Commit Graph

381 Commits

Author SHA1 Message Date
Kubernetes Submit Queue
1c17d985ca Merge pull request #52183 from MrHohn/kube-proxy-incluster-host
Automatic merge from submit-queue (batch tested with PRs 52883, 52183, 53915, 53848). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[GCE kube-up] Don't provision kubeconfig file for kube-proxy service account

**What this PR does / why we need it**:

Offloading the burden of provisioning kubeconfig file for kube-proxy service account from GCE startup scripts. This also helps us decoupling kube-proxy daemonset upgrade from node upgrade.

Previous attempt on https://github.com/kubernetes/kubernetes/pull/51172, using InClusterConfig for kube-proxy based on discussions on https://github.com/kubernetes/client-go/issues/281.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #NONE 

**Special notes for your reviewer**:
/assign @bowei @thockin 
cc @luxas @murali-reddy

**Release note**:

```release-note
NONE
```
2017-10-13 17:33:31 -07:00
Zihong Zheng
476138c676 [GCE kube-up] Don't provision kubeconfig file on nodes when kube-proxy run as a DaemonSet 2017-10-13 14:40:40 -07:00
Kubernetes Submit Queue
0564d52985 Merge pull request #53205 from kawych/master
Automatic merge from submit-queue (batch tested with PRs 50223, 53205). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Create e2e tests for Custom Metrics - Stackdriver Adapter and HPA based on custom metrics from Stackdriver

**What this PR does / why we need it**:
- Add e2e test for Custom Metrics - Stackdriver Adapter
- Add 2e2 test for HPA based on custom metrics from Stackdriver
- Enable HorizontalPodAutoscalerUseRESTClients option

**Release note**:

```release-note
Horizontal pod autoscaler uses REST clients through the kube-aggregator instead of the legacy client through the API server proxy.
```
2017-10-11 03:54:33 -07:00
Joe Betz
2e362ea142 Add 'ETCD_DOCKER_REPOSITORY' environment variable override to 'cluster/' scripts.
This allows the etcd docker registry that is currently hard coded to
`gcr.io/google_containers/etcd` in the `etcd.manifest` template to be
overridden.  This can be used to test new versions of etcd with
kubernetes that have not yet been published to
`gcr.io/google_containers/etcd` and also enables cluster operators to
manage the etcd images used by their cluster in an internal
repository.
2017-10-10 12:38:18 -07:00
Karol Wychowaniec
f3fddaedd0 Enable HorizontalPodAutoscalerUseRESTClients option 2017-10-10 10:50:09 +02:00
Kubernetes Submit Queue
d2276079f6 Merge pull request #52956 from m1093782566/ipvs-params
Automatic merge from submit-queue (batch tested with PRs 53044, 52956, 53512, 53028). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add ipvs sync period parameters - align to iptables proxier

**What this PR does / why we need it**:

Add ipvs sync period parameters - align to iptables proxier

**Which issue this PR fixes**: 

fixes #52957

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-10-05 18:29:39 -07:00
Piotr Szczesniak
747dffcba0 Fixed metrics API group name in audit configuration 2017-10-05 16:54:13 +02:00
Zihong Zheng
f107e378c9 Allow setting --concurrent-service-syncs for kube-controller-manager in GCE startup scripts 2017-10-04 15:04:56 -07:00
Kubernetes Submit Queue
cf3fcf235f Merge pull request #53280 from MrHohn/merge-kube-dns-yamls
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 Merge kube-dns templates into a single file

**What this PR does / why we need it**: Merge all of the kube-dns cluster yamls into a single file.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #42832

**Special notes for your reviewer**:
/assign @bowei @shashidharatd 
cc @kevin-wangzefeng @euank @lhuard1A

**Release note**:

```release-note
NONE
```
2017-10-03 11:46:43 -07:00
Zihong Zheng
db8f9ddcec Merge kube-dns templates into a single file 2017-10-03 09:43:52 -07:00
Kubernetes Submit Queue
f48eccad9e Merge pull request #53053 from shyamjvs/enable-audit-logging-kubemark
Automatic merge from submit-queue (batch tested with PRs 51765, 53053, 52771, 52860, 53284). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add audit-logging, feature-gates & few admission plugins to kubemark

To make kubemark match real cluster settings. Also includes a few other settings like request-timeout, etcd-quorum, etc.

