Commit Graph

631 Commits

Author SHA1 Message Date
Kubernetes Submit Queue
f1603181a3 Merge pull request #35970 from deads2k/controller-15-enable
Automatic merge from submit-queue

make using service account credentials from controllers optional

Adds a flag to make the "SA per controller" behavior optional.
2016-11-05 08:11:10 -07:00
deads2k
ebf796a649 make using service account credentials from controllers optional 2016-11-04 14:17:34 -04:00
Wojciech Tyczynski
ca99cbca02 Increase quota-bytes for etcd in v3 mode 2016-11-04 17:00:54 +01:00
Di Xu
dd6c980949 specify custom ca file to verify the keystone server 2016-11-04 15:11:41 +08:00
Timothy St. Clair
2b012e822a Add minimum iptables sync period to the proxy, default is 2/sec 2016-11-04 00:38:35 -05:00
Bowei Du
a06fc6ab7a Adds TCPCloseWaitTimeout option to kube-proxy for sysctl nf_conntrack_tcp_timeout_time_wait
Fixes issue-32551
2016-11-03 22:07:02 -07:00
Random-Liu
a5fdf3850c Add system verification. 2016-11-03 20:37:18 -07:00
saadali
402116aed4 Revert "Merge pull request #35821 from vishh/gci-mounter-scope"
This reverts commit 973fa6b334, reversing
changes made to 41b5fe86b6.
2016-11-03 20:23:25 -07:00
Kubernetes Submit Queue
973fa6b334 Merge pull request #35821 from vishh/gci-mounter-scope
Automatic merge from submit-queue

[Kubelet] Use the custom mounter script for Nfs and Glusterfs only

This patch reduces the scope for the containerized mounter to NFS and GlusterFS on GCE + GCI clusters

This patch also enabled the containerized mounter on GCI nodes

Shepherding multiple PRs through the submit queue is painful. Hence I combined them into this PR. Please review each commit individually.

cc @jingxu97 @saad-ali

https://github.com/kubernetes/kubernetes/pull/35652 has also been reverted as part of this PR
2016-11-03 04:32:19 -07:00
Kubernetes Submit Queue
2f84a7c8d2 Merge pull request #35594 from madhusudancs/federation-kubefed-init-00
Automatic merge from submit-queue

[Federation][init] Implement `kubefed init` command that performs federation control plane bootstrap.

Please review only the last commit here. This is based on PR #35593 which will be reviewed independently.

I am intentionally not including the unit tests in this PR to better distribute and parallelize reviews. This PR is already big.

I will add a release note separately for this entire feature, so please don't worry too much about the release note here in the PR.

Design Doc: PR #34484

cc @kubernetes/sig-cluster-federation @quinton-hoole @nikhiljindal
2016-11-03 02:08:14 -07:00
Vishnu Kannan
414e4ae549 Revert "Adding a root filesystem override for kubelet mounter"
This reverts commit e861a5761d.
2016-11-02 15:18:09 -07:00
Kubernetes Submit Queue
d28f7031a1 Merge pull request #35494 from madhusudancs/federation-kubefed-02
Automatic merge from submit-queue

[Federation][unjoin-00] Implement `kubefed unjoin` command.

Please review only the last commit here. This is based on PR #35493 which will be reviewed independently.

I will add a release note separately for this entire feature, so please don't worry too much about the release note here in the PR.

Design Doc: PR #34484

cc @kubernetes/sig-cluster-federation @quinton-hoole @nikhiljindal
2016-11-02 13:36:43 -07:00
Madhusudan.C.S
4a9377027d [Federation][init] Implement kubefed init command that performs federation control plane bootstrap. 2016-11-02 13:36:41 -07:00
Kubernetes Submit Queue
539165d899 Merge pull request #36075 from rmmh/root-gitattributes
Automatic merge from submit-queue

Move .gitattributes annotation to the root, so GitHub will respect them.

This should fix the merge conflicts by letting GitHub use the simpler line-by-line algorithm for this file. Having .gitattributes in a sub-directory would work for local merging, but would show conflicts on the web UI.
2016-11-02 12:13:54 -07:00
Madhusudan.C.S
90d46c8670 [Federation][unjoin-00] Implement kubefed unjoin command.
Also, add unit tests for `kubefed unjoin`.
2016-11-02 11:22:46 -07:00
Kubernetes Submit Queue
df8db653da Merge pull request #35493 from madhusudancs/federation-kubefed-01
Automatic merge from submit-queue

[Federation][join-01] Implement `kubefed join` command.

Supersedes PR #35155.

