Commit Graph

667 Commits

Author SHA1 Message Date
Jess Frazelle
0ad51ed763
AllowPrivilegeEscalation: add validations for caps and privileged
Signed-off-by: Jess Frazelle <acidburn@microsoft.com>
2017-09-25 13:22:02 -04:00
Di Xu
29249e0891 suspect nil pointer for HostPathType 2017-09-10 22:57:10 +08:00
PiotrProkop
59a86e4cbc Adding getHugePagesMountOptions function and tests 2017-09-05 17:15:49 +02:00
Derek Carr
38d5dee677 Node validation restricts pre-allocated hugepages to single page size 2017-09-05 10:34:30 -04:00
Derek Carr
afd8045ed7 HugePage changes in API and server 2017-09-05 09:46:08 -04:00
Hemant Kumar
e78d433150 Implement necessary API changes
Introduce feature gate for expanding PVs
Add a field to SC
Add new Conditions and feature tag pvc update
Add tests for size update via feature gate
register the resize admission plugin
Update golint failures
2017-09-04 09:02:34 +02:00
Kubernetes Submit Queue
3c621d6ee6 Merge pull request #51761 from karataliu/ccmupdatenode
Automatic merge from submit-queue (batch tested with PRs 51819, 51706, 51761, 51818, 51500)

Fix providerID update validation

**What this PR does / why we need it**:
Cloud controller manager supports updating providerID in #50730, but the node updating was blocked by 
validation rule.

This is to propose a fix for updating the validation rule by allowing altering spec.providerID if not set.

Please check #51596 for detail

**Which issue this PR fixes**
fixes #51596

**Special notes for your reviewer**:

**Release note**:
```release-note
```
2017-09-03 15:00:07 -07:00
Jan Safranek
c49e34fd17 Add API for mount propagation.
In fact, this is one annotation + its parsing & validation. Appropriate
kubelet logic that uses this annotation is in following patches.
2017-09-01 21:36:32 +02:00
Dong Liu
032a6d9441 Fix providerID update validation 2017-09-01 11:01:26 +08:00
Kubernetes Submit Queue
8679a8f5fe Merge pull request #50163 from jingxu97/Aug/sizeLimit
Automatic merge from submit-queue (batch tested with PRs 51707, 51662, 51723, 50163, 51633)

Change SizeLimit to a pointer

This PR fixes issue #50121

```release-note
The `emptyDir.sizeLimit` field is now correctly omitted from API requests and responses when unset.
```
2017-08-31 18:43:38 -07:00
Kubernetes Submit Queue
374e631626 Merge pull request #50757 from NickrenREN/local-storage-limitrange
Automatic merge from submit-queue

Add local ephemeral storage support in LimitRange

**Special notes for your reviewer**:
For a single local ephemeral storage resource

xref #43607 

**Release note**:
```release-note
Add local ephemeral storage support to LimitRange
```

/assign @jingxu97 
cc @ddysher
2017-08-30 13:12:23 -07:00
Jing Xu
4d6da1fd9a Change SizeLimit to a pointer
This PR fixes issue #50121
2017-08-30 11:50:35 -07:00
NickrenREN
370e0becb2 Add feature gate and validate test for local storage limitrange 2017-08-29 20:55:20 +08:00
Kubernetes Submit Queue
9f6c61bba3 Merge pull request #50435 from NickrenREN/localstorage-downwardapi
Automatic merge from submit-queue (batch tested with PRs 51471, 50561, 50435, 51473, 51436)

Add local storage to downwards API

**Release note**:
```release-note
Add local ephemeral storage to downward API 
```


/assign @NickrenREN
2017-08-29 02:22:13 -07:00
NickrenREN
bc393e3f8b Add feature gate for local storage quota 2017-08-26 14:14:26 +08:00
Kubernetes Submit Queue
76c520cea3 Merge pull request #50889 from NickrenREN/local-storage-eviction
Automatic merge from submit-queue (batch tested with PRs 50889, 51347, 50582, 51297, 51264)

Change eviction manager to manage one single local storage resource

**What this PR does / why we need it**:
We decided to manage one single resource name, eviction policy should be modified too.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*:  part of #50818