Fixes https://github.com/kubernetes/kubernetes/issues/53021
Related https://github.com/kubernetes/kubernetes/issues/51899 https://github.com/kubernetes/kubernetes/issues/44701

cc @kubernetes/sig-scalability-misc @wojtek-t @gmarek @smarterclayton
2017-10-03 09:02:32 -07:00
Shyam Jeedigunta
eadce7a180 Add audit-logging, feature-gates & few admission plugins to kubemark 2017-10-02 12:13:52 +02:00
Kubernetes Submit Queue
bff7821dab Merge pull request #53225 from crassirostris/fix-basic-audit
Automatic merge from submit-queue (batch tested with PRs 51021, 53225, 53094, 53219). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix basic audit in GCE deploy scripts

Fix https://github.com/kubernetes/kubernetes/issues/53154

Since AdvancedAudit feature gate is now enabled by default, we should explicitly disable it when using basic audit.
2017-09-29 12:38:19 -07:00
Mik Vyatskov
259260566f Fix basic audit in GCE deploy scripts
Signed-off-by: Mik Vyatskov <vmik@google.com>
2017-09-29 14:03:48 +02:00
Mike Danese
87e528d436 gce:restrict file permissions for PKI assets
from 644 to 600
2017-09-28 09:29:18 -07:00
Jordan Liggitt
20453f9e87 Adjust audit policy for scale issues 2017-09-25 13:13:14 -04:00
m1093782566
f4333f0a69 add ipvs sync period parameters 2017-09-24 10:48:08 +08:00
Kubernetes Submit Queue
5efab5a121 Merge pull request #52497 from jcbsmpsn/add-signing-duration-configuration-flag
Automatic merge from submit-queue (batch tested with PRs 48970, 52497, 51367, 52549, 52541). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>..

Add configuration support for signing duration.

Fixes https://github.com/kubernetes/kubernetes/issues/52286
Fixes https://github.com/kubernetes/kubernetes/issues/52282
Reverses revert (with fixes) https://github.com/kubernetes/kubernetes/pull/52299

```release-note
Add CLUSTER_SIGNING_DURATION environment variable to cluster
configuration scripts to allow configuration of signing duration of
certificates issued via the Certificate Signing Request API.
```
2017-09-19 01:17:42 -07:00
Kubernetes Submit Queue
549bd71ea7 Merge pull request #52488 from kawych/master
Automatic merge from submit-queue (batch tested with PRs 52488, 52548). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>..

Enable overriding Heapster resource requirements in GCP

This PR enables to override Heapster resource requirements in GCP.

**Release note:**
```release-note
```
2017-09-15 18:34:25 -07:00
Jacob Simpson
ca48fca127 Add configuration support for signing duration.
Add CLUSTER_SIGNING_DURATION environment variable to cluster
configuration scripts to allow configuration of signing duration of
certificates issued via the Certificate Signing Request API.
2017-09-15 10:22:19 -07:00
Karol Wychowaniec
8cfeb4f172 Enable overriding Heapster resource requirements in GCP 2017-09-15 11:45:37 +02:00
Kubernetes Submit Queue
0c1dcb01c5 Merge pull request #52115 from jcbsmpsn/flag-enable-kubelet-certificate-rotation
Automatic merge from submit-queue (batch tested with PRs 52452, 52115, 52260, 52290)

Add env var to enable kubelet rotation in kube-up.sh.

Fixes https://github.com/kubernetes/kubernetes/issues/52114

```release-note
Adds ROTATE_CERTIFICATES environment variable to kube-up.sh script for GCE
clusters. When that var is set to true, the command line flag enabling kubelet
client certificate rotation will be added to the kubelet command line.
```
2017-09-15 01:59:59 -07:00
Kubernetes Submit Queue
afdbfa251f Merge pull request #52358 from crassirostris/audit-policy-groups
Automatic merge from submit-queue (batch tested with PRs 52376, 52439, 52382, 52358, 52372)

Add new api groups to the GCE advanced audit policy

Fixes https://github.com/kubernetes/kubernetes/issues/52265

It introduces the missing api groups, that were introduced in 1.8 release.

@piosz there's also the 'metrics' api group, should we audit it?
2017-09-14 15:27:05 -07:00
Jacob Simpson
0ac34781c8 Add env var to enable kubelet rotation in kube-up.sh. 2017-09-14 11:30:03 -07:00
Kubernetes Submit Queue
cd343fd806 Merge pull request #52342 from crassirostris/audit-policy-gcp-variable
Automatic merge from submit-queue (batch tested with PRs 51601, 52153, 52364, 52362, 52342)

