xufei 00416946
f787db2508
return err directly when nodename is not consistent in cert
2020-07-25 09:10:32 +08:00
Jordan Liggitt
ba4d2aa076
Restrict node labels on Node create
2020-04-20 16:26:24 -04:00
Ted Yu
e0dbbf0a65
Visitors of Configmaps and Secrets should specify which containers to visit
...
Signed-off-by: Ted Yu <yuzhihong@gmail.com>
2020-03-20 07:59:44 -07:00
Tim Allclair (St. Clair)
581d3e26c9
Restrict mirror pod owner references ( #84657 )
...
* Restrict mirror pod owners.
See http://git.k8s.io/enhancements/keps/sig-auth/20190916-noderestriction-pods.md
* Address feedback, refactor test
* Verify node owner UID
2019-11-14 20:52:16 -08:00
David Eads
83f6f2717e
remove global variable dep in admission
2019-11-12 10:55:14 -05:00
wojtekt
ffad401b4e
Promote NodeLease feature to GA
2019-11-05 09:01:12 +01:00
Tim Allclair
fea3111554
Forbid label updates by nodes through pod/status
2019-10-23 15:54:40 -07:00
Jordan Liggitt
92ea33efc5
Clean up TODOs
2019-10-03 09:23:10 -04:00
Di Xu
34cab8f80a
populate object name for admission attributes when CREATE
2019-08-22 11:46:12 +08:00
Jordan Liggitt
61774cd717
Plumb context to admission Admit/Validate
2019-08-20 11:11:00 -04:00
draveness
35bc5dc6b6
feat: cleanup feature gates for KubeletPluginsWatcher
2019-06-23 16:59:36 +08:00
Miguel Bernabeu
f47da8a75d
Fix golint violations in several plugins
2019-05-23 20:00:06 +02:00
Andrew Kim
c919139245
update import of generic featuregate code from k8s.io/apiserver/pkg/util/feature -> k8s.io/component-base/featuregate
2019-05-08 10:01:50 -04:00
Antoine Pelisse
55f9eeed6c
Ignore changes to managed field in noderestriction
...
The validation is failing because the managedfields are changed when the
object is updated. We don't have a good way to verify that the changes
are only the ones that are supposed to happen, so we'll just ignore them
for now.
2019-03-06 13:48:38 -08:00
Xing Yang
85867e5625
Modify node admission and node authorizer
2019-03-04 16:42:12 -08:00
Mehdy Bohlool
d08bc3774d
Mechanical changes due to signature change for Admit and Validate functions
2019-02-16 13:28:47 -08:00
Davanum Srinivas
b975573385
move pkg/kubelet/apis/well_known_labels.go to staging/src/k8s.io/api/core/v1/
...
Co-Authored-By: Weibin Lin <linweibin1@huawei.com>
Change-Id: I163b2f2833e6b8767f72e2c815dcacd0f4e504ea
2019-02-05 13:39:07 -05:00
Jordan Liggitt
16e355791f
Improve node authorizer and noderestriction forbidden messages
2018-11-24 09:31:10 -05:00
Jordan Liggitt
9fb2dcad5e
Limit kubelets from updating their own labels
2018-11-13 23:48:47 -05:00
Cheng Xing
94d649b590
Rearranged feature flags
2018-09-07 17:45:27 -07:00
Cheng Xing
becc6a9c19
Implemented logic in kubelet for registering node info, including wiring to CSINodeInfo; added unit tests for node updates; updated RBAC, NodeAuthorizer, NodeRestriction.
2018-09-06 19:16:51 -07:00
Michael Taufen
1b7d06e025
Kubelet creates and manages node leases
...
This extends the Kubelet to create and periodically update leases in a
new kube-node-lease namespace. Based on [KEP-0009](https://github.com/kubernetes/community/blob/master/keps/sig-node/0009-node-heartbeat.md ),
these leases can be used as a node health signal, and will allow us to
reduce the load caused by over-frequent node status reporting.
- add NodeLease feature gate
- add kube-node-lease system namespace for node leases
- add Kubelet option for lease duration
- add Kubelet-internal lease controller to create and update lease
- add e2e test for NodeLease feature
- modify node authorizer and node restriction admission controller
to allow Kubelets access to corresponding leases
2018-08-26 16:03:36 -07:00
yue9944882
bc1fb1f7e8
node authz/ad externalization
2018-08-09 10:57:30 +08:00
Jordan Liggitt
15bcfd5e00
Prevent nodes from updating taints
2018-05-15 13:54:33 -04:00
Jordan Liggitt
8161033be4
Make node restriction admission pod lookups use an informer
2018-05-10 07:53:46 -04:00
Mike Danese
b43cd7307d
noderestriction: restrict nodes TokenRequest permission
...
nodes should only be able to create TokenRequests if:
* token is bound to a pod
* binding has uid and name
* the pod exists
* the pod is running on that node
2018-02-26 13:46:19 -08:00
Hemant Kumar
1b76b0b2ff
Allow node to update PVC's status
...
Implement node policy feature gates
Add tests for node policy update
2017-11-22 14:32:50 -05:00
Dr. Stefan Schimanski
012b085ac8
pkg/apis/core: mechanical import fixes in dependencies
2017-11-09 12:14:08 +01:00
Dr. Stefan Schimanski
aedcf681b3
admission: rename Validate{ -> Initialization}, Validat{ingAdmit -> e}
2017-11-02 09:29:55 +01:00
Michael Taufen
443d58e40a
Dynamic Kubelet Configuration
...
Alpha implementation of the Dynamic Kubelet Configuration feature.
See the proposal doc in #29459 .
2017-08-08 12:21:37 -07:00
Daniel Fernandes Martins
81ba522bbe
Make NodeRestriction admission allow evictions for bounded pods
2017-07-20 14:20:03 -03:00
Jordan Liggitt
e3e25df5df
Improve node restriction message
2017-07-10 22:44:24 -04:00
Jordan Liggitt
2106a2bbe5
Check live pod on cache miss before forbidding node deletion
2017-06-05 12:09:15 -04:00
Jordan Liggitt
fed30040c9
Make NodeRestriction admission require identifiable nodes
2017-05-30 15:15:23 -04:00
p0lyn0mial
c5019bf696
remove init blocks from all admission plugins
2017-05-23 22:00:32 +02:00
Jordan Liggitt
a26897362b
Use name from node object on create
2017-05-19 10:37:14 -04:00
Jordan Liggitt
6fd36792f1
Add NodeRestriction admission plugin
2017-05-18 16:43:42 -04:00
