Commit Graph

54 Commits

Author SHA1 Message Date
Paulo Gomes
b451563560
Add seccomp least privilege for kuberuntime 2020-07-08 22:03:29 +01:00
Paulo Gomes
8976e3620f
Add seccomp enforcement and validation based on new GA fields
Adds seccomp validation.

This ensures that field and annotation values must match when present.

Co-authored-by: Sascha Grunert <sgrunert@suse.com>
2020-07-06 09:13:25 +01:00
Javier Diaz-Montes
9743cda4a7 Adding Kubelet changes to enable SetHostnameAsFQDN feature
These changes allow to set FQDN as hostname of pods for pods
that set the new PodSpec field setHostnameAsFQDN to true. The PodSpec
new field was added in related PR.

This is PART2 (last) of the changes to enable KEP #1797 and addresses #91036
2020-06-14 21:26:27 -04:00
Davanum Srinivas
442a69c3bd
switch over k/k to use klog v2
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2020-05-16 07:54:27 -04:00
Khaled Henidak(Kal)
dba434c4ba kubenet for ipv6 dualstack 2019-07-02 22:26:25 +00:00
Davanum Srinivas
33081c1f07
New staging repository for cri-api
Change-Id: I2160b0b0ec4b9870a2d4452b428e395bbe12afbb
2019-03-26 18:21:04 -04:00
Lantao Liu
0ac651bfc3 Include pod logs in the pod ephemeral storage.
Signed-off-by: Lantao Liu <lantaol@google.com>
2019-03-08 16:42:14 -08:00
Lantao Liu
f14c6c95d6 New pod log directory /var/log/pods/NAMESPACE_NAME_UID.
Signed-off-by: Lantao Liu <lantaol@google.com>
2019-03-08 16:42:14 -08:00
Tim Allclair
e27f7ef151 Surface selected pod RuntimeHandler in Kubelet logs 2018-12-17 16:36:47 -08:00
Davanum Srinivas
954996e231
Move from glog to klog
- Move from the old github.com/golang/glog to k8s.io/klog
- klog as explicit InitFlags() so we add them as necessary
- we update the other repositories that we vendor that made a similar
change from glog to klog
  * github.com/kubernetes/repo-infra
  * k8s.io/gengo/
  * k8s.io/kube-openapi/
  * github.com/google/cadvisor
- Entirely remove all references to glog
- Fix some tests by explicit InitFlags in their init() methods

Change-Id: I92db545ff36fcec83afe98f550c9e630098b3135
2018-11-10 07:50:31 -05:00
Yu-Ju Hong
a1f7ae7ab3 kubelet: skip initializing/using the RuntimeClass in standalone mode
In standalone mode, kubelet will not be configured to talk to an
apiserver. The RuntimeClass manager should be disabled in this case.
2018-09-11 13:21:53 -07:00
Tim Allclair
63f3bc1b7e
Implement RuntimeClass support for the Kubelet & CRI 2018-09-04 13:45:11 -07:00
Lantao Liu
3193a4a469 Fix RunAsGroup. 2018-07-06 15:42:26 -07:00
Seth Jennings
6729add11c sysctls: create feature gate to track promotion 2018-06-06 00:23:11 +02:00
Jan Chaloupka
ab616a88b9 Promote sysctl annotations to API fields 2018-06-05 23:17:00 +02:00
Lee Verberne
e10042d22f Increment CRI version from v1alpha1 to v1alpha2
This also incorporates the version string into the package name so
that incompatibile versions will fail to connect.

Arbitrary choices:
- The proto3 package name is runtime.v1alpha2. The proto compiler
  normally translates this to a go package of "runtime_v1alpha2", but
  I renamed it to "v1alpha2" for consistency with existing packages.
- kubelet/apis/cri is used as "internalapi". I left it alone and put the
  public "runtimeapi" in kubelet/apis/cri/runtime.
2018-02-07 09:06:26 +01:00
Lee Verberne
0f1de41790 Update kubelet for enumerated CRI namespaces
This adds support to both the Generic Runtime Manager and the
dockershim for the CRI's enumerated namespaces.
2018-02-07 09:06:26 +01:00
Zihong Zheng
386d1b61bd Consolidate DNS codes in kubelet pkg 2017-11-16 21:07:24 -08:00
Shawn Hsiao
5cba1f47c3 Support copying options in resolv.conf into pod sandbox when dnsPolicy is Default 2017-11-07 07:54:52 -05:00
Pengfei Ni
f3150c9c8c Support seccomp profile from container's security context 2017-08-13 15:42:15 +08:00
Chao Xu
60604f8818 run hack/update-all 2017-06-22 11:31:03 -07:00
Chao Xu
f4989a45a5 run root-rewrite-v1-..., compile 2017-06-22 10:25:57 -07:00
Pengfei Ni
22e99504d7 Update CRI references 2017-06-09 10:16:40 +08:00
Pengfei Ni
8bc6e59278 kuberuntime: set sysctls for sandbox config 2017-05-15 12:52:38 +08:00
Michael Taufen
cbad320205 Reorganize kubelet tree so apis can be independently versioned 2017-05-12 10:02:33 -07:00
Jamie Hannaford
9440a68744 Use dedicated Unix User and Group ID types 2017-05-05 14:07:38 +02:00
Pengfei Ni
079158fa08 CRI: add support for dns cluster first policy
PR #29378 introduces ClusterFirstWithHostNet policy but only dockertools
was updated to support the feature. This PR updates kuberuntime to
support it for all runtimes.