Please review only the last commit here. This is based on PR #35492 which will be reviewed independently.

I will add a release note separately for this entire feature, so please don't worry too much about the release note here in the PR.

Design Doc: PR #34484

cc @kubernetes/sig-cluster-federation @quinton-hoole @mwielgus
2016-11-02 10:35:55 -07:00
Ryan Hitchman
955f31353d Move .gitattributes annotation to the root, so GitHub will respect them. 2016-11-02 09:48:45 -07:00
Zach Loafman
02ec4c373b e2e.go/kops: Make up timeout configurable, bump to 20m
Along the way: Fix ginkgo-e2e.sh. This change got dropped in the
original PR, but it was meant to allow a conformance-style
kubectl-auth test and still have a legit cloud provider.
2016-11-01 14:56:34 -07:00
Madhusudan.C.S
2342f6eefb [Federation][join-01] Implement kubefed join command.
Also, add unit tests for `kubefed join`.
2016-11-01 12:45:28 -07:00
Dr. Stefan Schimanski
5dc31d35a0 Add --tls-sni-cert-key to the apiserver for SNI support 2016-11-01 09:50:56 +01:00
Jordan Liggitt
1a7f7c5399
Allow apiserver to choose preferred kubelet address type 2016-10-31 16:02:38 -04:00
Jacob Beacham
cf6b6778dc Adding CLI tests for kubeadm. 2016-10-31 11:12:51 -07:00
Justin Santa Barbara
a3ba760a27 Federation: separate notion of zone-name & dns-suffix
We can put subdomains into hosted zones (for example,
foo.federation.example.com can be hosted in example.com)

By allowing sharing a common hosted zone, this means the user doesn't
have to do as much setup.
2016-10-30 20:50:09 -04:00
deads2k
3f9a4d51d5 wire up authenticating front proxy: 2016-10-28 08:36:46 -04:00
Vishnu kannan
e861a5761d Adding a root filesystem override for kubelet mounter
This is useful for supporting hostPath volumes via containerized
mounters in kubelet.

Signed-off-by: Vishnu kannan <vishnuk@google.com>
2016-10-26 21:42:59 -07:00
Kubernetes Submit Queue
10061ac358 Merge pull request #35523 from luxas/remove_reconcile
Automatic merge from submit-queue

Deprecate the --reconcile-cidr flag

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**: Follows up https://github.com/kubernetes/kubernetes/pull/34906

**Special notes for your reviewer**: I'm not sure why coreos had set `--reconcile-cidr` to `false` and what the implications are now.

**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
```release-note
Deprecate the --reconcile-cidr kubelet flag because it has no function anymore
```

PTAL @thockin @freehan @justinsb @yujuhong 
@kubernetes/sig-node @kubernetes/sig-network 

**I will add `hack/update-all.sh` contents soon to fix builds**
2016-10-26 20:18:37 -07:00
Vishnu kannan
adef4675a0 rename kubelet flag mounter-path to experimental-mounter-path
Signed-off-by: Vishnu kannan <vishnuk@google.com>
2016-10-26 14:50:33 -07:00
Lucas Käldström
6846e0b48a Remove usage of --reconcile-cidr 2016-10-26 20:26:07 +03:00
Jordan Liggitt
426caf5bd1
Kubelet auth flags 2016-10-25 03:40:08 -04:00
Jing Xu
34ef93aa0c Add mounterPath to mounter interface
In order to be able to use new mounter library, this PR adds the
mounterPath flag to kubelet which passes the flag to the mount
interface. If flag is empty, mount uses default mount path.
2016-10-20 14:15:27 -07:00
Kubernetes Submit Queue
61e0113019 Merge pull request #34906 from luxas/remove_old_networking
Automatic merge from submit-queue

WIP: Remove the legacy networking mode

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**:
Removes the deprecated configure-cbr0 flag and networking mode to avoid having untested and maybe unstable code in kubelet, see: #33789

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, #<issue_number>, ...)` format, will close that issue when PR gets merged)*: 
fixes #30589
fixes #31937

**Special notes for your reviewer**: There are a lot of deployments who rely on this networking mode. Not sure how we deal with that: force switch to kubenet or just delete the old deployment?

