Commit Graph

5834 Commits

Author SHA1 Message Date
Marcin Wielgus
46b0dc64f5 Reduce CPU scheduler request to 75m 2017-06-22 17:57:57 +02:00
Kubernetes Submit Queue
59935317ef Merge pull request #47887 from dnardo/ip-masq-agent
Automatic merge from submit-queue (batch tested with PRs 42252, 42251, 42249, 47512, 47887)

Bump the memory request/limit for ip-masq-daemon.

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
issue #47865
**Special notes for your reviewer**:

**Release note**:

```release-note
```
2017-06-21 22:13:36 -07:00
Daniel Nardo
d0c252f673 Bump the memory request/limit for ip-masq-daemon. 2017-06-21 19:05:03 -07:00
Marcin Wielgus
6a591d9dc1 Bump Cluster Autoscaler to 0.6.0-beta1 2017-06-21 23:58:15 +02:00
Kubernetes Submit Queue
afa78083de Merge pull request #47794 from dnardo/ip-masq-agent
Automatic merge from submit-queue

Add ip-masq-agent readiness label by default.  

Since we are setting the non-masq-cidr in the kubelet to 0.0.0.0/0 we
need to ensure the ip-masq-agent runs.

pr/#46473 made the NON_MASQUERADE_CIDR default to 0.0.0.0/0 which means we need to have this label set now.



**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
fixes #47752
**Special notes for your reviewer**:

**Release note**:

```release-note
ip-masq-agent is now the default for GCE
```
2017-06-20 23:26:30 -07:00
Kubernetes Submit Queue
5ca33f51ac Merge pull request #47773 from caesarxuchao/fix-upgrade
Automatic merge from submit-queue

fix validate-cluster.sh

attempt to fix #47379.

Without this fix, the validate-cluster.sh never retries if `kubectl-retry get cs` fails.

cc @dchen1107
2017-06-20 20:02:09 -07:00
Kubernetes Submit Queue
26c431affa Merge pull request #47632 from mwielgus/node-taints-scripts
Automatic merge from submit-queue (batch tested with PRs 45268, 47573, 47632, 47818)

NODE_TAINTS in gce startup scripts

Currently there is now way to pass a list of taints that should be added on node registration (at least not in gce or other saltbased deployment). This PR adds necessary plumbing to pass the taints from user or instance group template to kubelet startup flags. 

```release-note
Taints support in gce/salt startup scripts. 
```

The PR was manually tested. 
```
NODE_TAINTS: 'dedicated=ml:NoSchedule'
```
in kube-env results in 
```
spec:
[...]
  taints:
  - effect: NoSchedule
    key: dedicated
    timeAdded: null
    value: ml
```

cc: @davidopp @gmarek @dchen1107 @MaciekPytel
2017-06-20 18:18:59 -07:00
Daniel Nardo
fc279e069e Add ip-masq-agent readiness label by default. Since we are
setting the non-masq-cidr in the kubelet to 0.0.0.0/0 we
need to ensure the ip-masq-agent runs.

Add node label pre-req back to ip-masq-agent.

Make gce test consistent with gce default scripts.
2017-06-20 16:19:50 -07:00
Chao Xu
986164e78d fix validate-cluster.sh 2017-06-20 10:20:38 -07:00
Mike Danese
e1cd519e34 Merge pull request #47779 from kubernetes/revert-47764-ip-masq-agent
Revert "Require a label to indicate ip-masq-agent readiness. "
2017-06-20 11:37:39 +01:00
Kubernetes Submit Queue
d746cbbb39 Merge pull request #47634 from mwielgus/expander-price
Automatic merge from submit-queue (batch tested with PRs 46604, 47634)

Set price expander in Cluster Autoscaler for GCE

With CA 0.6 we will make price-preferred node expander the default one for GCE. For other cloud providers we will stick to the default one (random) until the community implement the required interfaces in CA repo.

https://github.com/kubernetes/autoscaler/issues/82

cc: @MaciekPytel @aleksandra-malinowska
2017-06-20 03:15:57 -07:00
Mike Danese
a58ad9f470 Revert "Require a label to indicate ip-masq-agent readiness. " 2017-06-20 10:51:06 +01:00
Dawn Chen
d066dd79d9 Merge pull request #47764 from dnardo/ip-masq-agent
Require a label to indicate ip-masq-agent readiness.
2017-06-19 20:00:42 -07:00
Daniel Nardo
2aa1277261 Require a label to indicate ip-masq-agent readiness. This prevents
a daemonset running on nodes where the master is 1.7 and has this
enabled by default, however, the nodes are still < 1.7.
2017-06-19 17:41:17 -07:00
Marcin Wielgus
9143569891 NODE_TAINTS in gce startup scripts 2017-06-20 00:51:56 +02:00
Kubernetes Submit Queue
440a85e77f Merge pull request #47458 from caseydavenport/standardize-cni-bin-dir
Automatic merge from submit-queue (batch tested with PRs 47669, 40284, 47356, 47458, 47701)

Standardize on home/kubernetes/bin for CNI

**What this PR does / why we need it**:

Standardizes where CNI plugins get installed on GCE.

