Commit Graph

542 Commits

Author SHA1 Message Date
Kubernetes Submit Queue
d7c0eb322c Merge pull request #34276 from freehan/cri-runtime-config
Automatic merge from submit-queue

add UpdateRuntimeConfig interface

Expose UpdateRuntimeConfig interface in RuntimeService for kubelet to pass a set of configurations to runtime. Currently it only takes PodCIDR.

The use case is for kubelet to pass configs to runtime. Kubelet holds some config/information which runtime does not have, such as PodCIDR. I expect some of kubelet configurations will gradually move to runtime, but I believe cases like PodCIDR, which dynamically assigned by k8s master, need to stay for a while.
2016-10-13 23:10:42 -07:00
Kubernetes Submit Queue
a944748ccb Merge pull request #34341 from apprenda/kubeadm-require-root
Automatic merge from submit-queue

kubeadm implement preflight checks

Checks that user running kubeamd init and join is root and will only execute
command if user is root. Moved away from using kubectl error handling to
having kubeadm handle its own errors. This should allow kubeadm to have
more meaningful errors, exit codes, and logging for specific kubeadm use
cases.

fixes #33908
2016-10-13 15:02:53 -07:00
Devan Goodwin
4231c046dd Fix errors and improve output in kubeadm pre-flight checks.
Add skip-preflight-checks to known flags.
Fix bug with preflight checks not returning system is-active as errors.
Fix error handling to use correct function.
2016-10-13 11:10:19 -03:00
Kubernetes Submit Queue
6a2f0932e4 Merge pull request #33379 from grosskur/kube-dns-bind-address
Automatic merge from submit-queue

kube-dns: Add --dns-bind-address flag

Currently, `kube-dns` always binds to `0.0.0.0` when starting the SkyDNS server. Sometimes it's useful to have it bind to a different address for testing. So add a new `--dns-bind-address` flag that can be used to configure this (default is `0.0.0.0`).
2016-10-13 06:26:27 -07:00
Minhan Xia
480bcb9760 add UpdateRuntimeConfig interface 2016-10-12 22:33:58 -07:00
Kubernetes Submit Queue
12b133577e Merge pull request #33278 from Crassirostris/gcl-e2e-test
Automatic merge from submit-queue

Add gcl cluster logging test

This PR changes default logging destination for tests to gcp and adds test for cluster logging using google cloud logging

Fix #20760
2016-10-12 06:54:25 -07:00
Mik Vyatskov
b9c72ee1cb Add gcl cluster logging test 2016-10-11 09:36:11 +02:00
Kubernetes Submit Queue
6656929b15 Merge pull request #34153 from zmerlynn/log-dump-optionally-use-kubectl
Automatic merge from submit-queue

log-dump.sh: Add a LOG_DUMP_USE_KUBECTL mode, refactor

**What this PR does / why we need it**: This refactors log-dump.sh so that it can optionally just use `"kubectl get node"` output, for dumping logs off a cluster that was brought up using something other than kube-up.sh (e.g. kops or kubeadm).

Note that for obvious reasons, if the cluster is fried, it'll probably fail to hit the apiserver and all bets are off, but for the 95% case where you're debugging tests, this is good. To cover the remaining 5%, you could actually squirrel away the relevant external IPs after the e2e.go:Up stage (because we better be able to hit the apiserver then) and fetch them from cache later.

**Special notes for your reviewer**: Sorry for so many changes. :)
2016-10-10 16:20:20 -07:00
Zach Loafman
4338351be2 log-dump.sh: Add a LOG_DUMP_USE_KUBECTL mode, refactor
This refactors log-dump.sh so that it can optionally just use "kubectl
get node" output, for dumping logs off a cluster that was brought up
using sometihng other than kube-up.sh (e.g. kops or kubeadm).

Note that for obvious reasons, if the cluster is fried, it'll probably
fail to hit the apiserver and all bets are off, but for the 95% case
where you're debugging tests, this is good. To cover the remaining 5%,
you could actually squirrel away the relevant external IPs after the
e2e.go:Up stage (because we better be able to hit the apiserver then)
and fetch them from cache later.
2016-10-10 13:41:49 -07:00
Kubernetes Submit Queue
2ecd96100e Merge pull request #33783 from derekwaynecarr/phase-1-pod-cgroups
Automatic merge from submit-queue

Add cgroup-driver and cgroups-per-qos flags to kubelet

Add the flags needed to support pod-level cgroups to kubelet.

/cc @vishh @dchen1107 @dubstack
2016-10-07 17:56:01 -07:00
Kubernetes Submit Queue
3be8e3e44b Merge pull request #33981 from freehan/e2e-deletens-on-failure
Automatic merge from submit-queue

add delete-namespace-on-failure flag

I have been doing this for a while. 

Setting `--delete-namespace=false --clean-start=true` only works if you have only one e2e test running in a loop. 