**Special notes for your reviewer**:

**Release note**:
```release-note
Change eviction manager to manage one single local ephemeral storage resource
```

/assign @jingxu97
2017-08-25 22:43:26 -07:00
NickrenREN
194418986f Add local storage to downwards API 2017-08-26 11:58:21 +08:00
Kubernetes Submit Queue
b65f3cc8dd Merge pull request #49850 from m1093782566/service-session-timeout
Automatic merge from submit-queue (batch tested with PRs 49850, 47782, 50595, 50730, 51341)

Paramaterize `stickyMaxAgeMinutes` for service in API

**What this PR does / why we need it**:

Currently I find `stickyMaxAgeMinutes` for a session affinity type service is hard code to 180min. There is a TODO comment, see

https://github.com/kubernetes/kubernetes/blob/master/pkg/proxy/iptables/proxier.go#L205

I think the seesion sticky max time varies from service to service and users may not aware of it since it's hard coded in all proxier.go - iptables, userspace and winuserspace.

Once we parameterize it in API, users can set/get the values for their different services.

Perhaps, we can introduce a new field `api.ClientIPAffinityConfig` in `api.ServiceSpec`.

There is an initial discussion about it in sig-network group. See,

https://groups.google.com/forum/#!topic/kubernetes-sig-network/i-LkeHrjs80

**Which issue this PR fixes**: 

fixes #49831

**Special notes for your reviewer**:

**Release note**:

```release-note
Paramaterize session affinity timeout seconds in service API for Client IP based session affinity.
```
2017-08-25 20:43:30 -07:00
NickrenREN
9730e3d302 Change validation for local ephemeral storage 2017-08-26 05:15:16 +08:00
Kubernetes Submit Queue
cd908f3e59 Merge pull request #51257 from NickrenREN/validation-bugfix
Automatic merge from submit-queue (batch tested with PRs 51038, 50063, 51257, 47171, 51143)

Fix validation return value

Errors returned by some validation functions may be wrong

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #51256


**Release note**:
```release-note
NONE
```
2017-08-25 12:31:05 -07:00
m1093782566
c355a2ac96 Paramaterize stickyMaxAgeMinutes for service in API 2017-08-25 17:44:47 +08:00
NickrenREN
a975ee1301 Fix validation return value 2017-08-25 09:25:43 +08:00
Huamin Chen
9e65623187 refactor CephFS PV spec to use SecretReference
Signed-off-by: Huamin Chen <hchen@redhat.com>
2017-08-24 18:49:05 +00:00
Huamin Chen
4525446af2 azure file volume: add secret namespace api
Signed-off-by: Huamin Chen <hchen@redhat.com>
2017-08-24 14:49:58 +00:00
Kubernetes Submit Queue
c041567b5a Merge pull request #46597 from dixudx/implement_proposal_34058
Automatic merge from submit-queue (batch tested with PRs 51113, 46597, 50397, 51052, 51166)

implement proposal 34058: hostPath volume type

**What this PR does / why we need it**:
implement proposal #34058

**Which issue this PR fixes** : fixes #46549

**Special notes for your reviewer**:
cc @thockin @luxas @euank PTAL
2017-08-23 23:16:27 -07:00
Kubernetes Submit Queue
ef1b835220 Merge pull request #50646 from rickypai/rpai/hostalias_hostnetwork
Automatic merge from submit-queue

Support HostAlias for HostNetwork Pods

**What this PR does / why we need it**: Currently, HostAlias does not support HostNetwork pods because historically, kubelet only manages hosts file for non-HostNetwork pods. With the recent change in https://github.com/kubernetes/kubernetes/pull/49140, kubelet now manages hosts file for all Pods, which enables HostAlias support also.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #48398

**Special notes for your reviewer**: might be easier to review commit-by-commit

**Release note**:

```release-note
HostAlias is now supported for both non-HostNetwork Pods and HostNetwork Pods.
```

@yujuhong @hongchaodeng @thockin
2017-08-23 22:06:27 -07:00
Kubernetes Submit Queue
55c601b5d8 Merge pull request #51092 from humblec/gluster-validation
Automatic merge from submit-queue (batch tested with PRs 51047, 48573, 50764, 51092, 50578)

Replace validateGlusterfs() with validateGlusterfsVolumeSource() for consistency.
2017-08-23 17:56:17 -07:00
Di Xu
d0a4af133b set default HostPathType to empty 2017-08-23 14:05:21 +08:00
Di Xu
5c45db564f implement proposal 34058: hostPath volume type 2017-08-23 14:05:21 +08:00
Kubernetes Submit Queue
d235fa3f1c Merge pull request #48789 from mtanino/issue/47311
Automatic merge from submit-queue (batch tested with PRs 50806, 48789, 49922, 49935, 50438)

iSCSI volume plugin: iSCSI initiatorname support

**What this PR does / why we need it**:

This PR adds iSCSI initiatorname parameter to ISCSIVolumeSource to enable automatic configuration of initiator name per volume. This would allow for more fine grained configuration, and remove the need to configure the initiator name on the host by administrator.

