Commit Graph

7447 Commits

Author SHA1 Message Date
Kubernetes Submit Queue
e2d997cfea
Merge pull request #64276 from wangzhen127/manifests-seccomp
Automatic merge from submit-queue (batch tested with PRs 64276, 64094, 64719, 64766, 64750). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use default seccomp profile for GCE manifests

**What this PR does / why we need it**:
This PR sets the default seccomp profile of unprivileged addons to 'docker/default' for GCE manifests. This PR is a followup of #62662. We are using 'docker/default' instead of 'runtime/default' in addons in order to handle node version skew. When seccomp profile is applied automatically by default later, we can remove those annotations.

This is PR is part of #39845.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-06-05 11:35:10 -07:00
Kubernetes Submit Queue
2f011d01fa
Merge pull request #64473 from nberlee/master
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Drop capabilities of CoreDNS container and run in read-only

**What this PR does / why we need it**: Make the CoreDNS container more secure by dropping (root) capabilities. Improve the integrity of the of the container by running the whole container in read-only.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:
Same [changes](aba0245609) as in the CoreDNS deployment repository.
**Release note**:

```release-note
Kubeadm: Make CoreDNS run in read-only mode and drop all unneeded privileges 
```
2018-06-05 10:23:19 -07:00
Kubernetes Submit Queue
5f5ac2e3ff
Merge pull request #64717 from rajansandeep/corednsimage
Automatic merge from submit-queue (batch tested with PRs 64344, 64709, 64717, 63631, 58647). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

CoreDNS pull image from gcr.io

**What this PR does / why we need it**:
CoreDNS now pulls image from gcr.io
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-06-05 02:16:13 -07:00
Nico Berlee
7ee5729eba
Run CoreDNS container only with CAP_NET_BIND_SERVICE, drop all other (root) privileges.
Run filesystem of container and config in read-only mode.
2018-06-05 08:22:47 +02:00
Kubernetes Submit Queue
898831ad9d
Merge pull request #64592 from ravisantoshgudimetla/revert-64364-remove-rescheduler
Automatic merge from submit-queue (batch tested with PRs 63453, 64592, 64482, 64618, 64661). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Revert "Remove rescheduler and corresponding tests from master"

Reverts kubernetes/kubernetes#64364

After discussing with @bsalamat on how DS controllers(ref: https://github.com/kubernetes/kubernetes/pull/63223#discussion_r192277527) cannot create pods if the cluster is at capacity and they have to rely on rescheduler for making some space, we thought it is better to 

- Bring rescheduler back.
- Make rescheduler priority aware.
- If cluster is full and if **only** DS controller is not able to create pods, let rescheduler be run and let it evict some pods which have less priority.
- The DS controller pods will be scheduled now.

So, I am reverting this PR now. Step 2, 3 above are going to be in rescheduler.

/cc @bsalamat @aveshagarwal @k82cn 

Please let me know your thoughts on this. 

```release-note
Revert #64364 to resurrect rescheduler. More info https://github.com/kubernetes/kubernetes/issues/64725 :)
```
2018-06-04 16:56:11 -07:00
Sandeep Rajan
ab0a421e8d coredns to gcr.io repo 2018-06-04 16:44:42 -04:00
Kubernetes Submit Queue
4f088e6263
Merge pull request #64591 from cadmuxe/custom_netd
Automatic merge from submit-queue (batch tested with PRs 61610, 64591, 58143, 63929). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add netd as an addon for GCP

**What this PR does / why we need it**:
Add netd as an addon for GKE.
The PR will add setup functions and var to help deploy netd daemon on GKE.
Please checkout more detail for netd at https://github.com/GoogleCloudPlatform/netd

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```
2018-06-04 12:26:16 -07:00
Kubernetes Submit Queue
36a3daa355
Merge pull request #61610 from rajansandeep/kubeupaddon
Automatic merge from submit-queue (batch tested with PRs 61610, 64591, 58143, 63929). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Create CoreDNS and kube-dns folders

**What this PR does / why we need it**:
Separate the CoreDNS and kube-dns manifests by creating their own folders (dns/coredns and dns/kube-dns) 

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #61435 

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
cc @MrHohn
2018-06-04 12:26:12 -07:00
Koonwah Chen
daf5e15535 add NON_MASTER_NODE_LABELS to config-test.sh 2018-06-03 20:47:26 -07:00
Koonwah Chen
37059e7efa Code clean up 2018-06-03 19:41:47 -07:00
Koonwah Chen
bb8272ead4 support netd on k8s 2018-06-03 01:35:27 -07:00
Kubernetes Submit Queue
586e558c3b
Merge pull request #59938 from rramkumar1/gce-cluster-up-ipvs
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add ipvs module loading logic to gce scripts

