Commit Graph

4566 Commits

Author SHA1 Message Date
Kubernetes Prow Robot
c726b2b3a3
Merge pull request #123431 from aramase/aramase/f/kep_3331_multiple_jwt_authenticator
Support multiple JWT authenticators with structured authn config
2024-03-06 17:37:29 -08:00
Kubernetes Prow Robot
05cb0a55c8
Merge pull request #123696 from aramase/aramase/f/kep_3331_v1beta1_api
Duplicate v1alpha1 AuthenticationConfiguration to v1beta1
2024-03-06 15:35:28 -08:00
Anish Ramasekar
39e1c9108c
Support multiple JWT authenticators with structured authn config
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2024-03-06 14:42:32 -08:00
Kubernetes Prow Robot
2b521e5f8e
Merge pull request #123405 from cici37/vapGA
[KEP-3488]Promote ValidatingAdmissionPolicy to GA
2024-03-05 18:29:53 -08:00
Kubernetes Prow Robot
5b4d97dc5a
Merge pull request #122541 from aojea/headless_selector
Implement a field selector for ClusterIP on Services
2024-03-05 17:30:57 -08:00
cici37
de506ce7ac Promote ValidatingAdmissionPolicy to GA. 2024-03-05 16:00:21 -08:00
Antonio Ojea
0595ec7942 implement field selector for clusterIP on services
This will allow components that don't need to watch headless services
(heavily used on ai/ml workloads) to filter them server side.

Specially useful for kubelet and kube-proxy

Co-authored-by: Jianbo Ma <sakuranlbj@gmail.com>

Change-Id: I6434d2c8c77aaf725ec5c07acbcda14311f24bfa

Change-Id: Iba9e25afb90712facfb3dee25c500bbe08ef38fc
2024-03-05 17:16:42 +00:00
Anish Ramasekar
b502aa6f31
Duplicate v1alpha1 AuthenticationConfiguration to v1beta1
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2024-03-05 09:10:34 -08:00
Kubernetes Prow Robot
50f4b1ea47
Merge pull request #123568 from enj/enj/i/jwt_username_required
jwt: fail on empty username via CEL expression
2024-03-04 20:07:33 -08:00
Kubernetes Prow Robot
439f7df65b
Merge pull request #122320 from armstrongli/master
allow service NodePort to be updated to 0 in case AllocateLoadBalance…
2024-03-04 18:38:05 -08:00
Kubernetes Prow Robot
6929a11f69
Merge pull request #123481 from sanposhiho/mindomain-stable
graduate MinDomainsInPodTopologySpread to stable
2024-03-04 17:18:53 -08:00
Kubernetes Prow Robot
f745503112
Merge pull request #123413 from seans3/tunneling-spdy-websockets
PortForward: Tunnel SPDY through WebSockets
2024-03-04 17:18:44 -08:00
Kubernetes Prow Robot
46a2137c1b
Merge pull request #123639 from liggitt/authz-metrics
Add authorization webhook duration/count/failopen metrics
2024-03-04 14:09:30 -08:00
Sean Sullivan
8b447d8c97 portforward: tunnel spdy through websockets 2024-03-04 11:10:30 -08:00
Jordan Liggitt
79b344d85e
Add authorization webhook duration/count/failopen metrics 2024-03-04 14:01:15 -05:00
Monis Khan
8345ad0bac
jwt: fail on empty username via CEL expression
Signed-off-by: Monis Khan <mok@microsoft.com>
2024-03-04 12:51:19 -05:00
Kubernetes Prow Robot
55d1518126
Merge pull request #123588 from pohly/scheduler-perf-any-cleanup
scheduler_perf: automatically delete created objects
2024-03-04 04:49:12 -08:00
Patrick Ohly
eb6abf0462 scheduler_perf: automatically delete created objects
This is not relevant for namespaced objects, but matters for the cluster-scoped
ResourceClass during unit testing. This works right now because there is only
one such unit test, but will fail when adding a second one.