**Which issue this PR fixes**: fixes #47311

**Special notes for your reviewer**:

/cc @rootfs @jsafrane @msau42

**Release note**:

```
iSCSI volume plugin: Support customization of iSCSI initiator name per volume
```
2017-08-22 19:45:29 -07:00
Humble Chirammal
55ce429620 Replace validateGlusterfs() with validateGlusterfsVolumeSource
for consistency.

Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
2017-08-22 14:47:02 +05:30
Kubernetes Submit Queue
0f8eaa45dd Merge pull request #49976 from aveshagarwal/master-pod-affinities-topology-key
Automatic merge from submit-queue (batch tested with PRs 50531, 50853, 49976, 50939, 50607)

Do not allow empty topology key for pod affinities.

**What this PR does / why we need it**:
This PR do not allow empty topology key for all 4 pod affinities.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
Affinity in annotations alpha feature is no longer supported in 1.8. Anyone upgrading from 1.7 with AffinityInAnnotation feature enabled must ensure pods (specifically with pod anti-affinity PreferredDuringSchedulingIgnoredDuringExecution) with empty TopologyKey fields must be removed before upgrading to 1.8.
```
@kubernetes/sig-scheduling-bugs  @bsalamat @davidopp
2017-08-21 15:46:20 -07:00
Mitsuhiro Tanino
a6e523f2e7 iSCSI volume plugin: iSCSI initiatorname support
This PR adds iSCSI initiatorname parameter to ISCSIVolumeSource
to enable automatic configuration of initiator name per volume.
This would allow for more fine grained configuration, and remove
the need to configure the initiator name on the host by
administrator.

fixes: #47311
2017-08-21 11:26:56 -04:00
David Eads
53348c0531 add diff details to pod validation error 2017-08-18 09:01:13 -04:00
Di Xu
a8742a0643 fix GPU resource validation incorrectly allows zero limits 2017-08-17 15:41:59 +08:00
Connor Doyle
630af5422b OIR predicate includes namespaced resources. 2017-08-16 15:29:24 -07:00
Ricky Pai
1e7c0a4b0c remove validation disallowing hostAlias with hostNetwork 2017-08-14 15:42:09 -07:00
Kubernetes Submit Queue
524a0e04c4 Merge pull request #50224 from xiangpengzhao/remove-beta-annotations
Automatic merge from submit-queue

Remove deprecated ESIPP beta annotations

**What this PR does / why we need it**:
Remove deprecated ESIPP beta annotations.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #50187

**Special notes for your reviewer**:
/assign @MrHohn
/sig network

**Release note**:

```release-note
Beta annotations `service.beta.kubernetes.io/external-traffic` and `service.beta.kubernetes.io/healthcheck-nodeport` have been removed. Please use fields `service.spec.externalTrafficPolicy` and `service.spec.healthCheckNodePort` instead.
```
2017-08-10 22:55:54 -07:00
mtanino
03e28476c4 FC plugin: Support WWID for volume identifier
This PR adds World Wide Identifier (WWID) parameter to
FCVolumeSource as an unique volume identifier.

fixes #48639
2017-08-10 09:59:31 -04:00
Kubernetes Submit Queue
458cc04330 Merge pull request #46254 from mtaufen/dkcfg
Automatic merge from submit-queue (batch tested with PRs 50016, 49583, 49930, 46254, 50337)

Alpha Dynamic Kubelet Configuration

Feature: https://github.com/kubernetes/features/issues/281

This proposal contains the alpha implementation of the Dynamic Kubelet Configuration feature proposed in ~#29459~ [community/contributors/design-proposals/dynamic-kubelet-configuration.md](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/dynamic-kubelet-configuration.md). 

Please note:
- ~The proposal doc is not yet up to date with this implementation, there are some subtle differences and some more significant ones. I will update the proposal doc to match by tomorrow afternoon.~
- ~This obviously needs more tests. I plan to write several O(soon). Since it's alpha and feature-gated, I'm decoupling this review from the review of the tests.~ I've beefed up the unit tests, though there is still plenty of testing to be done.
- ~I'm temporarily holding off on updating the generated docs, api specs, etc, for the sake of my reviewers 😄~ these files now live in a separate commit; the first commit is the one to review.

/cc @dchen1107 @vishh @bgrant0607 @thockin @derekwaynecarr 

