Commit Graph

11925 Commits

Author SHA1 Message Date
Kubernetes Prow Robot
6383b50ed9
Merge pull request #122213 from chendave/plan_control_node
kubeadm: update the help msg for `kubeadm upgrade plan`
2023-12-14 07:26:36 +01:00
Kubernetes Prow Robot
36d95c33b1
Merge pull request #122181 from SataQiu/clean-certs-20231205
kubeadm: cleanup unused CreateCSR and associated functions
2023-12-14 07:26:27 +01:00
Kubernetes Prow Robot
6e7f503e1a
Merge pull request #122144 from Jerry-yz/master
kubeadm: update func CreateJoinControlPlaneKubeConfigFiles variable name
2023-12-14 06:18:52 +01:00
Kubernetes Prow Robot
e4c8005fdf
Merge pull request #122128 from my-git9/configut
kubeadm: increase ut coverage of util/config
2023-12-14 06:18:07 +01:00
Kubernetes Prow Robot
d96dc5361f
Merge pull request #122061 from neolit123/1.30-fix-upgrade-plan-message-about-cm
kubeadm: remove outdated notes during upgrade
2023-12-14 05:10:28 +01:00
Kubernetes Prow Robot
040c59bb9d
Merge pull request #122013 from sanposhiho/patch-10
Fix: modify a flag doc of pod-max-in-unschedulable-pods-duration
2023-12-14 05:09:34 +01:00
Kubernetes Prow Robot
6fa0fe53a9
Merge pull request #121965 from my-git9/fixflaketoken
kubeadm: fix flaky test TestRetrieveValidatedConfigInfo
2023-12-14 05:08:58 +01:00
Kubernetes Prow Robot
60cde601a8
Merge pull request #121814 from danwinship/kubemark-iptables
Remove --use-real-proxier support from kubemark
2023-12-13 23:55:01 +01:00
Kubernetes Prow Robot
5852244b89
Merge pull request #121727 from my-git9/versiongetterut
kubeadm: increase ut coverage app/upgrade/versiongetter
2023-12-13 22:35:27 +01:00
Dave Chen
39417e9d44 kubeadm: update the help msg for kubeadm upgrade plan
Explictly show the help msg that `kubeadm upgrade plan` can only run
on the node where "admin.conf" exists, normally, this is the control
plane node.

Signed-off-by: Dave Chen <dave.chen@arm.com>
2023-12-08 16:22:17 +08:00
xin.li
20b67a4d1a kubeadm: increase ut coverage of util/config
Signed-off-by: xin.li <xin.li@daocloud.io>
2023-12-06 21:21:52 +08:00
AxeZhan
210ed2ebbd add preScore for volumeBinding 2023-12-06 15:35:35 +08:00
SataQiu
56262ca56a kubeadm: cleanup unused CreateCSR and associated functions 2023-12-05 18:17:14 +08:00
Jerry-yz
0c33ada850 update func CreateJoinControlPlaneKubeConfigFiles variable name 2023-12-01 17:08:36 +08:00
Lubomir I. Ivanov
f86249c68e kubeadm: remove outdated notes during upgrade
The notes printed to the user from common.go when
loadConfig fails are outdated and incorrect.
If the config cannot be loaded the user should not be instructed
to re-upload the config with kubeadm commands. Instead they
should do it manually with kubectl.

On loadConfig() error just wrap the error in a simple message
and show it to the user.

The current setup stomps missing IsNotFound errors for Node objects.
The underlying fetching of init configuration uses
the node object to construct an initconfiguration for this
upgrade process, so if the Node is missing the kube-config CM
will be reported as missing, which is incorrect.
2023-11-27 16:11:45 +02:00
Kensei Nakada
f221098d2c Fix: modify a flag doc of pod-max-in-unschedulable-pods-duration 2023-11-23 13:24:38 +00:00
xin.li
1dcb31aebb kubeadm: fix flaky test TestRetrieveValidatedConfigInfo
Signed-off-by: xin.li <xin.li@daocloud.io>
2023-11-20 23:42:54 +08:00
Kubernetes Prow Robot
930022cf26
Merge pull request #121841 from SataQiu/fix-renew-20231110
kubeadm: support updating certificate organization during 'kubeadm certs renew'
2023-11-11 09:49:36 +01:00
SataQiu
bda722bb68 kubeadm: support updating certificate organization during 'kubeadm certs renew' 2023-11-11 14:57:50 +08:00
Lubomir I. Ivanov
2780060a78 kubeadm: change SystemPrivilegedGroup in apiserve-kubelet-client.crt
The component connection between kube-apiserver and kubelet does not
require the "O" field on the Subject to be set to the
"system:masters" privileged group. It can be a less
privileged group like "kubeadm:cluster-admins".