Instead of passing a boolean flag down into all functions where it might be
needed, it's now a context value.
2024-03-04 09:54:38 +01:00
Kubernetes Prow Robot
e4a14fe0f5
Merge pull request #123575 from Huang-Wei/pod-scheduling-readiness-stable
Graduate PodSchedulingReadiness to stable
2024-03-03 22:29:38 -08:00
Anish Ramasekar
78fb0bae22
wire up discovery url in authenticator
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2024-03-03 17:34:51 -08:00
Jordan Liggitt
0605a75c5e
Duplicate v1alpha1 AuthorizationConfiguration to v1beta1 2024-03-02 02:00:31 -05:00
Kubernetes Prow Robot
8845c4c657
Merge pull request #123135 from munnerz/4193-beta-promotion
KEP-4193: promote ServiceAccountTokenJTI, ServiceAccountTokenPodNodeInfo and ServiceAccountTokenNodeBindingValidation to beta
2024-03-01 19:48:18 -08:00
Kubernetes Prow Robot
3e1da21801
Merge pull request #123611 from ritazh/authz-mcmetrics
Add authz webhook matchcondition metrics
2024-03-01 18:49:17 -08:00
Rita Zhang
e76fce7566
add authz webhook matchcondition metrics
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>
Signed-off-by: Jordan Liggitt <liggitt@google.com>
Co-authored-by: Jordan Liggitt <liggitt@google.com>
2024-03-01 14:41:27 -08:00
Jefftree
462dd326c2 Use v2 types with agg discovery 2024-03-01 13:15:22 -05:00
Kubernetes Prow Robot
df366107d1
Merge pull request #123529 from thockin/go-workspaces
Go workspaces for k/k and k/staging/*
2024-03-01 08:43:03 -08:00
Kubernetes Prow Robot
ed1cc43cf7
Merge pull request #123399 from pohly/test-context-use-cancellation
test: use cancellation from ktesting
2024-03-01 01:03:23 -08:00
Kubernetes Prow Robot
6cc77a577e
Merge pull request #123560 from ivelichkovich/master
kep-3716 GA, remove feature gate
2024-02-29 22:53:38 -08:00
Patrick Ohly
1d653e6185 test: use cancelation from ktesting
The return type of ktesting.NewTestContext is now a TContext. Code
which combined it WithCancel often didn't compile anymore (cannot overwrite
ktesting.TContext with context.Context). This is a good thing because all of
that code can be simplified to let ktesting handle the cancelation.
2024-03-01 07:51:22 +01:00
Tim Hockin
10c32b3e2f
Get rid of most references to GOPATH 2024-02-29 22:06:51 -08:00
Tim Hockin
530c4352fb
Rename new::setup_env back to setup_env 2024-02-29 22:06:44 -08:00
Tim Hockin
25b97dae82
Change ipamperf test to new setup_env 2024-02-29 22:06:12 -08:00
Kubernetes Prow Robot
5cf4fbe524
Merge pull request #123458 from aramase/aramase/i/min_jwt_payload
add min valid jwt payload to API docs for structured authn config
2024-02-29 15:11:40 -08:00
Igor Velichkovich
a51a5b4622 kep-3716 GA, remove feature gate 2024-02-29 14:14:19 -06:00
Jiahui Feng
e257522889 add transient types to admission test. 2024-02-29 12:08:43 -08:00
Kubernetes Prow Robot
67a06c2056
Merge pull request #122293 from mengjiao-liu/controller-reconsider-log-verbosity
kube-controller-manager: readjust log verbosity
2024-02-29 11:55:21 -08:00
Anish Ramasekar
b57d7d6ad7
add min valid jwt payload to API docs for structured authn config
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2024-02-29 11:08:39 -08:00
Kubernetes Prow Robot
331ced5606
Merge pull request #123579 from pohly/scheduler-perf-create-strict-validation
scheduler_perf: fail when input YAML is invalid
2024-02-29 05:05:52 -08:00
Kubernetes Prow Robot
411c29c39f
Merge pull request #123331 from aojea/ccm_update
CCM wait for providerID to initialize the Node object
2024-02-29 01:50:02 -08:00
Patrick Ohly
d6851ec735 scheduler_perf: fail when input YAML is invalid
The YAML files get decoded into an unstructured object, without validation, and
then sent to the apiserver with a generic client. The default behavior is to
issue a warning to the client, which gets logged by client-go. What we want
instead is an error that causes the test to fail in a clean way right at the
beginning.
2024-02-29 09:53:16 +01:00
Tim Hockin
8b579b2347
Change the build_binaries path to use modules
This makes "new" and "old" setup_env functions. In subsequent commits,
all callers of the "old" form will be fixed, and the "new" will be
renamed back.

