Commit Graph

509 Commits

Author SHA1 Message Date
Ed Bartosh
ae0f38437c kubelet: add support for dynamic resource allocation
Dependencies need to be updated to use
github.com/container-orchestrated-devices/container-device-interface.

It's not decided yet whether we will implement Topology support
for DRA or not. Not having any toppology-related code
will help to avoid wrong impression that DRA is used as a hint
provider for the Topology Manager.
2022-11-11 21:58:03 +01:00
Patrick Ohly
d2ff210c20 scheduler: add dynamic resource allocation plugin
The plugin handles the interaction with ResourceClaims that are referenced by a
Pod.
2022-11-11 21:58:03 +01:00
Patrick Ohly
0133df3929 kube-controller-manager: add ResourceClaim controller
The controller uses the exact same logic as the generic ephemeral inline volume
controller, just for inline ResourceClaimTemplate -> ResourceClaim.

In addition, it supports removal of pods from the ReservedFor field when those
pods are known to not need the claim anymore. At the moment, only this special
case is supported. Removal of arbitrary objects would imply granting full read
access to all types to determine whether a) an object is gone and b) if the
current incarnation is the one which is listed in ReservedFor. This may get
added later.
2022-11-10 20:23:50 +01:00
Michal Wozniak
ac4da3f437 Add the "patch" permission to the "pods/status" unconditionally 2022-11-09 11:56:27 +01:00
Michal Wozniak
c803892bd8 Enable the feature into beta 2022-11-09 09:02:40 +01:00
Michal Wozniak
6f54848fa0 Fix disruption controller permissions to allow patching pod's status 2022-11-03 10:19:22 +01:00
Kubernetes Prow Robot
525280d285 Merge pull request #112643 from SergeyKanzhelev/removeDynamicKubeletConfig
remove DynamicKubeletConfig feature gate from the code
2022-10-12 01:33:00 -07:00
Han Kang
db13f51db9 enable health check SLI metrics for apiserver
Change-Id: I1b43e6dfea35b8c3bfdf5daaa8b42adff2fbc786
2022-09-27 09:58:54 -07:00
Sergey Kanzhelev
39e49a91d7 remove DynamicKubeletConfig feature gate from the code 2022-09-23 23:14:19 +00:00
Michal Wozniak
bb561e0324 Fix controller policy and improve logging of related errors
Improve error logging from timed workers which are used for pod eviction

Co-authored-by: Aldo Culquicondor <1299064+alculquicondor@users.noreply.github.com>
2022-09-23 16:53:32 +02:00
m.nabokikh
00dfba473b Add auth API to get self subject attributes
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
2022-09-14 18:00:26 +02:00
Sarvesh Rangnekar
7093b10416 Introduce networking/v1alpha1 api, ClusterCIDR type
Introduce networking/v1alpha1 api group.

Add `ClusterCIDR` type to networking/v1alpha1 api group, this type
will enable the NodeIPAM controller to support multiple ClusterCIDRs.
2022-08-05 00:54:00 +00:00
Michal Wozniak
04fcbd721c Introduction of a pod condition type indicating disruption. Its reason field indicates the reason:
- PreemptionByKubeScheduler (Pod preempted by kube-scheduler)
- DeletionByTaintManager (Pod deleted by taint manager due to NoExecute taint)
- EvictionByEvictionAPI (Pod evicted by Eviction API)
- DeletionByPodGC (an orphaned Pod deleted by PodGC)PreemptedByScheduler (Pod preempted by kube-scheduler)
2022-08-02 11:12:16 +02:00
David Eads
184356ae92 allow namespace admins to use leases to encourage migration off of configmaps 2022-07-27 12:58:34 -04:00
Davanum Srinivas
a9593d634c Generate and format files
- Run hack/update-codegen.sh
- Run hack/update-generated-device-plugin.sh
- Run hack/update-generated-protobuf.sh
- Run hack/update-generated-runtime.sh
- Run hack/update-generated-swagger-docs.sh
- Run hack/update-openapi-spec.sh
- Run hack/update-gofmt.sh

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2022-07-26 13:14:05 -04:00
Jiawei Wang
760365d5c9 CSIMigration feature gate to GA 2022-06-06 21:19:19 +00:00
James Laverack
7d57d5c70d Revert "Introduce APIs to support multiple ClusterCIDRs (#108290)"
This reverts commit b9792a9dae.
2022-04-13 13:58:19 +01:00
Sarvesh Rangnekar
b9792a9dae Introduce APIs to support multiple ClusterCIDRs (#108290)
* Introduce networking/v1alpha1 api, ClusterCIDRConfig type

Introduce networking/v1alpha1 api group.