```release-note
Adds (alpha feature) the ability to dynamically configure Kubelets by enabling the DynamicKubeletConfig feature gate, posting a ConfigMap to the API server, and setting the spec.configSource field on Node objects. See the proposal at https://github.com/kubernetes/community/blob/master/contributors/design-proposals/dynamic-kubelet-configuration.md for details.
```
2017-08-09 14:14:32 -07:00
Michael Taufen
443d58e40a Dynamic Kubelet Configuration
Alpha implementation of the Dynamic Kubelet Configuration feature.
See the proposal doc in #29459.
2017-08-08 12:21:37 -07:00
Kubernetes Submit Queue
243e655161 Merge pull request #48986 from timoreimann/relax-env-var-naming-restrictions
Automatic merge from submit-queue (batch tested with PRs 50208, 50259, 49702, 50267, 48986)

Relax restrictions on environment variable names.

Fixes #2707

The POSIX standard restricts environment variable names to uppercase letters, digits, and the underscore character in shell contexts only. For generic application usage, it is stated that all other characters shall be tolerated. (Reference [here](http://pubs.opengroup.org/onlinepubs/009695399/basedefs/xbd_chap08.html), my prose reasoning [here](https://github.com/kubernetes/kubernetes/issues/2707#issuecomment-285309156).)

This change relaxes the rules to some degree. Namely, we stop requiring environment variable names to be strict `C_IDENTIFIERS` and start permitting lowercase, dot, and dash characters.

Public container images using environment variable names beyond the shell-only context can benefit from this relaxation. Elasticsearch is one popular example.
2017-08-08 01:53:08 -07:00
xiangpengzhao
ebe21ee4c1 Remove deprecated ESIPP beta annotations 2017-08-05 15:00:58 +08:00
Avesh Agarwal
0dad8dd459 Do not allow empty topology key for pod affinities. 2017-08-02 09:41:29 -04:00
xiangpengzhao
3f28074c54 Validate if service has duplicate port 2017-08-01 15:01:33 +08:00
Timo Reimann
604dfb3197 Relax restrictions on environment variable names.
The POSIX standard restricts environment variable names to uppercase
letters, digits, and the underscore character in shell contexts only.
For generic application usage, it is stated that all other characters
shall be tolerated.

This change relaxes the rules to some degree. Namely, we stop requiring
environment variable names to be strict C_IDENTIFIERS and start
permitting lowercase, dot, and dash characters.

Public container images using environment variable names beyond the
shell-only context can benefit from this relaxation. Elasticsearch is
one popular example.
2017-07-28 22:11:26 +02:00
Di Xu
8d86bd1c64 mountpath should be absolute 2017-07-12 23:37:51 +08:00
Kubernetes Submit Queue
faf4e57f1b Merge pull request #48125 from xiangpengzhao/downwardapi-poduid
Automatic merge from submit-queue (batch tested with PRs 48264, 48324, 48125, 47944, 47489)

Add Pod UID (metadata.uid) to downward API env var

**What this PR does / why we need it**:
Exposing Pod UID by downward API.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #28918 

**Special notes for your reviewer**:
Generated files aren't committed. I'd like CI to tell me what scripts should I run to generate these files.

/cc @smarterclayton @vishh @dubstack

**Release note**:

```release-note
NONE
```
2017-06-30 20:58:31 -07:00
Kubernetes Submit Queue
e74ef81622 Merge pull request #47284 from xiangpengzhao/fix-dup-targetport
Automatic merge from submit-queue

Validate if service has duplicate targetPort

**What this PR does / why we need it**:
Validate if a service has dup targetport

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47222

**Special notes for your reviewer**:
/cc @thockin 
@kubernetes/sig-network-pr-reviews

**Release note**:

```release-note
NONE
```
2017-06-30 02:50:49 -07:00
xiangpengzhao
9e31eb280a Populate endpoints and allow ports with headless service 2017-06-28 11:15:51 +08:00