But please review the code changes first (the first commit)

**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
```release-note
Removed the deprecated kubelet --configure-cbr0 flag, and with that the "classic" networking mode as well
```

PTAL @kubernetes/sig-network @kubernetes/sig-node @mikedanese
2016-10-19 01:03:39 -07:00
Kubernetes Submit Queue
714f816a34 Merge pull request #34719 from errordeveloper/api-and-disco-ports
Automatic merge from submit-queue

Add flags for alternative API and discovery ports

**What this PR does / why we need it**:

We had many issues reported due to the fact that we are using port 443 by default, and we should allow users to override whatever defaults we pick. This doesn't touch on `localhost:8080` yet, which should just generally get rid of.

**Which issue this PR fixes**: fixes #34311 #34307 #33638

**Special notes for your reviewer**: cc @pires 

**Release note**:
```release-note
Add `kubeadm` flags `--api-port` and `--discovery-port`, change default API port to 6443
```
2016-10-17 05:54:38 -07:00
Kubernetes Submit Queue
c4f509e65d Merge pull request #32769 from mfojtik/customize-api-path-clientgen
Automatic merge from submit-queue

clientgen: allow to pass custom apiPath when generating client sets

This PR allow to pass the `--clientset-api-path` parameter to clientgen that allows to customize the default API path set in clients. This allows projects like OpenShift to re-use the client with different API path (`/oapi` in our case).
2016-10-17 04:52:04 -07:00
Ilya Dmitrichenko
203d1338f1
Sort known flags 2016-10-17 12:08:11 +01:00
Ilya Dmitrichenko
327dec43fb
Add flags for alternative API and discovery ports (close #34311 #34307 #33638) 2016-10-17 12:08:11 +01:00
Kubernetes Submit Queue
40e1aa6b25 Merge pull request #34542 from Crassirostris/logs-generator
Automatic merge from submit-queue

Add logs generator

@piosz 

Tool to test logging mechanisms, mentioned in #34310
2016-10-17 03:32:31 -07:00
Lucas Käldström
0800df74ab Remove the legacy networking mode --configure-cbr0 2016-10-16 21:26:41 +03:00
Mik Vyatskov
7ab1fc4600 Add logs generator 2016-10-16 16:38:36 +02:00
Kubernetes Submit Queue
d7c0eb322c Merge pull request #34276 from freehan/cri-runtime-config
Automatic merge from submit-queue

add UpdateRuntimeConfig interface

Expose UpdateRuntimeConfig interface in RuntimeService for kubelet to pass a set of configurations to runtime. Currently it only takes PodCIDR.

The use case is for kubelet to pass configs to runtime. Kubelet holds some config/information which runtime does not have, such as PodCIDR. I expect some of kubelet configurations will gradually move to runtime, but I believe cases like PodCIDR, which dynamically assigned by k8s master, need to stay for a while.
2016-10-13 23:10:42 -07:00
Kubernetes Submit Queue
a944748ccb Merge pull request #34341 from apprenda/kubeadm-require-root
Automatic merge from submit-queue

kubeadm implement preflight checks

Checks that user running kubeamd init and join is root and will only execute
command if user is root. Moved away from using kubectl error handling to
having kubeadm handle its own errors. This should allow kubeadm to have
more meaningful errors, exit codes, and logging for specific kubeadm use
cases.

fixes #33908
2016-10-13 15:02:53 -07:00
Devan Goodwin
4231c046dd Fix errors and improve output in kubeadm pre-flight checks.
Add skip-preflight-checks to known flags.
Fix bug with preflight checks not returning system is-active as errors.
Fix error handling to use correct function.
2016-10-13 11:10:19 -03:00
Kubernetes Submit Queue
6a2f0932e4 Merge pull request #33379 from grosskur/kube-dns-bind-address
Automatic merge from submit-queue

kube-dns: Add --dns-bind-address flag

Currently, `kube-dns` always binds to `0.0.0.0` when starting the SkyDNS server. Sometimes it's useful to have it bind to a different address for testing. So add a new `--dns-bind-address` flag that can be used to configure this (default is `0.0.0.0`).
2016-10-13 06:26:27 -07:00
Minhan Xia
480bcb9760 add UpdateRuntimeConfig interface 2016-10-12 22:33:58 -07:00
Kubernetes Submit Queue
12b133577e Merge pull request #33278 from Crassirostris/gcl-e2e-test
Automatic merge from submit-queue

Add gcl cluster logging test

This PR changes default logging destination for tests to gcp and adds test for cluster logging using google cloud logging

Fix #20760
2016-10-12 06:54:25 -07:00
Mik Vyatskov
b9c72ee1cb Add gcl cluster logging test 2016-10-11 09:36:11 +02:00
Kubernetes Submit Queue
6656929b15 Merge pull request #34153 from zmerlynn/log-dump-optionally-use-kubectl
Automatic merge from submit-queue

log-dump.sh: Add a LOG_DUMP_USE_KUBECTL mode, refactor

**What this PR does / why we need it**: This refactors log-dump.sh so that it can optionally just use `"kubectl get node"` output, for dumping logs off a cluster that was brought up using something other than kube-up.sh (e.g. kops or kubeadm).

