Commit Graph

610 Commits

Author SHA1 Message Date
Kubernetes Submit Queue
72c6251508 Merge pull request #47019 from jessfraz/allowPrivilegeEscalation
Automatic merge from submit-queue (batch tested with PRs 49651, 49707, 49662, 47019, 49747)

Add support for `no_new_privs` via AllowPrivilegeEscalation

**What this PR does / why we need it**:
Implements kubernetes/community#639
Fixes #38417

Adds `AllowPrivilegeEscalation` and `DefaultAllowPrivilegeEscalation` to `PodSecurityPolicy`.
Adds `AllowPrivilegeEscalation` to container `SecurityContext`.

Adds the proposed behavior to `kuberuntime`, `dockershim`, and `rkt`. Adds a bunch of unit tests to ensure the desired default behavior and that when `DefaultAllowPrivilegeEscalation` is explicitly set.

Tests pass locally with docker and rkt runtimes. There are also a few integration tests with a `setuid` binary for sanity.

**Release note**:

```release-note
Adds AllowPrivilegeEscalation to control whether a process can gain more privileges than it's parent process
```
2017-07-31 16:56:58 -07:00
Janet Kuo
ac3f9b8c34 Autogen 2017-07-26 10:56:55 -07:00
Anirudh
c168a3faeb DS: autogen 2017-07-25 13:33:25 -07:00
Kubernetes Submit Queue
9bdf464bd5 Merge pull request #49286 from kargakis/remote-myself-from-some-places
Automatic merge from submit-queue (batch tested with PRs 49286, 49550)

Remove myself from a bunch of places

I am assigned in reviews which I never get to do. I prefer drive-bys whenever I can do them rather than the bot choosing myself in random, ends up being mere spam.

@smarterclayton please approve.
2017-07-25 06:41:08 -07:00
Kubernetes Submit Queue
7f1d9382ec Merge pull request #48846 from dashpole/remove_ood
Automatic merge from submit-queue

Remove flags low-diskspace-threshold-mb and outofdisk-transition-frequency

issue: #48843

This removes two flags replaced by the eviction manager.  These have been depreciated for two releases, which I believe correctly follows the kubernetes depreciation guidelines.

```release-note
Remove depreciated flags: --low-diskspace-threshold-mb and --outofdisk-transition-frequency, which are replaced by --eviction-hard
```

cc @mtaufen since I am changing kubelet flags
cc @vishh @derekwaynecarr 
/sig node
2017-07-24 23:05:50 -07:00
mbohlool
75c474d4bc Update swagger and OpenAPI spec 2017-07-24 17:28:29 -07:00
Jess Frazelle
ed3b78635f
allowPrivilegeEscalation: update docs
Signed-off-by: Jess Frazelle <acidburn@google.com>
2017-07-24 13:55:13 -04:00
David Ashpole
9bfa28bdff update things 2017-07-20 15:28:23 -07:00
Janet Kuo
56f16346d2 Autogen
make clean && make generated_files && hack/update-all.sh
2017-07-20 14:16:43 -07:00
Michail Kargakis
e884eac6fe
Remove myself from a bunch of places
Signed-off-by: Michail Kargakis <mkargaki@redhat.com>
2017-07-20 12:10:46 +02:00
Bobby (Babak) Salamat
e827e1ba87 autogenerated files 2017-07-18 17:47:57 -07:00
Mike Danese
c201553f27 remove some people from OWNERS so they don't get reviews anymore
These are googlers who don't work on the project anymore but are still
getting reviews assigned to them:
- bprashanth
- rjnagal
- vmarmol
2017-07-13 10:02:21 -07:00
Tim Allclair
a2f2e1d491 Name change: s/timstclair/tallclair/ 2017-07-10 14:05:46 -07:00
deads2k
3ee458d246 remove tpr API access 2017-07-03 11:25:59 -04:00
Bobby (Babak) Salamat
403b30f6e9 Autogenerated files 2017-06-26 15:02:49 -07:00
Bobby Salamat
91f893eebe Add priority to Kubernetes API 2017-06-26 13:43:19 -07:00
Chao Xu
60604f8818 run hack/update-all 2017-06-22 11:31:03 -07:00
Ricky Pai
797dc10a0c generated code 2017-06-21 16:39:50 -07:00
Kubernetes Submit Queue
03014f486c Merge pull request #47824 from mbohlool/revert2
Automatic merge from submit-queue (batch tested with PRs 47851, 47824, 47858, 46099)

Revert 44714 manually

#44714 broke backward compatibility for old swagger spec that kubectl still uses. The decision on #47448 was to revert this change but the change was not automatically revertible. Here I semi-manually remove all references to UnixUserID and UnixGroupID and updated generated files accordingly.

