Commit Graph

512 Commits

Author SHA1 Message Date
Jess Frazelle
0ad51ed763
AllowPrivilegeEscalation: add validations for caps and privileged
Signed-off-by: Jess Frazelle <acidburn@microsoft.com>
2017-09-25 13:22:02 -04:00
Kubernetes Submit Queue
a91c8939b7 Merge pull request #51601 from caesarxuchao/minor-test-fix
Automatic merge from submit-queue (batch tested with PRs 51601, 52153, 52364, 52362, 52342)

Minor fixes to validation test

Some test cases confuse the new object with the old object. This PR fixed that. Also added a test to verify that deletionTimestamp cannot be added (via the REST endpoints).
2017-09-13 09:30:01 -07:00
Chao Xu
c5a9237416 Fix pod update test descriptions to match the test cases 2017-09-06 10:30:18 -07:00
PiotrProkop
59a86e4cbc Adding getHugePagesMountOptions function and tests 2017-09-05 17:15:49 +02:00
Derek Carr
38d5dee677 Node validation restricts pre-allocated hugepages to single page size 2017-09-05 10:34:30 -04:00
Derek Carr
afd8045ed7 HugePage changes in API and server 2017-09-05 09:46:08 -04:00
Hemant Kumar
e78d433150 Implement necessary API changes
Introduce feature gate for expanding PVs
Add a field to SC
Add new Conditions and feature tag pvc update
Add tests for size update via feature gate
register the resize admission plugin
Update golint failures
2017-09-04 09:02:34 +02:00
Kubernetes Submit Queue
3c621d6ee6 Merge pull request #51761 from karataliu/ccmupdatenode
Automatic merge from submit-queue (batch tested with PRs 51819, 51706, 51761, 51818, 51500)

Fix providerID update validation

**What this PR does / why we need it**:
Cloud controller manager supports updating providerID in #50730, but the node updating was blocked by 
validation rule.

This is to propose a fix for updating the validation rule by allowing altering spec.providerID if not set.

Please check #51596 for detail

**Which issue this PR fixes**
fixes #51596

**Special notes for your reviewer**:

**Release note**:
```release-note
```
2017-09-03 15:00:07 -07:00
Jan Safranek
c49e34fd17 Add API for mount propagation.
In fact, this is one annotation + its parsing & validation. Appropriate
kubelet logic that uses this annotation is in following patches.
2017-09-01 21:36:32 +02:00
Dong Liu
032a6d9441 Fix providerID update validation 2017-09-01 11:01:26 +08:00
Kubernetes Submit Queue
8679a8f5fe Merge pull request #50163 from jingxu97/Aug/sizeLimit
Automatic merge from submit-queue (batch tested with PRs 51707, 51662, 51723, 50163, 51633)

Change SizeLimit to a pointer

This PR fixes issue #50121

```release-note
The `emptyDir.sizeLimit` field is now correctly omitted from API requests and responses when unset.
```
2017-08-31 18:43:38 -07:00
Kubernetes Submit Queue
374e631626 Merge pull request #50757 from NickrenREN/local-storage-limitrange
Automatic merge from submit-queue

Add local ephemeral storage support in LimitRange

**Special notes for your reviewer**:
For a single local ephemeral storage resource

xref #43607 

**Release note**:
```release-note
Add local ephemeral storage support to LimitRange
```

/assign @jingxu97 
cc @ddysher
2017-08-30 13:12:23 -07:00
Jing Xu
4d6da1fd9a Change SizeLimit to a pointer
This PR fixes issue #50121
2017-08-30 11:50:35 -07:00
NickrenREN
370e0becb2 Add feature gate and validate test for local storage limitrange 2017-08-29 20:55:20 +08:00
Kubernetes Submit Queue
9f6c61bba3 Merge pull request #50435 from NickrenREN/localstorage-downwardapi
Automatic merge from submit-queue (batch tested with PRs 51471, 50561, 50435, 51473, 51436)

