Commit Graph

49 Commits

Author SHA1 Message Date
Xing Yang
85867e5625 Modify node admission and node authorizer 2019-03-04 16:42:12 -08:00
Andrew Kim
01933b02a3 replace usage of v1beta1 VolumeAttachments with v1 2019-02-27 15:42:12 -05:00
Roy Lenferink
b43c04452f Updated OWNERS files to include link to docs 2019-02-04 22:33:12 +01:00
Jordan Liggitt
16e355791f Improve node authorizer and noderestriction forbidden messages 2018-11-24 09:31:10 -05:00
Davanum Srinivas
954996e231
Move from glog to klog
- Move from the old github.com/golang/glog to k8s.io/klog
- klog as explicit InitFlags() so we add them as necessary
- we update the other repositories that we vendor that made a similar
change from glog to klog
  * github.com/kubernetes/repo-infra
  * k8s.io/gengo/
  * k8s.io/kube-openapi/
  * github.com/google/cadvisor
- Entirely remove all references to glog
- Fix some tests by explicit InitFlags in their init() methods

Change-Id: I92db545ff36fcec83afe98f550c9e630098b3135
2018-11-10 07:50:31 -05:00
Jordan Liggitt
4cbdc98df3 node-isolation approvers/reviewers 2018-11-06 00:57:39 -05:00
Eric Chiang
766f5875bf Remove ericchiang from OWNERS files
Kept myself in the OpenID Connect ones for now.
2018-10-11 18:11:15 -07:00
Cheng Xing
94d649b590 Rearranged feature flags 2018-09-07 17:45:27 -07:00
Cheng Xing
becc6a9c19 Implemented logic in kubelet for registering node info, including wiring to CSINodeInfo; added unit tests for node updates; updated RBAC, NodeAuthorizer, NodeRestriction. 2018-09-06 19:16:51 -07:00
Michael Taufen
1b7d06e025 Kubelet creates and manages node leases
This extends the Kubelet to create and periodically update leases in a
new kube-node-lease namespace. Based on [KEP-0009](https://github.com/kubernetes/community/blob/master/keps/sig-node/0009-node-heartbeat.md),
these leases can be used as a node health signal, and will allow us to
reduce the load caused by over-frequent node status reporting.

- add NodeLease feature gate
- add kube-node-lease system namespace for node leases
- add Kubelet option for lease duration
- add Kubelet-internal lease controller to create and update lease
- add e2e test for NodeLease feature
- modify node authorizer and node restriction admission controller
to allow Kubelets access to corresponding leases
2018-08-26 16:03:36 -07:00
yue9944882
f624a4efb8 externalize node admission
fixes internal pod annotation reference

completely strip internal informers from authz initialization
2018-08-21 23:33:03 +08:00
yue9944882
e7d0983707 externalize pv informer in node authorizer 2018-08-17 11:14:43 +08:00
yue9944882
715f04b2ed should cast va instead of pv 2018-08-16 11:15:08 +08:00
yue9944882
bc1fb1f7e8 node authz/ad externalization 2018-08-09 10:57:30 +08:00
Jeff Grafton
23ceebac22 Run hack/update-bazel.sh 2018-06-22 16:22:57 -07:00
Jordan Liggitt
c8a0f52d5d
Short-circuit node authorizer graph edges for mirror pods 2018-06-06 11:34:14 -04:00
David Eads
092714ea0f switch rbac to external 2018-05-22 08:17:05 -04:00
wojtekt
f344c5c062 Requires single name for list and watch 2018-05-15 14:19:21 +02:00
Kubernetes Submit Queue
b2fe2a0a6d
Merge pull request #59847 from mtaufen/dkcfg-explicit-keys
Automatic merge from submit-queue (batch tested with PRs 63624, 59847). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

explicit kubelet config key in Node.Spec.ConfigSource.ConfigMap

This makes the Kubelet config key in the ConfigMap an explicit part of
the API, so we can stop using magic key names.
    
As part of this change, we are retiring ConfigMapRef for ConfigMap.


```release-note
You must now specify Node.Spec.ConfigSource.ConfigMap.KubeletConfigKey when using dynamic Kubelet config to tell the Kubelet which key of the ConfigMap identifies its config file.
```
2018-05-09 17:55:13 -07:00
Michael Taufen
c41cf55a2c explicit kubelet config key in Node.Spec.ConfigSource.ConfigMap
This makes the Kubelet config key in the ConfigMap an explicit part of
the API, so we can stop using magic key names.