Make advanced audit policy on GCP configurable

Related to https://github.com/kubernetes/kubernetes/issues/52265

Make GCP audit policy configurable

/cc @tallclair
2017-09-13 09:30:19 -07:00
Mik Vyatskov
ccf40abd50 Make advanced audit policy on GCP configurable 2017-09-13 14:36:26 +02:00
Mik Vyatskov
a9fb3c8efb Add new api groups to the GCE advanced audit policy 2017-09-13 12:07:48 +02:00
Mik Vyatskov
0933f5c8e0 Switch default audit policy to beta and omit RequestReceived stage 2017-09-12 16:36:13 +02:00
Eric Chiang
cd3c8770c5 Revert "Add cluster up configuration for certificate signing duration."
This reverts commit bd0c16cc8e.
2017-09-11 16:28:17 -07:00
Kubernetes Submit Queue
ed154988c5 Merge pull request #51844 from jcbsmpsn/add-signing-duration-configuration-flag
Automatic merge from submit-queue

Add cluster up configuration for certificate signing duration.

```release-note
Add CLUSTER_SIGNING_DURATION environment variable to cluster configuration scripts
to allow configuration of signing duration of certificates issued via the Certificate
Signing Request API.
```
2017-09-08 13:24:20 -07:00
Kubernetes Submit Queue
fa916c1002 Merge pull request #51986 from yujuhong/docker-pids
Automatic merge from submit-queue (batch tested with PRs 51921, 51829, 51968, 51988, 51986)

COS/GCE: bump the max pids for the docker service

**What this PR does / why we need it**:
TasksMax limits how many threads/processes docker can create. Insufficient limit affects container starts.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*:
fixes #51977

**Special notes for your reviewer**:

**Release note**:
```release-note
Ensure TasksMax is sufficient for docker
```
2017-09-05 21:03:17 -07:00
Kubernetes Submit Queue
578690448a Merge pull request #51988 from zmerlynn/fix-pod-priority
Automatic merge from submit-queue (batch tested with PRs 51921, 51829, 51968, 51988, 51986)

Fix unbound variable in configure-helper.sh

This isn't plumbed yet on GKE, so results in an unbound variable.

```release-note
NONE
```
2017-09-05 21:03:15 -07:00
Zach Loafman
bd86be402c Fix unbound variable in configure-helper.sh
This isn't plumbed yet on GKE, so results in an unbound variable.
2017-09-05 16:21:58 -07:00
Yu-Ju Hong
d6de90e8f7 COS/GCE: Ensure TasksMax is sufficient for docker
This affects how many threads/processes docker can create, and should
not be limited.
2017-09-05 16:18:43 -07:00
Jacob Simpson
bd0c16cc8e Add cluster up configuration for certificate signing duration. 2017-09-05 15:56:33 -07:00
Jing Xu
3d4bc931d3 Set up DNS server in containerized mounter path
During NFS/GlusterFS mount, it requires to have DNS server to be able to
resolve service name. This PR gets the DNS server ip from kubelet and
add it to the containerized mounter path. So if containerized mounter is
used, service name could be resolved during mount
2017-09-05 11:40:23 -07:00
Kubernetes Submit Queue
ffed1d3408 Merge pull request #51792 from piosz/metrics-server
Automatic merge from submit-queue (batch tested with PRs 49727, 51792)

Introducing metrics-server

ref https://github.com/kubernetes/features/issues/271

There is still some work blocked on problems with repo synchronization:
- migrate to `v1beta1` introduced in #51653 
- bump deps to HEAD
Will do it in a follow up PRs once the issue is resolved.

```release-note
Introduced Metrics Server
```
2017-09-04 03:37:59 -07:00
Kubernetes Submit Queue
53ee4397e7 Merge pull request #51827 from bowei/2ndary-range-name
Automatic merge from submit-queue (batch tested with PRs 51682, 51546, 51369, 50924, 51827)

Add `secondary-range-name` to the gce.conf

```release-note
NONE
```
2017-09-03 15:54:25 -07:00
Kubernetes Submit Queue
47d0db0e87 Merge pull request #51237 from gunjan5/calico-2.5-rbac
Automatic merge from submit-queue

Add RBAC, healthchecks, autoscalers and update Calico to v2.5.1

**What this PR does / why we need it**:
- Updates Calico to `v2.5`
  - Calico/node to `v2.5.1`
  - Calico CNI to `v1.10.0`
  - Typha to `v0.4.1`
- Enable health check endpoints
  - Add Readiness probe for calico-node and Typha
  - Add Liveness probe for calico-node and Typha
- Add RBAC manifest
  - With calico ClusterRole, ServiceAccount and ClusterRoleBinding
- Add Calico CRDs in the Calico manifest (only works for k8s v1.7+)
- Add vertical autoscaler for calico-node and Typha
- Add horizontal autoscaler for Typha 

