Commit Graph

3220 Commits

Author SHA1 Message Date
Hemant Kumar
e011187114 Update code to use new generic allocatedResourceStatus field 2023-07-17 15:30:35 -04:00
Kubernetes Prow Robot
bea27f82d3
Merge pull request #118209 from pohly/dra-pre-scheduled-pods
dra: pre-scheduled pods
2023-07-13 14:43:37 -07:00
Jiahui Feng
049614f884
ValidatingAdmissionPolicy controller for Type Checking (#117377)
* [API REVIEW] ValidatingAdmissionPolicyStatucController config.

worker count.

* ValidatingAdmissionPolicyStatus controller.

* remove CEL typechecking from API server.

* fix initializer tests.

* remove type checking integration tests

from API server integration tests.

* validatingadmissionpolicy-status options.

* grant access to VAP controller.

* add defaulting unit test.

* generated: ./hack/update-codegen.sh

* add OWNERS for VAP status controller.

* type checking test case.
2023-07-13 13:41:50 -07:00
Patrick Ohly
80ab8f0542 dra: handle scheduled pods in kube-controller-manager
When someone decides that a Pod should definitely run on a specific node, they
can create the Pod with spec.nodeName already set. Some custom scheduler might
do that. Then kubelet starts to check the pod and (if DRA is enabled) will
refuse to run it, either because the claims are still waiting for the first
consumer or the pod wasn't added to reservedFor. Both are things the scheduler
normally does.

Also, if a pod got scheduled while the DRA feature was off in the
kube-scheduler, a pod can reach the same state.

The resource claim controller can handle these two cases by taking over for the
kube-scheduler when nodeName is set. Triggering an allocation is simpler than
in the scheduler because all it takes is creating the right
PodSchedulingContext with spec.selectedNode set. There's no need to list nodes
because that choice was already made, permanently. Adding the pod to
reservedFor also isn't hard.

What's currently missing is triggering de-allocation of claims to re-allocate
them for the desired node. This is not important for claims that get created
for the pod from a template and then only get used once, but it might be
worthwhile to add de-allocation in the future.
2023-07-13 21:27:11 +02:00
Patrick Ohly
444d23bd2f dra: generated name for ResourceClaim from template
Generating the name avoids all potential name collisions. It's not clear how
much of a problem that was because users can avoid them and the deterministic
names for generic ephemeral volumes have not led to reports from users. But
using generated names is not too hard either.

What makes it relatively easy is that the new pod.status.resourceClaimStatus
map stores the generated name for kubelet and node authorizer, i.e. the
information in the pod is sufficient to determine the name of the
ResourceClaim.

The resource claim controller becomes a bit more complex and now needs
permission to modify the pod status. The new failure scenario of "ResourceClaim
created, updating pod status fails" is handled with the help of a new special
"resource.kubernetes.io/pod-claim-name" annotation that together with the owner
reference identifies exactly for what a ResourceClaim was generated, so
updating the pod status can be retried for existing ResourceClaims.

The transition from deterministic names is handled with a special case for that
recovery code path: a ResourceClaim with no annotation and a name that follows
the Kubernetes <= 1.27 naming pattern is assumed to be generated for that pod
claim and gets added to the pod status.

There's no immediate need for it, but just in case that it may become relevant,
the name of the generated ResourceClaim may also be left unset to record that
no claim was needed. Components processing such a pod can skip whatever they
normally would do for the claim. To ensure that they do and also cover other
cases properly ("no known field is set", "must check ownership"),
resourceclaim.Name gets extended.
2023-07-11 14:23:48 +02:00
Todd Neal
ea1eb7f8f7
implement sidecar resource calculation 2023-07-08 07:26:13 +09:00
Patrick Ohly
a514f40131 dra resourceclaim controller: delete generated claims when pod is done
When a pod is done, but not getting removed yet for while, then a claim that
got generated for that pod can be deleted already. This then also triggers
deallocation.
2023-07-05 16:10:20 +02:00
Rita Zhang
d6168bb658
Add ephemeralcontainer to imagepolicy securityaccount admission plugin
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>
2023-06-01 23:05:06 -07:00
Kubernetes Prow Robot
c35a2775b2
Merge pull request #115554 from yt2985/cleanSA
LegacyServiceAccountTokenCleanUp alpha
2023-05-26 08:54:53 -07:00
Kubernetes Prow Robot
03ebd4b7ef
Merge pull request #116656 from HirazawaUi/fik-fd-leaks
Cleanup fd leaks and file removal cleanup
2023-05-24 22:50:50 -07:00
tinatingyu
133eff3df4 implement LegacyServiceAccountTokenCleanUp alpha 2023-05-24 23:20:17 +00:00
Joe Betz
f0f92853ad Add api-machinery TL owners permissions for jpbetz 2023-05-15 11:09:54 -04:00
Daniel Smith
1ffe3f467e lavalamp is taking a long break 2023-05-11 16:43:38 +00:00
HirazawaUi
82e3fa0930 fix fd leaks and failed file removing for main pkg and cmd 2023-05-09 09:24:11 -05:00
Kubernetes Prow Robot
78833e1b33
Merge pull request #117713 from flant/ssr-ga
KEP-3325: Promote SelfSubjectReview to GA
2023-05-03 08:54:24 -07:00
m.nabokikh
40de26dcff KEP-3325: Promote SelfSubjectReview to GA
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
2023-05-02 14:50:40 +02:00
Tim Hockin
d55b67b349
Clean up brace whitespace in **/validation_test.go
This was making my eyes bleed as I read over code.