Also fixes #43352.
2017-03-20 17:50:38 +08:00
Seth Jennings
ccd87fca3f kubelet: add cgroup manager metrics 2017-03-06 08:53:47 -06:00
vefimova
fc8a37ec86 Added ability for Docker containers to set usage of dns settings along with hostNetwork is true
Introduced chages:
   1. Re-writing of the resolv.conf file generated by docker.
      Cluster dns settings aren't passed anymore to docker api in all cases, not only for pods with host network:
      the resolver conf will be overwritten after infra-container creation to override docker's behaviour.

   2. Added new one dnsPolicy - 'ClusterFirstWithHostNet', so now there are:
      - ClusterFirstWithHostNet - use dns settings in all cases, i.e. with hostNet=true as well
      - ClusterFirst - use dns settings unless hostNetwork is true
      - Default

Fixes #17406
2017-03-01 17:10:00 +00:00
Random-Liu
8380148d48 Remove extra operations when generating pod sandbox configuration. 2017-02-24 15:06:03 -08:00
Yu-Ju Hong
77286c38d3 kubelet: reduce extraneous logging for pods using host network
For pods using the host network, kubelet/shim should not log
error/warning messages when determining the pod IP address.
2017-02-14 16:09:42 -08:00
Michael Fraenkel
93c11422e4 CRI Portforward needs to forward websocket ports
- adjust ports to int32
- CRI flows the websocket ports as query params

- Do not validate ports since the protocol is unknown
  SPDY flows the ports as headers and websockets uses query params
- Only flow query params if there is at least one port query param
2017-02-01 18:03:42 -07:00
Yu-Ju Hong
c436671cca kuberuntime: remove the kubernetesManagedLabel label
The CRI shim should be responsible for returning only those
containers/sandboxes created through CRI. Remove this label in kubelet.
2017-01-27 17:08:46 -08:00
Pengfei Ni
53c20e3630 kubelet/kuberuntime: update cri to protobuf v3 2017-01-20 09:55:56 +08:00
deads2k
6a4d5cd7cc start the apimachinery repo 2017-01-11 09:09:48 -05:00
Euan Kemp
bcd939cb08 kuberuntime: set privileged for sandboxes 2016-12-08 13:11:16 -08:00
Pengfei Ni
f584ed4398 Fix package aliases to follow golang convention 2016-11-30 15:40:50 +08:00
Chao Xu
bcc783c594 run hack/update-all.sh 2016-11-23 15:53:09 -08:00
Chao Xu
5e1adf91df cmd/kubelet 2016-11-23 15:53:09 -08:00
Random-Liu
2ce5deb6fd Add separate username field in CRI and use it. 2016-11-15 16:50:02 -08:00
Random-Liu
99ee3f4b76 Add non-numeric user name support. 2016-11-08 16:07:29 -08:00
Pengfei Ni
f8e5f81fed cleanup TODOs in dockershim 2016-11-07 11:41:06 +08:00
Pengfei Ni
3df60eb163 Implement security context in kuberuntime 2016-11-07 11:07:56 +08:00
Tim St. Clair
86d849e374
Separate Direct and Indirect streaming paths, implement indirect path with CRI 2016-11-03 13:26:33 -07:00
Yu-Ju Hong
8a6285d844 CRI: Rename container/sandbox states
The enum constants are not namespaced. The shorter, unspecifc names are likely
to cause naming conflicts in the future.

Also replace "SandBox" with "Sandbox" in the API.
2016-11-01 13:18:21 -07:00
bprashanth
7c2aeecdd2 SetUp/TearDown II: remove code from kuberuntime 2016-10-31 13:05:19 -07:00
Random-Liu
121a91eb12 Symlink docker logs to CRI defined log path. 2016-10-23 19:08:47 -07:00
Yifan Gu
be4e825ac3 CRI: Remove the mount name and port name.
Per discussion on https://github.com/kubernetes/kubernetes/issues/33873.

Currently the mount name is not being used and also involves some
incorrect usage (sometimes it's referencing a mount name, sometimes
it's referecing a volume name), so we decide to remove it from CRI.

The port name is also not used, so remove it as well.
2016-10-04 13:10:59 -07:00
Yifan Gu
44ca3ea5e0 CRI: Add dns option, rename DNSOption to DNSConfig. 2016-09-29 13:46:32 -07:00
Pengfei Ni
d65309399a Kubelet: add SyncPod for new runtime API 2016-09-15 23:32:36 +08:00