Add local storage to downwards API

**Release note**:
```release-note
Add local ephemeral storage to downward API 
```


/assign @NickrenREN
2017-08-29 02:22:13 -07:00
NickrenREN
bc393e3f8b Add feature gate for local storage quota 2017-08-26 14:14:26 +08:00
Kubernetes Submit Queue
76c520cea3 Merge pull request #50889 from NickrenREN/local-storage-eviction
Automatic merge from submit-queue (batch tested with PRs 50889, 51347, 50582, 51297, 51264)

Change eviction manager to manage one single local storage resource

**What this PR does / why we need it**:
We decided to manage one single resource name, eviction policy should be modified too.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*:  part of #50818

**Special notes for your reviewer**:

**Release note**:
```release-note
Change eviction manager to manage one single local ephemeral storage resource
```

/assign @jingxu97
2017-08-25 22:43:26 -07:00
NickrenREN
194418986f Add local storage to downwards API 2017-08-26 11:58:21 +08:00
NickrenREN
9730e3d302 Change validation for local ephemeral storage 2017-08-26 05:15:16 +08:00
m1093782566
c355a2ac96 Paramaterize stickyMaxAgeMinutes for service in API 2017-08-25 17:44:47 +08:00
Kubernetes Submit Queue
c041567b5a Merge pull request #46597 from dixudx/implement_proposal_34058
Automatic merge from submit-queue (batch tested with PRs 51113, 46597, 50397, 51052, 51166)

implement proposal 34058: hostPath volume type

**What this PR does / why we need it**:
implement proposal #34058

**Which issue this PR fixes** : fixes #46549

**Special notes for your reviewer**:
cc @thockin @luxas @euank PTAL
2017-08-23 23:16:27 -07:00
Kubernetes Submit Queue
ef1b835220 Merge pull request #50646 from rickypai/rpai/hostalias_hostnetwork
Automatic merge from submit-queue

Support HostAlias for HostNetwork Pods

**What this PR does / why we need it**: Currently, HostAlias does not support HostNetwork pods because historically, kubelet only manages hosts file for non-HostNetwork pods. With the recent change in https://github.com/kubernetes/kubernetes/pull/49140, kubelet now manages hosts file for all Pods, which enables HostAlias support also.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #48398

**Special notes for your reviewer**: might be easier to review commit-by-commit

**Release note**:

```release-note
HostAlias is now supported for both non-HostNetwork Pods and HostNetwork Pods.
```

@yujuhong @hongchaodeng @thockin
2017-08-23 22:06:27 -07:00
Kubernetes Submit Queue
55c601b5d8 Merge pull request #51092 from humblec/gluster-validation
Automatic merge from submit-queue (batch tested with PRs 51047, 48573, 50764, 51092, 50578)

Replace validateGlusterfs() with validateGlusterfsVolumeSource() for consistency.
2017-08-23 17:56:17 -07:00
Di Xu
5c45db564f implement proposal 34058: hostPath volume type 2017-08-23 14:05:21 +08:00
Kubernetes Submit Queue
d235fa3f1c Merge pull request #48789 from mtanino/issue/47311
Automatic merge from submit-queue (batch tested with PRs 50806, 48789, 49922, 49935, 50438)

iSCSI volume plugin: iSCSI initiatorname support

**What this PR does / why we need it**:

This PR adds iSCSI initiatorname parameter to ISCSIVolumeSource to enable automatic configuration of initiator name per volume. This would allow for more fine grained configuration, and remove the need to configure the initiator name on the host by administrator.

**Which issue this PR fixes**: fixes #47311

**Special notes for your reviewer**:

/cc @rootfs @jsafrane @msau42

**Release note**:

```
iSCSI volume plugin: Support customization of iSCSI initiator name per volume
```
2017-08-22 19:45:29 -07:00
Humble Chirammal
55ce429620 Replace validateGlusterfs() with validateGlusterfsVolumeSource
for consistency.

Signed-off-by: Humble Chirammal <hchiramm@redhat.com>
2017-08-22 14:47:02 +05:30
Kubernetes Submit Queue
0f8eaa45dd Merge pull request #49976 from aveshagarwal/master-pod-affinities-topology-key
Automatic merge from submit-queue (batch tested with PRs 50531, 50853, 49976, 50939, 50607)

Do not allow empty topology key for pod affinities.