This PR lets someone to set `delete-namespace-on-failure=false` and run multiple tests in parallel and preserve the crime scene. It makes it easier to reproduce failures. 

Let me know if this is worth it or there are some other tricks I am not aware.
2016-10-07 04:34:27 -07:00
Kubernetes Submit Queue
7766b408b8 Merge pull request #31467 from vmware/fix-vsphere-cloud-provider.kerneltime
Automatic merge from submit-queue

Add support for vpshere cloud provider in kubeup

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**:
vSphere cloud provider added in 1.3 was not configured when deploying via kubeup

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
```release-note
Add support for vSphere Cloud Provider when deploying via kubeup on vSphere.
```

When deploying on vSphere using kube up add configuration
for vSphere cloud provider.
2016-10-05 19:12:17 -07:00
Ritesh H Shukla
ea22d0cc5f Update exceptions list for underscores introduced in kubeup for vSphere. 2016-10-05 16:57:33 -07:00
Kubernetes Submit Queue
05192d9d57 Merge pull request #33319 from juanvallejo/jvallejo/add-option-to-set-nodeport
Automatic merge from submit-queue

Add option to set a service nodeport

**Release note**:
```release-note
Add kubectl --node-port option for specifying the service nodeport
```

This patch adds the option to set a nodeport when creating a NodePort
service. In case of a port allocation error due to a specified port
being out of the valid range, the error now includes the valid
range. If a `--node-port` value is not specified, it defaults to zero, in
which case the allocator will default to its current behavior of
assigning an available port.

This patch also adds a new helper function in `cmd/util/helpers.go` to
retrieve `Int32` cobra flags.

**Example**
```
# create a nodeport service with an invalid port
$ kubectl create service nodeport mynodeport --tcp=8080:7777 --node-port=1
The Service "mynodeport" is invalid: spec.ports[0].nodePort: Invalid
value: 1: provided port is not in the valid range. Valid ports range
from 30000-32767

# create a nodeport service with a valid port
$ kubectl create service nodeport mynodeport --tcp=8080:7777 --node-port=30000
service "mynodeport" created

# create a nodeport service with a port already in use
$ kubectl create service nodeport mynodeport --tcp=8080:7777 --node-port=30000
The Service "mynodeport" is invalid: spec.ports[0].nodePort: Invalid value: 3000: provided port is already allocated

$ kubectl describe service mynodeport
Name:                   mynodeport
Namespace:              default
Labels:                 app=mynodeport
Selector:               app=mynodeport
Type:                   NodePort
IP:                     172.30.81.254
Port:                   8080-7777       8080/TCP
NodePort:               8080-7777       30000/TCP
Endpoints:              <none>
Session Affinity:       None
No events.
```

@fabianofranz
2016-10-05 15:00:32 -07:00
derekwaynecarr
0071cca51e Add generated code for kubelet flags 2016-10-05 13:48:37 -04:00
Kubernetes Submit Queue
457d3785de Merge pull request #33862 from luxas/remove_experimental_flannel
Automatic merge from submit-queue

Remove the flannel experimental overlay

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**:

It removes the deprecated flannel overlay integration in kubelet.
It's completely unnecessary now with CNI which can handle everything smoothly when flannel is running in a daemonset.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #17795, #30589

cc @kubernetes/sig-network @thockin @freehan @bprashanth @yujuhong @dchen1107
2016-10-04 21:39:20 -07:00
Kubernetes Submit Queue
3f4a66f3d6 Merge pull request #33970 from yifan-gu/remove_names
Automatic merge from submit-queue

CRI: Remove the mount name and port name.

Per discussion on https://github.com/kubernetes/kubernetes/issues/33873.

Currently the mount name is not being used and also involves some
incorrect usage (sometimes it's referencing a mount name, sometimes
it's referecing a volume name), so we decide to remove it from CRI.

The port name is also not used, so remove it as well.

Fix #33873
Fix #33526 

/cc @kubernetes/sig-node @kubernetes/sig-rktnetes
2016-10-04 17:08:20 -07:00
Zach Loafman
ca58119af7 e2e.go / kops: Add --kops-kubernetes-version
This adds a flag to override the version we're deploying with kops for
e2es. (The kops experience is disconnected from the actual source tree
we're running tests from, which is similar to GKE.)
2016-10-04 14:01:31 -07:00
Yifan Gu
48baeb4046 CRI: Update the hack/verify-flags/exceptions.txt 2016-10-04 13:22:50 -07:00
juanvallejo
395f6fda81 update known flags 2016-10-04 13:19:24 -04:00
Lucas Käldström
348717c50a Remove the flannel experimental overlay 2016-10-04 11:53:53 +03:00
Zach Loafman
eb44add29c e2e.go / kops: Add ssh-key option to override ssh key
By default, Jenkins stuffs the ssh key in
/workspace/.aws/kube_aws_rsa. Allow this to be overridden easily on
the command line.
2016-10-03 17:50:15 -07:00
Minhan Xia
47ccd15b1d add delete-namespace-on-failure flag 2016-10-03 17:14:51 -07:00
Kubernetes Submit Queue
6c5a187171 Merge pull request #33378 from deads2k/rbac-10-allow-token
Automatic merge from submit-queue

add anytoken authenticator

Adds `--insecure-allow-any-token` as a flag to the API server to create an authenticator that will accept any bearer token and transform it into a user by parsing it out as `username/group1,group2,...`.

