github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
120,455 Commits 1 Branch 31 Tags
95a159299b9be577be55550dbbca588f25580ae9
Commit Graph

48990 Commits

Author SHA1 Message Date
Kubernetes Prow Robot
95a159299b Merge pull request #122614 from tnqn/nftables-firewall 
kube-proxy: fix LoadBalancerSourceRanges not working for nftables mode
 2024-01-09 22:27:16 +01:00
Kubernetes Prow Robot
13fad117aa Merge pull request #122630 from uablrek/kube-proxy-ip-types 
Kube-proxy: use type net.IP for addresses
 2024-01-09 21:18:25 +01:00
Kubernetes Prow Robot
ccb1d08162 Merge pull request #121834 from vaibhav2107/eviction-update 
Added Imagefs inodes in default Eviction Hard
 2024-01-09 21:18:16 +01:00
Quan Tian
f21f8d9984 kube-proxy: fix LoadBalancerSourceRanges not working for nftables mode 
Previously, the firewall-check chain was run in input, forward, and
output hook but not prerouting hook. When the LoadBalancer traffic
arrived at input or forward hook, it had been DNATed to endpoint IP and
port, so the firewall-check chain didn't take effect, traffic from out
of LoadBalancerSourceRanges was not dropped.

It was not detected by unit test because the chains were sorted by
priority only, while hook should be taken into consideration.

The commit links the firewall-check chain to prerouting hook and unlinks
it from input and forward hook to ensure the traffic is filtered before
DNAT. The priorities of filter chains are updated from "DNATPriority-1"
to "DNATPriority-10" to allow third parties to insert something else
between them.

Signed-off-by: Quan Tian <qtian@vmware.com>
 2024-01-09 17:34:16 +08:00
Lars Ekman
50b3ffc71f kube-proxy: LoadBalancerSourceRanges as *net.IPNet 2024-01-09 09:17:56 +01:00
Lars Ekman
9eac24c656 kube-proxy: store ExternalIPs as net.IP 
They were stored as strings which could be non-canonical
and cause problems
 2024-01-09 09:17:50 +01:00
Lars Ekman
d2294007b0 kube-proxy: store LoadBalancerVIPs as net.IP 
They were stored as strings which could be non-canonical
and cause problems
 2024-01-09 09:17:43 +01:00
Lars Ekman
564b80b1e1 kube-proxy: don't use invalid cidrs in unit test 
CIDRs like 192.168.200.3/24 and fd00:20::1/64 replaced with
192.168.200.0/24 and fd00:20::/64
 2024-01-09 09:17:31 +01:00
Lars Ekman
41ba76d23e kube-proxy: don't use invalid cidrs in unit test 
CIDRs like 192.168.200.3/24 and fd00:20::1/64 replaced with
192.168.200.0/24 and fd00:20::/64
 2024-01-09 09:14:20 +01:00
Akihiro Suda
2e999fff02 Fix compiling e2e.test on macOS 
Fix issue 122650 (regression in PR 122552)

```
$ make WHAT=test/e2e/e2e.test
+++ [0109 10:06:53] Building go targets for darwin/amd64
    k8s.io/kubernetes/test/e2e/e2e.test (test)
package k8s.io/kubernetes/test/e2e
        imports k8s.io/kubernetes/test/e2e/common
        imports k8s.io/kubernetes/test/e2e/common/node
        imports k8s.io/kubernetes/pkg/kubelet
        imports github.com/opencontainers/runc/libcontainer/userns: C source files not allowed when not using cgo or SWIG: userns_maps.c
!!! [0109 10:06:54] Call tree:
!!! [0109 10:06:54]  1: /Users/suda/gopath/src/k8s.io/kubernetes/hack/lib/golang.sh:948 kube::golang::build_binaries_for_platform(...)
!!! [0109 10:06:54]  2: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
!!! [0109 10:06:54] Call tree:
!!! [0109 10:06:54]  1: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
!!! [0109 10:06:54] Call tree:
!!! [0109 10:06:54]  1: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
make: *** [all] Error 1
```