Add `ClusterCIDRConfig` type to networking/v1alpha1 api group, this type
will enable the NodeIPAM controller to support multiple ClusterCIDRs.

* Change ClusterCIDRConfig.NodeSelector type in api

* Fix review comments for API

* Update ClusterCIDRConfig API Spec

Introduce PerNodeHostBits field, remove PerNodeMaskSize
2022-03-30 19:39:00 -07:00
Kubernetes Prow Robot
c239b406f0 Merge pull request #108929 from gnufied/move-expansion-feature-gate-ga
Move all volume expansion feature gates to GA
2022-03-25 18:08:16 -07:00
Kubernetes Prow Robot
d60df5ba04 Merge pull request #108159 from pohly/logcheck
logcheck update and golangci-lint integration
2022-03-24 18:37:50 -07:00
Kubernetes Prow Robot
df790a5b06 Merge pull request #108738 from deads2k/add-eviction
allow namespace editors to evict pods
2022-03-24 12:18:41 -07:00
Hemant Kumar
9343cce20b remove ExpandPersistentVolume feature gate 2022-03-24 10:02:47 -04:00
Patrick Ohly
edffc700a4 enhance and fix log calls
Some of these changes are cosmetic (repeatedly calling klog.V instead of
reusing the result), others address real issues:

- Logging a message only above a certain verbosity threshold without
  recording that verbosity level (if klog.V().Enabled() { klog.Info... }):
  this matters when using a logging backend which records the verbosity
  level.

- Passing a format string with parameters to a logging function that
  doesn't do string formatting.

All of these locations where found by the enhanced logcheck tool from
https://github.com/kubernetes/klog/pull/297.

In some cases it reports false positives, but those can be suppressed with
source code comments.
2022-03-24 11:13:50 +01:00
David Eads
a5d3e6cd83 allow namespace editors to evict pods 2022-03-16 11:52:56 -04:00
Patrick Ohly
3a7deaa141 storage capacity: GA, always enabled, remove feature check
The code and tests for scenarios where the feature is disabled are no longer
needed because the feature is graduating to GA.
2022-03-14 20:05:45 +01:00
Kubernetes Prow Robot
85c43df3f6 Merge pull request #104244 from dgrisonnet/bootstrap-hpa-external-metrics
Add bootstrap policy for HPA external metrics
2022-03-03 08:43:48 -08:00
Kubernetes Prow Robot
effff78a1f Merge pull request #107744 from Shubham82/Adding_logs-node_authorizer
Added Logs Statement for a Pod in graph_populator.
2022-02-28 16:07:58 -08:00
Shubham Kuchhal
cdfbcf94fc Recording the Duration. 2022-02-25 13:20:01 +05:30
Shubham Kuchhal
54fb058cfb Added timestamp and verbosity value to V(5). 2022-02-24 18:33:00 +05:30
Jordan Liggitt
42c93b058e Add service account token request permissions to edit and admin clusterroles 2022-02-09 14:05:53 -05:00
Shubham Kuchhal
831a8eed68 Added Logs Statement for a Pod in graph_populator. 2022-01-25 14:11:56 +05:30
Davanum Srinivas
9405e9b55e Check in OWNERS modified by update-yamlfmt.sh
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2021-12-09 21:31:26 -05:00
Matthew Cary
bce87a3e4f controller change for statefulset auto-delete (implementation) 2021-11-17 16:48:50 -08:00
Patrick Ohly
a8c930ef46 generic ephemeral volume: graduation to GA
The feature gate gets locked to "true", with the goal to remove it in two
releases.

All code now can assume that the feature is enabled. Tests for "feature
disabled" are no longer needed and get removed.