**Which issue this PR fixes** 

Fixes: https://github.com/kubernetes/kubernetes/issues/47453

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-06-19 15:25:04 -07:00
Kubernetes Submit Queue
1e76d9e1d5 Merge pull request #47356 from dashpole/master_critical_pods
Automatic merge from submit-queue (batch tested with PRs 47669, 40284, 47356, 47458, 47701)

Mark Static pods on the Master as critical

fixes #47277.

A known issue with static pods is that they do not interact well with evictions.  If a static pod is evicted or oom killed, then it will never be recreated.  To mitigate this, we do not evict static pods that are critical.  In addition, non-critical pods are candidates for preemption if a critical pod is scheduled to the node.  If there are not enough allocatable resources on the node, this causes the static pod to be preempted.

This PR marks all static pods in the kube-system namspace as critical.

cc @vishh @dchen1107
2017-06-19 15:25:01 -07:00
Kubernetes Submit Queue
c5f38f4478 Merge pull request #47669 from caseydavenport/fix-typha
Automatic merge from submit-queue

Set Typha replica count to 0 when Calico is not enabled

**What this PR does / why we need it**:
A replacement for https://github.com/kubernetes/kubernetes/pull/47624, which turned out not to be the right fix. 

**Which issue this PR fixes**
https://github.com/kubernetes/kubernetes/issues/47622

**Release note**:
```release-note
NONE
```
2017-06-19 15:06:02 -07:00
Marcin Wielgus
8d801d918d Set price expander in Cluster Autoscaler for gce 2017-06-19 23:52:47 +02:00
Casey Davenport
489b8c186f Standardize on home/kubernetes/bin for CNI 2017-06-19 11:33:13 -07:00
Kubernetes Submit Queue
cc645a8c6f Merge pull request #46327 from supereagle/mark-network-plugin-dir-deprecated
Automatic merge from submit-queue (batch tested with PRs 46327, 47166)

mark --network-plugin-dir deprecated for kubelet

**What this PR does / why we need it**:

**Which issue this PR fixes** : fixes #43967

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-06-19 11:23:54 -07:00
Casey Davenport
2ba0f1c211 Set Typha replica count to 0 when Calico is not enabled 2017-06-19 11:08:17 -07:00
Kubernetes Submit Queue
b6faf34862 Merge pull request #47530 from mindprince/issue-47388-remove-dead-code
Automatic merge from submit-queue (batch tested with PRs 47530, 47679)

Use cos-stable-59-9460-64-0 instead of cos-beta-59-9460-20-0.

Remove dead code that has now moved to another repo as part of #47467

**Release note**:
```release-note
NONE
```

/sig node
2017-06-16 20:57:58 -07:00
Kubernetes Submit Queue
354e6c2a80 Merge pull request #47683 from rmmh/echoserver
Automatic merge from submit-queue (batch tested with PRs 47626, 47674, 47683, 47290, 47688)

Use echoserver:1.6 for better debugging and XSS prevention.

**What this PR does / why we need it**: This updates our test code to use a newer echoserver with XSS preventions.

**Which issue this PR fixes**: fixes #47682

**Special notes for your reviewer**: Marking as 1.7 since it's a fix to test code.

**Release note**:
```release-note
NONE
```
2017-06-16 19:56:59 -07:00
Kubernetes Submit Queue
260fcafe95 Merge pull request #47674 from Cynerva/gkk/missing-idle-status
Automatic merge from submit-queue (batch tested with PRs 47626, 47674, 47683, 47290, 47688)

Fix Juju kubernetes-master idle status never being set

**What this PR does / why we need it**:

This fixes a problem with the kubernetes-master charm where the "Kubernetes master running." status message never gets set.

This happens because the `kube-api-endpoint.connected` state that it's waiting for doesn't exist. The state we need is `kube-api-endpoint.available` as seen [here](https://github.com/juju-solutions/interface-http/blob/master/provides.py#L12).

