github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
122,356 Commits 1 Branch 31 Tags 1,019 MiB
96a144c977
Commit Graph

108 Commits

Author SHA1 Message Date
Dr. Stefan Schimanski
96a144c977
Address comments 
Signed-off-by: Dr. Stefan Schimanski <stefan.schimanski@gmail.com>
 2024-04-26 17:47:30 +02:00
Dr. Stefan Schimanski
e37917fea7
pkg/controlplane: split up config into generic controlplane and kube-related part 
Signed-off-by: Dr. Stefan Schimanski <stefan.schimanski@gmail.com>
 2024-04-26 14:14:06 +02:00
Nilekh Chaudhari
91a7708cdc
feat: implements Storage Version Migration API in-tree 
Signed-off-by: Nilekh Chaudhari <1626598+nilekhc@users.noreply.github.com>
 2024-03-08 04:18:56 +00:00
Antonio Ojea
3b450378e0 bootstrap controller for default ServiceCIDR 
The bootstrap controller for ServiceCIDR ensures that the default
ServiceCIDR is created from the existing flags.

It follows the same behavior than the kubernetes.default Service,
it only creates the default ServiceCIDR if it doesn't exist, but
does not modify it despite the parameters doesn't match.

review: bootstrap controller for default ServiceCIDR
 2023-10-31 21:05:04 +00:00
Abu Kashem
b24dd44904
apiserver: enable apf v1 API 2023-10-30 07:48:22 -04:00
Dr. Stefan Schimanski
581af9ba6d
kube-apiserver: use only one client in apiserver controllers 
Signed-off-by: Dr. Stefan Schimanski <stefan.schimanski@gmail.com>
 2023-10-10 16:49:56 +02:00
bzsuni
7c33b78418
remove resource flowschemas and prioritylevelconfigurations for legacyBetaEnabledByDefaultResources in v1.29 
Signed-off-by: bzsuni <bingzhe.sun@daocloud.io>
 2023-09-04 21:54:51 +08:00
SataQiu
2825519da2 apf: remove v1alpha1 API 2023-08-30 20:48:42 +08:00
SataQiu
213ed03c00 remove deprecated kube-apiserver identity lease garbage collector 2023-07-25 10:10:18 +08:00
Alexander Zielenski
88becfc0ba api: add v1beta1 ValidatingAdmissionPolicy/Binding types and storage 2023-07-20 13:24:09 -07:00
Richa Banker
cd5f3d9f9d Add impl for uvip 2023-07-18 17:36:22 -07:00
carlory
850dc6123a Remove ability to re-enable serving deprecated policyv1beta1 APIs 2023-07-18 10:24:26 +08:00
Antonio Ojea
c5147c91b8 controlplane: kubernetes.default controller stop polling 
the kubernetesservice controller is in charge of reconciling the
kubernetes.default service with the first IP in the service CIDR range
and port 443, it also maintains the Endpoints associated to the Service
using the configure EndpointReconciler.

Until now, the controller was creating the default namespace if it
doesn't exist , and creating the kubernetes.default service if it
doesn't exist too. However, it was polling the Service in each loop,
with this change we reuse the apiserver informers to watch the Service
instead of polling.

It also removes the logic to create the default network namespace, since
this is part of the systemnamespaces controller now.