**What this PR does / why we need it**:
Add ipvs module loading logic to gce scripts. 
Fixes a part of #59402.

/cc @Lion-Wei 
/assign @roberthbailey @m1093782566 

**Release note**:
```release-note
None
```
2018-05-31 20:55:44 -07:00
Koonwah Chen
d903d32856 Add netd as an addon for GKE. 2018-05-31 19:25:15 -07:00
RaviSantosh Gudimetla
872addf9e3
Revert "Remove rescheduler and corresponding tests from master" 2018-05-31 22:18:49 -04:00
Kubernetes Submit Queue
a7998a2a0e
Merge pull request #64292 from awly/gce-pull-exec-plugin
Automatic merge from submit-queue (batch tested with PRs 64582, 64292). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Pull gke-exec-auth-plugin binary on Nodes

If the plugin URL is set and VM is not master, pull the plugin binary.

**What this PR does / why we need it**: implement deployment of https://github.com/kubernetes/cloud-provider-gcp/tree/master/cmd/gke-exec-auth-plugin on Node VMs.

**Release note**:
```release-note
NONE
```
2018-05-31 19:04:03 -07:00
Kubernetes Submit Queue
01e21b8516
Merge pull request #64582 from dashpole/turn_off_memcg
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Disable memcg for testing prior to 1.11 release

**What this PR does / why we need it**:
Turn off kubelet memory cgroup notifications on GCE to unblock scalability testing.
Related issue: #62808 

```release-note
NONE
```
/sig node
/kind bug
/priority critical-urgent
/assign @shyamjvs @yujuhong
2018-05-31 19:00:28 -07:00
Andrew Lytvynov
7e444a453b Quote shell variable expansion 2018-05-31 16:04:19 -07:00
David Ashpole
c844b9afc4 disable memcg for testing prior to 1.11 release 2018-05-31 15:25:58 -07:00
Zhen Wang
227f7d761d Use default seccomp profile for GCE manifests 2018-05-31 10:35:26 -07:00
Rohit Ramkumar
cc87e73dd8 Add ipvs module loading logic to gce scripts 2018-05-31 08:40:05 -07:00
Kubernetes Submit Queue
a762ea1beb
Merge pull request #64364 from ravisantoshgudimetla/remove-rescheduler
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove rescheduler and corresponding tests from master

**What this PR does / why we need it**:
This is to remove rescheduler from master branch as we are promoting priority and preemption to beta.
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Part of #57471

**Special notes for your reviewer**:
/cc @bsalamat @aveshagarwal 
**Release note**:

```release-note
Remove rescheduler from master.
```
2018-05-30 22:20:26 -07:00
Kubernetes Submit Queue
6ea7763c40
Merge pull request #64281 from wangzhen127/es-seccomp
Automatic merge from submit-queue (batch tested with PRs 64281, 62991). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use default seccomp profile for flutend-elasticsearch addons

**What this PR does / why we need it**:
This PR sets the default seccomp profile to 'docker/default' for:
- fluentd-es daemon set.
- kibana-logging deployment.

The elasticsearch-logging stateful set is still unconfined because it uses gce:podsecuritypolicy:privileged.

This PR is a followup of #62662. We are using 'docker/default' instead of 'runtime/default' in addons in order to handle node version skew. When seccomp profile is applied automatically by default later, we can remove those annotations.

This is PR is part of #39845.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-05-30 13:24:05 -07:00
ravisantoshgudimetla
7559a3678b Build files generated 2018-05-29 20:04:43 -04:00
ravisantoshgudimetla
aeccffc339 Phase out rescheduler in favor of priority and preemption 2018-05-29 19:52:06 -04:00
Sandeep Rajan
753632d85b create coredns and kube-dns folders 2018-05-29 11:52:57 -04:00
Kubernetes Submit Queue
af45e9cdc4
Merge pull request #64258 from rajansandeep/bumpmanifest
Automatic merge from submit-queue (batch tested with PRs 64258, 63068). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update the CoreDNS version and manifest