**What this PR does / why we need it**:
This PR do not allow empty topology key for all 4 pod affinities.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
Affinity in annotations alpha feature is no longer supported in 1.8. Anyone upgrading from 1.7 with AffinityInAnnotation feature enabled must ensure pods (specifically with pod anti-affinity PreferredDuringSchedulingIgnoredDuringExecution) with empty TopologyKey fields must be removed before upgrading to 1.8.
```
@kubernetes/sig-scheduling-bugs  @bsalamat @davidopp
2017-08-21 15:46:20 -07:00
Mitsuhiro Tanino
a6e523f2e7 iSCSI volume plugin: iSCSI initiatorname support
This PR adds iSCSI initiatorname parameter to ISCSIVolumeSource
to enable automatic configuration of initiator name per volume.
This would allow for more fine grained configuration, and remove
the need to configure the initiator name on the host by
administrator.

fixes: #47311
2017-08-21 11:26:56 -04:00
Di Xu
75258b2763 update testcase err msg 2017-08-17 15:42:05 +08:00
Di Xu
a8742a0643 fix GPU resource validation incorrectly allows zero limits 2017-08-17 15:41:59 +08:00
Kubernetes Submit Queue
ce1485c626 Merge pull request #48922 from ConnorDoyle/integer-resources-as-default
Automatic merge from submit-queue (batch tested with PRs 46317, 48922, 50651, 50230, 47599)

Resources outside the `*kubernetes.io` namespace are integers and cannot be over-committed.

**What this PR does / why we need it**:

Fixes #50473 

Rationale: since the scheduler handles all resources except CPU as integers, that could just be the default behavior for namespaced resources.

cc @RenaudWasTaken @vishh 

**Release note**:

```release-note
Resources outside the `*kubernetes.io` namespace are integers and cannot be over-committed.
```
2017-08-16 19:50:15 -07:00
Jeffrey Regan
dbc22ad6fd Remove kubectl's dependence on schema file in pkg/api/validation.
**What this PR does / why we need it**:

Makes functions in validation/schema.go private to kubectl,
further isolating kubectl.

**Which issue this PR fixes**

Part of a series of PRs to address kubernetes/community#598

**Release note**:
```release-note
NONE
```
2017-08-16 16:38:28 -07:00
Connor Doyle
630af5422b OIR predicate includes namespaced resources. 2017-08-16 15:29:24 -07:00
Ricky Pai
1e7c0a4b0c remove validation disallowing hostAlias with hostNetwork 2017-08-14 15:42:09 -07:00
Kubernetes Submit Queue
524a0e04c4 Merge pull request #50224 from xiangpengzhao/remove-beta-annotations
Automatic merge from submit-queue

Remove deprecated ESIPP beta annotations

**What this PR does / why we need it**:
Remove deprecated ESIPP beta annotations.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #50187

**Special notes for your reviewer**:
/assign @MrHohn
/sig network

**Release note**:

```release-note
Beta annotations `service.beta.kubernetes.io/external-traffic` and `service.beta.kubernetes.io/healthcheck-nodeport` have been removed. Please use fields `service.spec.externalTrafficPolicy` and `service.spec.healthCheckNodePort` instead.
```
2017-08-10 22:55:54 -07:00
mtanino
03e28476c4 FC plugin: Support WWID for volume identifier
This PR adds World Wide Identifier (WWID) parameter to
FCVolumeSource as an unique volume identifier.

fixes #48639
2017-08-10 09:59:31 -04:00
NickrenREN
7589ef92c8 Clean validation_test go file
When i wrote test cases for local storage quota, found some unused vars and useless code, remove them
2017-08-09 09:15:25 +08:00
Kubernetes Submit Queue
243e655161 Merge pull request #48986 from timoreimann/relax-env-var-naming-restrictions
Automatic merge from submit-queue (batch tested with PRs 50208, 50259, 49702, 50267, 48986)

Relax restrictions on environment variable names.

Fixes #2707

The POSIX standard restricts environment variable names to uppercase letters, digits, and the underscore character in shell contexts only. For generic application usage, it is stated that all other characters shall be tolerated. (Reference [here](http://pubs.opengroup.org/onlinepubs/009695399/basedefs/xbd_chap08.html), my prose reasoning [here](https://github.com/kubernetes/kubernetes/issues/2707#issuecomment-285309156).)

This change relaxes the rules to some degree. Namely, we stop requiring environment variable names to be strict `C_IDENTIFIERS` and start permitting lowercase, dot, and dash characters.

Public container images using environment variable names beyond the shell-only context can benefit from this relaxation. Elasticsearch is one popular example.
2017-08-08 01:53:08 -07:00
xiangpengzhao
ebe21ee4c1 Remove deprecated ESIPP beta annotations 2017-08-05 15:00:58 +08:00
Kubernetes Submit Queue
865976fa4c Merge pull request #49739 from aveshagarwal/master-pod-anit-affinity-cleanup
Automatic merge from submit-queue (batch tested with PRs 50029, 48517, 49739, 49866, 49782)

Pod affinity test clean up as AffinitInAnnotation is removed.

**What this PR does / why we need it**:
These tests are already covered under "empty topologyKey" pod affinity test cases.
These test cases were added only to test the scenario when the AffinitInAnnotation
feature was disabled. Since AffinitInAnnotation is removed now, these test cases are
no longer needed as they are duplicate now.


**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```

@kubernetes/sig-scheduling-misc  @bsalamat
2017-08-02 12:46:53 -07:00
Avesh Agarwal
0dad8dd459 Do not allow empty topology key for pod affinities. 2017-08-02 09:41:29 -04:00
xiangpengzhao
3f28074c54 Validate if service has duplicate port 2017-08-01 15:01:33 +08:00
Timo Reimann
604dfb3197 Relax restrictions on environment variable names.
The POSIX standard restricts environment variable names to uppercase
letters, digits, and the underscore character in shell contexts only.
For generic application usage, it is stated that all other characters
shall be tolerated.

This change relaxes the rules to some degree. Namely, we stop requiring
environment variable names to be strict C_IDENTIFIERS and start
permitting lowercase, dot, and dash characters.

Public container images using environment variable names beyond the
shell-only context can benefit from this relaxation. Elasticsearch is
one popular example.
2017-07-28 22:11:26 +02:00
Avesh Agarwal
661aa50107 Pod affinity test clean up as AffinitInAnnotation is removed.
These tests are already covered under "empty topologyKey" pod affinity test cases.
These test cases were added only to test the scenario when the AffinitInAnnotation
feature was disabled. Since AffinitInAnnotation is removed now, these test cases are
no longer needed as they are duplicate now.
2017-07-27 15:19:32 -04:00
Di Xu
8d86bd1c64 mountpath should be absolute 2017-07-12 23:37:51 +08:00
Kubernetes Submit Queue
faf4e57f1b Merge pull request #48125 from xiangpengzhao/downwardapi-poduid
Automatic merge from submit-queue (batch tested with PRs 48264, 48324, 48125, 47944, 47489)

Add Pod UID (metadata.uid) to downward API env var

**What this PR does / why we need it**:
Exposing Pod UID by downward API.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #28918 

**Special notes for your reviewer**:
Generated files aren't committed. I'd like CI to tell me what scripts should I run to generate these files.

/cc @smarterclayton @vishh @dubstack

**Release note**:

```release-note
NONE
```
2017-06-30 20:58:31 -07:00
Kubernetes Submit Queue
e74ef81622 Merge pull request #47284 from xiangpengzhao/fix-dup-targetport
Automatic merge from submit-queue

Validate if service has duplicate targetPort

**What this PR does / why we need it**:
Validate if a service has dup targetport

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47222

**Special notes for your reviewer**:
/cc @thockin 
@kubernetes/sig-network-pr-reviews

**Release note**:

```release-note
NONE
```
2017-06-30 02:50:49 -07:00
xiangpengzhao
9e31eb280a Populate endpoints and allow ports with headless service 2017-06-28 11:15:51 +08:00
xiangpengzhao
0f65b218a0
Add Pod UID (metadata.uid) to downward API env var 2017-06-27 16:54:35 +08:00
Bobby Salamat
91f893eebe Add priority to Kubernetes API 2017-06-26 13:43:19 -07:00