Commit Graph

4554 Commits

Author SHA1 Message Date
Kubernetes Prow Robot
50f4b1ea47 Merge pull request #123568 from enj/enj/i/jwt_username_required
jwt: fail on empty username via CEL expression
2024-03-04 20:07:33 -08:00
Kubernetes Prow Robot
439f7df65b Merge pull request #122320 from armstrongli/master
allow service NodePort to be updated to 0 in case AllocateLoadBalance…
2024-03-04 18:38:05 -08:00
Kubernetes Prow Robot
6929a11f69 Merge pull request #123481 from sanposhiho/mindomain-stable
graduate MinDomainsInPodTopologySpread to stable
2024-03-04 17:18:53 -08:00
Kubernetes Prow Robot
f745503112 Merge pull request #123413 from seans3/tunneling-spdy-websockets
PortForward: Tunnel SPDY through WebSockets
2024-03-04 17:18:44 -08:00
Kubernetes Prow Robot
46a2137c1b Merge pull request #123639 from liggitt/authz-metrics
Add authorization webhook duration/count/failopen metrics
2024-03-04 14:09:30 -08:00
Sean Sullivan
8b447d8c97 portforward: tunnel spdy through websockets 2024-03-04 11:10:30 -08:00
Jordan Liggitt
79b344d85e Add authorization webhook duration/count/failopen metrics 2024-03-04 14:01:15 -05:00
Monis Khan
8345ad0bac jwt: fail on empty username via CEL expression
Signed-off-by: Monis Khan <mok@microsoft.com>
2024-03-04 12:51:19 -05:00
Kubernetes Prow Robot
55d1518126 Merge pull request #123588 from pohly/scheduler-perf-any-cleanup
scheduler_perf: automatically delete created objects
2024-03-04 04:49:12 -08:00
Patrick Ohly
eb6abf0462 scheduler_perf: automatically delete created objects
This is not relevant for namespaced objects, but matters for the cluster-scoped
ResourceClass during unit testing. This works right now because there is only
one such unit test, but will fail when adding a second one.