**Release note**:

```release-note
NONE
```
2017-09-03 14:01:04 -07:00
Piotr Szczesniak
55c21ac801 Introduced Metrics Server 2017-09-03 22:13:59 +02:00
Kubernetes Submit Queue
9637f46122 Merge pull request #51725 from nicksardo/gce-plumb-netvars
Automatic merge from submit-queue (batch tested with PRs 51805, 51725, 50925, 51474, 51638)

GCE: Plumb network & subnetwork to master

**Which issue this PR fixes** *
Fixes #51714

/assign @bowei 

**Release note**:
```release-note
NONE
```
2017-09-03 11:10:00 -07:00
Kubernetes Submit Queue
5632613c5b Merge pull request #51069 from MrHohn/kube-proxy-pod-priority
Automatic merge from submit-queue (batch tested with PRs 51553, 51538, 51663, 51069, 51737)

Allow enable pod priority feature gate for GCE and configure priority for kube-proxy

**What this PR does / why we need it**:
From #23225, this PR adds an option for user to enable pod priority feature gate using GCE startup scripts, and configure pod priority for kube-proxy when enabled.

The setup `priorityClassName: system` derives from: ce1485c626/staging/src/k8s.io/api/core/v1/types.go (L2536-L2542)

The plan is to configure pod priority for kube-proxy daemonset (https://github.com/kubernetes/kubernetes/pull/50705) in the same way.

**Special notes for your reviewer**:
cc @bsalamat @davidopp @thockin 

**Release note**:

```release-note
When using kube-up.sh on GCE, user could set env `ENABLE_POD_PRIORITY=true` to enable pod priority feature gate.
```
2017-09-02 21:58:04 -07:00
Kubernetes Submit Queue
2e69d4e625 Merge pull request #51564 from verult/MasterFlexDir
Automatic merge from submit-queue

Adding Flexvolume plugin dir piping for controller manager on COS

**What this PR does / why we need it**: Sets the default Flexvolume plugin directory correctly for controller manager running on COS images.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #51563

```release-note
NONE
```

/release-note-none
/sig storage
/assign @msau42 
/cc @wongma7
2017-09-02 08:20:13 -07:00
Bowei Du
1aeebcf6d3 Add secondary-range-name to the gce.conf 2017-09-01 14:28:16 -07:00
Gunjan Patel
05661b68eb Add RBAC, healthchecks, autoscaler and update Calico to v2.5.0, Typha to 0.4.0 2017-09-01 12:52:53 -07:00
Nick Sardo
506064376b Set NODE_NETWORK and NODE_SUBNETWORK in kube-up 2017-08-31 17:23:30 -07:00
Matt Liggett
ef0503b834 Add KUBE_APISERVER_REQUEST_TIMEOUT_SEC env var.
If set, connect it to kube-apiserver's --request-timeout flag.
2017-08-31 14:33:10 -07:00
Cheng Xing
da2a7a0bcc Adding Flexvolume plugin dir piping for master on COS 2017-08-29 15:09:29 -07:00
Kubernetes Submit Queue
0d17e9deb7 Merge pull request #48574 from sakshamsharma/kms-transformer
Automatic merge from submit-queue

Add Google cloud KMS service for envelope encryption transformer

This adds the required pieces which will allow addition of KMS based encryption providers (envelope transformer).

For now, we will be implementing it using Google Cloud KMS, but the code should make it easy to add support for any other such provider which can expose Decrypt and Encrypt calls.

Writing tests for Google Cloud KMS Service may cause a significant overhead to the testing framework. It has been tested locally and on GKE though.

Upcoming after this PR:
* Complete implementation of the envelope transformer, which uses LRU cache to maintain decrypted DEKs in memory.
* Track key version to assist in data re-encryption after a KEK rotation.

Development branch containing the changes described above: https://github.com/sakshamsharma/kubernetes/pull/4

Envelope transformer used by this PR was merged in #49350 

Concerns #48522 

Planned configuration:
```
kind: EncryptionConfig
apiVersion: v1
resources:
  - resources:
    - secrets
    providers:
    - kms:
        cachesize: 100
        configfile: gcp-cloudkms.conf
        name: gcp-cloudkms
    - identity: {}
```

gcp-cloudkms.conf:
```
[GoogleCloudKMS]
    kms-location: global
    kms-keyring: google-container-engine
    kms-cryptokey: example-key
```
2017-08-29 11:11:10 -07:00
Zihong Zheng
f2def6575c Configure pod priority for kube-proxy when enabled 2017-08-29 10:06:51 -07:00