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2024-01-09 10:42:20 +09:00
Kubernetes Prow Robot
2cf7465755 Merge pull request #122605 from tnqn/stale-chain-cleanup 
kube-proxy: do not delete previously stale but currently active chains
 2024-01-08 17:30:53 +01:00
Kubernetes Prow Robot
919d4624a0 Merge pull request #122503 from sunbinnnnn/scheduler-extender-support-ignore-bind 
Support ignore scheduler extender error when binding
 2024-01-08 17:30:44 +01:00
Kubernetes Prow Robot
5b979a3a53 Merge pull request #122498 from Gekko0114/close 
Allow framework plugins to be closed
 2024-01-08 17:30:36 +01:00
Kubernetes Prow Robot
f538feed8c Merge pull request #122296 from tnqn/nftables-kernel-requirement 
kube-proxy: change implementation of LoadBalancerSourceRanges for wider kernel support
 2024-01-08 17:30:27 +01:00
Kubernetes Prow Robot
000abc279e Merge pull request #122645 from aojea/cleanup_ipma 
remove dead code
 2024-01-08 16:26:37 +01:00
Antonio Ojea
e46778a246 remove dead code 
Change-Id: I8e1fd101ecb32436d82363c76fa84c476b171d52
 2024-01-08 13:15:28 +00:00
Neil Sun
87816ffb2c Support ignore scheduler extender error when binding 
Signed-off-by: sunbinnnnn <sunbinnnnn@hotmail.com>
 2024-01-08 21:06:25 +08:00
Quan Tian
377f521038 kube-proxy: change implementation of LoadBalancerSourceRanges for wider kernel support 
The nftables implementation made use of concatenation of ranges when
creating the set "firewall-allow", but the support was not available
before kernel 5.6. Therefore, nftables mode couldn't run on earlier
kernels, while 5.4 is still widely used.

An alternative of concatenation of ranges is to create a separate
firewall chain for every service port that needs firewalling, and jump
to the service's firewall chain from the common firewall chain via a
rule with vmap.

Renaming from "firewall" to "firewall-ips" is required when changing the
set to the map to support existing clusters to upgrade, otherwise it
would fail to create the map. Besides, "firewall-ips" corresponds to the
"service-ips" map, later we can add use "firewall-nodeports" if it's
determined that NodePort traffic should be subject to
LoadBalancerSourceRanges.

Signed-off-by: Quan Tian <qtian@vmware.com>
 2024-01-08 19:26:38 +08:00
Quan Tian
ca8c27c480 kube-proxy: do not delete previously stale but currently active chains 
In some cases a chain could change from stale to active, but once it's
added to staleChains it would always be deleted once. When the proxier
tries to delete a previously stale but currently active chain, it would
fail and lead to errors, though it won't cause real problem thanks to
kernel's validation.

The commit removes a chain from staleChains if it becomes active.