The old and new functions diff:

```diff
--- /tmp/a	2023-12-14 09:02:57.804092696 -0800
+++ /tmp/b	2023-12-14 09:03:09.679999585 -0800
@@ -1,4 +1,4 @@
-kube::golang::old::setup_env() {
+kube::golang:🆕:setup_env() {
   kube::golang::verify_go_version

   # Set up GOPATH.  We have tools which depend on being in a GOPATH (see
@@ -7,9 +7,9 @@
   # Even in module mode, we need to set GOPATH for `go build` and `go install`
   # to work.  We build various tools (usually via `go install`) from a lot of
   # scripts.
-  #   * We can't set GOBIN because that does not work on cross-compiles.
-  #   * We could use `go build -o <something>`, but it's subtle when it comes
-  #     to cross-compiles and whether the <something> is a file or a directory,
+  #   * We can't just set GOBIN because that does not work on cross-compiles.
+  #   * We could always use `go build -o <something>`, but it's subtle wrt
+  #     cross-compiles and whether the <something> is a file or a directory,
   #     and EVERY caller has to get it *just* right.
   #   * We could leave GOPATH alone and let `go install` write binaries
   #     wherever the user's GOPATH says (or doesn't say).
@@ -20,16 +20,6 @@
   #
   # Eventually, when we no longer rely on run-in-gopath.sh we may be able to
   # simplify this some.
-  local go_pkg_dir="${KUBE_GOPATH}/src/${KUBE_GO_PACKAGE}"
-  local go_pkg_basedir
-  go_pkg_basedir=$(dirname "${go_pkg_dir}")
-
-  mkdir -p "${go_pkg_basedir}"
-
-  # TODO: This symlink should be relative.
-  if [[ ! -e "${go_pkg_dir}" || "$(readlink "${go_pkg_dir}")" != "${KUBE_ROOT}" ]]; then
-    ln -snf "${KUBE_ROOT}" "${go_pkg_dir}"
-  fi
   export GOPATH="${KUBE_GOPATH}"

   # If these are not set, set them now.  This ensures that any subsequent
@@ -40,24 +30,10 @@
   # Make sure our own Go binaries are in PATH.
   export PATH="${KUBE_GOPATH}/bin:${PATH}"

-  # Change directories so that we are within the GOPATH.  Some tools get really
-  # upset if this is not true.  We use a whole fake GOPATH here to collect the
-  # resultant binaries.
-  local subdir
-  subdir=$(kube::realpath . | sed "s|${KUBE_ROOT}||")
-  cd "${KUBE_GOPATH}/src/${KUBE_GO_PACKAGE}/${subdir}" || return 1
-
-  # Set GOROOT so binaries that parse code can work properly.
-  GOROOT=$(go env GOROOT)
-  export GOROOT
-
   # Unset GOBIN in case it already exists in the current session.
   # Cross-compiles will not work with it set.
   unset GOBIN

-  # This seems to matter to some tools
-  export GO15VENDOREXPERIMENT=1
-
-  # Disable workspaces
-  export GOWORK=off
+  # Explicitly turn on modules.
+  export GO111MODULE=on
 }
```

Result: `make` works for k/k:

```
$ make kubectl
+++ [1211 11:07:31] Building go targets for linux/amd64
    k8s.io/kubernetes/cmd/kubectl (static)

$ make WHAT=./cmd/kubectl/
+++ [1211 11:08:19] Building go targets for linux/amd64
    k8s.io/kubernetes/./cmd/kubectl/ (non-static)

$ make WHAT=k8s.io/kubernetes/cmd/kubectl
+++ [1211 11:08:52] Building go targets for linux/amd64
    k8s.io/kubernetes/cmd/kubectl (static)
```

Result: `make` works for staging by package:

```
$ make WHAT=k8s.io/api
+++ [1211 11:11:37] Building go targets for linux/amd64
    k8s.io/api (non-static)
```

Result: `make` fails for staging by path:

```
$ make WHAT=./staging/src/k8s.io/api
+++ [1211 11:12:44] Building go targets for linux/amd64
    k8s.io/kubernetes/./staging/src/k8s.io/api (non-static)
cannot find module providing package k8s.io/kubernetes/staging/src/k8s.io/api: import lookup disabled by -mod=vendor
	(Go version in go.work is at least 1.14 and vendor directory exists.)
!!! [1211 11:12:44] Call tree:
!!! [1211 11:12:44]  1: /home/thockin/src/kubernetes/hack/lib/golang.sh:850 kube::golang::build_some_binaries(...)
!!! [1211 11:12:44]  2: /home/thockin/src/kubernetes/hack/lib/golang.sh:1012 kube::golang::build_binaries_for_platform(...)
!!! [1211 11:12:44]  3: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
!!! [1211 11:12:44] Call tree:
!!! [1211 11:12:44]  1: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
!!! [1211 11:12:44] Call tree:
!!! [1211 11:12:44]  1: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
make: *** [Makefile:96: all] Error 1
```