Note that for obvious reasons, if the cluster is fried, it'll probably fail to hit the apiserver and all bets are off, but for the 95% case where you're debugging tests, this is good. To cover the remaining 5%, you could actually squirrel away the relevant external IPs after the e2e.go:Up stage (because we better be able to hit the apiserver then) and fetch them from cache later.

**Special notes for your reviewer**: Sorry for so many changes. :)
2016-10-10 16:20:20 -07:00
Zach Loafman
4338351be2 log-dump.sh: Add a LOG_DUMP_USE_KUBECTL mode, refactor
This refactors log-dump.sh so that it can optionally just use "kubectl
get node" output, for dumping logs off a cluster that was brought up
using sometihng other than kube-up.sh (e.g. kops or kubeadm).

Note that for obvious reasons, if the cluster is fried, it'll probably
fail to hit the apiserver and all bets are off, but for the 95% case
where you're debugging tests, this is good. To cover the remaining 5%,
you could actually squirrel away the relevant external IPs after the
e2e.go:Up stage (because we better be able to hit the apiserver then)
and fetch them from cache later.
2016-10-10 13:41:49 -07:00
Kubernetes Submit Queue
2ecd96100e Merge pull request #33783 from derekwaynecarr/phase-1-pod-cgroups
Automatic merge from submit-queue

Add cgroup-driver and cgroups-per-qos flags to kubelet

Add the flags needed to support pod-level cgroups to kubelet.

/cc @vishh @dchen1107 @dubstack
2016-10-07 17:56:01 -07:00
Kubernetes Submit Queue
3be8e3e44b Merge pull request #33981 from freehan/e2e-deletens-on-failure
Automatic merge from submit-queue

add delete-namespace-on-failure flag

I have been doing this for a while. 

Setting `--delete-namespace=false --clean-start=true` only works if you have only one e2e test running in a loop. 

This PR lets someone to set `delete-namespace-on-failure=false` and run multiple tests in parallel and preserve the crime scene. It makes it easier to reproduce failures. 

Let me know if this is worth it or there are some other tricks I am not aware.
2016-10-07 04:34:27 -07:00
Michal Fojtik
aea9b486a0 clientgen: allow to pass custom apiPath when generating client sets 2016-10-06 11:27:29 +02:00
Kubernetes Submit Queue
7766b408b8 Merge pull request #31467 from vmware/fix-vsphere-cloud-provider.kerneltime
Automatic merge from submit-queue

Add support for vpshere cloud provider in kubeup

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**:
vSphere cloud provider added in 1.3 was not configured when deploying via kubeup

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:
<!--  Steps to write your release note:
1. Use the release-note-* labels to set the release note state (if you have access) 
2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`. 
-->
```release-note
Add support for vSphere Cloud Provider when deploying via kubeup on vSphere.
```

When deploying on vSphere using kube up add configuration
for vSphere cloud provider.
2016-10-05 19:12:17 -07:00
Ritesh H Shukla
ea22d0cc5f Update exceptions list for underscores introduced in kubeup for vSphere. 2016-10-05 16:57:33 -07:00
Kubernetes Submit Queue
05192d9d57 Merge pull request #33319 from juanvallejo/jvallejo/add-option-to-set-nodeport
Automatic merge from submit-queue

Add option to set a service nodeport

**Release note**:
```release-note
Add kubectl --node-port option for specifying the service nodeport
```

This patch adds the option to set a nodeport when creating a NodePort
service. In case of a port allocation error due to a specified port
being out of the valid range, the error now includes the valid
range. If a `--node-port` value is not specified, it defaults to zero, in
which case the allocator will default to its current behavior of
assigning an available port.

This patch also adds a new helper function in `cmd/util/helpers.go` to
retrieve `Int32` cobra flags.