**What this PR does / why we need it**:
Bumps CoreDNS to 1.1.3 and updates manifest

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
CoreDNS is now v1.1.3
```
2018-05-29 06:58:10 -07:00
Kubernetes Submit Queue
930b3939f1
Merge pull request #64294 from vishh/shutdown-script
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Adding a shutdown script that would enable handling preemptible VM terminations gracefully in GCP environment

This PR adds a shutdown script to COS nodes in GCP k8s clusters that will make preemptible nodes sleep for however long they can between the time they receive an ACPI shutdown request and get's terminated.
https://cloud.google.com/compute/docs/instances/preemptible#preemption_process

This will then allow for catching termination signals via GCE metadata APIs and gracefully evict pods in k8s.

xref https://github.com/kubernetes/release/pull/560/
2018-05-25 22:33:33 -07:00
Vishnu kannan
9475292cd8 Adding a shutdown script that would enable handling preemptible VM terminations gracefully in GCP environment
Signed-off-by: Vishnu kannan <vishnuk@google.com>
2018-05-25 16:20:24 -07:00
Kubernetes Submit Queue
8306b0b1a4
Merge pull request #64296 from mindprince/nvidia-gpu-device-plugin-update-strategy
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update nvidia-gpu-device-plugin to apps/v1 and use RollingUpdate updateStrategy.

Even though RollingUpdate is the default updateStrategy, we need to
specify it explicitly here because otherwise updating from
extensions/v1beta1 to apps/v1 doesn't change the updateStrategy.

Related to #57125 and #63634

```release-note
NONE
```

/assign @vishh @jiayingz 
/cc @janetkuo
2018-05-25 11:33:15 -07:00
Kubernetes Submit Queue
e9327e50b4
Merge pull request #64279 from wangzhen127/dns-seccomp
Automatic merge from submit-queue (batch tested with PRs 61963, 64279, 64130, 64125, 64049). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use default seccomp profile for DNS addons.

**What this PR does / why we need it**:
This PR sets the default seccomp profile of DNS addons to 'docker/default'. This PR is a followup of #62662. We are using 'docker/default' instead of 'runtime/default' in addons in order to handle node version skew. When seccomp profile is applied automatically by default later, we can remove those annotations.

This is PR is part of #39845.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-05-25 01:09:16 -07:00
Kubernetes Submit Queue
d7c40cf69e
Merge pull request #64275 from mtaufen/dkcfg-beta
Automatic merge from submit-queue (batch tested with PRs 63417, 64249, 64242, 64128, 64275). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

graduate DynamicKubeletConfig feature to beta

Everything in the https://github.com/kubernetes/features/issues/281 beta target except a few documentation-related items is complete. Docs should be done very soon, so I'm sending this PR to graduate to beta before freeze.

```release-note
The dynamic Kubelet config feature is now beta, and the DynamicKubeletConfig feature gate is on by default. In order to use dynamic Kubelet config, ensure that the Kubelet's --dynamic-config-dir option is set. 
```

/cc @luxas
2018-05-24 20:49:22 -07:00
Rohit Agarwal
5139bb580a Update nvidia-gpu-device-plugin to apps/v1 and use RollingUpdate updateStrategy.
Even though RollingUpdate is the default updateStrategy, we need to
specify it explicitly here because otherwise updating from
extensions/v1beta1 to apps/v1 doesn't change the updateStrategy.
2018-05-24 17:53:13 -07:00
Kubernetes Submit Queue
e299a5ea90
Merge pull request #63904 from hzxuzhonghu/gce-alpha-feature
Automatic merge from submit-queue (batch tested with PRs 64060, 63904, 64218, 64208, 64247). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Revert enable PodPreset admission and also enable settings.k8s.io/v1a…

…lpha1 api resource



**What this PR does / why we need it**:

Enable PodPreset admission for there are alpha feature test cases covering it.  Simultaneously enable sttings.k8s.io/v1alpha1 api resource.

Fixes #63843 

**Release note**:

```release-note
NONE
```
2018-05-24 17:01:14 -07:00
Andrew Lytvynov
1f7671b18d Pull gke-exec-auth-plugin binary on Nodes
If the plugin URL is set and VM is not master, pull the plugin binary.
2018-05-24 15:08:35 -07:00
Kubernetes Submit Queue
972a74e238
Merge pull request #63755 from tomoe/dumpstack-docker
Automatic merge from submit-queue (batch tested with PRs 63434, 64172, 63975, 64180, 63755). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Dump Stack when docker fails on healthcheck

Save stack dump of docker daemon in order to be able to
investigate why docker daemon was unresposive to `docker ps`

See https://github.com/moby/moby/blob/master/daemon/daemon.go on
how docker sets up a trap for SIGUSR1 with `setupDumpStackTrap()`

**What this PR does / why we need it**:

This allows us to investigate why docker daemon was unresponsive to "docker ps" command. 

**Special notes for your reviewer**:
Manually tested on Ubuntu and COS.

**Release note**:

```release-note
NONE
```
2018-05-24 12:18:25 -07:00
Kubernetes Submit Queue
3449c2c70c
Merge pull request #64172 from cjcullen/reorder
Automatic merge from submit-queue (batch tested with PRs 63434, 64172, 63975, 64180, 63755). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

re-reorder authorizers (RBAC before Webhook).

Sort of reverts #57426

We aren't relying on the ordering for anything, and it's not worth the additional latency/traffic at this point.
2018-05-24 12:18:13 -07:00
Zhen Wang
e9c7fe57d3 Use default seccomp profile for flutend-elasticsearch addon 2018-05-24 11:22:17 -07:00
Zhen Wang
c875690d0d Use default seccomp profile for DNS addons. 2018-05-24 10:55:40 -07:00
Michael Taufen
d4e48fd789 graduate DynamicKubeletConfig feature to beta 2018-05-24 09:59:29 -07:00
Sandeep Rajan
8d8b47596e update manifest
fix test
2018-05-24 09:02:16 -04:00
Kubernetes Submit Queue
ca62aa1ee2
Merge pull request #62756 from wangzhen127/seccomp-in-addon
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Use default seccomp profile for unprivileged addons

**What this PR does / why we need it**:
This PR sets the default seccomp profile of unprivileged addons to 'docker/default'. This PR is a followup of [#62662](https://github.com/kubernetes/kubernetes/pull/62662) and [#62671](https://github.com/kubernetes/kubernetes/pull/62671). We are using 'docker/default' instead of 'runtime/default' in addons in order to handle node version skew. When seccomp profile is applied automatically by default later, we can remove those annotations.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #39845

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2018-05-23 17:29:16 -07:00
CJ Cullen
b3a31b28af re-reorder authorizers (RBAC before Webhook). 2018-05-22 16:48:39 -07:00
Tomoe Sugihara
da23396e22 Dump Stack when docker fails on healthcheck
Send SIGUSR1 to dockerd to save stack dump of docker daemon
in order to be able to investigate why docker daemon was
unresposive to health check done by `docker ps`.

See https://github.com/moby/moby/blob/master/daemon/daemon.go on
how docker sets up a trap for SIGUSR1 with `setupDumpStackTrap()`
2018-05-21 11:39:59 +09:00
Kubernetes Submit Queue
0d815fbc27
Merge pull request #64029 from loburm/truncate-flag
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add environment variable to control truncating backend.

```release-note
NONE
```
2018-05-19 05:17:00 -07:00
Kubernetes Submit Queue
bfca0d32a5
Merge pull request #63689 from awly/gce-fix-kubelet-ca-path
Automatic merge from submit-queue (batch tested with PRs 63969, 63902, 63689, 63973, 63978). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Reuse existing CA cert path for kubelet certs

**What this PR does / why we need it**: configure-helper.sh already knows the path to CA cert, re-use that to avoid typos.

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```
2018-05-18 15:59:19 -07:00
Kubernetes Submit Queue
f105ae3e6d
Merge pull request #63918 from cezarygerard/sd-event-exporter
Automatic merge from submit-queue (batch tested with PRs 63569, 63918, 63980, 63295, 63989). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

New event exporter config with support for new stackdriver resources

New event exporter, with support for use new and old stackdriver resource model.

This should also be cherry-picked to release-1.10 branch, as all  fluentd-gcp components support new and stackdriver resource model.

```release-note
Update event-exporter to version v0.2.0  that supports old (gke_container/gce_instance) and new (k8s_container/k8s_node/k8s_pod) stackdriver resources.
```
2018-05-18 09:54:16 -07:00
Marian Lobur
c1d0004013 Add environment variable to control truncating backend. 2018-05-18 15:52:47 +02:00
Cezary Zawadka
d611aeac80 new event exporter config with support for new stackdriver resource types 2018-05-18 10:37:47 +02:00
Aleksandra Malinowska
6443cd3df8 Cluster Autoscaler 1.2.2 2018-05-17 16:42:46 +02:00
Maciej Borsz
128d6d3498 Add a way to pass extra arguments to etcd. 2018-05-17 10:48:13 +02:00