Commit Graph

809 Commits

Author SHA1 Message Date
Jing Xu
0b13aee0c0 Add EmptyDir Volume and local storage for container overlay Isolation
This PR adds two features:
1. add support for isolating the emptyDir volume use. If user
sets a size limit for emptyDir volume, kubelet's eviction manager
monitors its usage
and evict the pod if the usage exceeds the limit.
2. add support for isolating the local storage for container overlay. If
the container's overly usage exceeds the limit defined in container
spec, eviction manager will evict the pod.
2017-06-05 12:05:48 -07:00
Tim Hockin
be987b015c Merge pull request #46716 from thockin/proxy-comments
Kube-proxy cleanups
2017-06-03 15:57:17 -07:00
Dawn Chen
b9e8d2aee6 Merge pull request #46711 from derekwaynecarr/redundant-if-block
Fix cross-build by having active deadline seconds use maxInt32
2017-06-01 17:18:18 -07:00
Tim Hockin
fc34a9d6ba 'Global' -> 'Cluster' for traffic policy 2017-06-01 16:17:38 -07:00
Kubernetes Submit Queue
14a1cdd208 Merge pull request #44785 from jingxu97/April/apistorage
Automatic merge from submit-queue

Add Local Storage Capacity Isolation API

This PR adds the new APIs to support storage capacity isolation as
described in the proposal [https://github.com/kubernetes/community/pull/306](url)

1. Add SizeLimit for emptyDir volume
2. Add scratch and overlay storage type used by container level or
node level


**Release note**:

```release-note
Alpha feature: Local volume Storage Capacity Isolation allows users to set storage limit to isolate EmptyDir volumes, container storage overlay, and also supports allocatable storage for shared root file system. 
```
2017-06-01 09:12:19 -07:00
Derek Carr
6207e19fb8 Fix cross-compile error 2017-05-31 16:10:22 -04:00
Jing Xu
85f030c2aa Add storage isolation API
This PR adds the new APIs to support storage capacity isolation as described in the proposal
https://github.com/kubernetes/community/pull/306

1. Add SizeLimit for emptyDir volume
2. Add scratch and overlay storage type used by container level or
node level
2017-05-31 12:26:04 -07:00
Derek Carr
18bf8f8616 redudant if-block in validation code 2017-05-31 12:08:52 -04:00
Kubernetes Submit Queue
91cef78f43 Merge pull request #46640 from derekwaynecarr/active-deadline-seconds-fix
Automatic merge from submit-queue (batch tested with PRs 46661, 46562, 46657, 46655, 46640)

Improve validation of active deadline seconds

**What this PR does / why we need it**:
Improve validation of active deadline seconds to not allow it to be larger than max uint32.

If users choose a value that is too large, the conversion of that value to a duration in seconds can cause an overflow.  I see no practical benefit of having a value larger than uint32 at this time.

xref: https://bugzilla.redhat.com/show_bug.cgi?id=1456156

**Release note**:
```release-note
Restrict active deadline seconds max allowed value to be maximum uint32
```
2017-05-31 01:08:11 -07:00
Kubernetes Submit Queue
b0c3fb16ca Merge pull request #46412 from zjj2wry/va-test
Automatic merge from submit-queue

add test in validation

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-05-30 15:43:21 -07:00
Derek Carr
9d412210e9 Active deadline seconds validation improvements 2017-05-30 14:57:06 -04:00
zhengjiajin
c5121d9e6f add test for validation NFS and GlusterFS 2017-05-27 22:37:56 +08:00
zhengjiajin
857306b3c2 fix some type 2017-05-24 10:05:01 +08:00
Michelle Au
d848be195f API changes for persistent local volumes.
Includes:
- A new volume type, LocalVolumeSource.  This only supports
file-based local volumes for now.
- New alpha annotation in PV: NodeAffinity
- Validation + tests for specifying LocalVolumeSource and PV
NodeAffinity
- Alpha feature gate
2017-05-21 11:48:56 -07:00
Brendan Burns
4177b28e5a Add new AzureDisk API, but not implementation. 2017-05-18 11:36:42 -07:00
Zihong Zheng
5992425588 Autogenerated files 2017-05-16 21:55:51 -07:00
Zihong Zheng
c0920f75cf Move API annotations into annotation_key_constants and remove api/annotations package 2017-05-16 21:55:23 -07:00
Kubernetes Submit Queue
7cd32aba17 Merge pull request #45775 from liggitt/mirror-pod-validation
Automatic merge from submit-queue (batch tested with PRs 44337, 45775, 45832, 45574, 45758)

