Commit Graph

292 Commits

Author SHA1 Message Date
Kubernetes Submit Queue
26caa84d09
Merge pull request #63445 from ericchiang/deprecate-git-repo-volume
Automatic merge from submit-queue (batch tested with PRs 63445, 63820). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

core v1: deprecate the gitRepo volume type

gitRepo stopped accepting new features nearly 2 years ago https://github.com/kubernetes/kubernetes/issues/17676#issuecomment-228650586 and today this behavior can easily be achieved through an init container. The kubelet shelling out to git in the host namespace can also be a security issue on un-trusted repos, as was demonstrated by [CVE-2017-1000117](https://groups.google.com/forum/#!topic/kubernetes-announce/CTLXJ74cu8M). Our own documentation even alludes to this volume type being removed in the future:

> In the future, such volumes may be moved to an even more decoupled model, rather than extending the Kubernetes API for every such use case.

https://kubernetes.io/docs/concepts/storage/volumes/#gitrepo

Closes https://github.com/kubernetes/kubernetes/issues/60999

```release-note-action-required
The GitRepo volume type is deprecated. To provision a container with a git repo, mount an EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir into the Pod's container.
```

/release-note-action-required

Instead of this:

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: server
spec:
  containers:
  - image: nginx
    name: nginx
    volumeMounts:
    - mountPath: /mypath
      name: git-volume
  volumes:
  - name: git-volume
    gitRepo:
      repository: "git@somewhere:me/my-git-repository.git"
      revision: "22f1d8406d464b0c0874075539c1f2e96c253775"
```

Do this:

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: git-clone
data:
  git-clone.sh: |
    #!/bin/sh -e
    git clone $1 $3
    cd $3
    git reset --hard $2
---
apiVersion: v1
kind: Pod
metadata:
  name: server
spec:
  initContainers:
  - name: git-clone
    image: alpine/git # Any image with git will do
    command:
    - /usr/local/git/git-clone.sh
    args:
    - "https://somewhere/me/my-git-repository.git"
    - "22f1d8406d464b0c0874075539c1f2e96c253775"
    - "/mypath"
    volumeMounts:
    - name: git-clone
      mountPath: /usr/local/git
    - name: git-repo
      mountPath: /mypath
  containers:
  - image: nginx
    name: nginx
    volumeMounts:
    - mountPath: /mypath
      name: git-volume
  volumes:
  - name: git-volume
    emptyDir: {}
  - name: git-clone
    configMap:
      name: git-clone
      defaultMode: 0755
```
2018-05-31 16:20:07 -07:00
Eric Chiang
f8f5f045a7
generated: update generated API files
Commands run:

	./hack/update-api-reference-docs.sh
	./hack/update-generated-protobuf.sh
	./hack/update-generated-swagger-docs.sh
	./hack/update-openapi-spec.sh
	./hack/update-swagger-spec.sh
2018-05-30 16:52:42 -07:00
Mike Danese
514d280e2f autogenerated 2018-05-30 11:06:58 -07:00
Da K. Ma
b80a01b210 generated codes.
Signed-off-by: Da K. Ma <klaus1982.cn@gmail.com>
2018-04-24 08:55:04 +08:00
Slava Semushin
9223f0d539 Update generated files. 2018-03-27 20:18:00 +02:00
Kubernetes Submit Queue
0b062e1518
Merge pull request #60452 from danwinship/networkpolicy-pod-plus-ns
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Allow including both podSelector and namespaceSelector in a NetworkPolicyPeer

Updates NetworkPolicy API docs and validation to allow podSelector and namespaceSelector to be specified together in a NetworkPolicyPeer

Fixes #58637

**Release note**:
```release-note
NetworkPolicies can now target specific pods in other namespaces by including both a namespaceSelector and a podSelector in the same peer element.
```
2018-03-24 13:34:27 -07:00
Slava Semushin
2b4a832585 Autogenerated changes. 2018-03-21 11:21:17 +01:00
hangaoshuai
805ac2c0f0 update Mount propagation version in comment 2018-03-02 13:03:30 +08:00
Mayank Kumar
b888415ebf API Changes for RunAsGroup and Implementation and e2e 2018-02-28 22:09:56 -08:00
Dan Winship
8bc6edad5a Regenerate files 2018-02-28 08:27:39 -05:00
Kubernetes Submit Queue
ac25308c08
Merge pull request #59771 from MrHohn/custom-pod-dns-e2e
Automatic merge from submit-queue (batch tested with PRs 60324, 60269, 59771, 60314, 59941). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Promote configurable pod resolv.conf to Beta and add an e2e test

