github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
96,061 Commits 1 Branch 31 Tags 1,019 MiB
acb43c7c4a
Commit Graph

422 Commits

Author SHA1 Message Date
hwdef
b3377e61de pkg/kubeapiserver: fix staticcheck warning 2019-11-14 11:24:22 +08:00
Kubernetes Prow Robot
94efa988f4
Merge pull request #84813 from deads2k/admission-feature-gates 
remove global variable dependency from admission plugins
 2019-11-12 10:23:14 -08:00
Jordan Liggitt
d54a70db5c Switch kubelet/aggregated API servers to use v1 subjectaccessreviews 2019-11-11 17:19:11 -05:00
Jordan Liggitt
5ef4fe959a Switch kubelet/aggregated API servers to use v1 tokenreviews 2019-11-11 17:19:10 -05:00
Kubernetes Prow Robot
49a9b6cadf
Merge pull request #84727 from danwinship/ipv6-bind 
fix apiserver to advertise IPv6 endpoints if bound to IPv6
 2019-11-08 18:44:24 -08:00
David Eads
675c2fb924 add featuregate inspection as admission plugin initializer 2019-11-08 13:07:40 -05:00
Dan Winship
afa0b808f8 Fix apiserver to advertise IPv6 endpoints if bound to IPv6 
Also rename utilnet.ChooseBindAddress() to ResolveBindAddress(), to
better describe its functionality.
 2019-11-06 11:31:43 -05:00
Kubernetes Prow Robot
2aeacf025b
Merge pull request #84723 from hypnoglow/fix-golint-kubeapiserver 
Fix golint issues in pkg/kubeapiserver
 2019-11-05 22:18:20 -08:00
Igor Zibarev
03dfa1a641 Fix golint issues in pkg/kubeapiserver 2019-11-05 22:25:32 +03:00
Kubernetes Prow Robot
1d1385af91
Merge pull request #83474 from msau42/topology-ga 
CSI Topology ga
 2019-11-04 15:28:27 -08:00
Michelle Au
603a2aa8a9 Add CSINode to storage/v1 2019-10-28 13:41:13 -07:00
Jordan Liggitt
20b2439457 Feature-gate RuntimeClass informer starts 2019-10-24 01:18:07 -04:00
David Eads
6beb96261e wire up a means to dynamically reload ca bundles for kube-apiserver 2019-10-23 11:01:56 -04:00
draveness
1163a1d51e feat: update taint nodes by condition to GA 2019-10-19 09:17:41 +08:00
David Eads
5825634669 add the ability for dynamic header names in delegated authentication 2019-10-11 11:50:37 -04:00
David Eads
51195dd860 add ability to authenticators for dynamic update of certs 2019-10-01 09:50:20 -04:00
Kubernetes Prow Robot
478c26c0dc
Merge pull request #82033 from logicalhan/reviewers 
add logicalhan to reviewers for api-machinery directories
 2019-09-26 16:55:37 -07:00
mengyang02
da072063d1 to use existing validating function 2019-09-24 20:16:17 +08:00
Ted Yu
cdc1b71bde WithAuthentication should wrap WithMaxInFlightLimit 2019-09-19 13:39:49 -07:00
Kubernetes Prow Robot
8af33f9733
Merge pull request #81946 from deads2k/cache 
add cache-control headers to kube-apiserver
 2019-08-28 05:11:39 -07:00
Han Kang
b6831039b7 add logicalhan to reviewers for api-machinery directories 2019-08-27 10:40:29 -07:00
David Eads
f589c1213c add cache-control headers to kube-apiserver 2019-08-26 13:00:31 -04:00
Tim Allclair
c6173b28a9 Enable the RuntimeClass admission controller for scheduling 2019-08-23 13:33:06 -07:00
Jordan Liggitt
61774cd717 Plumb context to admission Admit/Validate 2019-08-20 11:11:00 -04:00
Ted Yu
3d2bc6f6ae Constant time password comparison 2019-08-07 22:07:57 -07:00
Kubernetes Prow Robot
e4f1588352
Merge pull request #78484 from egernst/runtimeclass-admission 
Runtimeclass admission
 2019-06-28 23:35:24 -07:00
draveness
ca6003bc75 feat: cleanup PodPriority features gate 2019-06-23 11:57:24 +08:00
Eric Ernst
e8608300c2 autogenerated code update based in new plugin 
Signed-off-by: Eric Ernst <eric.ernst@intel.com>
 2019-06-19 17:20:11 -07:00
Eric Ernst
2d326345f2 add RuntimeClass admission controller plugin 
Signed-off-by: Eric Ernst <eric.ernst@intel.com>
 2019-06-19 17:20:11 -07:00
Jordan Liggitt
9469fc0a71 Map replicationcontrollers/scale to extensions/v1beta1 replicationcontrollers/scale 2019-05-28 14:30:20 -04:00
SataQiu
64193630a7 cleanup: move the comment to its place 2019-05-23 12:29:12 +08:00
Daniel (Shijun) Qian
5268f69405 fix duplicated imports of k8s code (#77484) 
* fix duplicated imports of api/core/v1