Please wait for tests to pass then review that as there may still be tests that are failing.

Fixes #47448

Adding release note just because the original PR has a release note. If possible, we should remove both release notes as they cancel each other.

**Release note**: (removed by caesarxuchao)

UnixUserID and UnixGroupID is reverted back as int64 to keep backward compatibility.
2017-06-21 15:21:14 -07:00
Josh Horwitz
b6e08ec39d Revert "Merge pull request #43946 from jhorwit2/jah/host-path-psp"
This reverts commit b5eadb5d6b, reversing
changes made to 1889d654f5.
2017-06-21 12:45:22 -04:00
mbohlool
9fe19d1074 Update swagger 1.2 spec 2017-06-21 04:09:08 -07:00
Kubernetes Submit Queue
ad4d965711 Merge pull request #46961 from zjj2wry/api_describe
Automatic merge from submit-queue

Fix api description

**What this PR does / why we need it**:
prefered ->  preferred
the the ->  the

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-06-16 12:19:08 -07:00
Kubernetes Submit Queue
08c705e875 Merge pull request #46800 from deads2k/agg-33-priority
Automatic merge from submit-queue (batch tested with PRs 47492, 47542, 46800, 47545, 45764)

separate group and version priority

Fixes https://github.com/kubernetes/kubernetes/issues/46322


This just modifies the API and does the minimal plumbing.  I can extend this pull or do another to fix the priority problem.
2017-06-14 21:43:44 -07:00
deads2k
d13ad28420 add group priority to apiservice 2017-06-14 09:29:44 -04:00
Kenneth Owens
37a54d521a Generated code 2017-06-12 10:08:46 -07:00
Guangya Liu
9ecb5d9f4f Generated code. 2017-06-10 02:43:05 -04:00
Simon Croome
5e2503e71f Add StorageOS volume plugin 2017-06-09 13:19:27 +01:00
zhengjiajin
f7ce20d2e4 Fix api description 2017-06-09 10:27:53 +08:00
Kubernetes Submit Queue
5404948e7b Merge pull request #47041 from k82cn/k8s_10043
Automatic merge from submit-queue

Deprecated binding for 1.7

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #10043

```release-note
Deprecated Binding objects in 1.7.
```
2017-06-07 23:10:38 -07:00
Klaus Ma
fdc82d16f3 generated codes. 2017-06-08 10:51:46 +08:00
Kenneth Owens
1a784ef86f Auto generated code for StatefulSet update 2017-06-06 13:47:19 -07:00
Christoph Blecker
1bdc7a29ae
Update docs/ URLs to point to proper locations 2017-06-05 22:13:54 -07:00
Fabiano Franz
39e5812848 Update generated 2017-06-05 20:32:30 -03:00
Solly Ross
c8fdeb022f Update generated autoscaling files
This commit updates the generated autoscaling files to be up-to-date
with the HPA status condition changes.
2017-06-05 11:21:31 -04:00
mbohlool
af445855c1 Update OpenAPI spec 2017-06-04 21:54:11 -07:00
Kubernetes Submit Queue
dbd1503b65 Merge pull request #45924 from janetkuo/daemonset-history
Automatic merge from submit-queue

Implement Daemonset history

~Depends on #45867 (the 1st commit, ignore it when reviewing)~ (already merged)

Ref https://github.com/kubernetes/community/pull/527/ and https://github.com/kubernetes/community/pull/594

@kubernetes/sig-apps-api-reviews @kubernetes/sig-apps-pr-reviews @erictune @kow3ns @lukaszo @kargakis 