Some code wasn't using the new helper functions yet. That gets changed while
touching those lines.
2021-10-11 20:54:20 +02:00
Patrick Ohly
466dcdfcf6 auth: use generic ephemeral volume helper functions
The name concatenation and ownership check were originally considered small
enough to not warrant dedicated functions, but the intent of the code is more
readable with them.
2021-10-11 17:33:57 +02:00
Sahil Vazirani
3988405c8d GA TTLAfterFinish 2021-10-07 16:58:50 -07:00
Damien Grisonnet
f794c8bcd4 plugin: add bootstrap policy for external metrics
Since external metrics were added, we weren't running the HPA with
metrics REST clients by default, so we had no bootstrap policy to enable
the HPA controller to talk to the external metrics API.

This change adds permissions for the HPA controller to list and get
external.metrics.k8s.io by default as already done for the
custom.metrics.k8s.io API.

Signed-off-by: Damien Grisonnet <dgrisonn@redhat.com>
2021-08-09 17:33:34 +02:00
Kubernetes Prow Robot
e847b849c4 Merge pull request #103704 from robscott/endpoints-write-remove
Remove Endpoints write access from aggregated edit role
2021-07-19 20:57:31 -07:00
Rob Scott
416efdab26 Remove Endpoints write access from aggregated edit role 2021-07-13 22:17:12 -07:00
Rob Scott
6c61ee51b9 Revert granting EndpointSlice write access to edit role
This reverts part of the change introduced by #101203.
2021-07-13 22:13:07 -07:00
Aldo Culquicondor
2dd2622188 Track Job Pods completion in status
Through Job.status.uncountedPodUIDs and a Pod finalizer

An annotation marks if a job should be tracked with new behavior

A separate work queue is used to remove finalizers from orphan pods.

Change-Id: I1862e930257a9d1f7f1b2b0a526ed15bc8c248ad
2021-07-08 17:48:05 +00:00
Tomas Coufal
44cb4a63f6 Allow write on events to edit role
Signed-off-by: Tomas Coufal <tcoufal@redhat.com>
2021-06-14 23:13:29 +02:00
Kubernetes Prow Robot
6ede5ca95f Merge pull request #101186 from jsafrane/fix-ephemeral-rbac
Fix RBAC of generic ephemeral volumes controller
2021-04-20 09:06:45 -07:00
Mike Tougeron
896bb932ef Add endpointslices to default edit & view RBAC policies 2021-04-16 13:43:32 -07:00
Jan Safranek
cfbe5f1891 Fix RBAC of generic ephemeral volumes controller
The controller must be able to "update" finalizers of all pods to make
OwnerReferencesPermissionEnforcement admission plugin happy.
2021-04-16 11:01:54 +02:00
Patrick Ohly
c4311ae754 generic ephemeral volumes: refresh rbac testdata
This is the result of
  UPDATE_BOOTSTRAP_POLICY_FIXTURE_DATA=true go test k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy

Apparently enabling the GenericEphemeralVolume feature by default
affect this test. The policy that it now tests against is indeed
the one needed for the controller.
2021-03-09 08:24:52 +01:00
Patrick Ohly
85bfd26c17 CSIStorageCapacity: update rbac test data
This is the result of
  UPDATE_BOOTSTRAP_POLICY_FIXTURE_DATA=true go test k8s.io/kubernetes/plugin/pkg/auth/authorizer/rbac/bootstrappolicy
after enabling the CSIStorageCapacity feature. This enables
additional RBAC entries for reading CSIDriver and
CSIStorageCapacity.
2021-03-08 20:52:50 +01:00
Swetha Repakula
108fd44f7c Graduate EndpointSlice feature gate to GA 2021-03-06 15:58:47 -08:00
Abdullah Gharaibeh
3c5f018f8e Add CrossNamespacePodAffinity quota scope and PodAffinityTerm.NamespaceSelector APIs, and CrossNamespacePodAffinity quota scope implementation. 2021-03-03 22:52:43 -05:00
Benjamin Elder
56e092e382 hack/update-bazel.sh 2021-02-28 15:17:29 -08:00