Additionally, we need to add the relation arguments to idle_status so it doesn't break when called.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47676

**Special notes for your reviewer**:

**Release note**:

```release-note
Fix Juju kubernetes-master idle status never being set
```
2017-06-16 19:56:57 -07:00
Kubernetes Submit Queue
d7e5a8b67e Merge pull request #47626 from Q-Lee/metadata-fix
Automatic merge from submit-queue (batch tested with PRs 47626, 47674, 47683, 47290, 47688)

The KUBE-METADATA-SERVER firewall must be applied before the universa…

…l tcp ACCEPT



**What this PR does / why we need it**: the metadata firewall rule was broken by being appended after the universal tcp accept.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```
2017-06-16 19:56:55 -07:00
Kubernetes Submit Queue
b00b6b97b7 Merge pull request #47606 from cheftako/requestCAFile
Automatic merge from submit-queue (batch tested with PRs 38751, 44282, 46382, 47603, 47606)

Working on fixing #43716.

This will create the necessary certificates.
On GCE is will upload those certificates to Metadata.
They are then pulled down on to the kube-apiserver.
They are written to the /etc/src/kubernetes/pki directory.
Finally they are loaded vi the appropriate command line flags.
The requestheader-client-ca-file can be seen by running the following:-
kubectl get ConfigMap extension-apiserver-authentication
--namespace=kube-system -o yaml
Minor bug fixes.
Made sure AGGR_MASTER_NAME is set up in all configs.
Clean up variable names.
Added additional requestheader configuration parameters.
Added check so that if there is no Aggregator CA contents we won't start
the aggregator with the relevant flags.

**What this PR does / why we need it**:
This PR creates a request header CA. It also creates a proxy client cert/key pair.
It causes these files to end up on kube-apiserver and set the CLI flags so they are properly loaded.
Without it the customer either has to set them up themselves or re-use the master CA which is a security vulnerability.
Currently this creates everything on GCE.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #43716

**Special notes for your reviewer**:
This is a reapply of pull/47094 with the GKE issue resolved.

**Release note**: None
2017-06-16 18:05:55 -07:00
Ryan Hitchman
783e400d99 Use echoserver:1.6 for better debugging and XSS prevention. 2017-06-16 15:47:15 -07:00
Rohit Agarwal
3a86c97cf6 Use cos-stable-59-9460-64-0 instead of cos-beta-59-9460-20-0.
- It contains a fix for ipaliasing.
- It contains a fix which decouples GPU driver installation from kernel
version.

Remove dead code that has now moved to another repo as part of #47467
2017-06-16 13:48:50 -07:00
George Kraft
02d0830594 Fix Juju kubernetes-master idle_status never being called 2017-06-16 14:48:31 -05:00
Quintin Lee
b886897f9d Prepend the metadata firewall in gce, so it isn't superceded. 2017-06-16 10:08:48 -07:00
Jacob Simpson
334de1cbe1 Auto approve kubelet certificate signing requests. 2017-06-16 08:47:12 -07:00
Kubernetes Submit Queue
6742fda0bb Merge pull request #47624 from caseydavenport/fix-typha
Automatic merge from submit-queue

Don't start any Typha instances if not using Calico

**What this PR does / why we need it**:

Don't start any Typha instances if Calico isn't being used.  A recent change now includes all add-ons on the master, but we don't always want a Typha replica.

**Which issue this PR fixes**

Fixes https://github.com/kubernetes/kubernetes/issues/47622

**Release note**:
```release-note
NONE
```


cc @dnardo
2017-06-15 22:58:31 -07:00
Kubernetes Submit Queue
c8dc08ea87 Merge pull request #47562 from verult/VolumeDirFlag
Automatic merge from submit-queue (batch tested with PRs 47562, 47605)

Adding option in node start script to add "volume-plugin-dir" flag to kubelet.

**What this PR does / why we need it**: Adds a variable to allow specifying FlexVolume driver directory through cluster/kube-up.sh. Without this, the process of setting up FlexVolume in a non-default directory is very manual.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47561
2017-06-15 21:54:28 -07:00
Kubernetes Submit Queue
8e1cf60a48 Merge pull request #47481 from sakshamsharma/encprovenv
Automatic merge from submit-queue

Add encryption provider support via environment variables

These changes are needed to allow cloud providers to use the encryption providers as an alpha feature. The version checks can be done in the respective cloud providers'.

