Commit Graph

58456 Commits

Author SHA1 Message Date
Kubernetes Submit Queue
e570831443
Merge pull request #55400 from mrahbar/update_elasticsearch_kibana
Automatic merge from submit-queue (batch tested with PRs 55998, 55400). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update of elasticsearch kibana version

**What this PR does / why we need it**:
Updated elasticsearch and kibana version to version 5.6.4
This was motivated by @crassirostris in https://github.com/kubernetes/kubernetes/pull/54215#issuecomment-343003874

**Release note**:
```release-note
[fluentd-elasticsearch addon] Elasticsearch and Kibana are updated to version 5.6.4
```
2017-11-22 03:54:23 -08:00
Kubernetes Submit Queue
991e33d36a
Merge pull request #55998 from xiangpengzhao/regen-apiserver-crt
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Regenerate API server serving certificates when upgrading.

**What this PR does / why we need it**:
TODO: 
- [x] check the age of crt.
- [x] check the new version number.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes https://github.com/kubernetes/kubeadm/issues/548

**Special notes for your reviewer**:
/cc @luxas 

**Release note**:

```release-note
NONE
```
2017-11-22 03:43:05 -08:00
Kubernetes Submit Queue
997e777c03
Merge pull request #56179 from Random-Liu/fix-fluentd-cri-log-support
Automatic merge from submit-queue (batch tested with PRs 56115, 55143, 56179). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Do not add new field in fluentd CRI log format.

After https://github.com/kubernetes/kubernetes/pull/55922 is merged, the test `Cluster level logging implemented by Stackdriver should ingest logs` starts to fail in cri-containerd cluster e2e test.
https://k8s-testgrid.appspot.com/sig-node-containerd#e2e-gci

I believe the reason is that the GCP fluentd plugin assumes that there are only `timestamp`, `severity`, `stream` and `log|message|msg` fields in the log entry.

If there is any other fields, GCP fluentd plugin will not try to convert the payload to json, even if the log content is json. The plugin deletes `stream`, `timestamp` and `severity`, then assumes that there is only one field left e13c89a1b6/lib/fluent/plugin/out_google_cloud.rb (L495).

This PR removes the tag field. With this, fluentd GCP plugin should work again.

@yujuhong @crassirostris 
/cc @kubernetes/sig-node-bugs @kubernetes/sig-instrumentation-bugs 
/cc @derekwaynecarr for milestone approve. Thanks!

**Release note**:

```release-note
none
```
2017-11-22 02:56:28 -08:00
Kubernetes Submit Queue
d09f679459
Merge pull request #55143 from feiskyer/version
Automatic merge from submit-queue (batch tested with PRs 56115, 55143, 56179). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use GetVersion() API instead of ver command

**What this PR does / why we need it**:

Should use GetVersion vs Shelling out to ver.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #55083

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-11-22 02:56:26 -08:00
Kubernetes Submit Queue
9f09c55e62
Merge pull request #56115 from m1093782566/ipset-image
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

install ipset in debian-iptables docker image

**What this PR does / why we need it**:

IPVS kube-proxy use ipset doing SNAT and packets filtering. Because IPVS kube-proxy is based on debian-iptables docker image, this PR installs ipset util in the image.

I believe I lost this change in #54219 somehow during code rebase.

**Which issue(s) this PR fixes**:
Fixes #56116

**Special notes for your reviewer**:

**Release note**:

```release-note
install ipset in debian-iptables docker image
```

/sig network

/kind bug

/area kube-proxy
2017-11-22 02:35:19 -08:00
Kubernetes Submit Queue
bd8d8f4387
Merge pull request #56186 from liggitt/master
Automatic merge from submit-queue (batch tested with PRs 55103, 56036, 56186). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Revert "Kubelet flags take precedence over config from files/ConfigMaps"

This reverts commit cbebb61450.