**Example**
```
# create a nodeport service with an invalid port
$ kubectl create service nodeport mynodeport --tcp=8080:7777 --node-port=1
The Service "mynodeport" is invalid: spec.ports[0].nodePort: Invalid
value: 1: provided port is not in the valid range. Valid ports range
from 30000-32767

# create a nodeport service with a valid port
$ kubectl create service nodeport mynodeport --tcp=8080:7777 --node-port=30000
service "mynodeport" created

# create a nodeport service with a port already in use
$ kubectl create service nodeport mynodeport --tcp=8080:7777 --node-port=30000
The Service "mynodeport" is invalid: spec.ports[0].nodePort: Invalid value: 3000: provided port is already allocated

$ kubectl describe service mynodeport
Name:                   mynodeport
Namespace:              default
Labels:                 app=mynodeport
Selector:               app=mynodeport
Type:                   NodePort
IP:                     172.30.81.254
Port:                   8080-7777       8080/TCP
NodePort:               8080-7777       30000/TCP
Endpoints:              <none>
Session Affinity:       None
No events.
```

@fabianofranz
2016-10-05 15:00:32 -07:00
derekwaynecarr
0071cca51e Add generated code for kubelet flags 2016-10-05 13:48:37 -04:00
Kubernetes Submit Queue
457d3785de Merge pull request #33862 from luxas/remove_experimental_flannel
Automatic merge from submit-queue

Remove the flannel experimental overlay

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. If this is your first time, read our contributor guidelines https://github.com/kubernetes/kubernetes/blob/master/CONTRIBUTING.md and developer guide https://github.com/kubernetes/kubernetes/blob/master/docs/devel/development.md
2. If you want *faster* PR reviews, read how: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/faster_reviews.md
3. Follow the instructions for writing a release note: https://github.com/kubernetes/kubernetes/blob/master/docs/devel/pull-requests.md#release-notes
-->

**What this PR does / why we need it**:

It removes the deprecated flannel overlay integration in kubelet.
It's completely unnecessary now with CNI which can handle everything smoothly when flannel is running in a daemonset.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #17795, #30589

cc @kubernetes/sig-network @thockin @freehan @bprashanth @yujuhong @dchen1107
2016-10-04 21:39:20 -07:00
Kubernetes Submit Queue
3f4a66f3d6 Merge pull request #33970 from yifan-gu/remove_names
Automatic merge from submit-queue

CRI: Remove the mount name and port name.

Per discussion on https://github.com/kubernetes/kubernetes/issues/33873.

Currently the mount name is not being used and also involves some
incorrect usage (sometimes it's referencing a mount name, sometimes
it's referecing a volume name), so we decide to remove it from CRI.

The port name is also not used, so remove it as well.

Fix #33873
Fix #33526 

/cc @kubernetes/sig-node @kubernetes/sig-rktnetes
2016-10-04 17:08:20 -07:00
Zach Loafman
ca58119af7 e2e.go / kops: Add --kops-kubernetes-version
This adds a flag to override the version we're deploying with kops for
e2es. (The kops experience is disconnected from the actual source tree
we're running tests from, which is similar to GKE.)
2016-10-04 14:01:31 -07:00
Yifan Gu
48baeb4046 CRI: Update the hack/verify-flags/exceptions.txt 2016-10-04 13:22:50 -07:00
juanvallejo
395f6fda81 update known flags 2016-10-04 13:19:24 -04:00
Lucas Käldström
348717c50a Remove the flannel experimental overlay 2016-10-04 11:53:53 +03:00
Zach Loafman
eb44add29c e2e.go / kops: Add ssh-key option to override ssh key
By default, Jenkins stuffs the ssh key in
/workspace/.aws/kube_aws_rsa. Allow this to be overridden easily on
the command line.
2016-10-03 17:50:15 -07:00
Minhan Xia
47ccd15b1d add delete-namespace-on-failure flag 2016-10-03 17:14:51 -07:00
Kubernetes Submit Queue
6c5a187171 Merge pull request #33378 from deads2k/rbac-10-allow-token
Automatic merge from submit-queue

add anytoken authenticator

Adds `--insecure-allow-any-token` as a flag to the API server to create an authenticator that will accept any bearer token and transform it into a user by parsing it out as `username/group1,group2,...`.

This gives an easy way to identify as a user and check permissions:
```bash
ALLOW_ANY_TOKEN=true hack/local-up-cluster.sh 
kubectl config set-cluster local-kube --server=https://localhost:6443 --insecure-skip-tls-verify=true
kubectl config set-credentials david --token=david/group1
kubectl config set-context local --cluster=local-kube --user=david
kubectl config use-context local
```

@kubernetes/sig-auth
2016-09-29 12:32:08 -07:00
Kubernetes Submit Queue
364caad0f0 Merge pull request #33582 from aanm/fixing-local-cluster-up
Automatic merge from submit-queue

