Commit Graph

23 Commits

Author SHA1 Message Date
Antoine Pelisse
e41f2ccd41 gce-addons: Make sure default/limit-range doesn't get overridden 2020-02-06 12:10:12 -08:00
Pavithra Ramesh
1de2327afc Attach a new finalizer in GCE ILB creation.
Add logic in service_controller to skip create/update
if finalizer from a different controller is found.

The newly added finalizer will be checked by other controllers
implementing ILB services to determine if a given service is
already being managed by service_controller.

Moved finalizer check into cloudprovider code.

added unit test to verify new finalizer.

Modified existing unit test to create a fake service so that
attach/remove finalizer step can be tested.
2020-01-28 15:02:19 -08:00
draveness
495faa22db feat: cleanup pod critical pod annotations feature 2019-08-09 08:41:23 +08:00
Walter Fender
ebb65c5f4c Get network-proxy working with GCE.
Got the proxy-server coming up in the master.
Added certs and have it comiung up with those certs.
Added a daemonset to run the network-agent.
Adding support for agent running as a sameon set on every node.

Added quick hack to test that proxy server/agent were correctly
tunneling traffic to the kubelet.

Added more WIP for reading network proxy configuration.
Get flags set correctly and fix connection services.
Adding missing ApplyTo
Added ConnectivityService.
Fixed build directives. Added connectivity service configuration.
Fixed log levels.
Fixed minor issues for feature turned off.
Fixed boilerplate and format.
Moved log dialer initialization earlier as per Liggits suggestion.
Fixed a few minor issues in the configuration for GCE.
Fixed scheme allocation
Adding unit test.
Added test for direct connectivity service.

Switching to injecting the Lookup method rather than using a Singleton.
First round of mikedaneses feedback.
Fixed deployment to use yaml and other changes suggested by MikeDanese.

Switched network proxy server/agent which are kebab-case not camelCase.
Picked up DIAL_RSP fix.
Factored in deads2k feedback.
Feedback from mikedanese
Factored in second round of feedback from David.
Fix path in verify.
Factored in anfernee's feedback.
First part of lavalamps feedback.
Factored in more changes from lavalamp and mikedanese.

Renamed network-proxy to konnectivity-server and konnectivity-agent.
Fixed tolerations and config file checking.
Added missing strptr
Finished lavalamps requested rename.
Disambiguating konnectivity service by renaming it egress selector.

Switched feature flag to KUBE_ENABLE_EGRESS_VIA_KONNECTIVITY_SERVICE
2019-08-06 23:09:49 -07:00
draveness
d83526d253 Revert "feat: cleanup pod critical pod annotations feature"
This reverts commit b6d41ee5cc.
2019-07-18 13:31:12 +08:00
draveness
b6d41ee5cc feat: cleanup pod critical pod annotations feature 2019-07-11 08:54:19 +08:00
Yuwen Ma
53bace16df Updated gce node-termination-handler yaml. 2019-05-06 11:29:47 -07:00
Jeff Grafton
e216995ef1 Update repo-infra, bazel-skylib, rules_docker, and rules_go dependencies
Also require bazel 0.18.0+
2019-02-12 17:55:10 -08:00
Tim Allclair
485b21e8cb Fix kube-proxy PodSecurityPolicy RoleBinding namespace 2019-01-09 17:57:15 -08:00
Mike Danese
98c468de8d update PSPs to allow projected volumes 2018-11-16 19:32:44 +00:00
Kubernetes Submit Queue
6900a8042b
Merge pull request #67224 from grayluck/namespace-cloudprovider-rbac
Automatic merge from submit-queue (batch tested with PRs 65251, 67255, 67224, 67297, 68105). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md.

Add namespace for (cluster)role(binding) cloud-provider.

**What this PR does / why we need it**:
Add namespace for (cluster)role(binding) cloud-provider.
Change the addonmanager mode to be from reconcile to EnsureExists.

Needs to be cherrypicked together with https://github.com/kubernetes/kubernetes/pull/59686.

**Special notes for your reviewer**:
/assign @bowei @tallclair 
/sig auth

**Release note**:

```release-note
Role, ClusterRole and their bindings for cloud-provider is put under system namespace. Their addonmanager mode switches to EnsureExists.
```

Manual tested. Cluster can be created succesfully using kube-up.sh with desired (cluster)role(binding)s.
2018-08-31 19:25:33 -07:00
Vishnu kannan
ee65e6ac04 Adding GCE node termination handler as an optional addon.
This step is a pre-requisite for auto-deploying that addon in GKE.

Signed-off-by: Vishnu kannan <vishnuk@google.com>
2018-08-31 12:47:37 -07:00
yankaiz
bea625fd65 Add namespace for (cluster)role(binding) cloud-provider.
Change the addonmanager mode to be from reconcile to EnsureExists.
2018-08-27 20:47:26 -07:00
Tim Allclair
13adb97714 Allow adding default capabilities to unprivileged addons 2018-08-20 17:28:09 -07:00
Zhen Wang
6351e25203 Use runtime/default as default seccomp profile for unprivileged PodSecurityPolicy 2018-05-15 09:39:37 -07:00
Slava Semushin
044bf2e415 Update addon manifests to use policy/v1beta1 and grant permissions in policy API group. 2018-04-17 14:56:55 +02:00
Nick Sardo
911a082d65 Add cloud-provider policies to be applied via addon mgr 2018-02-15 14:49:33 -08:00
halfcrazy
9b64650311 fix typo in cluster 2018-02-03 11:08:06 +08:00
Jeff Grafton
1b503e0e3d Use the pkg_tar wrapper from kubernetes/repo-infra 2018-01-18 17:10:16 -08:00
Mike Danese
13116457ba cluster: remove gce dependencies out of salt
basically just:
* move all manifests into the new gce/manifests dir
* move limit-range into gce/addons/limit-range
* move abac jsonl into gce/manifests. this is gross but we will
  hopefully be able to delete this config soon. it only exists to support
  a deprecated feature.
* fix build, release, deploy to look for everything in its new home
2018-01-16 09:59:29 -08:00
Tim Allclair
a1513161b3
Reorganize addon PodSecurityPolicies 2017-11-10 13:57:32 -08:00
Tim Allclair
368afc6217
Add GCP addon PodSecurityPolicies & Bindings 2017-11-01 14:03:05 -07:00
Tim Allclair
1bd6249ad4
Introduce GCE-specific addon directory 2017-10-17 16:08:03 -07:00