Commit Graph

404 Commits

Author SHA1 Message Date
Kubernetes Prow Robot
a90f31f85a
Merge pull request #106179 from vivek-koppuru/fix-secret-format
Fix string output format for secret validations
2021-12-07 17:26:10 -08:00
Sergey Kanzhelev
1918ecad04 update the grpc field name for consistency 2021-12-01 18:16:08 +00:00
Sergey Kanzhelev
b7affcced1 implement :grpc probe action 2021-11-17 17:31:23 +00:00
Hemant Kumar
63fffd37b1 Implement API changes necessary for recovery from resize failure 2021-11-15 18:39:30 -05:00
Kubernetes Prow Robot
5d60c8d857
Merge pull request #102393 from mengjiao-liu/fix-sysctl-regex
Upgrade preparation to verify sysctl values containing forward slashes by regex
2021-11-09 18:23:26 -08:00
Vivek Koppuru
de680aec08 Fix string output format for secret validations 2021-11-05 18:29:48 +05:30
Mengjiao Liu
275d832ce2 Upgrade preparation to verify sysctl values containing forward slashes by regex 2021-11-04 11:49:56 +08:00
Tim Hockin
11a25bfeb6
De-share the Handler struct in core API (#105979)
* De-share the Handler struct in core API

An upcoming PR adds a handler that only applies on one of these paths.
Having fields that don't work seems bad.

This never should have been shared.  Lifecycle hooks are like a "write"
while probes are more like a "read". HTTPGet and TCPSocket don't really
make sense as lifecycle hooks (but I can't take that back). When we add
gRPC, it is EXPLICITLY a health check (defined by gRPC) not an arbitrary
RPC - so a probe makes sense but a hook does not.

In the future I can also see adding lifecycle hooks that don't make
sense as probes.  E.g. 'sleep' is a common lifecycle request. The only
option is `exec`, which requires having a sleep binary in your image.

* Run update scripts
2021-10-29 13:15:11 -07:00
ravisantoshgudimetla
d7d0beb65f api: Handle validation of PodOS field presence 2021-10-28 17:31:52 -04:00
Kubernetes Prow Robot
7fbb384e15
Merge pull request #105682 from pohly/generic-ephemeral-volume-raw-block
storage validation: accept generic ephemeral volumes as volume device
2021-10-22 18:04:50 -07:00
Kubernetes Prow Robot
18104ecf1f
Merge pull request #105405 from verb/1.23-ec-beta
Promote EphemeralContainers to beta
2021-10-20 09:24:10 -07:00
Lee Verberne
d33bbb8940 Allow volumeDevices in ephemeral containers 2021-10-19 23:04:05 -04:00
Lee Verberne
d874cf8ffd List disallowed ephemeral container fields
Listing these explicitly makes it easier to determine whether a new
Container field has been evaluated for use with ephemeral containers.
This does not change the behavior of ephemeral containers.
2021-10-19 23:03:57 -04:00
Lee Verberne
f81c48cd0a Disallow subpath for ephemeral container mounts 2021-10-19 23:01:15 -04:00
Lee Verberne
764859081a Validate ephemeralContainerStatuses during update 2021-10-19 23:00:51 -04:00
Patrick Ohly
a40d2eb18c storage validation: accept generic ephemeral volumes as volume device
Raw block devices are possible with generic ephemeral volumes, so rejecting a
pod with that combination is wrong.
2021-10-19 13:30:32 +02:00
Mark Rossetti
3ddff55fe6 Adding unit test coverage for API validation for emphermal contaienrs in hostprocess pods on Windows
Signed-off-by: Mark Rossetti <marosset@microsoft.com>
2021-10-18 15:46:27 -07:00
Lee Verberne
8b24dc07ff Test ephemeral container/pod conflicting fields
This adds a test case to cover the scenario where the fields of an
ephemeral container conflict with other fields in the pod and must be
detected by full PodSpec validation.
2021-09-30 21:47:19 +02:00
Lee Verberne
4451138bfa Validate PodSpec in EphemeralContainersUpdate
Previously this only validated the ephemeral containers, but it's safer
to validate the entire PodSpec in case other parts of validation add
logic that checks ephemeral containers.
2021-09-27 22:58:08 +02:00
Khaled Henidak (Kal)
a53e2eaeab
move IPv6DualStack feature to stable. (#104691)
* kube-proxy