**What this PR does / why we need it**:
Feature issue: https://github.com/kubernetes/features/issues/504

There is no semantic changes. `CustomPodDNS` feature gate will be turned on by default.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #56521

**Special notes for your reviewer**:
/assign @bowei @thockin 

**Release note**:

```release-note
Adds BETA support for `DNSConfig` field in PodSpec and `DNSPolicy=None`.
```
2018-02-24 20:01:44 -08:00
Lee Verberne
a41de1b734 Generated code for Shared Process Namespace 2018-02-21 19:13:06 +01:00
Zihong Zheng
44a64edc54 Auto-generated files for CustomPodDNS Beta API 2018-02-12 13:55:10 -08:00
Di Xu
521146e62d auto-generated 2018-02-11 11:04:15 +08:00
Kubernetes Submit Queue
f99ed35b28
Merge pull request #58444 from bsalamat/update_prio
Automatic merge from submit-queue (batch tested with PRs 58444, 59283, 59437, 59325, 59449). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update PriorityClassName API doc

**What this PR does / why we need it**: It updates the comment (and hence API doc) for PriorityClassName of PodSpec.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

/sig scheduling
2018-02-06 22:42:33 -08:00
Bobby (Babak) Salamat
646ee95213 autogenerated files 2018-02-06 17:55:14 -08:00
Mike Spreitzer
b43dc4fac2 Clarify that ListOptions.Timeout is not conditional on inactivity
Fixes #58558
2018-02-05 17:04:03 -05:00
Chakravarthy Nelluri
18c5234b3a Mark Flexvolume as GA 2017-12-12 14:53:40 -05:00
Kubernetes Submit Queue
05a7b58a1d
Merge pull request #56400 from feiskyer/dns-none
Automatic merge from submit-queue (batch tested with PRs 56400, 56535). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Document None dns policy clearly 

**What this PR does / why we need it**:

Needs to indicate that None dns policy is controlled by a feature gate and by alpha. It also needs to note that only 1.9 or later Kubernetes servers will allow the None value.

Needs to be fixed for 1.9 so that public API documentation is correct.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #56399

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-11-29 18:59:10 -08:00
Kubernetes Submit Queue
bb9f27f9ee
Merge pull request #56425 from cmluciano/cml/deprecatev1beta1
Automatic merge from submit-queue (batch tested with PRs 56497, 56500, 55018, 56544, 56425). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Mark v1beta1 NetworkPolicy types as deprecated

**What this PR does / why we need it**:
Deprecates v1beta1 NetworkPolicy in favor of v1. The default storage is now set to v1 in 1.9.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Related #56423

**Special notes for your reviewer**:

**Release note**:

```
deprecate NetworkPolicy v1beta1 API in extensions
```
2017-11-29 15:26:11 -08:00
Christopher M. Luciano
0b72a20e0f
Generated code NP v1beta1 2017-11-29 10:08:44 -05:00
Pengfei Ni
491a481525 Add generated files 2017-11-28 04:33:53 +00:00
Haoran Wang
e297a819ef generated 2017-11-23 16:23:53 +08:00
MrHohn
44b5cf3e12 Autogenerated codes for Custom Pod DNS API 2017-11-20 16:18:05 -08:00
Huamin Chen
56ec6e1028 generated files
Signed-off-by: Huamin Chen <hchen@redhat.com>
2017-11-18 20:05:40 +00:00
Scott Creeley
de4138d828 generated code for VolumeMode api change 2017-11-18 12:03:33 -05:00
Kubernetes Submit Queue
95038553d7
Merge pull request #53911 from tallclair/psp-docs
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Clarify DefaultAddCapabilities behavior

Clarify that capabilities listed in `DefaultAddCapabilities` in the `PodSecurityPolicySpec` need not be repeated in `AllowedCapabilities`.