This gives an easy way to identify as a user and check permissions:
```bash
ALLOW_ANY_TOKEN=true hack/local-up-cluster.sh 
kubectl config set-cluster local-kube --server=https://localhost:6443 --insecure-skip-tls-verify=true
kubectl config set-credentials david --token=david/group1
kubectl config set-context local --cluster=local-kube --user=david
kubectl config use-context local
```

@kubernetes/sig-auth
2016-09-29 12:32:08 -07:00
Kubernetes Submit Queue
364caad0f0 Merge pull request #33582 from aanm/fixing-local-cluster-up
Automatic merge from submit-queue

Fixing local cluster up

hack: fix local-cluster-up advertise_address default value
Fixes: 9fc1d61

Signed-off-by: André Martins <aanm90@gmail.com>

ping @dims
2016-09-29 11:25:13 -07:00
deads2k
5080a575ad add anytoken authenticator 2016-09-29 14:14:06 -04:00
Kubernetes Submit Queue
d187997c94 Merge pull request #32386 from liggitt/anonymous-authenticated-groups
Automatic merge from submit-queue

Allow anonymous API server access, decorate authenticated users with system:authenticated group

When writing authorization policy, it is often necessary to allow certain actions to any authenticated user. For example, creating a service or configmap, and granting read access to all users

It is also frequently necessary to allow actions to any unauthenticated user. For example, fetching discovery APIs might be part of an authentication process, and therefore need to be able to be read without access to authentication credentials.

This PR:
* Adds an option to allow anonymous requests to the secured API port. If enabled, requests to the secure port that are not rejected by other configured authentication methods are treated as anonymous requests, and given a username of `system:anonymous` and a group of `system:unauthenticated`. Note: this should only be used with an `--authorization-mode` other than `AlwaysAllow`
* Decorates user.Info returned from configured authenticators with the group `system:authenticated`.

This is related to defining a default set of roles and bindings for RBAC (https://github.com/kubernetes/features/issues/2). The bootstrap policy should allow all users (anonymous or authenticated) to request the discovery APIs.

```release-note
kube-apiserver learned the '--anonymous-auth' flag, which defaults to true. When enabled, requests to the secure port that are not rejected by other configured authentication methods are treated as anonymous requests, and given a username of 'system:anonymous' and a group of 'system:unauthenticated'. 

Authenticated users are decorated with a 'system:authenticated' group.

NOTE: anonymous access is enabled by default. If you rely on authentication alone to authorize access, change to use an authorization mode other than AlwaysAllow, or or set '--anonymous-auth=false'.
```

c.f. https://github.com/kubernetes/kubernetes/issues/29177#issuecomment-244191596
2016-09-29 10:47:49 -07:00
Doug Davis
9d5bac6330 Change minion to node
Contination of #1111

I tried to keep this PR down to just a simple search-n-replace to keep
things simple.  I may have gone too far in some spots but its easy to
roll those back if needed.

I avoided renaming `contrib/mesos/pkg/minion` because there's already
a `contrib/mesos/pkg/node` dir and fixing that will require a bit of work
due to a circular import chain that pops up. So I'm saving that for a
follow-on PR.

I rolled back some of this from a previous commit because it just got
to big/messy. Will follow up with additional PRs

Signed-off-by: Doug Davis <dug@us.ibm.com>
2016-09-28 10:53:30 -07:00
André Martins
3dfd324987 hack: fix local-cluster-up advertise_address default value
Fixes: 9fc1d61ab7

Signed-off-by: André Martins <aanm90@gmail.com>
2016-09-28 16:40:50 +01:00
Zach Loafman
d905478e0a e2e.go: Add -deployment, add a kops deployment method
This splits off all the bash stuff into an interface, and plumbs
through a separate interface to bring up a cluster using "kops"
instead. Right now it assumes kops == AWS.
2016-09-27 14:45:19 -07:00
Tim Hockin
957c85a8fd Add a lower-bound for conntrack 2016-09-26 20:25:40 -07:00
Jordan Liggitt
0c36c5e556
Add anonymous auth to the auth chain 2016-09-26 17:19:00 -04:00
Lucas Käldström
37dab80173
Make the Kubernetes control plane version configurable 2016-09-24 14:46:42 +01:00
Evgeny L
0a68bb05ea
Rename flag --schedule-workload to --schedule-pods-here for kubeadm init 2016-09-24 14:46:41 +01:00
Evgeny L
987da0186b
Add kubeadm flags to known-flags.txt 2016-09-24 14:46:41 +01:00
Alan Grosskurth
112a3f3faf known-flags.txt: Add --dns-bind-address
This is a newly-added kube-dns flag.
2016-09-23 22:11:32 -07:00
Kubernetes Submit Queue
c46bc88f04 Merge pull request #31491 from dims/fixes-issue-13598
Automatic merge from submit-queue

