Commit Graph

2417 Commits

Author SHA1 Message Date
Kubernetes Prow Robot
96c057ab48
Merge pull request #92001 from huffmanca/include-csidriver-fsgroup
Include CSIDriver capability to indicate fsGroup support
2020-07-16 09:11:42 -07:00
Kubernetes Prow Robot
c23a4b08d7
Merge pull request #92874 from chelseychen/event-api
Fix a few places where source field is empty when creating events via events/v1
2020-07-11 20:57:31 -07:00
Christian Huffman
58bd3e5230 Include CSIDriver SupportsFsGroup 2020-07-11 23:29:24 -04:00
Sascha Grunert
96fb83c4c1
Implement PodSecurityPolicy enforcement for seccomp GA
This implements the necessary pieced for the PodSecurityPolicy
enforcement like described in the appropriate KEP section:

https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/20190717-seccomp-ga.md#podsecuritypolicy-enforcement

Signed-off-by: Sascha Grunert <sgrunert@suse.com>
2020-07-10 15:55:21 +02:00
Kubernetes Prow Robot
26f0227019
Merge pull request #91408 from saschagrunert/seccomp-api-migration
Add seccomp GA version skew for pods
2020-07-10 04:29:48 -07:00
Kubernetes Prow Robot
dd649bb7ef
Merge pull request #91342 from mgugino-upstream-stage/evict-deleted-ok
Eviction: ignore PDBs if pods with DeletionTimestamp
2020-07-09 15:30:33 -07:00
Kubernetes Prow Robot
94a08e159a
Merge pull request #92387 from pohly/csi-storage-capacity
CSI storage capacity check
2020-07-09 00:04:59 -07:00
Chelsey Chen
e010436e2a Update conversion between ReportingController and Source.Component 2020-07-08 08:46:38 -04:00
Sascha Grunert
c3ba2d8b8b
Add seccomp GA version skew for pods
This adds a new conversion function to the pod strategy to handle the
seccomp version skew strategy:

https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/20190717-seccomp-ga.mdversion-skew-strategy

Signed-off-by: Sascha Grunert <sgrunert@suse.com>
2020-07-06 16:06:24 +02:00
Paulo Gomes
8976e3620f
Add seccomp enforcement and validation based on new GA fields
Adds seccomp validation.

This ensures that field and annotation values must match when present.