I used the following in vim.  I made them up on the fly, but they seemed
to pass manual inspection.

:g/},\n\s*{$/s//}, {/
:w
:g/{$\n\s*{$/s//{{/
:w
:g/^\(\s*\)},\n\1},$/s//}},/
:w
:g/^\(\s*\)},$\n\1}$/s//}}/
:w
2023-05-02 00:48:42 -07:00
ialidzhikov
d231d6022b Remove endpoints (old leader election) related RBAC from kube-controller-manager ClusterRole 2023-04-17 23:01:35 +03:00
Hao Ruan
c4e1b01416 replace spew methods with dump methods 2023-04-14 08:05:53 +08:00
Tim Hockin
bc302fa414
Replace uses of ObjectReflectDiff with cmp.Diff
ObjectReflectDiff is already a shim over cmp.Diff, so no actual output
or behavior changes
2023-04-12 08:48:03 -07:00
Tim Hockin
97bab44cae
Replace apimachinery diff.StringDiff with cmp
I forced failures of most of these tests and verified readability
2023-04-12 08:45:31 -07:00
Sathyanarayanan Saravanamuthu
9363afc650 Fixing broken tests
Signed-off-by: Sathyanarayanan Saravanamuthu <sathyanarays@vmware.com>
2023-04-10 11:18:09 +05:30
Sathyanarayanan Saravanamuthu
26b35ce36a Remove endpoint related RBAC from scheduler cluster role 2023-04-06 17:40:52 +05:30
Monis Khan
735bbc135c
Clean up formatting
Signed-off-by: Monis Khan <mok@microsoft.com>
2023-03-30 16:38:15 -04:00
Taahir Ahmed
51f759aa05 ClusterTrustBundles: kube-apiserver integration tests 2023-03-15 20:19:48 -07:00
Taahir Ahmed
6a75e7c40c ClusterTrustBundles: Define types
This commit is the main API piece of KEP-3257 (ClusterTrustBundles).

This commit:

* Adds the certificates.k8s.io/v1alpha1 API group
* Adds the ClusterTrustBundle type.
* Registers the new type in kube-apiserver.
* Implements the type-specfic validation specified for
  ClusterTrustBundles:
  - spec.pemTrustAnchors must always be non-empty.
  - spec.signerName must be either empty or a valid signer name.
  - Changing spec.signerName is disallowed.
* Implements the "attest" admission check to restrict actions on
  ClusterTrustBundles that include a signer name.

Because it wasn't specified in the KEP, I chose to make attempts to
update the signer name be validation errors, rather than silently
ignored.

I have tested this out by launching these changes in kind and
manipulating ClusterTrustBundle objects in the resulting cluster using
kubectl.
2023-03-15 20:10:18 -07:00
Patrick Ohly
fec5233668 api: resource.k8s.io PodScheduling -> PodSchedulingContext
The name "PodScheduling" was unusual because in contrast to most other names,
it was impossible to put an article in front of it. Now PodSchedulingContext is
used instead.
2023-03-14 10:18:08 +01:00
Jiahui Feng
501976cc34 fix broken tests after dependency injection. 2023-03-13 14:40:47 -07:00
Kubernetes Prow Robot
cd56332d06
Merge pull request #116501 from mattcary/ss-beta
Graduate StatefulSetAutoDelete to beta
2023-03-13 19:31:20 -07:00
Matthew Cary
1d6df8233c Graduate StatefulSetAutoDelete to beta
Change-Id: Iee385580d313c69fbb8a893eb5c165aa0b75725d
2023-03-13 17:09:29 -07:00
Kubernetes Prow Robot
9c5eebaf3f
Merge pull request #115879 from mtardy/scdeny-warning
`SecurityContextDeny` admission plugin: add warning on creation
2023-03-13 07:02:48 -07:00
mtardy
36a2156033 Add a SecurityContextDeny feature gate disabled by default
Put plugin registration behind the feature gate.
2023-03-13 10:18:08 +01:00
Todd Neal
4096c9209c dedupe pod resource request calculation 2023-03-09 17:15:53 -06:00
Maksim Nabokikh
c1431af4f8
KEP-3325: Promote SelfSubjectReview to Beta (#116274)
* Promote SelfSubjectReview to Beta