Fixing local cluster up

hack: fix local-cluster-up advertise_address default value
Fixes: 9fc1d61

Signed-off-by: André Martins <aanm90@gmail.com>

ping @dims
2016-09-29 11:25:13 -07:00
deads2k
5080a575ad add anytoken authenticator 2016-09-29 14:14:06 -04:00
Kubernetes Submit Queue
d187997c94 Merge pull request #32386 from liggitt/anonymous-authenticated-groups
Automatic merge from submit-queue

Allow anonymous API server access, decorate authenticated users with system:authenticated group

When writing authorization policy, it is often necessary to allow certain actions to any authenticated user. For example, creating a service or configmap, and granting read access to all users

It is also frequently necessary to allow actions to any unauthenticated user. For example, fetching discovery APIs might be part of an authentication process, and therefore need to be able to be read without access to authentication credentials.

This PR:
* Adds an option to allow anonymous requests to the secured API port. If enabled, requests to the secure port that are not rejected by other configured authentication methods are treated as anonymous requests, and given a username of `system:anonymous` and a group of `system:unauthenticated`. Note: this should only be used with an `--authorization-mode` other than `AlwaysAllow`
* Decorates user.Info returned from configured authenticators with the group `system:authenticated`.

This is related to defining a default set of roles and bindings for RBAC (https://github.com/kubernetes/features/issues/2). The bootstrap policy should allow all users (anonymous or authenticated) to request the discovery APIs.

```release-note
kube-apiserver learned the '--anonymous-auth' flag, which defaults to true. When enabled, requests to the secure port that are not rejected by other configured authentication methods are treated as anonymous requests, and given a username of 'system:anonymous' and a group of 'system:unauthenticated'. 

Authenticated users are decorated with a 'system:authenticated' group.

NOTE: anonymous access is enabled by default. If you rely on authentication alone to authorize access, change to use an authorization mode other than AlwaysAllow, or or set '--anonymous-auth=false'.
```

c.f. https://github.com/kubernetes/kubernetes/issues/29177#issuecomment-244191596
2016-09-29 10:47:49 -07:00
Doug Davis
9d5bac6330 Change minion to node
Contination of #1111

I tried to keep this PR down to just a simple search-n-replace to keep
things simple.  I may have gone too far in some spots but its easy to
roll those back if needed.

I avoided renaming `contrib/mesos/pkg/minion` because there's already
a `contrib/mesos/pkg/node` dir and fixing that will require a bit of work
due to a circular import chain that pops up. So I'm saving that for a
follow-on PR.

I rolled back some of this from a previous commit because it just got
to big/messy. Will follow up with additional PRs

Signed-off-by: Doug Davis <dug@us.ibm.com>
2016-09-28 10:53:30 -07:00
André Martins
3dfd324987 hack: fix local-cluster-up advertise_address default value
Fixes: 9fc1d61ab7

Signed-off-by: André Martins <aanm90@gmail.com>
2016-09-28 16:40:50 +01:00
Zach Loafman
d905478e0a e2e.go: Add -deployment, add a kops deployment method
This splits off all the bash stuff into an interface, and plumbs
through a separate interface to bring up a cluster using "kops"
instead. Right now it assumes kops == AWS.
2016-09-27 14:45:19 -07:00
Tim Hockin
957c85a8fd Add a lower-bound for conntrack 2016-09-26 20:25:40 -07:00
Jordan Liggitt
0c36c5e556
Add anonymous auth to the auth chain 2016-09-26 17:19:00 -04:00
Lucas Käldström
37dab80173
Make the Kubernetes control plane version configurable 2016-09-24 14:46:42 +01:00
Evgeny L
0a68bb05ea
Rename flag --schedule-workload to --schedule-pods-here for kubeadm init 2016-09-24 14:46:41 +01:00
Evgeny L
987da0186b
Add kubeadm flags to known-flags.txt 2016-09-24 14:46:41 +01:00
Alan Grosskurth
112a3f3faf known-flags.txt: Add --dns-bind-address
This is a newly-added kube-dns flag.
2016-09-23 22:11:32 -07:00
Kubernetes Submit Queue
c46bc88f04 Merge pull request #31491 from dims/fixes-issue-13598
Automatic merge from submit-queue

Allow secure access to apiserver from Admission Controllers

* Allow options.InsecurePort to be set to 0 to switch off insecure access
* In NewSelfClient, Set the TLSClientConfig to the cert and key files
  if InsecurePort is switched off
* Mint a bearer token that allows the client(s) created in NewSelfClient
  to talk to the api server
* Add a new authenticator that checks for this specific bearer token