Per https://github.com/kubernetes/kubernetes/pull/56097#issuecomment-346243014

```release-note
NONE
```
2017-11-22 00:27:32 -08:00
Kubernetes Submit Queue
a83869276f
Merge pull request #56036 from m1093782566/flush-ipvs
Automatic merge from submit-queue (batch tested with PRs 55103, 56036, 56186). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add cleanup-ipvs flag for kube-proxy 

**What this PR does / why we need it**:

There is no way to tell if a given ipvs rule is created by ipvs proxier or not, and some people have complained that iptables/userspace proxier will clean up their ipvs rules when start up - both iptables and userspace proxiers need to clean up legacy proxy rules created by ipvs proxier.

This PR adds a new `--cleanup-ipvs` flag for kube-proxy for the sake of providing users a way to decide if clean up IPVS rules or not when start iptables or userspace proxier.

**Which issue(s) this PR fixes**:
Fixes #55857 

**Special notes for your reviewer**:

**Release note**:

```release-note
Add cleanup-ipvs flag for kube-proxy 
```

/sig network
/area ipvs
/king bug
2017-11-22 00:27:30 -08:00
Kubernetes Submit Queue
2a18a2aadf
Merge pull request #55103 from ConnorDoyle/remove-oir
Automatic merge from submit-queue (batch tested with PRs 55103, 56036, 56186). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Removed opaque integer resources (deprecated in v1.8)

**What this PR does / why we need it**:

* Remove opaque integer resources (OIR) support from the code base. This feature was deprecated in v1.8 and replaced by Extended Resources (ER).

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #55102

**Release note**:

```release-note
Remove opaque integer resources (OIR) support (deprecated in v1.8.)
```
2017-11-22 00:27:27 -08:00
Kubernetes Submit Queue
b18d86d5cc
Merge pull request #51498 from NickrenREN/pvc-resize-cinder
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Implement volume resize for cinder

**What this PR does / why we need it**:
resize for cinder
xref: [resize proposal](https://github.com/kubernetes/community/pull/657)

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: xref https://github.com/kubernetes/community/pull/657
Follow up: #49727

**Special notes for your reviewer**:

**Release note**:
```release-note
Implement volume resize for cinder
```

wip, assign to myself first

/assign @NickrenREN
2017-11-21 23:40:37 -08:00
m1093782566
787a55bb67 install ipset in debian-iptables docker image and bump tag to v10 2017-11-22 15:37:15 +08:00
xiangpengzhao
e75c6628de Add unit test case for new funcs 2017-11-22 14:41:41 +08:00
xiangpengzhao
7549b4184f Make expired cert check more clear. 2017-11-22 14:41:40 +08:00
xiangpengzhao
2b00d36241 Address review comments. 2017-11-22 14:41:40 +08:00
xiangpengzhao
b37d6641a7 Auto generated BUILD files. 2017-11-22 14:41:37 +08:00
Kubernetes Submit Queue
afb26b9323
Merge pull request #51493 from mtanino/pr/BlockVolumesSupport-fc
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Block volumes Support: FC plugin update

**What this PR does / why we need it**:

Add interface changes to FC volume plugin to enable block volumes support feature.

**Which issue this PR fixes**: 
Based on this proposal (kubernetes/community#805 & kubernetes/community#1265) and this feature issue: kubernetes/features#351

**Special notes for your reviewer**:

This PR temporarily includes following changes except FC plugin change for reviewing purpose.
These changes will be removed from the PR once they are merged.
- (#50457) API Change 
- (#53385) VolumeMode PV-PVC Binding change
- (#51494) Container runtime interface change, volumemanager changes, operationexecutor changes

There are another PRs related to this functionality.
(#50457) API Change
(#53385) VolumeMode PV-PVC Binding change
(#51494) Container runtime interface change, volumemanager changes, operationexecutor changes
(#55112) Block volume: Command line printer update
Plugins
(#51493) Block volumes Support: FC plugin update
(#54752) Block volumes Support: iSCSI plugin update