Co-authored-by: Sascha Grunert <sgrunert@suse.com>
2020-07-06 09:13:25 +01:00
Patrick Ohly
9a66e8e1b5 CSIStorageCapacity: 'make update' 2020-07-03 21:54:14 +02:00
Patrick Ohly
1089954fa6 CSIStorageCapacity: CSIDriver.Spec.StorageCapacity field
This is needed to inform the Kubernetes pod scheduler whether it has
to check CSIStorageCapacity objects for available capacity.
2020-07-03 21:54:14 +02:00
Patrick Ohly
22aeb81e84 CSIStorageCapacity: CSIStorageCapacity API
This adds the CSIStorageCapacity API change for
https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/1472-storage-capacity-tracking
2020-07-03 21:54:14 +02:00
Kubernetes Prow Robot
1b871091b9
Merge pull request #91645 from chelseychen/event-api
Promote new Event API to v1
2020-07-02 04:16:46 -07:00
Kubernetes Prow Robot
94e1c54735
Merge pull request #92655 from BenTheElder/cleanup-some-owners
Cleanup some owners
2020-07-01 23:14:08 -07:00
Chelsey Chen
c90330d8f4 Auto generated changes 2020-07-01 10:50:34 -04:00
Chelsey Chen
75612c1746 Promote new Event API to v1 2020-07-01 10:50:28 -04:00
Benjamin Elder
2abc8afece eparis to emeritus 2020-06-30 09:50:44 -07:00
Benjamin Elder
960ef085e9 zmerlynn to emeritus 2020-06-30 09:43:59 -07:00
Kubernetes Prow Robot
2e12311d2e
Merge pull request #91606 from danwinship/service-ipallocator-cleanups
Service IPAllocator cleanups
2020-06-30 00:02:27 -07:00
Mark Janssen
e3a0ca2731 Fix staticcheck failures for pkg/registry/...
Errors from staticcheck:
pkg/registry/autoscaling/horizontalpodautoscaler/storage/storage_test.go:207:7: this value of err is never used (SA4006)
pkg/registry/core/namespace/storage/storage.go:256:5: options.OrphanDependents is deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both. +optional  (SA1019)
pkg/registry/core/namespace/storage/storage.go:257:11: options.OrphanDependents is deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both. +optional  (SA1019)
pkg/registry/core/namespace/storage/storage.go:266:5: options.OrphanDependents is deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both. +optional  (SA1019)
pkg/registry/core/namespace/storage/storage.go:267:11: options.OrphanDependents is deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both. +optional  (SA1019)
pkg/registry/core/persistentvolumeclaim/storage/storage_test.go:165:2: this value of err is never used (SA4006)
pkg/registry/core/resourcequota/storage/storage_test.go:202:7: this value of err is never used (SA4006)
pkg/registry/core/service/ipallocator/allocator_test.go:338:2: this value of other is never used (SA4006)
pkg/registry/core/service/portallocator/allocator_test.go:199:2: this value of other is never used (SA4006)
pkg/registry/core/service/storage/rest_test.go:1843:2: this value of location is never used (SA4006)
pkg/registry/core/service/storage/rest_test.go:1849:2: this value of location is never used (SA4006)
pkg/registry/core/service/storage/rest_test.go:3174:20: use net.IP.Equal to compare net.IPs, not bytes.Equal (SA1021)
pkg/registry/core/service/storage/rest_test.go:3178:20: use net.IP.Equal to compare net.IPs, not bytes.Equal (SA1021)
pkg/registry/core/service/storage/rest_test.go:3185:20: use net.IP.Equal to compare net.IPs, not bytes.Equal (SA1021)
pkg/registry/core/service/storage/rest_test.go:3189:20: use net.IP.Equal to compare net.IPs, not bytes.Equal (SA1021)
2020-06-21 17:23:42 +02:00
Kubernetes Prow Robot
342bcf55e8
Merge pull request #89937 from aojea/portAllocator2
portAllocator sync local data before allocate
2020-06-18 19:03:10 -07:00
Kubernetes Prow Robot
53f3699cf9
Merge pull request #89778 from cmluciano/cml/ingressv1
ingress: Add Ingress to v1 API and update backend to defaultBackend
2020-06-16 23:10:39 -07:00
Kubernetes Prow Robot
fbc78f53b7
Merge pull request #91590 from knight42/fix/repair-node-port
fix(service::repair): accept same nodePort with different protocols
2020-06-15 18:14:10 -07:00
knight42
136849728c
address comments 2020-06-13 09:30:20 +08:00
Kubernetes Prow Robot
9ccf6f7de7
Merge pull request #91818 from wojtek-t/remove_cachesize
Remove heuristic watchcache sizes
2020-06-10 22:43:24 -07:00
knight42
e0d125b046
fix(service::repair): accept same nodePort with different protocols
Signed-off-by: knight42 <anonymousknight96@gmail.com>
2020-06-10 23:35:07 +08:00
Kubernetes Prow Robot
d01cc01ab4
Merge pull request #91400 from danwinship/ipfamily-validation
service: fix IPFamily validation and defaulting problems
2020-06-08 17:55:18 -07:00
Kubernetes Prow Robot
04dec17d5b
Merge pull request #90342 from liggitt/scale-patch
patch scale subresources inside guaranteedupdate loop
2020-06-08 15:11:19 -07:00
wojtekt
5ceb53987b Remove heuristic watchcache sizes 2020-06-08 13:32:52 +02:00
Kubernetes Prow Robot
3f8bb1bf50
Merge pull request #91685 from liggitt/csr-v1
CertificateSigningRequest v1 API
2020-06-05 15:30:14 -07:00
Jordan Liggitt
a504445086 Generated files
Change-Id: I598d686849f4b97846757b227f5191bac031798b
2020-06-05 04:58:14 +00:00
Jordan Liggitt
e0f5cca410 Copy CSR v1beta1 to v1
* Remove prerelease tags
* Update copyright, package, imports to v1
* Remove signerName, usages, and condition status defaulting
2020-06-05 00:47:24 -04:00
Kubernetes Prow Robot
e422e9a3f4
Merge pull request #91595 from jpbetz/get-list-storage-options
Introduce GetOptions and ListOptions to storage interface
2020-06-03 12:18:11 -07:00
Joe Betz
4c99949ae6 Add GetOptions and ListOptions to storage interface 2020-06-03 10:21:38 -07:00
Kubernetes Prow Robot
84861d2102
Merge pull request #91558 from liggitt/csr-e2e
Add e2e coverage for the CertificateSigningRequest API, enable patch support for approval subresource
2020-06-02 06:28:15 -07:00
Kubernetes Prow Robot
5fb9e35e57
Merge pull request #90191 from liggitt/csr-status
CSR condition status, lastTransitionTime, versioned validation
2020-06-01 23:34:15 -07:00
Michael Gugino
dd49915c55 Eviction: ignore PDBs if pods with DeletionTimestamp
When using the eviction API, if a pod already has
a non-zero DeletionTimestamp, we don't need to check
PDBs as it has already been marked for deletion.
2020-06-02 01:06:45 -04:00
Dan Winship
f6dcc1c07e Minor tweak to IPv6 service IP allocation
The service allocator skips the "broadcast address" in the service
CIDR, but that concept only applies to IPv4 addressing.
2020-06-01 08:16:18 -04:00
Dan Winship
4a7c86c105 make test a bit more generic 2020-06-01 08:13:27 -04:00
Dan Winship
ddebbfd806 update for APIs being moved to utilnet
Several of the functions in pkg/registry/core/service/ipallocator were
moved to k8s.io/utils/net, but then the original code was never
updated to used to the vendored versions.