**Release note**:

```release-note
NONE
```
2017-11-12 12:17:54 -08:00
Kubernetes Submit Queue
68436545ff
Merge pull request #54797 from guangxuli/fix_inconsistent_description
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix the inconsistent description of TopologyKey in PodAffinityTerm

**What this PR does / why we need it**:
Clarify the confusing of inconsistent description.
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
Just fix #54276
**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-11-11 09:27:24 -08:00
Gavin
c17b9d3de1 update auto-gen code 2017-11-09 08:47:14 +08:00
Janet Kuo
b0c086eeb9 Autogen 2017-11-07 21:49:24 -08:00
Tim Allclair
0b4e8f9b3a
generated code 2017-11-07 12:38:29 -08:00
Kubernetes Submit Queue
71155962aa
Merge pull request #54936 from wackxu/deletime
Automatic merge from submit-queue (batch tested with PRs 55050, 53464, 54936, 55028, 54928). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update deletionTimestamp with information about finalizer effect

**What this PR does / why we need it**:

ref https://github.com/kubernetes/community/pull/1177

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:Fixes # https://github.com/kubernetes/website/issues/6128

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-11-03 12:59:16 -07:00
wackxu
25354c73c3 Update deletionTimestamp with information about finalizer effect 2017-11-03 10:48:48 +08:00
tengqm
dcefc825ea Improve deleteOptions doc (generated) 2017-11-02 11:48:40 +08:00
Kubernetes Submit Queue
7d5dc528a0 Merge pull request #54013 from vladimirvivien/scaleio-secret-multi-tenancy
Automatic merge from submit-queue (batch tested with PRs 49865, 53731, 54013, 54513, 51502). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

ScaleIO - Ability to specify Secret's name and namespace 

**What this PR does / why we need it**:
This PR is to decouple the ScaleIO secret from the same namespace as that of the StorageClass/PVC/PV that uses it (#53619). Currently, authorized non-admin k8s user, who creates volumes, may end up having unauthorized access to ScaleIO secret information.  This PR introduces secret parameter that allows specification of secret's namespace.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #53619 

**Release note**:
```release-note
ScaleIO persistent volumes now support referencing a secret in a namespace other than the bound persistent volume claim's namespace; this is controlled during provisioning with the `secretNamespace` storage class parameter; StoragePool and ProtectionDomain attributes no longer defaults to the value `default`
```
2017-10-26 13:24:34 -07:00
Kubernetes Submit Queue
8bcc1c621e Merge pull request #54143 from porridge/fix-tches-typo
Automatic merge from submit-queue (batch tested with PRs 53946, 53993, 54315, 54143, 54532). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix typo in comment.

**Release note**:
```release-note
NONE
```
2017-10-25 21:20:37 -07:00
Vladimir Vivien
1c9aff8e58 ScaleIO - Generated files 2017-10-25 16:05:57 -04:00
Marcin Owsiany
b9c4ea3f36 More generated files. 2017-10-18 14:17:23 +02:00
zhengchuan hu
77dbe5995f generated when exec hack/update-all.sh 2017-10-12 23:19:31 +08:00
Jordan Liggitt
bed6d0f5ea
Use pointer for PSP allow escalation 2017-10-04 13:55:06 -04:00
Kubernetes Submit Queue
029ed12b33 Merge pull request #49205 from dixudx/fix_api_type_typos
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix some typos in api/types

**What this PR does / why we need it**:
Fix some typos in api/types

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #53420

**Special notes for your reviewer**:

**Release note**:

```release-note
None
```
2017-10-03 20:17:43 -07:00
Ryan Roden-Corrent
53939c4433 Improve explanation of ReplicaSet.
"ReplicaSet represents the configuration of a ReplicaSet" does not tell
you much. I took the explanation from
https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/#when-to-use-a-replicaset
2017-10-03 16:22:12 -04:00
Brendan Burns
449082f55d Add 201/202 to the list of returned codes. 2017-09-28 12:25:39 -07:00
Di Xu
05c4640799 auto-gen 2017-09-26 13:07:36 +08:00
Guangya Liu
e31bcb97c6 Generated code. 2017-09-20 00:15:24 -04:00
Kubernetes Submit Queue
1a44e26670 Merge pull request #48216 from kargakis/update-pds-api-comment
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>..

api: update progressdeadlineseconds comment for deployments

@kubernetes/sig-apps-api-reviews we may never end up doing autorollback - this drops the comment from the pds field for now
2017-09-16 15:33:18 -07:00
Christopher M. Luciano
84290ce35c
EgressRule generated code 2017-09-05 12:48:55 -04:00
Kubernetes Submit Queue
52b50fa82a Merge pull request #51828 from kow3ns/workloads-deprecations-1.8
Automatic merge from submit-queue