Change the group in the apiserve-kubelet-client
certificate specification. This cert is passed to
--kubelet-client-certificate.
2023-11-10 15:05:14 +02:00
Dan Winship
ae3235aa01 Remove --use-real-proxier support from kubemark
kubemark's proxy mode exists to test how kube-proxy affects the load
on the apiserver, not how it affects the load on the node. There's no
need to generate fake iptables commands, because that all happens
entirely independently of the api watchers.
2023-11-09 06:52:10 -05:00
xin.li
29335763fe kubeadm: increase ut coverage app/upgrade/versiongetter
Signed-off-by: xin.li <xin.li@daocloud.io>
2023-11-08 09:45:42 +08:00
Lubomir I. Ivanov
6dc11c1f21 kubeadm: ensure the kubelet and kube-apiserver wait checks go first
The addition of the "super-admin.conf" functionality required
init.go's Client() to create RBAC rules on its first creation.

However this created a problem with the "wait-control-plane" phase
of "kubeadm init" where a client is needed to connect to the
API server Discovery API's "/healthz" endpoint. The logic that ensures
the RBAC became the step where the API server wait was polled for.

To avoid this, introduce a new InitData function ClientWithoutBootstrap.
In "wait-control-plane" use this client, which has no permissions
(anonymous), but is sufficient to connect to the "/healthz".

Pending changes here would be:
- Stop using the "/healthz", instead a regular REST client from
the kubelet cert/key can be constructed.
- Make the wait for kubelet / API server linear (not in go routines).
2023-11-06 12:43:20 +02:00
Kubernetes Prow Robot
953afbb328
Merge pull request #121193 from sohankunkerkar/kubelet-config-dir
Retarget drop-in kubelet configuration dir feature to Alpha
2023-11-03 23:59:29 +01:00
Sohan Kunkerkar
ee5578be52 cmd/kubelet: fix overriding default KubeletConfig fields in drop-in configs if not set
This commit resolves an issue where certain KubeletConfig fields, specifically:
- FileCheckFrequency
- VolumeStatsAggPeriod
- EvictionPressureTransitionPeriod
- Authorization.Mode
- EvictionHard
were inadvertently overridden when not explicitly set in drop-in configs. To retain the
original values if they were absent in the drop-in configs, mergeKubeletConfigurations
uses a JSON patch merge strategy to selectively merge configurations. It prevents essential
configuration settings from being overridden, ensuring a more predictable behavior for users.

Signed-off-by: Sohan Kunkerkar <sohank2602@gmail.com>
Co-authored-by: Peter Hunt <pehunt@redhat.com>
2023-11-03 17:48:29 -04:00
Mohamed Omar Zaian
3c268b7524 etcd: Update to version 3.5.10 2023-11-02 10:30:41 +01:00
Kubernetes Prow Robot
6abff7457e
Merge pull request #116516 from aojea/servicecidr
KEP-1880 Multiple ServiceCIDR ( and IPAddress allocation)
2023-11-01 03:52:24 +01:00
Kubernetes Prow Robot
bfd67c4454
Merge pull request #121648 from neolit123/1.29-super-admin-conf
kubeadm: do not poll in TestEnsureAdminClusterRoleBindingImpl
2023-11-01 01:51:26 +01:00
Dan Winship
93860a5217 Distinguish iptables-based and nftables-based backends, do startup cleanup
When switching from iptables or ipvs to nftables, clean up old
iptables/ipvs rules. When switching the other way, clean up old
nftables rules.
2023-10-31 17:38:32 -04:00
Dan Winship
abb1a458a9 Create an nftables.Interface in nftables proxier
And update most of the comments to refer to "nftables" rather than
"iptables" (even though it doesn't actually do any nftables updating
at this point).

For now the proxy also internally creates a
utiliptablestesting.FakeIPTables to keep the existing sync code
compiling.
2023-10-31 17:38:29 -04:00
Dan Winship
1a6b9b811e Simplify nftables/proxier.go by removing localhost nodeport support
and related route_localnet setting / anti-martian-packet rule
2023-10-31 17:33:53 -04:00
Dan Winship
a70653143e Add a dummy nftables kube-proxy backend which is just a copy of iptables 2023-10-31 17:31:42 -04:00
Antonio Ojea
3edcce52e3 service cidr controller manager: use new ServiceCIDR API 2023-10-31 21:05:50 +00:00
Antonio Ojea
e3a0df26a8 remove flag cidr max size validation if gate enable 2023-10-31 21:05:06 +00:00
Antonio Ojea
4ff80864e1 service cidr controller manager
Controls the lifecycle of the ServiceCIDRs adding finalizers and
setting the Ready condition in status when they are created, and
removing the finalizers once it is safe to remove (no orphan IPAddresses)

An IPAddress is orphan if there are no ServiceCIDR containing it.

