 2017-10-16 11:57:10 +02:00
Kubernetes Submit Queue
1ab5075c7c Merge pull request #52637 from stewart-yu/issue#06
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Modify Schedule function

**What this PR does / why we need it**:
It is obvious that no need to prioritizing when only one node after predicate.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:
@davidopp @timothysc

**Release note**:

```release-note
NONE
```
2017-10-16 00:38:15 -07:00
Jordan Liggitt
8c5b01376a
PodSecurityPolicy: Order by name, prefer non-mutating policies, require *api.Pod, allow GC updates 2017-10-16 02:22:11 -04:00
Jordan Liggitt
a5f722e181
PodSecurityPolicy: avoid unnecessary securitycontext mutation 2017-10-16 02:22:10 -04:00
Jordan Liggitt
b6a750c1f6
SecurityContext: Add accessors/mutators for effective container security context 2017-10-16 02:22:10 -04:00
Jordan Liggitt
34ed25cf52
GC: Add check for nil interface 2017-10-16 02:21:11 -04:00
Jordan Liggitt
fef3b03188
PodSecurityPolicy: pass effective runAsNonRoot and runAsUser to user validation interface 2017-10-16 02:21:11 -04:00
Jordan Liggitt
e34a00d14f
PodSecurityPolicy: pass effective selinux options to validate 2017-10-16 02:21:11 -04:00
Jordan Liggitt
5dc4da7c6a
PodSecurityPolicy: limit validation to provided groups 2017-10-16 02:21:11 -04:00
Jordan Liggitt
9e34f2b968
PodSecurityPolicy: pass effective capabilities to validation interface 2017-10-16 02:21:11 -04:00
Jordan Liggitt
abc7c077e1
PodSecurityPolicy: avoid unnecessary mutation of supplemental groups 2017-10-16 02:21:10 -04:00
Jordan Liggitt
cfb490e3a1
PodSecurityPolicy: avoid unnecessary mutation of container capabilities 2017-10-16 02:21:10 -04:00
Jordan Liggitt
59510caaf3
PodSecurityPolicy: only set runAsNonRoot when runAsUser is nil 2017-10-16 02:21:10 -04:00
Jordan Liggitt
b45b809f4c
PodSecurityPolicy: Do not mutate nil privileged field to false 2017-10-16 02:21:10 -04:00
Kubernetes Submit Queue
77b83e446b Merge pull request #53839 from ixdy/update-bazel-workspace
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 Update rules_go, repo-infra, and rules_docker dependencies

**What this PR does / why we need it**: several of our bazel dependencies were getting pretty old, since they required bazel 0.5.4+ but there were various failures if we tried to use them with bazel 0.5.4.

Now that bazel 0.6.0 (and 0.6.1) have been out for a while, we can bump our dependencies and get a number of fixes and new functionality.

x-ref #52677 and others

**Special notes for your reviewer**:
* This will now explicitly require bazel 0.6.0+ to build kubernetes.
* Our staging directories are causing some issues for `gazelle`; it wants to set `importpath = "k8s.io/kubernetes/staging/src/k8s.io/blah"` instead of `importpath = "k8s.io/blah"`. I'm not sure what is the correct way to fix this; what we're doing here is pretty weird and nonstandard. I've used a `sed` substitution for now.
* The `-proto=default` option of `gazelle` has a number of bugs right now (https://github.com/bazelbuild/rules_go/issues/888, https://github.com/bazelbuild/rules_go/issues/900, https://github.com/bazelbuild/rules_go/issues/907), so I am forcing the legacy behavior.

**Release note**:

```release-note
NONE
```

/assign @mikedanese @spxtr @BenTheElder
2017-10-15 21:50:13 -07:00
Kubernetes Submit Queue
9ba01e5e78 Merge pull request #50729 from allencloud/remove-redundant-error-test-case
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove redundant error test case in autoscaling validation

Signed-off-by: allencloud <allen.sun@daocloud.io>



**What this PR does / why we need it**:
I think the error test case I removed is the same as https://github.com/kubernetes/kubernetes/blob/master/pkg/apis/autoscaling/validation/validation_test.go#L393-L412 .
So maybe removal of this part is proper, since it would reduce the codes and save a little bit time in testing.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
NONE

**Special notes for your reviewer**:
NONE

**Release note**:

```release-note
NONE
```
2017-10-15 20:19:51 -07:00
Kubernetes Submit Queue
021e3ebf0c Merge pull request #52465 from WanLinghao/kubectl_cp_amend
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

improve kubectl cp command in several ways 

**Release note**:
"kubectl cp" process soft link in better ways as well as some little bugs
  
**Soft link**:
before this patch 
    "kubectl cp" command will copy the soft link to destination as an empty regular file
after this patch
    "kubectl cp" command will behave the same as tar command
this patch improves it on both from container and to container

**some bugs**
1.from container to host
     a.when copy a file ends with '/', it will cause a panic.
        for example, container gakki has a regular file /tmp/test, then run command 
         _kubectl cp gakki:/tmp/test/  /tmp_
         a panic happens
 b.when copy a file which does not exist in container, the command ends up without 
         any error information

2.from host to container
    a.when run command like
        kubectl cp ""  gakki:/tmp
        it will try cp current directory to container, in other words, this command works
        the same as kubectl cp . gakki:/tmp
  b.current cp command will omit  an empty directory
2017-10-15 19:28:21 -07:00
Jeff Grafton
aee5f457db update BUILD files 2017-10-15 18:18:13 -07:00
Jeff Grafton
32551a3322 Use -proto=legacy with gazelle, and manually fix staging/ import paths 2017-10-15 18:13:56 -07:00
Jeff Grafton
638ea5205f Update rules_go, repo-infra, and rules_docker dependencies
This requires bazel 0.6.0+.
2017-10-15 18:13:56 -07:00
Kubernetes Submit Queue
02f0d92160 Merge pull request #51686 from choury/fix_dup_unbind
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix duplicate unbind action in kube-proxy

**What this PR does / why we need it**:
Fix duplicate unbind action in kube-proxy. It will generate unnecessary error info If unbind multi-ports on one service .

**Which issue this PR fixes**:
fixes #51694

**Release-note**:
```release-note
NONE
```
2017-10-15 17:38:45 -07:00
Kubernetes Submit Queue
8166743cb6 Merge pull request #53890 from FengyunPan/registry-approver
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Volunteer to help with sig/openstack

I would like to do some code review/approve for OpenStack cloud
provider and cinder volume.

**Release note**:
```release-note
NONE
```
2017-10-15 16:03:27 -07:00
Kubernetes Submit Queue
4ad4e1ec40 Merge pull request #53938 from drinktee/cloudtest
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add unit test for cloud-controller-manager

**What this PR does / why we need it**:
Add more unit test for coud-controller-manager

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
NONE

**Special notes for your reviewer**:
NONE

```release-note
NONE
```
2017-10-14 22:46:55 -07:00