---

TODOs:
- [x] API changes
  - [x] (maybe) Remove rollback subresource if we decide to do client-side rollback 
- [x] deployment controller 
  - [x] controller revision
    - [x] owner ref (claim & adoption)
    - [x] history reconstruct (put revision number, hash collision avoidance)
    - [x] de-dup history and relabel pods
    - [x] compare ds template with history 
  - [x] hash labels (put it in controller revision, pods, and maybe deployment)
  - [x] clean up old history 
  - [x] Rename status.uniquifier when we reach consensus in #44774 
- [x] e2e tests 
- [x] unit tests 
  - [x] daemoncontroller_test.go 
  - [x] update_test.go 
  - [x] ~(maybe) storage_test.go // if we do server side rollback~

kubectl part is in #46144

--- 

**Release note**:

```release-note
```
2017-06-03 16:52:38 -07:00
Tim Hockin
be987b015c Merge pull request #46716 from thockin/proxy-comments
Kube-proxy cleanups
2017-06-03 15:57:17 -07:00
Janet Kuo
4e6f70ff67 Autogen: run hack/update-all.sh 2017-06-03 00:43:53 -07:00
Kubernetes Submit Queue
3093936a18 Merge pull request #46551 from caesarxuchao/rule-validation
Automatic merge from submit-queue (batch tested with PRs 46726, 41912, 46695, 46034, 46551)

Fix validation of Rule.Resouces
2017-06-02 21:42:43 -07:00
Jordan Liggitt
24c50a7df7
Regenerate openapi for 1.8 2017-06-02 11:07:37 -04:00
Tim Hockin
fc34a9d6ba 'Global' -> 'Cluster' for traffic policy 2017-06-01 16:17:38 -07:00
Kubernetes Submit Queue
14a1cdd208 Merge pull request #44785 from jingxu97/April/apistorage
Automatic merge from submit-queue

Add Local Storage Capacity Isolation API

This PR adds the new APIs to support storage capacity isolation as
described in the proposal [https://github.com/kubernetes/community/pull/306](url)

1. Add SizeLimit for emptyDir volume
2. Add scratch and overlay storage type used by container level or
node level


**Release note**:

```release-note
Alpha feature: Local volume Storage Capacity Isolation allows users to set storage limit to isolate EmptyDir volumes, container storage overlay, and also supports allocatable storage for shared root file system. 
```
2017-06-01 09:12:19 -07:00
Chao Xu
e9d9b05234 generated 2017-05-31 16:51:19 -07:00
Jing Xu
695f7be697 generated files 2017-05-31 13:06:39 -07:00
Kubernetes Submit Queue
e97b72296f Merge pull request #46556 from mbohlool/gvk
Automatic merge from submit-queue (batch tested with PRs 46076, 43879, 44897, 46556, 46654)

Use meta.v1 GroupVersionKind with json tags to generate OpenAPI spec

We are using two different GVK struct in generation of OpenAPI extensions. This PR unify that and also add json tags to meta.v1 GVK to comply with json naming system in other serializations. Also the value of Action extension is now lowercase.

ref: https://github.com/kubernetes/kubernetes/pull/46388
2017-05-30 23:20:04 -07:00
Kubernetes Submit Queue
8c1f45953b Merge pull request #46431 from zjj2wry/rollback-rollback
Automatic merge from submit-queue (batch tested with PRs 42240, 46100, 46154, 46431, 45755)

Fix api description in swagger

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
 NONE
```
2017-05-30 14:57:05 -07:00
mbohlool
fcb9290062 Generated spec 2017-05-30 14:43:27 -07:00
Josh Horwitz
86f1ebdd87 swagger update 2017-05-29 13:03:25 -04:00
Josh Horwitz
0fc75d5fd5 openapi generated file 2017-05-29 13:03:25 -04:00
Kubernetes Submit Queue
66a1d07ef4 Merge pull request #46407 from liggitt/namespace-delete-collection
Automatic merge from submit-queue (batch tested with PRs 46407, 46457)

Remove deletecollection support from namespace object

Namespace storage accidentally picked up deletecollection support from embedding the generic store. If invoked, it skips the custom namespace `Delete()` storage method that enforces finalization, and skips the namespace lifecycle admission plugin that protects immortal namespaces from deletion.

Given the data integrity implications of skipping namespace finalization, I'd backport this as far as we're releasing patch releases.

```release-note
The namespace API object no longer supports the deletecollection operation.
```
2017-05-28 13:16:54 -07:00