**Release note**:

```
FC plugin: Support for block volume 
- This enables uses to allow attaching raw block volume to their pod without filesystem through FC plugin.
```
2017-11-21 22:25:50 -08:00
Kubernetes Submit Queue
9a0bbd0aa9
Merge pull request #53765 from tanshanshan/fix-bug1
Automatic merge from submit-queue (batch tested with PRs 54529, 53765). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix  #53735, check whether  interface conversion is ok

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

fix #53735

avoid interface conversion error 

**Special notes for your reviewer**:

**Release note**:

```release-note
```
2017-11-21 21:38:59 -08:00
Kubernetes Submit Queue
1bdb61f828
Merge pull request #54529 from vladimirvivien/k8s-csi-intree-plugin
Automatic merge from submit-queue (batch tested with PRs 54529, 53765). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Kubernetes CSI - in-tree Plugin Implementation

**What this PR does / why we need it**:
This PR is part of the internal Kubernetes CSI Volume plugin.  It implements the Attach/Detach/Mount/Unmount API.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: https://github.com/kubernetes/features/issues/178

**Special notes for your reviewer**:
- Implements feature https://github.com/kubernetes/features/issues/178
- Designed https://github.com/kubernetes/community/pull/1258

Other CSI Volume plugin PRs
- CSI Persistent Volume Source - https://github.com/kubernetes/kubernetes/pull/55204

**Release note**:
```release-note
NONE
```
2017-11-21 21:38:56 -08:00
Jordan Liggitt
ae7dccf2e9
Revert "Kubelet flags take precedence over config from files/ConfigMaps"
This reverts commit cbebb61450.
2017-11-21 23:55:43 -05:00
Kubernetes Submit Queue
1489d19443
Merge pull request #56175 from ericchiang/oidc-fix-prefixing
Automatic merge from submit-queue (batch tested with PRs 51494, 56097, 56072, 56175). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

oidc auth: fix prefix flag plumbing

Fixes https://github.com/kubernetes/kubernetes/issues/56169

Tested this with an full API server against Google. It works now.

:(

cc @kubernetes/sig-auth-bugs 

```release-note
kube-apiserver: fixed --oidc-username-prefix and --oidc-group-prefix flags which previously weren't correctly enabled
```

/assign @liggitt @deads2k 

Probably worth a cherry pick.
2017-11-21 19:49:33 -08:00
Kubernetes Submit Queue
947295a760
Merge pull request #56072 from kad/fine-checks
Automatic merge from submit-queue (batch tested with PRs 51494, 56097, 56072, 56175). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Implement individual control for kubeadm preflight checks

**What this PR does / why we need it**:
With new flag `--ignore-checks-errors` user is able to
decrease severity of each individual check error to warning.

Old flag `--skip-preflight-checks` now acts as `--ignore-checks-errors=all` and will produce warnings.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes kubernetes/kubeadm#480

**Special notes for your reviewer**:
/area kubeadm 
/sig cluster-lifecycle

cc @luxas 

**Release note**:
```release-note
New kubeadm flag `--ignore-checks-errors` that enables to decrease severity of each individual error to warning.
Old flag `--skip-preflight-checks` is marked as deprecated and acts as `--ignore-checks-errors=all`
```
2017-11-21 19:49:31 -08:00
Kubernetes Submit Queue
d7a96d5e88
Merge pull request #56097 from mtaufen/kc-file-e2e-test
Automatic merge from submit-queue (batch tested with PRs 51494, 56097, 56072, 56175). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Kubelet flags take precedence over config from files/ConfigMaps

Changes the Kubelet configuration flag precedence order so that flags
take precedence over config from files/ConfigMaps.