Signed-off-by: Quan Tian <qtian@vmware.com>
 2024-01-08 17:53:52 +08:00
Nikola
5704a58810 add test for the registered feature gates 2024-01-07 18:10:25 +02:00
Kubernetes Prow Robot
b529e6ff1c Merge pull request #122622 from nayihz/cleanup_comment 
swap originalPod and modifiedPod to match the comments
 2024-01-06 14:20:50 +01:00
nayihz
edff1c3b2f swap originalPod and modifiedPod to match the comments. 2024-01-06 19:07:18 +08:00
moriya
288c00c0c7 Allow framework plugins to be closed 2024-01-06 10:11:19 +09:00
Kubernetes Prow Robot
d4678c79e7 Merge pull request #122600 from lzhecheng/credentialprovider-plugin-use-error-is 
Use errors.Is() to handle err returned by LookPath()
 2024-01-05 20:22:48 +01:00
Kubernetes Prow Robot
d39f401767 Merge pull request #122090 from carlory/remove-intree-vsphere 
remove the deprecated in-tree vsphere volume's code
 2024-01-05 16:52:22 +01:00
Kubernetes Prow Robot
d250588077 Merge pull request #121825 from carlory/clean-113 
remove duplicated check in operator_generator.go
 2024-01-05 16:52:13 +01:00
Zhecheng Li
af6e653f17 Use errors.Is() to handle err returned by LookPath() 
Signed-off-by: Zhecheng Li <zhechengli@microsoft.com>
 2024-01-05 05:07:28 +00:00
Kubernetes Prow Robot
09a5049ca7 Merge pull request #122570 from bzsuni/ut/networking/servicecidr 
KEP-1880 Add ut for pkg/registry/networking/servicecidr
 2024-01-04 22:03:32 +01:00
Kubernetes Prow Robot
6427e2c9c8 Merge pull request #122578 from carlory/lock-default-ConsistentHTTPGetHandlers 
lock GA feature-gate ConsistentHTTPGetHandlers to default
 2024-01-04 18:00:52 +01:00
Kubernetes Prow Robot
0babde6bac Merge pull request #122475 from pacoxu/patch-9 
fix nil pointer dereference when EventedPLEG is enabled
 2024-01-04 18:00:43 +01:00
Kubernetes Prow Robot
c0dc42073d Merge pull request #122373 from danwinship/linux-proxy 
Properly build-tag the Linux kube-proxy backend code
 2024-01-04 18:00:34 +01:00
Kubernetes Prow Robot
a21487f78b Merge pull request #122138 from ii2day/ga/remove_KubeletPodResourcesGetAllocatable 
Remove GA featuregate about KubeletPodResourcesGetAllocatable in 1.30
 2024-01-04 17:59:57 +01:00
Kubernetes Prow Robot
744b2db652 Merge pull request #122135 from Rei1010/sidecarContainerToBeta 
Add SidecarContainers feature beta version
 2024-01-04 17:59:48 +01:00
Kubernetes Prow Robot
2b1ccec47e Merge pull request #122087 from fatsheep9146/fix-kubelet-trace-broke 
fix kubelet trace broke in 1.28
 2024-01-04 17:59:39 +01:00
Kubernetes Prow Robot
e1576c8e43 Merge pull request #121924 from saschagrunert/leaky 
Remove `leaky` package and move `PodInfraContainerName` to staging
 2024-01-04 17:59:30 +01:00
Kubernetes Prow Robot
c96d7a5b5a Merge pull request #121774 from charles-chenzz/increase_timeout_in_dra_shouldTimeOut 
increase timeout in fakeDraDriverGrpcServer to fix flake
 2024-01-04 17:59:12 +01:00
Kubernetes Prow Robot
2efed1f1cb Merge pull request #120291 from lzhecheng/fix-credentialprovider-win-bin-path 
Fix Windows credential provider cannot find binary
 2024-01-04 17:58:54 +01:00
Kubernetes Prow Robot
f12529c2f2 Merge pull request #118756 from sxllwx/bugfix/cascade-ctx 
namespace-controller: Correctly cascade ctx when making API calls
 2024-01-04 17:58:45 +01:00
Kubernetes Prow Robot
014149d66e Merge pull request #121565 from srivastav-abhishek/logs_test_datarace 
[FLAKE] Fixed UT pkg/kubelet/kuberuntime/logs/TestReadRotatedLog caused due to data race
 2024-01-04 16:49:23 +01:00
bzsuni
289bd72631 Add ut for pkg/registry/networking/servicecidr 
Signed-off-by: bzsuni <bingzhe.sun@daocloud.io>
 2024-01-04 23:09:29 +08:00
Kubernetes Prow Robot
692be54671 Merge pull request #122508 from carlory/fix-122337 
remove wrong warning event (FileSystemResizeFailed) for pod
 2024-01-04 14:42:49 +01:00
Kubernetes Prow Robot
a65dcd616e Merge pull request #122086 from bzsuni/ga/ExpandedDNSConfig 
Remove GA featuregate about ExpandedDNSConfig in 1.30
 2024-01-04 14:42:42 +01:00
carlory
55c5db172e lock GA feature-gate ConsistentHTTPGetHandlers to default 2024-01-04 15:12:08 +08:00
carlory
55e1646fa4 removed the deprecated azureFile in-tree storage plugin 2024-01-04 14:41:33 +08:00
Kubernetes Prow Robot
8609b8c22c Merge pull request #119779 from sanposhiho/prefilterexec 
run all PreFilter when the preemption will happen later in the same scheduling cycle
 2024-01-03 16:16:09 +01:00
Kubernetes Prow Robot
c015565db3 Merge pull request #122449 from carlory/kep-3751-api-changes 
ValidateVolumeAttributesClassUpdate also validates new vac object.
 2024-01-03 10:29:48 +01:00
Kubernetes Prow Robot
1850794626 Merge pull request #122139 from bzsuni/ga/KubeletPodResources 
Remove GA featuregate about KubeletPodResources in 1.30
 2024-01-02 19:56:33 +01:00
Kubernetes Prow Robot
adc256ff04 Merge pull request #122409 from Rei1010/removeKubeletPodResourcesGetAllocatable 
Remove GA feature gate LegacyServiceAccountTokenTracking in 1.30
 2024-01-02 18:04:35 +01:00
Kensei Nakada
09abd6be5a address reviews 2024-01-02 02:10:41 +00:00
Kensei Nakada
5ab2317947 run all PreFilter when the preemption will happen later in the same scheduling cycle 2024-01-01 09:44:06 +00:00