Change-Id: I70954f8e6309e7af8e4b749bf0752168f0ec2c42
Signed-off-by: Antonio Ojea <aojea@google.com>
 2023-07-13 10:41:06 +00:00
Dr. Stefan Schimanski
a34e06e74c
kube-apiserver/corerest: structure Config 2023-07-11 17:27:20 +02:00
Dr. Stefan Schimanski
75e3576523
kube-apiserver: rewire service controllers: kubernetesservice + IP repair 2023-07-11 17:27:20 +02:00
Dr. Stefan Schimanski
c733c57962
pkg/controlplane: wire core storage as RESTStorageProvider 2023-07-05 16:46:40 +02:00
Dr. Stefan Schimanski
68aee61d4f
SPLIT: kube-apiserver/corerest: split out service IP setup logic 2023-07-05 11:00:37 +02:00
Dr. Stefan Schimanski
dad3e4d211
SPLIT: kube-apiserver/corerest: split constructor 2023-07-05 09:45:20 +02:00
Dr. Stefan Schimanski
4149933ed2
kube-apiserver: move "public IP matches IP family" check to option validation 2023-07-04 22:28:27 +02:00
Dr. Stefan Schimanski
616c959988
FIXUP: pkg/controlplane: move bootstrap controller to controllers/kubernetesservice 2023-07-04 16:38:14 +02:00
Dr. Stefan Schimanski
764da8a01d
FIXUP: cmd/kube-apiserver/app/options: split apart controlplane part 2023-06-26 21:50:38 +02:00
carlory
e7396e3551 remove ability to re-enable serving deprecated versions of the runtimeclasses kind 2023-05-02 22:40:26 +08:00
carlory
da922f0af6 Remove ability to re-enable serving deprecated discoveryv1beta1 APIs 2023-04-30 19:21:46 +08:00
carlory
944a4cd311 Remove ability to re-enable serving deprecated autoscalingapiv2beta APIs 2023-04-29 16:51:48 +08:00
Kubernetes Prow Robot
4ca7bcec24
Merge pull request #117665 from carlory/fix-007 
Remove ability to re-enable serving deprecated eventv1beta1 APIs
 2023-04-28 11:08:27 -07:00
carlory
f81b49d873 Remove ability to re-enable serving deprecated eventv1beta1 APIs 2023-04-28 14:58:59 +08:00
carlory
48d01d6d9b Remove ability to re-enable serving deprecated batchapiv1beta1 APIs 2023-04-28 14:08:31 +08:00
Taahir Ahmed
6a75e7c40c ClusterTrustBundles: Define types 
This commit is the main API piece of KEP-3257 (ClusterTrustBundles).

This commit:

* Adds the certificates.k8s.io/v1alpha1 API group
* Adds the ClusterTrustBundle type.
* Registers the new type in kube-apiserver.
* Implements the type-specfic validation specified for
  ClusterTrustBundles:
  - spec.pemTrustAnchors must always be non-empty.
  - spec.signerName must be either empty or a valid signer name.
  - Changing spec.signerName is disallowed.
* Implements the "attest" admission check to restrict actions on
  ClusterTrustBundles that include a signer name.

Because it wasn't specified in the KEP, I chose to make attempts to
update the signer name be validation errors, rather than silently
ignored.

I have tested this out by launching these changes in kind and
manipulating ClusterTrustBundle objects in the resulting cluster using
kubectl.
 2023-03-15 20:10:18 -07:00
Antonio Ojea
e6f197a991 plumb new ipallocators in the apiserver 
plumb the new allocators from the control-plane instance to the
registry_core

Change-Id: I240cc91942260f725492597f1b599f7480560b1e
 2023-03-14 22:58:11 +00:00
Patrick Ohly
29941b8d3e api: resource.k8s.io v1alpha1 -> v1alpha2 
For Kubernetes 1.27, we intend to make some breaking API changes:
- rename PodScheduling -> PodSchedulingHints (https://github.com/kubernetes/kubernetes/issues/114283)
- extend ResourceClaimStatus (https://github.com/kubernetes/enhancements/pull/3802)

We need to switch from v1alpha1 to v1alpha2 for that.
 2023-03-14 07:52:03 +01:00
Paco Xu
49032c394c The storage.k8s.io/v1beta1 API version of CSIStorageCapacity will no longer be served in v1.27. 2023-03-13 15:06:04 +08:00
Antonio Ojea
6e78e3279a consider default a system namespace to be managed by the namespace controller 
Change-Id: I08d68c18234404c1258aa003211d82e2e72dadb1
 2023-03-10 17:49:53 +00:00
Antonio Ojea
eecfaf658e decouple system namespaces from bootstrap controller 
Use an informer instead of polling.