Change-Id: Icbe31e1ed8525fa04df3b741c8a817e5f2a49e80
2023-10-31 21:05:05 +00:00
Kubernetes Prow Robot
0c93f40374
Merge pull request #120995 from aroradaman/move-get-kernel-version
move GetKernelVersion out of pkg/proxy/ipvs
2023-10-31 20:23:41 +01:00
Kubernetes Prow Robot
5d03ce7ae4
Merge pull request #120354 from aroradaman/proxy-conntrack-api
Add support for `nf_conntrack_tcp_be_liberal` sysctl to kube-proxy
2023-10-31 19:15:44 +01:00
Kubernetes Prow Robot
ef658637fd
Merge pull request #121611 from atiratree/test-gated-controllers
controller descriptors should not be feature gated
2023-10-31 18:10:07 +01:00
Lubomir I. Ivanov
c2a365c6a7 kubeadm: do not poll in TestEnsureAdminClusterRoleBindingImpl
In EnsureAdminClusterRoleBindingImpl() there are a couple of
polls around CRB create calls. When testing the function
a short retry and a timeout are used. These introduce around
2x20 fake client "connections" / poll iterations under a couple
of test cases with 2 seconds overall test increase.

Given the polls in EnsureAdminClusterRoleBindingImpl()
are of type PollUntilContextTimeout() with "immediate" set to "true",
the short retry / time out can be removed when testing,
because one poll iteration is guaranteed and the tested function
is at 100% coverage with reactors and test cases.
2023-10-31 17:37:10 +02:00
Kubernetes Prow Robot
f5a5d83d7c
Merge pull request #121089 from tkashem/apf-v1
Promote APF API to v1
2023-10-31 02:39:30 +01:00
Filip Křepinský
1daf1b0705 test that controller descriptors should not be feature gated
controllers enabled by default should define feature gates in
ControllerDescriptor.requiredFeatureGates and not during a descriptor
registration in NewControllerDescriptors
2023-10-31 00:00:34 +01:00
Filip Křepinský
fed11c0793 remove unnecessary gating of taint-eviction-controller descriptor 2023-10-31 00:00:14 +01:00
Kubernetes Prow Robot
5cb83d1cd2
Merge pull request #121609 from neolit123/1.29-super-admin-conf
kubeadm: poll additional CRB create calls for kubeadm:cluster-admins
2023-10-30 21:12:00 +01:00
Kubernetes Prow Robot
e4212878dd
Merge pull request #119208 from atosatto/separate-taint-manager
Decouple TaintManager from NodeLifeCycleController (KEP-3902)
2023-10-30 21:11:33 +01:00
Kubernetes Prow Robot
ceea5fd0cb
Merge pull request #119109 from jiahuif-forks/feature/validating-admission-policy/crd-typechecking
ValidatingAdmissionPolicy - Type Checking for API Expensions types
2023-10-30 21:11:19 +01:00
Andrea Tosatto
ccda2d6fd4 kube-controller-manager: Decouple TaintManager from NodeLifeCycleController (KEP-3902) 2023-10-30 12:23:56 +00:00
Abu Kashem
b24dd44904
apiserver: enable apf v1 API 2023-10-30 07:48:22 -04:00
Lubomir I. Ivanov
05076de57f kubeadm: poll additional CRB create calls for kubeadm:cluster-admins
Poll CRB create calls for kubeadm:cluster-admins when using the
super-admin.conf credential. The prior create call that uses the
credential admin.conf was already polled. Polling this subsequent
call seems advisable to ensure that momentary errors in between
cannot trip EnsureAdminClusterRoleBindingImpl().
2023-10-30 12:51:13 +02:00
Kubernetes Prow Robot
f3560758d2
Merge pull request #114534 from ruquanzhao/skipaddons
kubeadm: Support skipping addons image pull
2023-10-30 04:20:44 +01:00
Kubernetes Prow Robot
74098ab5ad
Merge pull request #119500 from JackTroy/fix-threshold-arg
Add explanation for large-cluster-size-threshold arg
2023-10-30 02:50:10 +01:00