As part of this change, we are retiring ConfigMapRef for ConfigMap.
2018-05-08 15:37:26 -07:00
Jordan Liggitt
ff8cdabfd4
Maintain index of high-cardinality edges in node authorizer graph 2018-05-02 16:05:28 -04:00
Jordan Liggitt
ad7d5505b9
clean up vertex/edge deletion 2018-05-02 15:39:50 -04:00
Jordan Liggitt
1c6998a2f3
Add node authorizer contention benchmark 2018-04-19 23:11:54 -04:00
Jordan Liggitt
7f5def4361
fix graph test sorting 2018-04-06 20:46:25 -04:00
hangaoshuai
33f389bc1e use handle DeletedFinalStateUnknown objects in function deleteNode 2018-03-30 11:51:39 +08:00
Michael Taufen
ab8dc12333 node authorizer sets up access rules for dynamic config
This PR makes the node authorizer automatically set up access rules for
dynamic Kubelet config.

I also added some validation to the node strategy, which I discovered we
were missing while writing this.
2018-03-27 08:49:45 -07:00
Mike Danese
2cc75f0a5a auth: allow nodes to create tokones for svcaccts of pods
running on them.
2018-02-26 13:46:19 -08:00
Serguei Bezverkhi
a6ca466859 k8s csi code change 2018-02-23 16:50:43 -05:00
Jeff Grafton
ef56a8d6bb Autogenerated: hack/update-bazel.sh 2018-02-16 13:43:01 -08:00
NickrenREN
7b9d2c046f Use v1beta1 VolumeAttachment 2018-01-31 18:46:11 +08:00
Jordan Liggitt
ecfd18e2a6
Add get volumeattachments support to Node authorizer 2018-01-17 00:00:18 -05:00
Jeff Grafton
efee0704c6 Autogenerate BUILD files 2017-12-23 13:12:11 -08:00
Jordan Liggitt
d073c10dbc
Refactor flex pv to allow secret namespace 2017-12-13 23:32:16 -05:00
Hemant Kumar
1b76b0b2ff Allow node to update PVC's status
Implement node policy feature gates
Add tests for node policy update
2017-11-22 14:32:50 -05:00
Dr. Stefan Schimanski
bec617f3cc Update generated files 2017-11-09 12:14:08 +01:00
Dr. Stefan Schimanski
012b085ac8 pkg/apis/core: mechanical import fixes in dependencies 2017-11-09 12:14:08 +01:00
Mike Danese
12125455d8 move authorizers over to new interface 2017-11-03 13:46:28 -07:00
Kubernetes Submit Queue
0e21ac81c0 Merge pull request #51416 from justinsb/fix_nodeidentitifer_godocs
Automatic merge from submit-queue (batch tested with PRs 51416, 53535). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix NodeIdentifier godocs: IdentifyNode -> NodeIdentity
2017-10-17 08:44:13 -07:00
Jeff Grafton
aee5f457db update BUILD files 2017-10-15 18:18:13 -07:00
Justin Santa Barbara
bc66c6187c Fix NodeIdentifier godocs: IdentifyNode -> NodeIdentity
The godocs had an older name for the NodeIdentity function.
2017-08-26 15:56:33 -04:00
Jeff Grafton
a7f49c906d Use buildozer to delete licenses() rules except under third_party/ 2017-08-11 09:32:39 -07:00
Jeff Grafton
33276f06be Use buildozer to remove deprecated automanaged tags 2017-08-11 09:31:50 -07:00
Kubernetes Submit Queue
9548fbd514 Merge pull request #47955 from CaoShuFeng/trivial
Automatic merge from submit-queue

[trivial]fix function name in comment

**Release note**:

```
NONE
```
2017-07-13 18:50:19 -07:00
Kubernetes Submit Queue
80a0f555db Merge pull request #48748 from liggitt/node-restriction-message
Automatic merge from submit-queue (batch tested with PRs 48405, 48742, 48748, 48571, 48482)

Improve node restriction message

Help debug https://github.com/kubernetes/kubernetes/issues/48687#issuecomment-314224531

/assign @luxas
2017-07-12 08:05:20 -07:00
Jordan Liggitt
e3e25df5df
Improve node restriction message 2017-07-10 22:44:24 -04:00
Tim Allclair
a2f2e1d491 Name change: s/timstclair/tallclair/ 2017-07-10 14:05:46 -07:00
Cao Shufeng
fad8b45667 [trivial]fix function name in comment 2017-06-23 17:53:35 +08:00
Simon Croome
5e2503e71f Add StorageOS volume plugin 2017-06-09 13:19:27 +01:00
Jordan Liggitt
fc8e915a4b
Add Node authorization mode based on graph of node-related objects 2017-05-30 16:53:03 -04:00