* fix duplicated imports of client-go/kubernetes

* fix duplicated imports of rest code

* change import name to more reasonable
 2019-05-08 10:12:47 -07:00
Christopher M. Luciano
4bac85c162
ingress: use networking api group for default storage of ingress 
Signed-off-by: Christopher M. Luciano <cmluciano@us.ibm.com>

The change to registrytest was found by liggitt to mitigate a NPE error.
This is necessary since ingress is a cohabitating resource that is not
stored in the default version for the networking resource.

Signed-off-by: Christopher M. Luciano <cmluciano@us.ibm.com>
 2019-05-01 15:14:11 -04:00
Kubernetes Prow Robot
98b6f35999
Merge pull request #74610 from oomichi/issue/74038-2 
Enable StorageObjectInUseProtection by default
 2019-04-16 02:11:29 -07:00
yue9944882
65ba58a9a5 remove internal client dependency in pkg/* 2019-04-09 21:43:51 +08:00
Kubernetes Prow Robot
dccb8ab5b0
Merge pull request #74615 from andrewsykim/delete-pvl-controller 
Delete the out-of-tree PV labeler controller
 2019-03-05 08:16:03 -08:00
Xing Yang
bb45b8ee34 Make CSINodeInfo and CSIDriver Core APIs 
This PR is the first step to transition CSINodeInfo and CSIDriver
CRD's to in-tree APIs. It adds them to the existing API group
“storage.k8s.io” as core storage APIs.
 2019-03-02 12:31:05 -08:00
Andrew Kim
01933b02a3 replace usage of v1beta1 VolumeAttachments with v1 2019-02-27 15:42:12 -05:00
Andrew Kim
2901def8c3 delete the persistentvolume labeler controller 2019-02-26 14:23:20 -05:00
Kenichi Omichi
ede5477697 Enable StorageObjectInUseProtection by default 
StorageObjectInUseProtection plugin of admission controller adds
the flag `kubernetes.io/pvc-protection` or `kubernetes.io/pv-protection`
to newly created PVCs or PV. In case a user deletes a PVC or PV the PVC
or PV is not removed until the finalizer is removed from the PVC or PV
by PVC or PV Protection Controller.
We are testing this plugin on the e2e tests of "PV Protection" because
most setup scripts enable that like:

* cluster/centos/config-default.sh: Enabled
* cluster/gce/config-default.sh: Enabled
* cluster/gce/config-test.sh: Enabled
* cluster/kubemark/gce/config-default.sh: Enabled
* hack/local-up-cluster.sh: Enabled
* cluster/juju/layers/kubernetes-master/reactive/kubernetes_master.py: Disabled

As we are testing it normally, it is nice to enable the plugin by
default.
 2019-02-26 18:08:44 +00:00
Kubernetes Prow Robot
b5566c7818
Merge pull request #71896 from awly/client-go-keyutil 
client-go: extract new keyutil package from util/cert
 2019-02-23 01:43:16 -08:00
Mike Danese
47043bcac1 enforce that cloud providers are only linked in main or app packages 2019-02-22 11:56:39 -08:00
Jordan Liggitt
8c28d3f63c Add networking.k8s.io/v1beta1 Ingress 2019-02-20 16:41:14 -05:00
Andrew Lytvynov
18458392ca Extract new keyutil package from client-go/util/cert 
This package contains public/private key utilities copied directly from
client-go/util/cert. All imports were updated.

Future PRs will actually refactor the libraries.