Tighten validation of mirror pod annotations

Tightens validation for pods with a mirror pod annotation:
1. spec.nodeName must be set
2. makes the mirror pod annotation immutable
3. starts validating pod-specific annotations during pod status update

None of these changes affect usage of the mirror pod annotation by kubelets, which only set it on pod creation (verified this is true back to 1.5.x)

the second commit updates the pod validation tests to look for specific error messages (best reviewed ignoring whitespace changes)

This is the validation portion of https://github.com/kubernetes/community/blob/master/contributors/design-proposals/kubelet-authorizer.md and https://github.com/kubernetes/features/issues/279

```release-note
Mirror pods must now indicate the nodeName they are bound to on creation. The mirror pod annotation is now treated as immutable and cannot be added to an existing pod, removed from a pod, or modified.
```
2017-05-15 18:39:13 -07:00
Jordan Liggitt
eb0e4fa94c
Test specific errors in pod validation tests 2017-05-13 22:34:41 -04:00
Jordan Liggitt
cd3a1187a1
Require nodeName for mirror pods, make mirror pod annotation immutable 2017-05-13 22:34:41 -04:00
Zihong Zheng
12277a0ad4 Update ESIPP validation and service registry unit tests 2017-05-12 10:59:00 -07:00
Zihong Zheng
79ca71708a Adjust ESIPP validation and service registry codes 2017-05-12 10:58:59 -07:00
Kubernetes Submit Queue
99ede8ac1b Merge pull request #45390 from mbohlool/c4
Automatic merge from submit-queue (batch tested with PRs 43006, 45305, 45390, 45412, 45392)

Update go-restful dependency

This is required by #44787. But because both this and the changes in 44787 need constant rebase, I am trying to get this one in separately to make less rebases.

The change is only a dependency update.
2017-05-05 16:39:08 -07:00
Kubernetes Submit Queue
17d33ea82e Merge pull request #44830 from NickrenREN/remove-NodeLegacyHostIP
Automatic merge from submit-queue

Remove deprecated NodeLegacyHostIP

**Release note**:
```release-note
Remove deprecated node address type `NodeLegacyHostIP`.
```

ref #44807
2017-05-05 15:38:58 -07:00
mbohlool
ea042c6ca0 Update go-restful dependency 2017-05-05 13:57:01 -07:00
Jamie Hannaford
9440a68744 Use dedicated Unix User and Group ID types 2017-05-05 14:07:38 +02:00
Ricky Pai
78d66626de validate HostAliases have valid IP and hostnames 2017-04-28 21:43:54 -07:00
Ricky Pai
d544561a17 validate HostAliases are not present when using hostNetwork 2017-04-28 21:43:54 -07:00
Kubernetes Submit Queue
82cde2182f Merge pull request #44741 from MrHohn/esipp-validation-refine
Automatic merge from submit-queue

Refine ESIPP validation logic in validation.go

Separated from #41162.

The previous ESIPP validation logic in validation.go has a huge overlap with [function healthCheckNodePortUpdate in service/rest.go](870585e8e1/pkg/registry/core/service/rest.go (L283-L373)), in which we reject any invalid modifications on ESIPP annotations.

This PR removes the overlap, and make validation.go only check if values are legal and whether user mixes different API versions (alpha & beta).

We are indeed removing the alpha annotation support, but it is kept in the codes for the ease of transiting the same logic onto beta/GA.

/assign @thockin @freehan 

**Release note**:

```release-note
NONE
```
2017-04-25 00:46:03 -07:00
NickrenREN
7d00e5cfb6 remove deprecated NodeLegacyHostIP 2017-04-24 11:01:25 +08:00
Kubernetes Submit Queue
3559c067c6 Merge pull request #41571 from php-coder/fix_comments
Automatic merge from submit-queue

Minor cleanups

Minor improvements:
- `ValidateNoNewFinalizers`: remove unused const
- Mention that mutation of `spec.initContainers[*].image` field is allowed
- Improve godoc comments
2017-04-21 08:34:07 -07:00
Zihong Zheng
a95c71e8b8 Refine service external traffic validation 2017-04-20 14:12:15 -07:00
Chao Xu
d4850b6c2b move pkg/api/v1/helpers.go to subpackage 2017-04-14 14:25:11 -07:00
Mike Danese
a05c3c0efd autogenerated 2017-04-14 10:40:57 -07:00
Avesh Agarwal
ebe3255439 Add unit tests when the feature AffinityInAnnotations is disabled. 2017-04-13 17:15:45 -04:00
Avesh Agarwal
d2117c0148 Fix to not allow when the feature AffinityInAnnotations is disabled.
https://github.com/kubernetes/kubernetes/issues/44360
2017-04-13 17:15:44 -04:00
Chao Xu
08aa712a6c move helpers.go to helper 2017-04-11 15:49:11 -07:00
Kubernetes Submit Queue
d2e4f54791 Merge pull request #30302 from aveshagarwal/master-project-node-selector-taints-tolerations
Automatic merge from submit-queue (batch tested with PRs 43870, 30302, 42722, 43736)