See:
https://docs.google.com/document/d/18-MsChpTkrMGCSqAQN9QGgWuuFoK90SznBbwVkfZryo/

Also modifies e2e node test suite to transform all relevant Kubelet flags into
a config file before starting tests when the KubeletConfigFile feature gate is
true, and turns on the KubeletConfigFile gate for all e2e node tests.
This allows the alpha dynamic Kubelet config feature to continue to 
work in tests after the precedence change.

fixes #56171

Related: https://github.com/kubernetes/features/issues/281


```release-note
CLI flags passed to the Kubelet now take precedence over Kubelet config files and dynamic Kubelet config. This helps ensure backwards compatible behavior across Kubelet binary updates.
```
2017-11-21 19:49:27 -08:00
Kubernetes Submit Queue
db7bb9e2ed
Merge pull request #51494 from mtanino/pr/BlockVolumesSupport-volumemanager
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Block volumes Support: CRI, volumemanager and operationexecutor changes

**What this PR does / why we need it**:
This PR contains following items to enable block volumes support feature.
- container runtime interface change
- volumemanager changes
- operationexecuto changes


**Which issue this PR fixes**:
Based on this proposal (kubernetes/community#805) and this feature issue: kubernetes/features#351

**Special notes for your reviewer**:

There are another PRs related to this functionality.
(#50457) API Change
(#53385) VolumeMode PV-PVC Binding change
(#51494) Container runtime interface change, volumemanager changes, operationexecutor changes
(#55112) Block volume: Command line printer update
Plugins
(#51493) Block volumes Support: FC plugin update
(#54752) Block volumes Support: iSCSI plugin update

**Release note**:
```
Adds alpha support for block volume, which allows the users to attach raw block volume to their pod without filesystem on top of the volume.
```
/cc @msau42 @liggitt @jsafrane @saad-ali @erinboyd @screeley44
2017-11-21 19:43:27 -08:00
Kubernetes Submit Queue
754017bef4
Merge pull request #56105 from balajismaniam/enable-cpuman-only-when-not-skipped
Automatic merge from submit-queue (batch tested with PRs 55340, 55329, 56168, 56170, 56105). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Enable cpu manager only if the node e2e test is not skipped.

**What this PR does / why we need it**: This PR enables cpu manager in Kubelet only if the node e2e tests are not skipped. This change fixes the failures seen in https://k8s-testgrid.appspot.com/sig-node-kubelet#kubelet-serial-gce-e2e. 

Fixes #56144
2017-11-21 18:56:39 -08:00
Kubernetes Submit Queue
943d37246a
Merge pull request #56170 from rajansandeep/corefileupdate
Automatic merge from submit-queue (batch tested with PRs 55340, 55329, 56168, 56170, 56105). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update the configmap manifest in CoreDNS

**What this PR does / why we need it**:
This PR updates the corefile to retain the pod requests support like in kube-dns. This helps when upgrading CoreDNS using kubeadm upgrade (#55952).

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-11-21 18:56:37 -08:00
Kubernetes Submit Queue
d5bc9a4164
Merge pull request #56168 from screeley44/fix-toggle-bug
Automatic merge from submit-queue (batch tested with PRs 55340, 55329, 56168, 56170, 56105). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fixing issue of feature gate not being turned off properly

Fixes #56166 

Adding proper defer and toggle of feature gate for BlockVolume support
2017-11-21 18:56:34 -08:00
Kubernetes Submit Queue
5ac4f172f9
Merge pull request #55329 from kow3ns/sts-name-label
Automatic merge from submit-queue (batch tested with PRs 55340, 55329, 56168, 56170, 56105). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Sts per Pod Name Label

**What this PR does / why we need it**:
StatefulSet controller will add a label for each Pod in the StatefulSet. The label is of the form 
`statefulset.kubernetes.io/pod-name: <pod.Name>`. This allows a unique service to be created for each Pod in the StatefulSet.

Fixes  #44103, #28660


```release-note
StatefulSet controller will create a label for each Pod in a StatefulSet. The label is named statefulset.kubernetes.io/pod-name and it is equal to the name of the Pod. This allows users to create a Service per Pod to expose a connection to individual Pods.
```
2017-11-21 18:56:31 -08:00
Kubernetes Submit Queue
3bb6eeeb07
Merge pull request #55340 from jiayingz/metrics
Automatic merge from submit-queue (batch tested with PRs 55340, 55329, 56168, 56170, 56105). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Adds device plugin allocation latency metric.