* endpoints controller

* app: kube-controller-manager

* app: cloud-controller-manager

* kubelet

* app: api-server

* node utils + registry/strategy

* api: validation (comment removal)

* api:pod strategy (util pkg)

* api: docs

* core: integration testing

* kubeadm: change feature gate to GA

* service registry and rest stack

* move feature to GA

* generated
2021-09-24 16:30:22 -07:00
saad-ali
beb17fe10b Remove VolumeSubpath feature gate
Remove the VolumeSubpath feature gate.

Feature gate convention has been updated since this was introduced to
indicate that they "are intended to be deprecated and removed after a
feature becomes GA or is dropped.".
2021-09-17 01:59:23 -07:00
h4ghhh
0734820279
'New' Event namespace validate failed (#100125) 2021-09-16 04:29:45 -07:00
Tim Hockin
650f8cfd35 Svc REST: Validate input before IP allocation
This commit started as removing FIXME comments, but in doing so I
realized that the IP allocation process was using unvalidated user
input.  Before de-layering, validation was called twice - once before
init and once after, which the init code depended on.

Fortunately (or not?) we had duplicative checks that caught errors but
with less friendly messages.

This commit calls validation before initializing the rest of the
IP-related fields.

This also re-organizes that code a bit, cleans up error messages and
comments, and adds a test SPECIFICALLY for the errors in those cases.
2021-09-11 11:30:01 -07:00
Tim Hockin
8bcba526b6 Svc REST: Better errors on stack-downgrades
Converting dual-stack to single-stack needs good errors.
2021-09-11 11:30:01 -07:00
Tim Hockin
f4521aa75a Fix validation on ETP: "" is not valid
This was causing tests to pass which ought not be passing.  This is not
an API change because we default the value of it when needed.  So we
would never see this in the wild, but it makes the tests sloppy.
2021-09-11 11:30:01 -07:00
Tim Hockin
ccf3376570 Svc REST: De-layer Update
This is the last layered method.  All allocator logic is moved to the
beginUpdate() path.  Removing the now-useless layer will happen in a
subsequent commit.
2021-09-11 11:30:00 -07:00
Tim Hockin
14d0571a5f Svc REST: Don't call validation directly
The validation is called soon after anyway.
2021-09-11 10:49:13 -07:00
Antonio Ojea
0cd75e8fec run hack/update-netparse-cve.sh 2021-08-20 10:42:09 +02:00
Kubernetes Prow Robot
e375563732
Merge pull request #103245 from wzshiming/fix/prober-termination
Add validation for Prober TerminationGracePeriodSeconds
2021-07-13 09:30:30 -07:00
Kubernetes Prow Robot
e799d7b191
Merge pull request #99023 from verb/1.21-securitycontext
Allow setting securityContext in ephemeral containers
2021-07-09 20:50:46 -07:00
Shiming Zhang
513bd93f76 update test for feature gate 2021-07-09 10:37:38 +08:00
Kubernetes Prow Robot
36a7426aa5
Merge pull request #99144 from bart0sh/PR0094-promote-HugePageStorageMediumSize-to-GA
promote huge page storage medium size to GA
2021-07-07 18:09:05 -07:00
Kubernetes Prow Robot
eaba61b4de
Merge pull request #103276 from NetApp/data-source-ref
Add DataSourceRef field to PVC spec
2021-07-07 08:56:44 -07:00
Shiming Zhang
d8fe255f41 Add test for validateProbe 2021-07-07 11:31:23 +08:00
Shiming Zhang
e378600c90 Add validation for Prober TerminationGracePeriodSeconds 2021-07-07 10:51:30 +08:00
Ben Swartzlander
00dba76918 Add DataSourceRef field to PVC spec
Modify the behavior of the AnyVolumeDataSource alpha feature gate to enable
a new field, DataSourceRef, rather than modifying the behavior of the
existing DataSource field. This allows addition Volume Populators in a way
that doesn't risk breaking backwards compatibility, although it will
result in eventually deprecating the DataSource field.
2021-07-06 21:17:41 -04:00
Andrew Sy Kim
28f3f36505
Promote the ServiceInternalTrafficPolicy field to Beta and on by default (#103462)
* pkg/features: promote the ServiceInternalTrafficPolicy field to Beta and on by default

