Commit Graph

21266 Commits

Author SHA1 Message Date
Jordan Liggitt
83bd512861 Adjust CEL cost calculation and versioning for authorization library 2024-07-19 15:06:49 -04:00
David Eads
be2e32fa3e Add CEL fieldSelector / labelSelector support to authorizer library 2024-07-19 15:06:49 -04:00
Jordan Liggitt
03d48b7683 Move CEL env initialization out of package init()
This ensures compatibility version and feature gates can be initialized
before cached CEL environments are created.
2024-07-19 15:06:48 -04:00
Jordan Liggitt
1d2ad282cf Improve CEL cost tests to catch unhandled estimates or types 2024-07-19 15:06:47 -04:00
David Eads
92e3445e9d add field and label selectors to authorization attributes
Co-authored-by: Jordan Liggitt <liggitt@google.com>
2024-07-19 15:06:47 -04:00
David Eads
f5e5bef2e0 generate 2024-07-19 14:35:37 -04:00
David Eads
90f0b88b6a add subjectaccessreview field and label selectors
Co-authored-by: Jordan Liggitt <liggitt@google.com>
2024-07-19 14:34:49 -04:00
Kubernetes Prow Robot
acaec0c23a Merge pull request #126124 from cici37/feature/validating-admission-policy/metrics-improvement
Feature/validating admission policy/metrics improvement
2024-07-19 10:34:58 -07:00
Kubernetes Prow Robot
77e12aeca9 Merge pull request #126207 from thockin/ingress-backend-port-atomic
Make ServiceBackendPort an atomic struct
2024-07-18 19:24:26 -07:00
Kubernetes Prow Robot
25935965c5 Merge pull request #125782 from aborrero/master
procMount: fix default value documentation
2024-07-18 19:24:11 -07:00
Kubernetes Prow Robot
f2428d66cc Merge pull request #125163 from pohly/dra-kubelet-api-version-independent-no-rest-proxy
DRA: make kubelet independent of the resource.k8s.io API version
2024-07-18 17:47:48 -07:00
Patrick Ohly
7701a48bd6 dra kubelet: bump gRPC API to v1alpha4
The previous changes are an API break, therefore we need a new version.
2024-07-18 23:30:09 +02:00
Kubernetes Prow Robot
d040043edb Merge pull request #124736 from MikeSpreitzer/exempt-borrows-more
More assertive borrowing by exempt
2024-07-18 13:41:38 -07:00
Tim Hockin
7313990f61 Make ServiceBackendPort an atomic struct
This allows different actors to force ownership of it without having to
explicitly unset the other field.
2024-07-18 13:20:33 -07:00
Kubernetes Prow Robot
595927da21 Merge pull request #125660 from saschagrunert/oci-volumesource-api
[KEP-4639] Add `ImageVolumeSource` API
2024-07-18 10:39:15 -07:00
Kubernetes Prow Robot
601eb7e9cf Merge pull request #122922 from marosset/windows-memory-eviction
Add support for Windows memory-pressure eviction
2024-07-18 10:39:06 -07:00
Kubernetes Prow Robot
73198f893c Merge pull request #124859 from morlay/master
Remove json:",omitempty" where json:",inline" specified.
2024-07-18 09:33:33 -07:00
Sascha Grunert
f7ca3131e0 Add ImageVolumeSource API
Adding the required Kubernetes API so that the kubelet can start using
it. This patch also adds the corresponding alpha feature gate as
outlined in KEP 4639.

Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
2024-07-18 17:25:54 +02:00
Lukasz Szaszkiewicz
88f47b4b4d Revert "kube-apiserver: promote WatchList feature to beta"
This reverts commit 0b15903b35.
2024-07-18 09:29:24 +02:00
Patrick Ohly
348f94ab55 DRA: read ResourceClaim in DRA drivers
This is the second and final step towards making kubelet independent of the
resource.k8s.io API versioning because it now doesn't need to copy structs
defined by that API from the driver to the API server.
2024-07-18 09:09:20 +02:00
Patrick Ohly
616a014347 DRA: move ResourceSlice publishing into DRA drivers
This is a first step towards making kubelet independent of the resource.k8s.io
API versioning because it now doesn't need to copy structs defined by that API
from the driver to the API server. The next step is removing the other
direction (reading ResourceClaim status and passing the resource handle to
drivers).