Instead of passing a boolean flag down into all functions where it might be
needed, it's now a context value.
2024-03-04 09:54:38 +01:00
Kubernetes Prow Robot
e4a14fe0f5 Merge pull request #123575 from Huang-Wei/pod-scheduling-readiness-stable
Graduate PodSchedulingReadiness to stable
2024-03-03 22:29:38 -08:00
Anish Ramasekar
78fb0bae22 wire up discovery url in authenticator
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2024-03-03 17:34:51 -08:00
Jordan Liggitt
0605a75c5e Duplicate v1alpha1 AuthorizationConfiguration to v1beta1 2024-03-02 02:00:31 -05:00
Kubernetes Prow Robot
8845c4c657 Merge pull request #123135 from munnerz/4193-beta-promotion
KEP-4193: promote ServiceAccountTokenJTI, ServiceAccountTokenPodNodeInfo and ServiceAccountTokenNodeBindingValidation to beta
2024-03-01 19:48:18 -08:00
Kubernetes Prow Robot
3e1da21801 Merge pull request #123611 from ritazh/authz-mcmetrics
Add authz webhook matchcondition metrics
2024-03-01 18:49:17 -08:00
Rita Zhang
e76fce7566 add authz webhook matchcondition metrics
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>
Signed-off-by: Jordan Liggitt <liggitt@google.com>
Co-authored-by: Jordan Liggitt <liggitt@google.com>
2024-03-01 14:41:27 -08:00
Jefftree
462dd326c2 Use v2 types with agg discovery 2024-03-01 13:15:22 -05:00
Kubernetes Prow Robot
df366107d1 Merge pull request #123529 from thockin/go-workspaces
Go workspaces for k/k and k/staging/*
2024-03-01 08:43:03 -08:00
Kubernetes Prow Robot
ed1cc43cf7 Merge pull request #123399 from pohly/test-context-use-cancellation
test: use cancellation from ktesting
2024-03-01 01:03:23 -08:00
Kubernetes Prow Robot
6cc77a577e Merge pull request #123560 from ivelichkovich/master
kep-3716 GA, remove feature gate
2024-02-29 22:53:38 -08:00
Patrick Ohly
1d653e6185 test: use cancelation from ktesting
The return type of ktesting.NewTestContext is now a TContext. Code
which combined it WithCancel often didn't compile anymore (cannot overwrite
ktesting.TContext with context.Context). This is a good thing because all of
that code can be simplified to let ktesting handle the cancelation.
2024-03-01 07:51:22 +01:00
Tim Hockin
10c32b3e2f Get rid of most references to GOPATH 2024-02-29 22:06:51 -08:00
Tim Hockin
530c4352fb Rename new::setup_env back to setup_env 2024-02-29 22:06:44 -08:00
Tim Hockin
25b97dae82 Change ipamperf test to new setup_env 2024-02-29 22:06:12 -08:00
Kubernetes Prow Robot
5cf4fbe524 Merge pull request #123458 from aramase/aramase/i/min_jwt_payload
add min valid jwt payload to API docs for structured authn config
2024-02-29 15:11:40 -08:00
Igor Velichkovich
a51a5b4622 kep-3716 GA, remove feature gate 2024-02-29 14:14:19 -06:00
Kubernetes Prow Robot
67a06c2056 Merge pull request #122293 from mengjiao-liu/controller-reconsider-log-verbosity
kube-controller-manager: readjust log verbosity
2024-02-29 11:55:21 -08:00
Anish Ramasekar
b57d7d6ad7 add min valid jwt payload to API docs for structured authn config
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
2024-02-29 11:08:39 -08:00
Kubernetes Prow Robot
331ced5606 Merge pull request #123579 from pohly/scheduler-perf-create-strict-validation
scheduler_perf: fail when input YAML is invalid
2024-02-29 05:05:52 -08:00
Kubernetes Prow Robot
411c29c39f Merge pull request #123331 from aojea/ccm_update
CCM wait for providerID to initialize the Node object
2024-02-29 01:50:02 -08:00
Patrick Ohly
d6851ec735 scheduler_perf: fail when input YAML is invalid
The YAML files get decoded into an unstructured object, without validation, and
then sent to the apiserver with a generic client. The default behavior is to
issue a warning to the client, which gets logged by client-go. What we want
instead is an error that causes the test to fail in a clean way right at the
beginning.
2024-02-29 09:53:16 +01:00
Tim Hockin
8b579b2347 Change the build_binaries path to use modules
This makes "new" and "old" setup_env functions. In subsequent commits,
all callers of the "old" form will be fixed, and the "new" will be
renamed back.

The old and new functions diff:

```diff
--- /tmp/a	2023-12-14 09:02:57.804092696 -0800
+++ /tmp/b	2023-12-14 09:03:09.679999585 -0800
@@ -1,4 +1,4 @@
-kube::golang::old::setup_env() {
+kube::golang:🆕:setup_env() {
   kube::golang::verify_go_version

   # Set up GOPATH.  We have tools which depend on being in a GOPATH (see
@@ -7,9 +7,9 @@
   # Even in module mode, we need to set GOPATH for `go build` and `go install`
   # to work.  We build various tools (usually via `go install`) from a lot of
   # scripts.
-  #   * We can't set GOBIN because that does not work on cross-compiles.
-  #   * We could use `go build -o <something>`, but it's subtle when it comes
-  #     to cross-compiles and whether the <something> is a file or a directory,
+  #   * We can't just set GOBIN because that does not work on cross-compiles.
+  #   * We could always use `go build -o <something>`, but it's subtle wrt
+  #     cross-compiles and whether the <something> is a file or a directory,
   #     and EVERY caller has to get it *just* right.
   #   * We could leave GOPATH alone and let `go install` write binaries
   #     wherever the user's GOPATH says (or doesn't say).
@@ -20,16 +20,6 @@
   #
   # Eventually, when we no longer rely on run-in-gopath.sh we may be able to
   # simplify this some.
-  local go_pkg_dir="${KUBE_GOPATH}/src/${KUBE_GO_PACKAGE}"
-  local go_pkg_basedir
-  go_pkg_basedir=$(dirname "${go_pkg_dir}")
-
-  mkdir -p "${go_pkg_basedir}"
-
-  # TODO: This symlink should be relative.
-  if [[ ! -e "${go_pkg_dir}" || "$(readlink "${go_pkg_dir}")" != "${KUBE_ROOT}" ]]; then
-    ln -snf "${KUBE_ROOT}" "${go_pkg_dir}"
-  fi
   export GOPATH="${KUBE_GOPATH}"

   # If these are not set, set them now.  This ensures that any subsequent
@@ -40,24 +30,10 @@
   # Make sure our own Go binaries are in PATH.
   export PATH="${KUBE_GOPATH}/bin:${PATH}"

-  # Change directories so that we are within the GOPATH.  Some tools get really
-  # upset if this is not true.  We use a whole fake GOPATH here to collect the
-  # resultant binaries.
-  local subdir
-  subdir=$(kube::realpath . | sed "s|${KUBE_ROOT}||")
-  cd "${KUBE_GOPATH}/src/${KUBE_GO_PACKAGE}/${subdir}" || return 1
-
-  # Set GOROOT so binaries that parse code can work properly.
-  GOROOT=$(go env GOROOT)
-  export GOROOT
-
   # Unset GOBIN in case it already exists in the current session.
   # Cross-compiles will not work with it set.
   unset GOBIN

-  # This seems to matter to some tools
-  export GO15VENDOREXPERIMENT=1
-
-  # Disable workspaces
-  export GOWORK=off
+  # Explicitly turn on modules.
+  export GO111MODULE=on
 }
```