Allow secure access to apiserver from Admission Controllers

* Allow options.InsecurePort to be set to 0 to switch off insecure access
* In NewSelfClient, Set the TLSClientConfig to the cert and key files
  if InsecurePort is switched off
* Mint a bearer token that allows the client(s) created in NewSelfClient
  to talk to the api server
* Add a new authenticator that checks for this specific bearer token

Fixes #13598
2016-09-21 21:31:56 -07:00
Davanum Srinivas
364dd1a752 New command line flag - Set CA file for apiserver in-process client 2016-09-20 18:59:35 -04:00
Kubernetes Submit Queue
e3e26164d5 Merge pull request #32902 from jayunit100/viper_hierarchies
Automatic merge from submit-queue

Viper direct bindings to TestContext struct with hierarchichal suppor…

Part of #31453 to support hierarchichal parameters.  This one does so for density, paves way for other tests as well.
2016-09-20 15:11:22 -07:00
jayunit100
be2e1f5d96 viper hierarchies, cadvisor impl 2016-09-20 15:42:22 -04:00
Random-Liu
ae031634e4 Add CRI Validation test. The test run non-flaky, non-serial test against
Kubernetes HEAD and docker v1.11.2 with CRI enabled.
2016-09-20 12:18:07 -07:00
Kubernetes Submit Queue
650715d231 Merge pull request #32903 from yujuhong/enable_docker_shim
Automatic merge from submit-queue

kubelet: Add a hidden flag to enable docker CRI integration for testing
2016-09-20 11:19:26 -07:00
Kubernetes Submit Queue
12ecc60833 Merge pull request #32264 from dshulyak/enable_hostpath_provisioner
Automatic merge from submit-queue

Enable hostpath provisioner for vagrant environment

This flag is required to run e2e tests for certain features (petset), and for manual tests and debugging.

related: https://github.com/kubernetes/kubernetes/issues/32119
2016-09-20 00:30:42 -07:00
Yu-Ju Hong
1c3c1ac514 kubelet: Add a hidden flag to enable docker CRI integration
The new flag, if specified, and if --container-runtime=docker, switches
kubelet to use the new CRI implementation for testing. This is hidden flag
since the feature is still under heavy development and the flag may be changed
in the near future.
2016-09-19 13:09:00 -07:00
Kubernetes Submit Queue
3aa72fa480 Merge pull request #32926 from kubernetes/revert-32841-revert-32251-fix-oom-policy
Automatic merge from submit-queue

[kubelet] Fix oom-score-adj policy in kubelet

Fixes #32238 

We have been having this regression since v1.3. It is critical for GKE/GCE deployments of k8s because docker daemon has a high likelihood of being OOM killed which will end up nuking all containers. 
The reason for moving from mnt to pid is that docker daemon moves itself into a new mnt namespace with systemd based deployments.
2016-09-17 13:00:20 -07:00
Kubernetes Submit Queue
294502685c Merge pull request #30577 from chrislovecnm/cassandra-petset
Automatic merge from submit-queue

Pet Set Example for Cassandra

- updating cassandra to 3.7
- added pet set example
- adding pet set for Cassandra e2e tests
- changed service as we do not want a lb service, as we are running C*
- updated docs

cc @bgrant0607 

cc @kubernetes/examples 

We can probably close a couple of other open PR, since I did some other stuff.
2016-09-16 21:56:18 -07:00
Vish Kannan
a1fe3adbc7 Revert "Revert "[kubelet] Fix oom-score-adj policy in kubelet"" 2016-09-16 16:32:58 -07:00
Vish Kannan
492ca3bc9c Revert "[kubelet] Fix oom-score-adj policy in kubelet" 2016-09-15 19:28:59 -07:00
Vishnu kannan
7df2c304b6 update flag exception scripts
Signed-off-by: Vishnu kannan <vishnuk@google.com>
2016-09-14 12:43:59 -07:00
Dmitry Shulyak
c59eb6275f Enable hostpath provisioner for vagrant environment
It is required to run automated tests for certain features (petset),
and for manual tests and debugging.

Change-Id: I9203aab6d67c8ff0cc4574473e8d0af888fe1804
2016-09-14 16:58:04 +03:00