The drivers must get deployed so that they have their own connection to the API
server. Securing at least the writes via a validating admission policy should
be possible.

As before, the kubelet removes all ResourceSlices for its node at startup, then
DRA drivers recreate them if (and only if) they start up again. This ensures
that there are no orphaned ResourceSlices when a driver gets removed while the
kubelet was down.

While at it, logging gets cleaned up and updated to use structured, contextual
logging as much as possible. gRPC requests and streams now use a shared,
per-process request ID and streams also get logged.
2024-07-18 09:09:19 +02:00
Kubernetes Prow Robot
d0545c8eb4 Merge pull request #126073 from a7i/fake-apply-scale-subresource
fix: fake clientset ApplyScale subresource from 'status' to 'scale'
2024-07-17 17:35:52 -07:00
Kubernetes Prow Robot
45cb3a1bd0 Merge pull request #126173 from bergerhoffer/cli-help
A few minor help text tweaks
2024-07-17 16:29:34 -07:00
Mark Rossetti
0411a3d565 Add support for memory pressure evictiong on Windows
Signed-off-by: Mark Rossetti <marosset@microsoft.com>
2024-07-17 15:11:30 -07:00
Kubernetes Prow Robot
42e22cc99d Merge pull request #126162 from danwinship/kube-proxy-config-owners
Add me to kube-proxy config api approvers
2024-07-17 13:10:00 -07:00
Kubernetes Prow Robot
b23f41e192 Merge pull request #125940 from thockin/master
Clarify errors in ProjectedVolume validation
2024-07-17 13:09:51 -07:00
Kubernetes Prow Robot
ef8d67f865 Merge pull request #125809 from aojea/cloud_hostname
add unit tests for hostname node.status.addresses
2024-07-17 12:05:52 -07:00
Andrea Hoffer
5252f79f9b A few minor help text tweaks 2024-07-17 13:30:34 -04:00
Kubernetes Prow Robot
c3bcd4fff0 Merge pull request #126139 from enj/enj/i/revert_list_cache
Revert "Move ConsistentListFromCache to Beta default"
2024-07-17 09:59:14 -07:00
Dan Winship
5c372faca6 Add me to kube-proxy config api approvers 2024-07-17 09:41:53 -04:00
Monis Khan
aeb51a16e3 Revert "Move ConsistentListFromCache to Beta default"
This reverts commit 0c0e19b343.

During stress test for SVM controller, the controller is unable to
make a list call due to following error:

resourceversion.go:155: I0716 21:49:26.973127] storage-version-migrator-controller: Error syncing SVM resource, retrying svm="crdsvm" err="error getting latest resourceVersion for stable.example.com/v1, Resource=testcrds: Timeout: Too large resource version: 28976, current: 20349"

With the feature disabled, the stress test passes.