For #53497


**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note

```
2017-11-21 18:56:29 -08:00
Kubernetes Submit Queue
277d866111
Merge pull request #50984 from timothysc/checkpoint
Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Initial basic bootstrap-checkpoint support

**What this PR does / why we need it**:
Adds initial support for Pod checkpointing to allow for controlled recovery of the control plane during self host failure conditions. 

fixes #49236
xref https://github.com/kubernetes/features/issues/378

**Special notes for your reviewer**:

Proposal is here: https://docs.google.com/document/d/1hhrCa_nv0Sg4O_zJYOnelE8a5ClieyewEsQM6c7-5-o/edit?ts=5988fba8#

1. Controlled tests work, but I have not tested the self hosted api-server recovery, that requires validation and logs.  /cc @luxas 
2. In adding hooks for checkpoint manager much of the tests around basicpodmanager appears to be stub'd.  This has become an anti-pattern in the code and should be avoided.  
3. I need a node-e2e to ensure consistency of behavior. 

**Release note**:
```
Add basic bootstrap checkpointing support to the kubelet for control plane recovery
```

/cc @kubernetes/sig-cluster-lifecycle-misc @kubernetes/sig-node-pr-reviews
2017-11-21 17:57:40 -08:00
Kubernetes Submit Queue
8a5cf788b0
Merge pull request #55848 from MrHohn/custom-pod-dns-api
Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add Custom Pod DNS to Kubernetes API

**What this PR does / why we need it**:
Ref:
- Feature issue: https://github.com/kubernetes/features/issues/504
- Proposal: https://github.com/kubernetes/community/pull/1276

This PR adds the relevant APIs, validation check and the underlying kubelet changes.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #NONE 

**Special notes for your reviewer**:
/sig network 
@kubernetes/sig-network-api-reviews 
/assign @bowei @thockin 

**Release note**:

```release-note
Add DNSConfig field to PodSpec and support "None" mode for DNSPolicy (Alpha).
```
2017-11-21 17:57:37 -08:00
Kubernetes Submit Queue
94a8d81172
Merge pull request #55447 from jingxu97/Nov/podmetric
Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add Pod-level local ephemeral storage metric in Summary API

This PR adds pod-level ephemeral storage metric into Summary API.
Pod-level ephemeral storage usage is the sum of all containers and local
ephemeral volume including EmptyDir (if not backed up by memory or
hugepages), configueMap, and downwardAPI.
Address issue #55978

**Release note**:
```release-note
Add pod-level local ephemeral storage metric in Summary API. Pod-level ephemeral storage reports the total filesystem usage for the containers and emptyDir volumes in the measured Pod.
```
2017-11-21 17:57:34 -08:00
Kubernetes Submit Queue
2f2ab910ef
Merge pull request #55752 from kevinkim9264/fix-azure-loadbalancer
Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Azure Load Balancer reconciliation should consider all Kubernetes-controlled properties of a LB NSG

**What this PR does / why we need it**:
This PR refers to issue #55733 
With this PR, Kubernetes will update Azure nsg rules based on not just name, but also based on other properties such as destination port range and destination ip address.
We need it because right now Kubernetes will detect the difference and update only if there is difference in Name of nsg rule. It's been working fine for changing destination port range and source IP address because these two are part of the Name. (which external users should not assume) Basically right now, Kubernetes won't detect the difference if I go ahead and change any part of nsg rule using port UI. 
This PR will let Kubernetes detect the difference and always try to reconcile nsg rules with service definition.

**Which issue(s) this PR fixes** :
Fixes #55733 

**Special notes for your reviewer**: None

**Release note**:

```release-note
Kubernetes update Azure nsg rules based on not just difference in Name, but also in Protocol, SourcePortRange, DestinationPortRange, SourceAddressPrefix, DestinationAddressPrefix, Access, and Direction.
```
2017-11-21 17:57:31 -08:00
Kubernetes Submit Queue
25ebf875b4
Merge pull request #55812 from deads2k/admission-17-external
Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Make versioned types for webhook admission config

Versioned webhook admission config type as promised in https://github.com/kubernetes/kubernetes/pull/54414.  

@kubernetes/sig-api-machinery-pr-reviews 
@ericchiang as promised.  fyi.