Workloads deprecation 1.8

**What this PR does / why we need it**: This PR deprecates the Deployment, ReplicaSet, and DaemonSet kinds in the extensions/v1beta1 group version and the StatefulSet, Deployment, and ControllerRevision kinds in the apps/v1beta1 group version. The Deployment, ReplicaSet, DaemonSet, StatefuSet, and ControllerRevision kinds in the apps/v1beta2 group version are now the current version.

xref kubernetes/features#353

```release-note
The Deployment, DaemonSet, and ReplicaSet kinds in the extensions/v1beta1 group version are now deprecated, as are the Deployment, StatefulSet, and ControllerRevision kinds in apps/v1beta1. As they will not be removed until after a GA version becomes available, you may continue to use these kinds in existing code. However, all new code should be developed against the apps/v1beta2 group version.
```
2017-09-03 16:44:46 -07:00
Kubernetes Submit Queue
35ffb5c6cf Merge pull request #48921 from smarterclayton/paging_prototype
Automatic merge from submit-queue (batch tested with PRs 50832, 51119, 51636, 48921, 51712)

Alpha list paging implementation

Design in kubernetes/community#896

Support `?limit=NUMBER`, `?continue=CONTINUATIONTOKEN`, and a `continue` field
on ListMeta and pass through to etcd. Perform minor validation as an example.

```
# first out of three
$ curl http://127.0.0.1:8080/api/v1/namespaces?limit=1
{
  "kind": "NamespaceList",
  "apiVersion": "v1",
  "metadata": {
    "selfLink": "/api/v1/namespaces",
    "resourceVersion": "146",
    "next": "ZGVmYXVsdA"
  },
  "items": [
    {
      "metadata": {
        "name": "default",
        "selfLink": "/api/v1/namespaces/default",
        "uid": "f95e1390-6852-11e7-ab03-7831c1b76042",
        "resourceVersion": "4",
        "creationTimestamp": "2017-07-14T05:12:03Z"
      },
      "spec": {
        "finalizers": [
          "kubernetes"
        ]
      },
      "status": {
        "phase": "Active"
      }
    }
  ]
}
...
# last
$ curl "http://127.0.0.1:8080/api/v1/namespaces?limit=1&continue=a3ViZS1wdWJsaWM"
{
  "kind": "NamespaceList",
  "apiVersion": "v1",
  "metadata": {
    "selfLink": "/api/v1/namespaces",
    "resourceVersion": "145"
  },
  "items": [
    {
      "metadata": {
        "name": "kube-system",
        "selfLink": "/api/v1/namespaces/kube-system",
        "uid": "f95e9484-6852-11e7-ab03-7831c1b76042",
        "resourceVersion": "5",
        "creationTimestamp": "2017-07-14T05:12:03Z"
      },
      "spec": {
        "finalizers": [
          "kubernetes"
        ]
      },
      "status": {
        "phase": "Active"
      }
    }
  ]
}
```
2017-09-02 19:26:29 -07:00
Kubernetes Submit Queue
11a836078d Merge pull request #46444 from jsafrane/node-mount-propagation
Automatic merge from submit-queue (batch tested with PRs 45724, 48051, 46444, 51056, 51605)

Mount propagation in kubelet

Together with #45724 it implements mount propagation as proposed in https://github.com/kubernetes/community/pull/659

There is:

- New alpha annotation that allows user to explicitly set propagation mode for each `VolumeMount` in pod containers (to be replaced with real `VolumeMount.Propagation` field during beta) + validation + tests. "Private" is the default one (= no change to existing pods).

  I know about proposal for real API fields for alpha feature in https://docs.google.com/document/d/1wuoSqHkeT51mQQ7dIFhUKrdi3-1wbKrNWeIL4cKb9zU/edit, but it seems it's not implemented yet. It would save me quite lot of code and ugly annotation.

- Updated CRI API to transport chosen propagation to Docker.

- New `kubelet --experimental-mount-propagation` option to enable the previous bullet without modifying types.go (worked around with changing `KubeletDeps`... not nice, but it's better than adding a parameter to `NewMainKubelet` and removing it in the next release...)

```release-note
kubelet has alpha support for mount propagation. It is disabled by default and it is there for testing only. This feature may be redesigned or even removed in a future release.
```

@derekwaynecarr @dchen1107 @kubernetes/sig-node-pr-reviews
2017-09-02 12:11:07 -07:00