Result: `make` works for k/k:

```
$ make kubectl
+++ [1211 11:07:31] Building go targets for linux/amd64
    k8s.io/kubernetes/cmd/kubectl (static)

$ make WHAT=./cmd/kubectl/
+++ [1211 11:08:19] Building go targets for linux/amd64
    k8s.io/kubernetes/./cmd/kubectl/ (non-static)

$ make WHAT=k8s.io/kubernetes/cmd/kubectl
+++ [1211 11:08:52] Building go targets for linux/amd64
    k8s.io/kubernetes/cmd/kubectl (static)
```

Result: `make` works for staging by package:

```
$ make WHAT=k8s.io/api
+++ [1211 11:11:37] Building go targets for linux/amd64
    k8s.io/api (non-static)
```

Result: `make` fails for staging by path:

```
$ make WHAT=./staging/src/k8s.io/api
+++ [1211 11:12:44] Building go targets for linux/amd64
    k8s.io/kubernetes/./staging/src/k8s.io/api (non-static)
cannot find module providing package k8s.io/kubernetes/staging/src/k8s.io/api: import lookup disabled by -mod=vendor
	(Go version in go.work is at least 1.14 and vendor directory exists.)
!!! [1211 11:12:44] Call tree:
!!! [1211 11:12:44]  1: /home/thockin/src/kubernetes/hack/lib/golang.sh:850 kube::golang::build_some_binaries(...)
!!! [1211 11:12:44]  2: /home/thockin/src/kubernetes/hack/lib/golang.sh:1012 kube::golang::build_binaries_for_platform(...)
!!! [1211 11:12:44]  3: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
!!! [1211 11:12:44] Call tree:
!!! [1211 11:12:44]  1: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
!!! [1211 11:12:44] Call tree:
!!! [1211 11:12:44]  1: hack/make-rules/build.sh:27 kube::golang::build_binaries(...)
make: *** [Makefile:96: all] Error 1
```