Updates #71004
 2019-02-19 09:48:59 -08:00
Kubernetes Prow Robot
0ffd59e403
Merge pull request #74154 from mbohlool/gimli 
Use Request Object interfaces instead of static scheme that is more appropriate for CRDs
 2019-02-19 07:21:53 -08:00
Mehdy Bohlool
0f186323bc Update generated files 2019-02-16 13:28:48 -08:00
Mehdy Bohlool
cebb4ee2ac Remove the propagated scheme from the Admission chain 2019-02-16 13:28:47 -08:00
Mehdy Bohlool
513a87c7b2 Add ObjectInterfaces to Admission and Validation 2019-02-16 13:28:47 -08:00
Marek Counts
160ed26c20 autogen files to support new project structure. 2019-02-15 10:29:31 -05:00
Marek Counts
7744f90830 Moved flag and globalflag 
Moved all flag code from `staging/src/k8s.io/apiserver/pkg/util/[flag|globalflag]` to `component-base/cli/[flag|globalflag]` except for the term function because of unwanted dependencies.
 2019-02-15 10:28:13 -05:00
Chao Xu
1f2e2e61cf generated 2019-02-12 15:04:57 -08:00
Chao Xu
3f21ca029a changing imports 2019-02-12 10:06:04 -08:00
Kubernetes Prow Robot
0ae81c986a
Merge pull request #67678 from caesarxuchao/remove-storage-versions-flag 
Remove storage versions flag
 2019-02-11 17:40:27 -08:00
Roy Lenferink
b43c04452f Updated OWNERS files to include link to docs 2019-02-04 22:33:12 +01:00
Chao Xu
bed7696876 generated BUILD files 2019-01-30 13:28:48 -08:00
Chao Xu
1281243860 Remove the --storage-versions flag from kube-apiserver. 
The storage version now is solely decided by the
scheme.PrioritizedVersionsForGroup(). For cohabitating resources, the storage
version will be that of the overriding group as returned by
storageFactory.getStorageGroupResource().
 2019-01-30 13:28:48 -08:00
Jordan Liggitt
89b0b0b84b Clean up initializer-related comments, test data 2019-01-25 12:37:45 -05:00
Kubernetes Prow Robot
d654b49c0e
Merge pull request #73097 from bsalamat/fix_taint_nodes 
Add NotReady taint to new nodes during admission
 2019-01-24 23:46:23 -08:00
Bobby (Babak) Salamat
763cb708d1 Autogenerated files 2019-01-24 10:31:23 -08:00
Bobby (Babak) Salamat
c2a4d2cbdf Add a default admission controller to taint new nodes on creation. 2019-01-24 10:31:23 -08:00
Jordan Liggitt
1a15d80967 generated 2019-01-23 16:34:44 -05:00
Jordan Liggitt
17aa60686e Deprecate and remove use of alpha metadata.initializers field, remove IncludeUninitialized options 2019-01-23 16:34:43 -05:00
Jordan Liggitt
dc1fa870bf Remove alpha InitializerConfiguration types, Initializers admission plugin 2019-01-23 11:37:39 -05:00
Walter Fender
97426ce7a5 Adding cheftako to reviewers 
Also adding as an owners to pkg/cloudprovider.
 2018-12-27 15:25:20 -08:00
lovejoy
d437305cbf
Fix the authorization-policy-file description 
Actually this is in a format like below not a csv format
```json
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group":"system:authenticated",  "namespace": "*", "resource": "*","apiGroup": "*"}}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group":"system:authenticated",  "namespace": "*", "resource": "ingresses","apiGroup": "extensions"}}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group":"system:authenticated",  "namespace": "*", "resource": "*","apiGroup": "apiextensions.k8s.io"}}
```
 2018-12-24 14:54:34 +08:00
k8s-ci-robot
e5326f22ea
Merge pull request #70471 from xichengliudui/fix181031 
Fix some typos
 2018-11-29 00:48:16 -08:00
Mike Danese
effad15ecc patch webhook authenticator to support token review with arbitrary audiences 2018-11-16 19:30:42 -05:00
k8s-ci-robot
b1a52a38e9
Merge pull request #67257 from pbarker/audit 
dynamic audit configuration
 2018-11-15 02:42:59 -08:00
Patrick Barker
5cb70e369f adds dynamic audit configuration generated 2018-11-15 01:03:45 +00:00
Patrick Barker
eb89d3dddd adds dynamic audit configuration 2018-11-14 17:54:06 -07:00
Mike Danese
67bbf753cb retrofit svcacct token authenticator to support audience validation 2018-11-13 20:38:41 -08:00
k8s-ci-robot
bd2cb5a72d
Merge pull request #70831 from mikedanese/securesvcacct 
add BoundServiceAccountTokenVolume feature
 2018-11-13 08:54:25 -08:00
k8s-ci-robot
27cf50d85e
Merge pull request #70322 from mikedanese/audoidc 
make oidc authenticator (more?) audience aware
 2018-11-12 17:03:29 -08:00
Mike Danese
f4ff26679f add BoundServiceAccountTokenVolume feature 
* require TokenRequest to be enabled and configured
* bind ca.crt publisher to this feature rather than to TokenRequest
 2018-11-12 13:11:47 -08:00
Mike Danese
a714d9cd04 make oidc authenticator (more?) audience aware 
Part of https://github.com/kubernetes/kubernetes/issues/69893
 2018-11-12 12:43:21 -08:00
Davanum Srinivas
954996e231
Move from glog to klog 
- Move from the old github.com/golang/glog to k8s.io/klog
- klog as explicit InitFlags() so we add them as necessary
- we update the other repositories that we vendor that made a similar
change from glog to klog
  * github.com/kubernetes/repo-infra
  * k8s.io/gengo/
  * k8s.io/kube-openapi/
  * github.com/google/cadvisor
- Entirely remove all references to glog
- Fix some tests by explicit InitFlags in their init() methods