Change-Id: Ib071e53addb914fcb31d8a1346cf61ca6d22520b
 2023-03-10 17:49:47 +00:00
Maksim Nabokikh
c1431af4f8
KEP-3325: Promote SelfSubjectReview to Beta (#116274) 
* Promote SelfSubjectReview to Beta

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

* Fix whoami API

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

* Fixes according to code review

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

---------

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
 2023-03-08 15:42:33 -08:00
Patrick Ohly
dad95e1be6 update lease controller 
Passing in a context instead of a stop channel has several advantages:
- ensures that client-go calls return as soon as the controller is asked to stop
- contextual logging can be used

By passing that context down to its own functions and checking it while
waiting, the lease controller also doesn't get stuck in backoffEnsureLease
anymore (https://github.com/kubernetes/kubernetes/issues/116196).
 2023-03-02 15:06:00 +01:00
Andrew Sy Kim
a7de3e15a5 apiserver: use the identity value in the apiserver identity hash 
Signed-off-by: Andrew Sy Kim <andrewsy@google.com>
 2023-01-13 16:20:14 -05:00
Andrew Sy Kim
3da0f1809c apiserver: update lease label key to apiserver.kubernetes.io/identity 
Signed-off-by: Andrew Sy Kim <andrewsy@google.com>
 2023-01-13 15:37:22 -05:00
Jordan Liggitt
78cb3862f1
Fix indentation/spacing in comments to render correctly in godoc 2022-12-17 23:27:38 -05:00
Iceber Gu
034292718a remove enabled by default beta resources that have been removed 
Signed-off-by: Iceber Gu <wei.cai-nat@daocloud.io>
 2022-12-08 13:28:24 +08:00
Patrick Ohly
5cca60f0b8 api: dynamic resource allocation API 
This adds a new resource.k8s.io API group with v1alpha1 as version. It contains
four new types: resource.ResourceClaim, resource.ResourceClass, resource.ResourceClaimTemplate, and
resource.PodScheduling.
 2022-11-10 20:08:24 +01:00
Kubernetes Prow Robot
3a99a5954d
Merge pull request #113629 from andrewsykim/apiserver-identity-beta 
Promote APIServerIdentity to Beta
 2022-11-08 12:43:10 -08:00
Kubernetes Prow Robot
595ea32411
Merge pull request #113314 from cici37/celIntegration 
CEL validation in Admission chain
 2022-11-07 17:08:33 -08:00
Andrew Sy Kim
d24f93e4a4 pkg/controlplane: update lease parameters into public variables so they can be set by integration tests 
Signed-off-by: Andrew Sy Kim <andrewsy@google.com>
 2022-11-07 19:36:22 -05:00
Andrew Sy Kim
02020b20e7 kube-apiserver: remove flags --identity-lease-duration-seconds and --identity-lease-renew-interval-seconds 
Signed-off-by: Andrew Sy Kim <andrewsy@google.com>
 2022-11-07 19:36:22 -05:00
Cici Huang
d3f48136d0 Add Authz check to validate policy and binding. 
Co-authored-by: Jiahui Feng <jhf@google.com>
Co-authored-by: Jordan Liggitt <liggitt@google.com>
 2022-11-07 21:29:56 +00:00
Cici Huang
0486e06261 Adding new api version of admissionregistration.k8s.io v1alpha1 for CEL in Admission Control 2022-11-07 20:51:51 +00:00
Andrew Sy Kim
72f2e1cc0d lease controller: update NewController to accept leaseName as a parameter, remove NewControllerWithLeaseName 
Signed-off-by: Andrew Sy Kim <andrewsy@google.com>
 2022-11-04 00:44:13 -04:00
Andrew Sy Kim
3c0b75f4ad apiserver identity: always use a unique value for the Lease holder identity 
Signed-off-by: Andrew Sy Kim <andrewsy@google.com>
 2022-11-03 22:53:56 -04:00
Andrew Sy Kim
21507902ba apiserver identity: use persistent identity format based on hostname 
Signed-off-by: Andrew Sy Kim <andrewsy@google.com>
 2022-11-03 22:53:56 -04:00
Shihang Zhang
569cd70a52 track legacy service account tokens 2022-10-24 09:37:53 -07:00