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>

* pkg/api/service/testing: update Service test fixture functions to set internalTrafficPolicy=Cluster by default

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>

* pkg/apis/core/validation: add more Service validation tests for internalTrafficPolicy

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>

* pkg/registry/core/service/storage: fix failing Service REST storage tests to use internalTrafficPolicy: Cluster

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>

* pkg/registry/core/service/storage: add two test cases for Service REST TestServiceRegistryInternalTrafficPolicyClusterThenLocal and TestServiceRegistryInternalTrafficPolicyLocalThenCluster

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>

* pkg/registry/core/service: update strategy unit tests to expect default
internalTrafficPolicy=Cluster

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>

* pkg/proxy/ipvs: fix unit test Test_EndpointSliceReadyAndTerminatingLocal to use internalTrafficPolicy=Cluster

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>

* pkg/apis/core: update fuzzers to set Service internalTrafficPolicy field

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>

* pkg/api/service/testing: refactor Service test fixtures to use Tweak funcs

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>
2021-07-06 06:16:30 -07:00
Hanlin Shi
79b6df96fc Add tests for LB type service
1. create LB type svc with nodeport allocation set to false
1. create LB type svc with nodeport allocation unset
3. update LB type svc's nodeport allocation field

Signed-off-by: Hanlin Shi <shihanlin9@gmail.com>
2021-07-02 21:58:49 +00:00
Hanlin Shi
24592ca989 Update the related tests
1. add AllocateLoadBalancerNodePorts fields in specs for validation test cases
2. update fuzzer
3. in resource quota e2e, allocate node port for loadbalancer type service and
   exceed the node port quota

Signed-off-by: Hanlin Shi <shihanlin9@gmail.com>
2021-07-02 21:58:41 +00:00
Chris Henzie
7491d01651 Validate use of the ReadWriteOncePod access mode
This will only work if the "ReadWriteOncePod" feature gate is enabled.
Additionally, this access mode will only work when used by itself. This
is because when ReadWriteOncePod is used on a PV or PVC, it renders all
other access modes useless since it is most restrictive.
2021-06-28 21:25:37 -07:00
Chris Henzie
dba8ee229e Add validation options for PersistentVolumeClaims
These options provide an extensible way of configuring how PVCs are
validated
2021-06-28 21:24:55 -07:00
Chris Henzie
9ba0eed7c5 Add validation options for PersistentVolumes
These options provide an extensible way of configuring how PVs are
validated
2021-06-28 21:24:55 -07:00
Shiming Zhang
40593fa4d3 spec.terminationGracePeriodSeconds allow it to be set to 1s if it was previously negative 2021-06-28 11:49:39 +08:00
Lee Verberne
70765fa24d Allow securityContext in EphemeralContainers 2021-06-25 18:47:22 +02:00
Andrew Sy Kim
4d38d21880 apis: remove Service topologyKeys
Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>
2021-06-03 22:17:45 -04:00
Kubernetes Prow Robot
e8760b95bb
Merge pull request #102336 from SataQiu/remove-podpreset
cleanup PodPreset testdata
2021-05-27 11:36:23 -07:00
Gunju Kim
6317ce63c6 Add feature gate ExpandedDNSConfig
ExpandedDNSConfig allows kubernetes to have expanded DNS(Domain Name
System) configuration
2021-05-27 07:10:13 +09:00
SataQiu
9cfbf06225 cleanup PodPreset testdata 2021-05-26 19:57:29 +08:00
marosset
93da0fd45d API support for Windows host process containers
Co-authored-by: James Sturtevant <jstur@microsoft.com>
2021-05-19 16:24:13 -07:00
Ed Bartosh
c12aa0f6b7 promote HugePageStorageMediumSize to GA 2021-05-10 15:57:55 +03:00