Change-Id: I92db545ff36fcec83afe98f550c9e630098b3135
 2018-11-10 07:50:31 -05:00
k8s-ci-robot
0aba557741
Merge pull request #70600 from liggitt/sig-auth-subprojects 
Add owners/approvers aliases for sig-auth subprojects
 2018-11-06 17:55:07 -08:00
k8s-ci-robot
50de3a0d79
Merge pull request #69659 from cheftako/lintClean3 
Fixes lint errors in kubeapiserver packages
 2018-11-06 14:02:05 -08:00
Jordan Liggitt
9ae79f9653 authorizers subproject approvers/reviewers 2018-11-06 00:57:38 -05:00
Jordan Liggitt
4fa2a0cc8a authenticators subproject approvers/reviewers 2018-11-06 00:57:38 -05:00
k8s-ci-robot
c8604653f0
Merge pull request #70449 from mikedanese/simplcache 
remove webhook cache implementation and replace with token cache
 2018-11-05 16:32:34 -08:00
Mike Danese
0ec4d6d396 remove webhook cache implementation and replace with the token cache 
The striped cache used by the token cache is slightly more sophisticated
however the simple cache provides about the same exact behavior. I used
the striped cache rather than the simple cache because:

* It has been used without issue as the primary token cache.
* It preforms better under load.
* It is already exposed in the public API of the token cache package.
 2018-11-05 13:08:45 -08:00
walter
2af982abb9 Fixes lint errors in kubeapiserver packages 
Fixes lint errors in kubeapiserver/admission, kubeapiserver/authorizer,
kubeapiserver/authenticator. Also enables lint testing of these
directories.
Fixed go format.
Fixed changes from config.
 2018-11-04 17:22:41 -08:00
Patrick Barker
d33f347ba8 refactors kubeapiserver webhook utility to be generic generated 2018-11-02 11:42:04 -06:00
Patrick Barker
1081fffdd5 refactors kubeapiserver webhook utility to be generic 2018-11-02 11:41:58 -06:00
Mike Danese
34cc8eeac7 wrap all audience unaware authenticators in kube-apiserver 2018-10-31 15:31:49 -07:00
xichengliudui
8477389e7c Fix some types 
Fix some typos
 2018-10-31 04:05:25 -04:00
k8s-ci-robot
1f0f4cd7eb
Merge pull request #70308 from mikedanese/trev7 
default api audiences to service account token issuer if available
 2018-10-29 22:08:01 -07:00
Mike Danese
a13b48de94 default api audiences to service account token issuer if available 
This is a sane default that users can choose to migrate away from later.
 2018-10-29 16:40:06 -07:00
zuoxiu.jm
efeec1edee remove internal informer/lister generator 2018-10-29 11:37:55 +08:00
zuoxiu.jm
7f608eb5df prune internal informer from kubeapiserver constructor 2018-10-29 11:30:44 +08:00
yue9944882
6a8faa6e40 replace contrustor of ad controller with config.complete.new flow 
review:
1. import order
2. only set nil field on complete
3. replace hardcoded default namespace
 2018-10-26 11:49:37 +08:00
Kim Min
79599ac419 Prune internal clientset/informer from kubeapiserver admission initializer (#70167) 
* externalize pv resize admission controller

* externalize podtolerationrestriction admission controller

* externalize podnodeselector admission controller

* remove internal clientset/informer from kubeapiserver admission initializer

* minor change: fixes scheduler integration test compiliation
 2018-10-24 14:47:16 -07:00
Mike Danese
371b1e7fed promote --service-account-api-audiences to top level kube-apiserver config 
The service account authenticator isn't the only authenticator that
should respect API audience. The authentication config structure should
reflect that.
 2018-10-22 18:21:37 -07:00
k8s-ci-robot
cf3a930938
Merge pull request #69607 from mikedanese/audctx 
tokenreview: add APIAudiences config to generic API server and augment context
 2018-10-15 19:03:43 -07:00
k8s-ci-robot
793b8752d1
Merge pull request #68777 from stewart-yu/patch-1 
remove unneed parameter in test struct
 2018-10-12 16:01:23 -07:00
Mike Danese
21fd8f2041 tokenreview: add APIAudiences config to generic API server and augment context 2018-10-09 22:47:10 -07:00
Christoph Blecker
97b2992dc1
Update gofmt for go1.11 2018-10-05 12:59:38 -07:00
walter
6990a6392a Cleaned up lint errors in pkg/kubeapiserver/server. 2018-09-26 23:12:30 -07:00
Stewart-YU
5ef8e41215 remove unneed parameter in test struct 
remove unneed parameter in test struct
 2018-09-26 08:59:42 +08:00