Fixes #13598
2016-09-21 21:31:56 -07:00
Davanum Srinivas
364dd1a752 New command line flag - Set CA file for apiserver in-process client 2016-09-20 18:59:35 -04:00
Kubernetes Submit Queue
e3e26164d5 Merge pull request #32902 from jayunit100/viper_hierarchies
Automatic merge from submit-queue

Viper direct bindings to TestContext struct with hierarchichal suppor…

Part of #31453 to support hierarchichal parameters.  This one does so for density, paves way for other tests as well.
2016-09-20 15:11:22 -07:00
jayunit100
be2e1f5d96 viper hierarchies, cadvisor impl 2016-09-20 15:42:22 -04:00
Random-Liu
ae031634e4 Add CRI Validation test. The test run non-flaky, non-serial test against
Kubernetes HEAD and docker v1.11.2 with CRI enabled.
2016-09-20 12:18:07 -07:00
Kubernetes Submit Queue
650715d231 Merge pull request #32903 from yujuhong/enable_docker_shim
Automatic merge from submit-queue

kubelet: Add a hidden flag to enable docker CRI integration for testing
2016-09-20 11:19:26 -07:00
Kubernetes Submit Queue
12ecc60833 Merge pull request #32264 from dshulyak/enable_hostpath_provisioner
Automatic merge from submit-queue

Enable hostpath provisioner for vagrant environment

This flag is required to run e2e tests for certain features (petset), and for manual tests and debugging.

related: https://github.com/kubernetes/kubernetes/issues/32119
2016-09-20 00:30:42 -07:00
Yu-Ju Hong
1c3c1ac514 kubelet: Add a hidden flag to enable docker CRI integration
The new flag, if specified, and if --container-runtime=docker, switches
kubelet to use the new CRI implementation for testing. This is hidden flag
since the feature is still under heavy development and the flag may be changed
in the near future.
2016-09-19 13:09:00 -07:00
Kubernetes Submit Queue
3aa72fa480 Merge pull request #32926 from kubernetes/revert-32841-revert-32251-fix-oom-policy
Automatic merge from submit-queue

[kubelet] Fix oom-score-adj policy in kubelet

Fixes #32238 

We have been having this regression since v1.3. It is critical for GKE/GCE deployments of k8s because docker daemon has a high likelihood of being OOM killed which will end up nuking all containers. 
The reason for moving from mnt to pid is that docker daemon moves itself into a new mnt namespace with systemd based deployments.
2016-09-17 13:00:20 -07:00
Kubernetes Submit Queue
294502685c Merge pull request #30577 from chrislovecnm/cassandra-petset
Automatic merge from submit-queue

Pet Set Example for Cassandra

- updating cassandra to 3.7
- added pet set example
- adding pet set for Cassandra e2e tests
- changed service as we do not want a lb service, as we are running C*
- updated docs

cc @bgrant0607 

cc @kubernetes/examples 

We can probably close a couple of other open PR, since I did some other stuff.
2016-09-16 21:56:18 -07:00
Vish Kannan
a1fe3adbc7 Revert "Revert "[kubelet] Fix oom-score-adj policy in kubelet"" 2016-09-16 16:32:58 -07:00
Vish Kannan
492ca3bc9c Revert "[kubelet] Fix oom-score-adj policy in kubelet" 2016-09-15 19:28:59 -07:00
Vishnu kannan
7df2c304b6 update flag exception scripts
Signed-off-by: Vishnu kannan <vishnuk@google.com>
2016-09-14 12:43:59 -07:00
Dmitry Shulyak
c59eb6275f Enable hostpath provisioner for vagrant environment
It is required to run automated tests for certain features (petset),
and for manual tests and debugging.

Change-Id: I9203aab6d67c8ff0cc4574473e8d0af888fe1804
2016-09-14 16:58:04 +03:00
Kubernetes Submit Queue
e56a32a22d Merge pull request #31772 from gmarek/wrong_flag
Automatic merge from submit-queue

Create a flag for route reconciliation and deprecate unused node-sync-…

cc @pwittrock to decide if it can go in 1.4. It's a zero risk cleanup, that will reduce confusion about cluster configuration.
2016-09-14 06:22:47 -07:00
Kubernetes Submit Queue
75e09a892f Merge pull request #32161 from hongchaodeng/rb
Automatic merge from submit-queue

etcd: data rollback tool of v3 -> v2

ref: https://github.com/kubernetes/features/issues/44
ref #20504

What?
This provides a rollback tool for some users to rollback etcd data from v3 to v2.
2016-09-14 04:12:02 -07:00
gmarek
4f0129b023 Create a flag for route reconciliatio and deprecate unused node-sync-period one 2016-09-14 11:49:50 +02:00
Kubernetes Submit Queue
c4893df894 Merge pull request #32151 from bboreham/fix-cni-on-gci
Automatic merge from submit-queue

Add flag to set CNI bin dir, and use it on gci nodes

**What this PR does / why we need it**:

When using `kube-up` on GCE, following #31023 which moved the workers from debian to gci, CNI just isn't working.  The root cause is basically as discussed in #28563: one flag (`--network-plugin-dir`) means two different things, and the `configure-helper` script uses it for the wrong purpose.