Context: #46460 and #46916

@destijl @jcbsmpsn @smarterclayton
2017-06-15 20:39:57 -07:00
Casey Davenport
199ecdbbdd Don't start any Typha instances if not using Calico 2017-06-15 17:20:32 -07:00
Kubernetes Submit Queue
dbc5d91bf0 Merge pull request #47567 from nicksardo/gclb-bump-0.9.5
Automatic merge from submit-queue

[GCE] Bump GLBC version to 0.9.5

Fixes #47559 
```release-note
Bump GLBC version to 0.9.5 - fixes [loss of manually modified GCLB health check settings](https://github.com/kubernetes/kubernetes/issues/47559) upon upgrade from pre-1.6.4 to either 1.6.4 or 1.6.5, or from pre-1.5.8 to 1.5.8.
```
2017-06-15 16:52:10 -07:00
Jeff Grafton
641f8c1f29 Revert "Update fluentd-gcp to 2.0.6"
This reverts commit 0bcc271b28.
2017-06-15 11:46:17 -07:00
Walter Fender
e06795533f Working on fixing #43716.
This will create the necessary certificates.
On GCE is will upload those certificates to Metadata.
They are then pulled down on to the kube-apiserver.
They are written to the /etc/src/kubernetes/pki directory.
Finally they are loaded vi the appropriate command line flags.
The requestheader-client-ca-file can be seen by running the following:-
kubectl get ConfigMap extension-apiserver-authentication
--namespace=kube-system -o yaml
Minor bug fixes.
Made sure AGGR_MASTER_NAME is set up in all configs.
Clean up variable names.
Added additional requestheader configuration parameters.
Added check so that if there is no Aggregator CA contents we won't start
the aggregator with the relevant flags.
2017-06-15 10:48:34 -07:00
Kubernetes Submit Queue
79eb0abce8 Merge pull request #47545 from ixdy/update-1.7-images
Automatic merge from submit-queue (batch tested with PRs 47492, 47542, 46800, 47545, 45764)

Update addons with upstream CVE fixes

**What this PR does / why we need it**: refreshes the cluster-proportional-autoscaler, metadata-proxy, and fluentd-gcp addons with new base images with fixes for the following vulnerabilities:
* CVE-2016-4448
* CVE-2016-8859
* CVE-2016-9841
* CVE-2016-9843
* CVE-2017-9526

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: x-ref #47386, though there are still a few images left to update

**Release note**:

```release-note
Update cluster-proportional-autoscaler, metadata-proxy, and fluentd-gcp addons with fixes for CVE-2016-4448, CVE-2016-8859, CVE-2016-9841, CVE-2016-9843, and CVE-2017-9526.
```

/cc @timstclair @MrHohn @Q-Lee @crassirostris
2017-06-14 21:43:46 -07:00
Kubernetes Submit Queue
b2d844bd77 Merge pull request #47492 from bowei/fix-gci-gcloud
Automatic merge from submit-queue

Fix dangling reference to gcloud alpha API for GCI (should be beta)

This reference to the alpha API was missed (fixed in GCE, but not GCI)

Fixes #47494

```release-note
none
```
2017-06-14 21:39:21 -07:00
Kubernetes Submit Queue
454233512d Merge pull request #47482 from timstclair/audit-policy
Automatic merge from submit-queue (batch tested with PRs 47510, 47516, 47482, 47521, 47537)

Fix typos in audit policy config

For kubernetes/features#22
2017-06-14 20:32:47 -07:00
Kubernetes Submit Queue
fa23890bd9 Merge pull request #47510 from mwielgus/allow-zero-size-migs
Automatic merge from submit-queue (batch tested with PRs 47510, 47516, 47482, 47521, 47537)

Allow autoscaler min at 0 in GCE

Allow scaling migs to zero in GCE startup scripts. This only makes sense when there is more than 1 mig. The main use case (for now) will be to test scaling to to zero in e2e tests.
2017-06-14 20:32:43 -07:00
Nick Sardo
244df6ad6e Bump GLBC version to 0.9.5 2017-06-14 18:45:50 -07:00
Saksham Sharma
a50114ac02 Add encryption provider support via env variables 2017-06-14 18:40:36 -07:00
Cheng Xing
6eecd3fb59 Adding option in node start script to add "volume-plugin-dir" flag to kubelet. 2017-06-14 17:56:06 -07:00
Dawn Chen
d6e1e21230 Revert "Set up proxy certs for Aggregator." 2017-06-14 13:44:34 -07:00
Jeff Grafton
0bcc271b28 Update fluentd-gcp to 2.0.6 2017-06-14 13:32:03 -07:00
Jeff Grafton
702617815d Update metadata-proxy to 0.1.1 2017-06-14 13:31:47 -07:00
Jeff Grafton
d5bd3c488a Update cluster-proportional-autoscaler-amd64 to 1.1.2-r2 2017-06-14 12:42:23 -07:00