Production-Grade Container Scheduling and Management
Go to file
Kubernetes Submit Queue b058b299c9
Merge pull request #58977 from Random-Liu/fix-pod-sandbox-privilege
Automatic merge from submit-queue (batch tested with PRs 58777, 58978, 58977, 58775). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix pod sandbox privilege.

Fixes https://github.com/kubernetes/kubernetes/issues/58979.

In cri-containerd, we start enforcing that a privileged container can't be created in privileged sandbox in https://github.com/containerd/cri-containerd/pull/577.

However, after that the e2e-gci-device-plugin-gpu test starts failing. https://k8s-testgrid.appspot.com/sig-node-containerd#e2e-gci-device-plugin-gpu
```
I0128 06:49:09.117] Jan 28 06:49:09.086: INFO: At 2018-01-28 06:41:10 +0000 UTC - event for nvidia-driver-installer-5kkrz: {kubelet bootstrap-e2e-minion-group-7s2v} Failed: (combined from similar events): Error: failed to generate container "cfb9f4f01fc2685db6469d3f6348077b94d4aa577e2e6345bf890f8871ec80dd" spec: no privileged container allowed in sandbox
```

The reason is that kubelet doesn't check init container when setting sandbox privilege.

Signed-off-by: Lantao Liu <lantaol@google.com>

**Release note**:

```release-note
none.
```
@kubernetes/sig-node-bugs @yujuhong @feiskyer @mrunalp
2018-01-29 14:59:42 -08:00
.github
api Merge pull request #57938 from dims/add-binary-configmap 2018-01-26 04:34:33 -08:00
build fix make quick-verify 2018-01-27 11:26:11 +08:00
cluster Merge pull request #57426 from mikedanese/reorder 2018-01-29 12:37:40 -08:00
cmd Kubelet flags take precedence 2018-01-29 10:07:37 -08:00
docs Merge pull request #57938 from dims/add-binary-configmap 2018-01-26 04:34:33 -08:00
examples Remove apiVersion from scheduler extender example configuration 2018-01-18 14:41:53 -08:00
Godeps godep: vendor gopkg.in/square/go-jose.v2/jwt 2018-01-23 14:47:25 -08:00
hack Merge pull request #58968 from deads2k/server-07-deadarg 2018-01-29 13:48:42 -08:00
logo
pkg Merge pull request #58977 from Random-Liu/fix-pod-sandbox-privilege 2018-01-29 14:59:42 -08:00
plugin Merge pull request #58485 from k82cn/k8s_58471 2018-01-26 12:23:00 -08:00
staging Merge pull request #58963 from deads2k/server-06-dead-etcdserver 2018-01-29 13:48:48 -08:00
test Merge pull request #58777 from filbranden/nnp1 2018-01-29 14:59:36 -08:00
third_party Add brackets and quotes where needed 2018-01-26 15:11:53 -08:00
translations Generate bindata.go and k8s.mo 2018-01-20 01:56:49 +00:00
vendor godep: vendor gopkg.in/square/go-jose.v2/jwt 2018-01-23 14:47:25 -08:00
.bazelrc
.generated_files
.gitattributes Hide generated files only on github 2018-01-22 10:58:48 +01:00
.gitignore
.kazelcfg.json
BUILD.bazel
CHANGELOG-1.2.md
CHANGELOG-1.3.md
CHANGELOG-1.4.md Revert k8s.gcr.io vanity domain 2017-12-22 14:36:16 -08:00
CHANGELOG-1.5.md Revert k8s.gcr.io vanity domain 2017-12-22 14:36:16 -08:00
CHANGELOG-1.6.md Revert k8s.gcr.io vanity domain 2017-12-22 14:36:16 -08:00
CHANGELOG-1.7.md Update CHANGELOG-1.7.md for v1.7.12. 2017-12-29 13:42:49 +01:00
CHANGELOG-1.8.md CHANGELOG: feature flag is "AdvancedAuditing" not "AdvancedAudit" 2018-01-18 14:19:39 -08:00
CHANGELOG-1.9.md Update CHANGELOG-1.9.md for v1.9.2. 2018-01-18 13:46:38 -06:00
CHANGELOG-1.10.md Update CHANGELOG-1.10.md for v1.10.0-alpha.2. 2018-01-26 14:24:30 -05:00
CHANGELOG.md Update release note links for 1.10 2018-01-17 22:45:12 +01:00
code-of-conduct.md Update code-of-conduct.md 2017-12-20 13:33:36 -05:00
CONTRIBUTING.md Pointed to community/contributors/guide/README.md 2017-12-15 22:08:34 +05:30
labels.yaml
LICENSE
Makefile
Makefile.generated_files
OWNERS
OWNERS_ALIASES fabiano no longer a thing 2017-12-19 16:37:12 -02:00
README.md Update README.md with punctuation improvements 2018-01-23 10:16:37 -06:00
SUPPORT.md
WORKSPACE

Kubernetes

Submit Queue Widget GoDoc Widget CII Best Practices


Kubernetes is an open source system for managing containerized applications across multiple hosts; providing basic mechanisms for deployment, maintenance, and scaling of applications.

Kubernetes builds upon a decade and a half of experience at Google running production workloads at scale using a system called Borg, combined with best-of-breed ideas and practices from the community.

Kubernetes is hosted by the Cloud Native Computing Foundation (CNCF). If you are a company that wants to help shape the evolution of technologies that are container-packaged, dynamically-scheduled and microservices-oriented, consider joining the CNCF. For details about who's involved and how Kubernetes plays a role, read the CNCF announcement.


To start using Kubernetes

See our documentation on kubernetes.io.

Try our interactive tutorial.

Take a free course on Scalable Microservices with Kubernetes.

To start developing Kubernetes

The community repository hosts all information about building Kubernetes from source, how to contribute code and documentation, who to contact about what, etc.

If you want to build Kubernetes right away there are two options:

You have a working Go environment.
$ go get -d k8s.io/kubernetes
$ cd $GOPATH/src/k8s.io/kubernetes
$ make
You have a working Docker environment.
$ git clone https://github.com/kubernetes/kubernetes
$ cd kubernetes
$ make quick-release

For the full story, head over to the developer's documentation.

Support

If you need support, start with the troubleshooting guide, and work your way through the process that we've outlined.

That said, if you have questions, reach out to us one way or another.

Analytics