This PR adds a new flag `--cni-bin-dir`, then uses it to configure CNI as desired.

As discussed at #28563, I have also added a flag `--cni-conf-dir` so users can be explicit 

**Which issue this PR fixes** : fixes #28563

**Special notes for your reviewer**:

I left the old flag largely alone for backwards-compatibility, with the exception that I stop setting the default when CNI is in use.  The value of `"/usr/libexec/kubernetes/kubelet-plugins/net/exec/"` is unlikely to be what is wanted there.

**Release note**:
```release-note
Added new kubelet flags `--cni-bin-dir` and `--cni-conf-dir` to specify where CNI files are located.
Fixed CNI configuration on GCI platform when using CNI.
```
2016-09-13 16:42:06 -07:00
Maisem Ali
19ca81cd36 Adding support for upgrading testing across image types. 2016-09-13 13:46:20 -07:00
Bryan Boreham
db5fa5297d Fix unit tests and known flags list 2016-09-13 20:42:52 +00:00
Hongchao Deng
61e238cac3 etcd: data rollback tool of v3 -> v2 2016-09-08 12:29:19 -07:00
chrislovecnm
07f751956d - updates to docker
- updating java to 3.7
- added pet set example
- adding pet set for Cassandra e2e tests
- changed service as we do not want a lb service, as we are running C*
- updated docs

fixing headers and adding exception for run.sh

adding documentation, thank god for reflog

Did not mean to commit that as the README ... fixing

fixing problems in README

fixing more problems in README

more README tweaks

munge updates

updating examples_test for PetSet in Cassandra examples

updating petset to no use better security context
2016-09-06 19:57:37 -06:00
Wojciech Tyczynski
4b29d006b0 Allow for not-ready nodes in e2e test 2016-09-06 12:14:45 +02:00
Kubernetes Submit Queue
5c332e0d02 Merge pull request #31628 from Random-Liu/move-image-logic-to-remote-run
Automatic merge from submit-queue

Node E2E: Move the image and host related logic to be remote run specific.

This PR addresses #31597, and better fixes #31588.

With this PR:
1) All remote logic is moved into remote mode.
2) All gci related logic is only called when `HOSTS` and `IMAGES` are not specified.
3) Run node e2e against other node e2e images will work again - `make test-e2e-node REMOET=true IMAGES=e2e-node-containervm-v20160321-image`.
4) List images will work again - `make test-e2e-node REMOTE=true LIST_IMAGES=true`.

Mark 1.4, because https://github.com/kubernetes/kubernetes/pull/31588 is marked as 1.4. And this makes the node e2e work as is described in the [doc ](https://github.com/kubernetes/kubernetes/blob/master/docs/devel/e2e-node-tests.md#run-tests-using-different-images).

@yujuhong @vishh 
/cc @kubernetes/sig-node
2016-08-30 04:24:55 -07:00
Kubernetes Submit Queue
09a97203aa Merge pull request #30744 from madhusudancs/fed-split-build-to-develop-deploy
Automatic merge from submit-queue

Separate federation build.sh into development and deployment scripts.

The idea behind this separation is that it provides a clear distinction
between the dev environment and the prod environment. The
deploy/deploy.sh script will be shipped to the users, but
develop/develop.sh will be purely for development purposes and won't
be part of a release distribution.

Purely for developer convenience, all the deployment functionality is
made available through the develop/develop.sh script.

This change also copies deploy/* files into the release distribution.

cc @kubernetes/sig-cluster-federation @colhom 

```release-note
Federation can now be deployed using the `federation/deploy/deploy.sh` script. This script does not depend on any of the development environment shell library/scripts. This is an alternative to the current `federation-up.sh`/`federation-down.sh` scripts. Both the scripts are going to co-exist in this release, but the `federation-up.sh`/`federation-down.sh` scripts might be removed in a future release in favor of `federation/deploy/deploy.sh` script.
```
2016-08-29 13:46:19 -07:00