Result: `make test` fails:

```
$ make test WHAT=./cmd/kubectl
+++ [1211 11:13:38] Set GOMAXPROCS automatically to 6
+++ [1211 11:13:38] Running tests without code coverage and with -race
cmd/kubectl/kubectl.go:25:2: cannot find package "k8s.io/client-go/plugin/pkg/client/auth" in any of:
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/client-go/plugin/pkg/client/auth (vendor tree)
	/home/thockin/sdk/gotip/src/k8s.io/client-go/plugin/pkg/client/auth (from $GOROOT)
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/client-go/plugin/pkg/client/auth (from $GOPATH)
cmd/kubectl/kubectl.go:20:2: cannot find package "k8s.io/component-base/cli" in any of:
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/component-base/cli (vendor tree)
	/home/thockin/sdk/gotip/src/k8s.io/component-base/cli (from $GOROOT)
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/component-base/cli (from $GOPATH)
cmd/kubectl/kubectl.go:21:2: cannot find package "k8s.io/kubectl/pkg/cmd" in any of:
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/kubectl/pkg/cmd (vendor tree)
	/home/thockin/sdk/gotip/src/k8s.io/kubectl/pkg/cmd (from $GOROOT)
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/kubectl/pkg/cmd (from $GOPATH)
cmd/kubectl/kubectl.go:22:2: cannot find package "k8s.io/kubectl/pkg/cmd/util" in any of:
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/kubectl/pkg/cmd/util (vendor tree)
	/home/thockin/sdk/gotip/src/k8s.io/kubectl/pkg/cmd/util (from $GOROOT)
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/kubectl/pkg/cmd/util (from $GOPATH)
make: *** [Makefile:191: test] Error 1
```
2024-02-29 00:22:07 -08:00
Wei Huang
01db4ae9e7
Graduate PodSchedulingReadiness to stable 2024-02-28 23:18:44 -08:00
Jiahui Feng
64ee859aa8 make ValidatingAdmissionPolicy ignore excluded resources. 2024-02-28 15:31:44 -08:00
Jiahui Feng
5b1fffa3e4 add resource filter to admission initializer. 2024-02-28 15:31:18 -08:00
Michał Woźniak
e568a77a93
Support for the Job managedBy field (alpha) (#123273)
* support for the managed-by label in Job

* Use managedBy field instead of managed-by label

* Additional review remarks

* Review remarks 2

* review remarks 3

* Skip cleanup of finalizers for job with custom managedBy

* Drop the performance optimization

* imrpove logs
2024-03-05 09:25:15 -08:00
Kensei Nakada
58a826a59a graduate MinDomainsInPodTopologySpread to stable 2024-02-28 10:42:29 +00:00
Kubernetes Prow Robot
98bd90fbe2
Merge pull request #114672 from pohly/log-text-split-streams
log: split streams also for text output
2024-02-26 01:44:58 -08:00
Antonio Ojea
099f26296b integration test for cloud provider
very simple tests to check that the node controllers removes the taint.

Test will be used later for add more coverage without having to depend
on e2e tests for validating complex scenarios and combinations of flags
and controllers.

Change-Id: I55ce01488352cce9d673585e7959678c2bfb5924
2024-02-26 09:01:21 +00:00
Mengjiao Liu
b584b87a94 kube-controller-manager: readjust log verbosity
- Increase the global level for broadcaster's logging to 3 so that users can ignore event messages by lowering the logging level. It reduces information noise.
- Making sure the context is properly injected into the broadcaster, this will allow the -v flag value to be used also in that broadcaster, rather than the above global value.
- test: use cancellation from ktesting
- golangci-hints: checked error return value
2024-02-26 14:51:56 +08:00
Kubernetes Prow Robot
38638adaee
Merge pull request #123418 from rikatz/kep-1860-to-beta
Promote LoadBalancerIPMode to Beta
2024-02-24 12:48:07 -08:00