Signed-off-by: Monis Khan <mok@microsoft.com>
2024-07-16 23:12:16 -04:00
Kubernetes Prow Robot
8aff9d3192 Merge pull request #126072 from aroradaman/proxy-config-v1alpah2-windows
kube-proxy: internal config: add Linux and Windows section
2024-07-16 19:37:12 -07:00
Kubernetes Prow Robot
fc3abdaf2d Merge pull request #125470 from everpeace/kep-3619-SupplementalGroupsPolicy-e2e
KEP-3619: Add NodeStatus.Features.SupplementalGroupsPolicy API and e2e
2024-07-16 13:57:06 -07:00
Cici Huang
b7821078b3 Fix the error type, Add into observation, Fix tests. 2024-07-16 08:27:36 -07:00
Jiahui Feng
d61edc51b8 make use of new error reporting in the dispatcher. 2024-07-16 07:22:11 -07:00
Jiahui Feng
8e9232ef46 remove unused policy_definition_total metric and state label 2024-07-16 07:22:06 -07:00
Jiahui Feng
ce45a82346 make Err wrap one or zero error. 2024-07-16 07:22:00 -07:00
Jiahui Feng
b846c39047 errors improvement. 2024-07-16 07:22:00 -07:00
xyz-li
18b81ab68c api: fix ValidatingAdmissionPolicyList json tag
This change make api-server not omity the field `item` of
ValidatingAdmissionPolicyList when ValidatingAdmissionPolicy is empty.
So kubetl will print ValidatingAdmissionPolicyList correctly when ValidatingAdmissionPolicy is empty.

Signed-off-by: xyz-li <hui0787411@163.com>
2024-07-16 17:00:28 +08:00
Shingo Omura
5d75660dc1 KEP-3619: API: add NodeFeatures.SupplementalGroupsPolicy in NodeStatus
KEP-3619: don't capitalize comment in K8S API

KEP-3619: fix typos and grammatical ones in K8s API

KEP-3619: rephrase NodeFeatures, NodeHandlerFeatures in K8s API
2024-07-16 12:35:55 +09:00
Shingo Omura
38e4c6b016 KEP-3619: CRI: add RuntimeFeatures.SupplementalGroupsPolicy in StatusResponse
KEP-3619: don't capitalize comment in CRI

KEP-3619: fix typos and grammatical ones in CRI

KEP-3619: rephrase RuntimeFeatures, RuntimeHandlerFeatures comment in CRI
2024-07-16 12:11:58 +09:00
Kubernetes Prow Robot
ae1caa40a2 Merge pull request #125961 from Jerry-yz/master
Chore: fix scheduler code comment typos
2024-07-15 19:27:30 -07:00
Kubernetes Prow Robot
f36a821de8 Merge pull request #126034 from sohankunkerkar/add-usernamespaces
api: add user namespaces field to NodeRuntimeHandlerFeatures
2024-07-15 16:41:17 -07:00
Kubernetes Prow Robot
611cbbf64b Merge pull request #126105 from benluddy/cbor-framer
KEP-4222: Implement runtime.Framer for CBOR Sequences.
2024-07-15 13:11:09 -07:00
Peter Hunt
86240aaca1 api: add user namespaces field to NodeRuntimeHandlerFeatures
Signed-off-by: Sohan Kunkerkar <sohank2602@gmail.com>
2024-07-15 15:55:39 -04:00
Ben Luddy
e2b36a0f0c Implement runtime.Framer for CBOR Sequences. 2024-07-15 15:07:14 -04:00
Daman Arora
7a6fec3ea7 kube-proxy: internal config: add Windows section
Introduce Windows section for internal configuration of kube-proxy
adhering to the v1alpha2 version specifications as detailed in
https://kep.k8s.io/784. This also introduces WindowsRunAsService
to v1alpha1 configuration.

Signed-off-by: Daman Arora <aroradaman@gmail.com>
2024-07-15 22:43:47 +05:30
Kubernetes Prow Robot
fe1840205c Merge pull request #125926 from MadhavJivrajani/bump-staticcheck-exclude-SA1006
[go1.23] hack: bump go-tools and exclude SA1006
2024-07-15 10:05:19 -07:00
Kubernetes Prow Robot
06ec6ba05d Merge pull request #125305 from p0lyn0mial/upstream-dynamic-client-uses-watch-list
dynamic client: add support for API streaming
2024-07-15 10:05:12 -07:00
Kubernetes Prow Robot
7bbc891f9b Merge pull request #125769 from siyuanfoundation/api-comp-ver1
add emulated-version flag to kube-scheduler to control the feature gate.
2024-07-15 09:01:17 -07:00