Result: `make test` fails:

```
$ make test WHAT=./cmd/kubectl
+++ [1211 11:13:38] Set GOMAXPROCS automatically to 6
+++ [1211 11:13:38] Running tests without code coverage and with -race
cmd/kubectl/kubectl.go:25:2: cannot find package "k8s.io/client-go/plugin/pkg/client/auth" in any of:
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/client-go/plugin/pkg/client/auth (vendor tree)
	/home/thockin/sdk/gotip/src/k8s.io/client-go/plugin/pkg/client/auth (from $GOROOT)
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/client-go/plugin/pkg/client/auth (from $GOPATH)
cmd/kubectl/kubectl.go:20:2: cannot find package "k8s.io/component-base/cli" in any of:
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/component-base/cli (vendor tree)
	/home/thockin/sdk/gotip/src/k8s.io/component-base/cli (from $GOROOT)
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/component-base/cli (from $GOPATH)
cmd/kubectl/kubectl.go:21:2: cannot find package "k8s.io/kubectl/pkg/cmd" in any of:
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/kubectl/pkg/cmd (vendor tree)
	/home/thockin/sdk/gotip/src/k8s.io/kubectl/pkg/cmd (from $GOROOT)
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/kubectl/pkg/cmd (from $GOPATH)
cmd/kubectl/kubectl.go:22:2: cannot find package "k8s.io/kubectl/pkg/cmd/util" in any of:
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/kubectl/pkg/cmd/util (vendor tree)
	/home/thockin/sdk/gotip/src/k8s.io/kubectl/pkg/cmd/util (from $GOROOT)
	/home/thockin/src/kubernetes/_output/local/go/src/k8s.io/kubectl/pkg/cmd/util (from $GOPATH)
make: *** [Makefile:191: test] Error 1
```
2024-02-29 00:22:07 -08:00
Wei Huang
01db4ae9e7 Graduate PodSchedulingReadiness to stable 2024-02-28 23:18:44 -08:00
Kensei Nakada
58a826a59a graduate MinDomainsInPodTopologySpread to stable 2024-02-28 10:42:29 +00:00
Kubernetes Prow Robot
98bd90fbe2 Merge pull request #114672 from pohly/log-text-split-streams
log: split streams also for text output
2024-02-26 01:44:58 -08:00
Antonio Ojea
099f26296b integration test for cloud provider
very simple tests to check that the node controllers removes the taint.

Test will be used later for add more coverage without having to depend
on e2e tests for validating complex scenarios and combinations of flags
and controllers.

Change-Id: I55ce01488352cce9d673585e7959678c2bfb5924
2024-02-26 09:01:21 +00:00
Mengjiao Liu
b584b87a94 kube-controller-manager: readjust log verbosity
- Increase the global level for broadcaster's logging to 3 so that users can ignore event messages by lowering the logging level. It reduces information noise.
- Making sure the context is properly injected into the broadcaster, this will allow the -v flag value to be used also in that broadcaster, rather than the above global value.
- test: use cancellation from ktesting
- golangci-hints: checked error return value
2024-02-26 14:51:56 +08:00
Kubernetes Prow Robot
38638adaee Merge pull request #123418 from rikatz/kep-1860-to-beta
Promote LoadBalancerIPMode to Beta
2024-02-24 12:48:07 -08:00
Kubernetes Prow Robot
31a482a149 Merge pull request #120344 from rohitssingh/disable_force_detach
Add a flag to disable force detach behavior in kube-controller-manager
2024-02-22 13:02:38 -08:00
Rohit Singh
13dddca6a2 Add "disable-force-detach-on-timeout" flag to kube-controller-manager 2024-02-22 18:31:52 +00:00
Ricardo Katz
d816ab7657 Promote LoadBalancerIPMode to Beta 2024-02-22 08:35:12 -03:00
Kubernetes Prow Robot
3d3d705a6d Merge pull request #122883 from Jefftree/agg-discovery-block-stale
Aggregated Discovery, mark APIServices stale before initial health check
2024-02-21 12:02:41 -08:00
Jefftree
6726e65619 Aggregated Discovery, mark stale before initial health check 2024-02-20 18:15:13 -05:00
Kubernetes Prow Robot
64386c5aba Merge pull request #122419 from pohly/scheduler-perf-create-any
scheduler-perf: create any object from YAML
2024-02-19 07:44:40 -08:00
Jordan Liggitt
d5d3eddb95 Add allowed/denied metrics for authorizers 2024-02-16 08:20:59 -05:00
Kubernetes Prow Robot
66d038d84d Merge pull request #121946 from liggitt/reload-authz
KEP-3221: Implement authorization configuration file reloading
2024-02-15 18:37:13 -08:00
Kubernetes Prow Robot
50b4cfc414 Merge pull request #123321 from mimowo/job-reset-metrics
Reset metrics in the Job integration test before testing
2024-02-15 10:57:58 -08:00
Kubernetes Prow Robot
47f92ce231 Merge pull request #123242 from mimowo/fast-backoff-for-replacment-policy-tests
Improve accuracy of the PodsCreationTotal metric and use fast pod failure backoff for ReplacementPolicy integration tests
2024-02-15 09:54:53 -08:00
Michal Wozniak
ab8cdae3b1 Reset metrics in the Job integration test before testing 2024-02-15 14:50:24 +01:00
Michal Wozniak
115dc90633 Increase accuracy of the pods_creation_total metric and improve test exec time 2024-02-15 10:59:01 +01:00