(utilnet's version of RangeSize does not have the IPv6 special case
that the original code did, so we need to move that to
NewAllocatorCIDRRange now.)
2020-05-30 17:40:02 -04:00
Kubernetes Prow Robot
d1586ea3f9
Merge pull request #91502 from deads2k/dyn-audit-removal-00
remove --feature-gates=DynamicAuditing
2020-05-29 11:56:20 -07:00
Kubernetes Prow Robot
825eb77c88
Merge pull request #83906 from mgugino-upstream-stage/pdb-exclude-pending
Allow deletion of pending pods when using PDBS
2020-05-29 11:55:34 -07:00
Jordan Liggitt
e11404ac1f Add patch support for certificatesigningrequests/approval 2020-05-29 11:50:44 -04:00
Jordan Liggitt
7049149181 Generated files 2020-05-28 16:53:23 -04:00
Michael Gugino
047b0cee71 Quit retrying early with user supplied resourceVersion
This commit also updates tests and comments.
2020-05-28 16:14:45 -04:00
Jordan Liggitt
aed0621f2e Plumb version info to validation, separate main/status/approval validation 2020-05-28 12:20:40 -04:00
David Eads
e857adbdfd remove-api 2020-05-27 16:58:05 -04:00
Kubernetes Prow Robot
0e37bcce2c
Merge pull request #88385 from tallclair/node-reviews
Remove tallclair from some OWNERS files
2020-05-24 20:23:11 -07:00
Clayton Coleman
c6b833ac3c service: fix IPFamily validation and defaulting problems
If the dual-stack flag is enabled and the cluster is single stack IPv6,
the allocator logic for service clusterIP does not properly handle rejecting
a request for an IPv4 family. Return a 422 Invalid on the ipFamily field
when the dual stack flag is on (as it would when it hits beta) and the
cluster is configured for single-stack IPv6.

The family is now defaulted or cleared in BeforeCreate/BeforeUpdate,
and is either inherited from the previous object (if nil or unchanged),
or set to the default strategy's family as necessary. The existing
family defaulting when cluster ip is provided remains in the api
section. We add additonal family defaulting at the time we allocate
the IP to ensure that IPFamily is a consequence of the ClusterIP
and prevent accidental reversion. This defaulting also ensures that
old clients that submit a nil IPFamily for non ClusterIP services
receive a default.

To properly handle validation, make the strategy and the validation code
path condition on which configuration options are passed to service
storage. Move validation and preparation logic inside the strategy where
it belongs. Service validation is now dependent on the configuration of
the server, and as such ValidateConditionService needs to know what the
allowed families are.
2020-05-23 11:08:19 -04:00