```yaml
kind: AdmissionConfiguration
apiVersion: apiserver.k8s.io/v1alpha1
plugins:
- name: GenericAdmissionWebhook
  configuration:
    kind: WebhookAdmission
    apiVersion: apiserver.config.k8s.io/v1alpha1
    kubeConfigFile: /path/to/my/file
```

`ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh`
2017-11-21 17:57:29 -08:00
Lantao Liu
09b614abbb Do not add new field in fluentd CRI log format. 2017-11-22 01:25:24 +00:00
Vladimir Vivien
e489629895 CSI - GoDeps dependency updates 2017-11-21 20:21:04 -05:00
Vladimir Vivien
c90a68c133 CSI - Generated source code
This commit tracks all auto-generated sources.
2017-11-21 20:21:04 -05:00
Vladimir Vivien
dd08d1b489 CSI - API source code implementation
This commit tracks source code update for the CSI volume plugin implementation.
2017-11-21 20:20:58 -05:00
Kubernetes Submit Queue
630dbedef9
Merge pull request #56042 from stewart-yu/kubeadm#554
Automatic merge from submit-queue (batch tested with PRs 56128, 56004, 56083, 55833, 56042). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Automatically opt into dependent feature gates when using kubeadm

**What this PR does / why we need it**:
There will be a dependency chain between  feature gates.  kubeadm needs to automatically opt into dependent feature gates of a chosen one.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes # [https://github.com/kubernetes/kubeadm/issues/554](https://github.com/kubernetes/kubeadm/issues/554)

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-11-21 17:05:02 -08:00
Kubernetes Submit Queue
c975b13869
Merge pull request #55833 from feiskyer/azure-vmss
Automatic merge from submit-queue (batch tested with PRs 56128, 56004, 56083, 55833, 56042). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add initial Virtual Machine Scale Sets (VMSS) support in Azure

**What this PR does / why we need it**:

This is the first step of adding Virtual Machine Scale Sets (VMSS) support in Azure, it

- Adds  vmType params to support both vmss and standard in Azure
- Adds initial InstanceID/InstanceType/IP/Routes support for vmss instances
- Master nodes may not belong to any scale sets, so it falls back to VirtualMachinesClient for such instances

Have validated that nodes could be registered and pods could be scheduled and run correctly.

Still more work to do to fully support Azure VMSS. And next steps are tracking at #43287.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:

Part of #43287.

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-11-21 17:04:59 -08:00
Kubernetes Submit Queue
5d3aae0192
Merge pull request #56083 from yguo0905/sched-log
Automatic merge from submit-queue (batch tested with PRs 56128, 56004, 56083, 55833, 56042). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Suppress the warning when a pod in binding cannot be expired

**What this PR does / why we need it**:

I have a scheduler extender, which implements the `Bind` call and takes several minutes to respond to that call. The scheduler log was full of the following error.

```
W1120 10:23:09.691188   99720 cache.go:442] Couldn't expire cache for pod default/xxx. Binding is still in progress.
```

The TTL for a pod to be expired in the scheduler cache is 30 seconds. But it's also possible that the binding (which is done asynchronously) can take longer than 30 seconds.
2cbb07a439/plugin/pkg/scheduler/factory/factory.go (L143)

The go routine that checks whether a pod has been expired is triggered every second.
2cbb07a439/plugin/pkg/scheduler/schedulercache/cache.go (L33)

So, it will print the the following warning every seconds until the pod gets expired.
2cbb07a439/plugin/pkg/scheduler/schedulercache/cache.go (L442-L443)

I think it's a valid for the binding to take more than one second, so we should downgrade this to an info to avoid polluting the scheduler log.

**Release note**:
```release-note
None
```

/sig scheduling
/assign @bsalamat 
/cc @vishh
2017-11-21 17:04:56 -08:00
Kubernetes Submit Queue
4cafc5459b
Merge pull request #56004 from caesarxuchao/admission-v1beta1
Automatic merge from submit-queue (batch tested with PRs 56128, 56004, 56083, 55833, 56042). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Graduate the admission and admissionregistration (webhook part) API to v1beta1

ref: kubernetes/features#492

Most changes are mechanical. Please take a look at the commit message to see if the commit is worth reviewing.