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

* Fix whoami API

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

* Fixes according to code review

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

---------

Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
2023-03-08 15:42:33 -08:00
torredil
6aebda9b1e Remove AWS legacy cloud provider + EBS in-tree storage plugin
Signed-off-by: torredil <torredil@amazon.com>
2023-03-06 14:01:15 +00:00
Vinay Kulkarni
76962b0fa7 In-place Pod Vertical Scaling - API changes
1. Define ContainerResizePolicy and add it to Container struct.
 2. Add ResourcesAllocated and Resources fields to ContainerStatus struct.
 3. Define ResourcesResizeStatus and add it to PodStatus struct.
 4. Add InPlacePodVerticalScaling feature gate and drop disabled fields.
 5. ResizePolicy validation & defaulting and Resources mutability for CPU/Memory.
 6. Various fixes from code review feedback (originally committed on Apr 12, 2022)
KEP: /enhancements/keps/sig-node/1287-in-place-update-pod-resources
2023-02-24 17:18:04 +00:00
mtardy
5049382a81 Scdeny admission plugin: add warning on register 2023-02-19 13:09:21 +01:00
SataQiu
b9e5f5ad2f using const systemNodeRoleName instead of string system:node 2023-02-13 14:22:28 +08:00
Kubernetes Prow Robot
76e881d4d5
Merge pull request #114817 from TommyStarK/plugin-pkg-admission/replace-deprecated-pointer-function
plugin/pkg/admission: Replace deprecated pointer function
2023-01-04 14:30:44 -08:00
TommyStarK
d570ab8bc5 plugin/pkg/admission: Replace deprecated pointer function
Signed-off-by: TommyStarK <thomasmilox@gmail.com>
2023-01-04 14:12:32 +01:00
SataQiu
bc4a13bd74 remove heapster rule from system:controller:horizontal-pod-autoscaler clusterrole 2023-01-04 16:28:42 +08:00
Jordan Liggitt
78cb3862f1
Fix indentation/spacing in comments to render correctly in godoc 2022-12-17 23:27:38 -05:00
Daniel Smith
8100efc7b3 Enable propagration of HasSynced
* Add tracker types and tests
* Modify ResourceEventHandler interface's OnAdd member
* Add additional ResourceEventHandlerDetailedFuncs struct
* Fix SharedInformer to let users track HasSynced for their handlers
* Fix in-tree controllers which weren't computing HasSynced correctly
* Deprecate the cache.Pop function
2022-12-14 18:43:33 +00:00
Kubernetes Prow Robot
6edb35d63e
Merge pull request #114116 from jsafrane/fix-pvc-autodelete
Fix OwnerReferencesPermissionEnforcement complaints when autodeleting PVCs
2022-12-10 06:04:40 -08:00
Kubernetes Prow Robot
8814b99bfa
Merge pull request #111576 from inosato/remove-ioutil-from-auth-plugin
Remove ioutil from auth plugin
2022-12-09 15:42:07 -08:00
Kubernetes Prow Robot
da8a78ebd2
Merge pull request #113267 from hoskeri/cleanup-kubelet-admin-role
Remove unused RBAC rule from system:kubelet-api-admin
2022-12-09 14:33:33 -08:00
Jan Safranek
ebc5b208ae Fix OwnerReferencesPermissionEnforcement complaints when autodeleting PVCs
When StatefulSetAutoDeletePVC feature gate is enabled, StatefulSet
controller updates ownerReferences on managed PVCs. To be able to pass
OwnerReferencesPermissionEnforcement admission, it must have permissions to
delete PVCs.
2022-11-24 14:46:45 +01:00
Kubernetes Prow Robot
d1c0171aed
Merge pull request #111023 from pohly/dynamic-resource-allocation
dynamic resource allocation
2022-11-11 16:21:56 -08:00
Ed Bartosh
ae0f38437c kubelet: add support for dynamic resource allocation
Dependencies need to be updated to use
github.com/container-orchestrated-devices/container-device-interface.

It's not decided yet whether we will implement Topology support
for DRA or not. Not having any toppology-related code
will help to avoid wrong impression that DRA is used as a hint
provider for the Topology Manager.
2022-11-11 21:58:03 +01:00
Patrick Ohly
d2ff210c20 scheduler: add dynamic resource allocation plugin
The plugin handles the interaction with ResourceClaims that are referenced by a
Pod.
2022-11-11 21:58:03 +01:00