Admission plugin to merge pod and namespace tolerations for restricting pod placement on nodes

```release-note
This admission plugin checks for tolerations on the pod being admitted and its namespace, and verifies if there is any conflict. If there is no conflict, then it merges the pod's namespace tolerations with the the pod's tolerations and it verifies them against its namespace' whitelist of tolerations and returns. If a namespace does not have its default or whitelist tolerations specified, then cluster level default and whitelist is used. An example of its versioned config:

apiVersion: apiserver.k8s.io/v1alpha1
kind: AdmissionConfiguration
plugins:
- name: "PodTolerationRestriction"
  configuration:
    apiVersion: podtolerationrestriction.admission.k8s.io/v1alpha1
    kind: Configuration
    default:
     - Key: key1
       Value: value1
     - Key: key2
       Value: value2
    whitelist:
    - Key: key1
      Value: value1
    - Key: key2
      Value: value2
```
2017-04-10 13:33:13 -07:00
Klaus Ma
c2b629ee2a Removed hostname/subdomain annotation. 2017-04-10 13:55:40 +08:00
Avesh Agarwal
af53794854 Pod toleration restriction plugin with taints and tolerations. 2017-04-06 16:15:34 -04:00
Huamin Chen
4b7e084a8e add iSCSI CHAP API
Signed-off-by: Huamin Chen <hchen@redhat.com>
2017-04-05 12:43:48 +00:00
Slava Semushin
95049b6440 Minor cleanups.
- ValidateNoNewFinalizers: remove unused const
- Mention that mutation of spec.initContainers[*].image field is allowed
- Improve godoc comments
- validation_test.go(expectPrefix): remove unused function
2017-04-05 09:49:35 +02:00
Kubernetes Submit Queue
e28cb42706 Merge pull request #42717 from andrewsykim/support-host-ip-downward-api
Automatic merge from submit-queue

Support status.hostIP in downward API

**What this PR does / why we need it**:
Exposes pod's hostIP (node IP) via downward API. 

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: 
fixes https://github.com/kubernetes/kubernetes/issues/24657

**Special notes for your reviewer**:
Not sure if there's more documentation that's needed, please point me in the right direction and I will add some :)
2017-04-03 15:48:12 -07:00
Kubernetes Submit Queue
70684584be Merge pull request #42083 from fraenkel/validate_name
Automatic merge from submit-queue (batch tested with PRs 42038, 42083)

Validate ConfigMapRef and SecretRef name

fixes #42037

**Release note**:
```release-note
When creating a container using envFrom,
1. validate the name of the ConfigMap in a ConfigMapRef
2. validate the name of the Secret in a SecretRef
```
2017-04-03 04:07:21 -07:00
Kubernetes Submit Queue
a4f6cae9c9 Merge pull request #38741 from sandflee/validate-activeDeadline
Automatic merge from submit-queue

validate activeDeadlineSeconds in rs/rc

**What this PR does / why we need it**:
if setting activeDeadlineSeconds, deployment will continuously created new pods after old pod dies.
**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #38684

**Special notes for your reviewer**:

**Release note**:

```release-note
ActiveDeadlineSeconds is validated in workload controllers now, make sure it's not set anywhere (it shouldn't be set by default and having it set means your controller will restart the Pods at some point)
```
2017-03-29 14:53:13 -07:00
andrewsykim
91c027d6cc support hostIP in downward API 2017-03-28 20:20:19 -04:00
Avesh Agarwal
eccbd992da Add validation for taints annotations. 2017-03-22 01:01:49 -04:00
Avesh Agarwal
ff4c1d80d2 Add validation for toleration annotations. 2017-03-22 00:53:34 -04:00
Avesh Agarwal
ab5b462d17 Add node affinity, pod affinity and pod antiaffinity validation for alpha annotations. 2017-03-22 00:28:00 -04:00
Hemant Kumar
12d6b87894 Validation PVs for mount options
We are going to move the validation in its own package
and we will be calling validation for individual volume types
as needed.
2017-03-09 18:24:37 -05:00