```release-note
Action required:
The `admission/v1alpha1` API has graduated to `v1beta1`. Please delete your existing webhooks before upgrading the cluster, and update your admission webhooks to use the latest API, because the API has backwards incompatible changes.
The webhook registration related part of the `admissionregistration` API has graduated to `v1beta1`. Please delete your existing configurations before upgrading the cluster, and update your configuration file to use the latest API.
```
2017-11-21 17:04:54 -08:00
Kubernetes Submit Queue
2ba1d9916b
Merge pull request #56128 from MrHohn/fix-ingress-before-each
Automatic merge from submit-queue (batch tested with PRs 56128, 56004, 56083, 55833, 56042). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Don't call f.BeforeEach() again in ingress suite

**What this PR does / why we need it**: Calling f.BeforeEach() explicitly in ingress suite is causing test panics. See #56089.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes (hopefully) #56089

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-11-21 17:04:50 -08:00
Michael Taufen
cbebb61450 Kubelet flags take precedence over config from files/ConfigMaps
Changes the Kubelet configuration flag precedence order so that flags
take precedence over config from files/ConfigMaps.

See issue #56171 for more details.

Also modifies e2e node test suite to transform all relevant Kubelet
flags into a config file before starting tests when the
KubeletConfigFile feature gate is true, and turns on the
KubeletConfigFile gate for all e2e node tests. This allows the alpha
dynamic Kubelet config feature to continue to work in tests after
the precedence change.
2017-11-21 16:02:27 -08:00
Kubernetes Submit Queue
a69f9dad90
Merge pull request #55794 from porridge/patient-big-master
Automatic merge from submit-queue (batch tested with PRs 54316, 53400, 55933, 55786, 55794). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Be less agressive and more patient when creating large master.

**What this PR does / why we need it**:

Workaround for #55777

**Release note**:
```release-note
NONE
```
2017-11-21 15:04:34 -08:00
Kubernetes Submit Queue
61792ef482
Merge pull request #55786 from porridge/debug-e2e-pod-wait
Automatic merge from submit-queue (batch tested with PRs 54316, 53400, 55933, 55786, 55794). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Improve messages around waiting for pods.

**What this PR does / why we need it**:

This is a step towards solving #55785

**Release note**:
```release-note
NONE
```
2017-11-21 15:04:31 -08:00
Kubernetes Submit Queue
34b258ca4b
Merge pull request #55933 from bsalamat/starvation3
Automatic merge from submit-queue (batch tested with PRs 54316, 53400, 55933, 55786, 55794). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add support to take nominated pods into account during scheduling to avoid starvation of higher priority pods

**What this PR does / why we need it**:
When a pod preempts lower priority pods, the preemptor gets a "nominated node name" annotation. We call such a pod a nominated pod. This PR adds the logic to take such nominated pods into account when scheduling other pods on the same node that the nominated pod is expected to run. This is needed to avoid starvation of preemptor pods. Otherwise, lower priority pods may fill up the space freed after preemption before the preemptor gets a chance to get scheduled.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #54501

**Special notes for your reviewer**: This PR is built on top of #55109 and includes all the changes there as well.

**Release note**:

```release-note
Add support to take nominated pods into account during scheduling to avoid starvation of higher priority pods.
```

/sig scheduling
ref/ #47604
2017-11-21 15:04:28 -08:00
Kubernetes Submit Queue
63d4b85bf4
Merge pull request #53400 from micahhausler/aws-nlb
Automatic merge from submit-queue (batch tested with PRs 54316, 53400, 55933, 55786, 55794). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add Amazon NLB support

**What this PR does / why we need it**:

This adds support for AWS's NLB for `LoadBalancer` services.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

Fixes #52173

**Special notes for your reviewer**:

This is NOT yet ready for merge, but I'd love any feedback before it is.

This requires at least `v1.10.40` of the [github.com/aws/aws-sdk-go](https://github.com/aws/aws-sdk-go), which is not yet included in Kubernetes. Per @justinsb, I'm waiting on possibly #48314 to update to `v1.10.40`  or some other PR. 

I tried to make the change as easy to review as possible, so some LoadBalancer logic is duplicated in the `if isNLB(annotations)` blocks. I can refactor that and sprinkle more `isNLB()` switches around, but it might be harder to view the diff.

**Other Notes:**

* NLB's subnets cannot be modified after creation (maybe look for public subnets in all AZ's?).  Currently, I'm just using `c.findELBSubnets()`
* Health check uses TCP with all the NLB default values. I was thinking HTTP health checks via annotation could be added later. Should that go into this PR?
* ~~`externalTrafficPolicy`/`healthCheckNodePort` are ignored. Should those be implemented for this PR?~~
* `externalTrafficPolicy` and subsequent `healthCheckNodePort` are handled properly. This may come with uneven load balancing, as NLB doesn't support weighted backends.
* With classic ELB, you have a security group the ELB is inside of to associate Instance (k8s node) SG rules with a LoadBalancer (k8s Service), but NLB's don't have a security group. Instead, I use the `Description` field on [`ec2.IpRange`](https://docs.aws.amazon.com/sdk-for-go/api/service/ec2/#IpRange) with the following annotations. Is this ok? I couldn't think of another way to associate SG rule to the NLB
    * Node SG gets an rule added for VPC cidr on NodePort for Health Check with annotation in description `kubernetes.io/rule/nlb/health=<loadBalancerName>`
    * Node SG gets an rule added for `loadBalancerSourceRanges` to  NodePort for client traffic with annotation in description `kubernetes.io/rule/nlb/client=<loadBalancerName>`
    * **Note: if `loadBalancerSourceRanges` is unspecified, this opens instance security groups to traffic from `0.0.0.0/0` on the service's nodePorts**
* Respects internal annotation
* Creates a TargetGroup per frontend port: simplifies updates when you have same backend port for multiple front end ports.
* Does not (yet) verify that we're under the NLB limits in terms of # of listeners
* `UpdateLoadBalancer()`  basically just calls `EnsureLoadBalancer` for NLB's. Is this ok?

**Areas for future improvement or optimization**:

* A new annotation indicating a new security group should be created for NLB traffic and instances would be placed in this new SG. (Could bump up against the default limit of 5 SG's per instance)
* Only create a client health check security group rule when the VPC cidr is not a subset of `spec.loadBalancerSourceRanges`
* Consolidate TargetGroups if a service has 2+ frontend ports and the same nodePort.
* A new annotation for specifying TargetGroup Health Check options.

**Release note**:

```release-notes
Add Amazon NLB support - Fixes #52173
```

ping @justinsb @bchav
2017-11-21 15:04:25 -08:00
Kubernetes Submit Queue
03b7d77be4
Merge pull request #54316 from dashpole/disk_request_eviction
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Take disk requests into account during evictions

fixes #54314

This PR is part of the local storage feature, and it makes the eviction manager take disk requests into account during disk evictions.
This uses the same eviction strategy as we do for memory.
Disk requests are only considered when the LocalStorageCapacityIsolation feature gate is enabled.  This is enforced by adding a check for the feature gate in getRequests().
I have added unit testing to ensure that previous behavior is preserved when the feature gate is disabled.
Most of the changes are testing.  Reviewers should focus on changes in **eviction/helpers.go**

/sig node
/assign @jingxu97  @vishh
2017-11-21 14:31:47 -08:00
Eric Chiang
df76402906 oidc auth: fix prefix flag plumbing 2017-11-21 14:22:25 -08:00
Jiaying Zhang
048bafdd0b Adds device plugin registration count metric and allocation latency metric. 2017-11-21 13:44:10 -08:00
Chao Xu
fcf4f15c89 update-all generated 2017-11-21 13:00:40 -08:00