Commit Graph

13639 Commits

Author SHA1 Message Date
derekwaynecarr
d6e23b984c Add codegen artifacts for kubelet flag 2016-07-21 10:06:17 -04:00
derekwaynecarr
99bddd23c4 Add eviction minimum reclaim option to kubelet 2016-07-21 10:06:17 -04:00
k8s-merge-robot
0b1f0e8353 Merge pull request #29234 from mtaufen/doublecode-volume-newmainkubelet
Automatic merge from submit-queue

Remove duplicate code

I think this code is wrongly duplicated. See #29233. Feel free to correct me if I am wrong.
2016-07-21 06:48:51 -07:00
k8s-merge-robot
ac17b239b6 Merge pull request #29145 from yifan-gu/no_chtime
Automatic merge from submit-queue

rkt: Don't return if the service file doesn't exist when killing the pod

Remove an unused logic. Also this prevents the KillPod() from failing
when the service file doesn't exist. E.g., it can be removed by garbage
collection in a rare case:

1, There are already more than `gcPolicy.MaxContainers` containers running
   on the host.
2, The new pod(A) starts to run but doesn't enter 'RUNNING' state yet.
3, GC is triggered, and it sees the pod(A) is in an inactive state (not running),
   and the it needs to remove the pod to force the `gcPolicy.MaxContainers`.
4, GC fails to remove the pod because `rkt rm` fails when the pod is running,
   but it removes the service file anyway.
5, Follow up KillPod() call will fail because it cannot find the service file
   on disk.

Also this is possible only when the pod has been in prepared state for longer
than 1 min, which sounds like another issue.

cc @kubernetes/sig-rktnetes
2016-07-21 05:20:15 -07:00
k8s-merge-robot
f4543250a8 Merge pull request #29133 from deads2k/priority-queue
Automatic merge from submit-queue

use a separate queue for initial quota calculation

When the quota controller gets backed up on resyncs, it can take a long time to observe the first usage stats which are needed by the admission plugin.  This creates a second queue to prioritize the initial calculation.
2016-07-21 04:46:59 -07:00
Wojciech Tyczynski
4d0d115690 Revert "add tokenreviews endpoint to implement webhook" 2016-07-21 09:40:35 +02:00
k8s-merge-robot
f8fd8046e7 Merge pull request #29275 from wojtek-t/rs_shared_pod_informer
Automatic merge from submit-queue

Use sharedPodInformer in ReplicaSet controller

@caesarxuchao
2016-07-21 00:05:01 -07:00
k8s-merge-robot
1784e99a1d Merge pull request #29102 from ping035627/ping035627-patch-0719
Automatic merge from submit-queue

Optimise getAPIGroupVersion function in genericapiserver.go

About the newAPIGroupVersion and the getAPIGroupVersion function  in genericapiserver.go, I think they can optimise.
2016-07-20 23:31:17 -07:00
k8s-merge-robot
165add8692 Merge pull request #29034 from ivan4th/fix-init-container-update-validation
Automatic merge from submit-queue

Fix init container update validation for pods

Partial fix #26840

The remaining issues with `kubectl apply` on pods with init containers
are caused by temporary annotation-based representation and
will resolve themselves once init containers leave alpha state.
Also, this PR makes sure internal and external objects don't get mixed up by the
PATCH handler (see related issue #25106).

This PR is an alternative for #28557 which met criticism from @smarterclayton 
and @liggitt for working around the temporary issue with annotations.
#28557 is a full fix for #26840 and contains an e2e test that cannot pass
without the `VolumeMounts` workaround. As there appears to be no
good way to include an e2e test that's known to be failing in k8s source,
I've removed it from this PR.

Either this PR or #28557 should be applied, but not both.
2016-07-20 22:56:00 -07:00
k8s-merge-robot
8ead63f127 Merge pull request #28788 from deads2k/wire-authentication
Automatic merge from submit-queue

add tokenreviews endpoint to implement webhook

Wires up an API resource under `apis/authentication.k8s.io/v1beta1` to expose the webhook token authentication API as an API resource.  This allows one API server to use another for authentication and uses existing policy engines for the "authoritative" API server to controller access to the endpoint.

@cjcullen you wrote the initial type
2016-07-20 22:23:45 -07:00
k8s-merge-robot
99e24da2ff Merge pull request #29077 from saad-ali/fixIssue29051NamespaceDeletion
Automatic merge from submit-queue

Fix "PVC Volume not detached if pod deleted via namespace deletion" issue

Fixes #29051: "PVC Volume not detached if pod deleted via namespace deletion"

This PR:
* Fixes a bug in `desired_state_of_the_world_populator.go` to check the value of `exists` returned by the `podInformer` so that it can delete pods even if the delete event is missed (or fails).
* Reduces the desired state of the world populators sleep period from 5 min to 1 min (reducing the amount of time a volume would remain attached if a volume delete event is missed or fails).
2016-07-20 20:40:32 -07:00
k8s-merge-robot
4379619a63 Merge pull request #28939 from saad-ali/fixIssue28616ParallelMount
Automatic merge from submit-queue

Allow mounts to run in parallel for non-attachable volumes

This PR:
* Fixes https://github.com/kubernetes/kubernetes/issues/28616
  * Enables mount volume operations to run in parallel for non-attachable volume plugins.
  * Enables unmount volume operations to run in parallel for all volume plugins.
* Renames `GoRoutineMap` to `GoroutineMap`, resolving a long outstanding request from @thockin: `"Goroutine" is a noun`
2016-07-20 14:56:58 -07:00
k8s-merge-robot
afe4977c9b Merge pull request #28975 from ronnielai/image-gc-1
Automatic merge from submit-queue

ImagePuller refactoring

A plain refactoring
- Moving image pullers to a new pkg/kubelet/images directory
- Hiding image pullers inside the new ImageManager 

The next step is to consolidate the logic of the serialized and the parallel image pullers inside ImageManager

xref: #25577
2016-07-20 13:37:48 -07:00
k8s-merge-robot
e2a697db47 Merge pull request #29246 from Random-Liu/fix-image-remove-bug
Automatic merge from submit-queue

Kubelet: Set PruneChildren when removing image.

This is a bug introduced during switching to engine-api. https://github.com/kubernetes/kubernetes/issues/23563.

When removing image, there is an option `noprune`:
```
If prune is true, ancestor images will each attempt to be deleted quietly.
```

In go-dockerclient, the default value of the option is ["noprune=false"](https://github.com/fsouza/go-dockerclient/blob/master/image.go#L171), which means that ancestor images should be also removed. This is the expected behaviour.

However in engine-api, the option is changed to `PruneChildren`, and the default value is `PruneChildren=false`, which means that ancestor images won't be removed.
This makes `ImageRemove` only remove the first layer of the image, which causes the image garbage collection not working as expected.

This should be fixed in 1.3.
And thanks to @ronnielai for finding the bug! :)

/cc @kubernetes/sig-node
2016-07-20 12:59:53 -07:00
k8s-merge-robot
c0557a6b66 Merge pull request #29171 from euank/determine-container-ip-args
Automatic merge from submit-queue

docker_manager: Correct determineContainerIP args

This could result in the network plugin not retrieving the pod ip in a
call to SyncPod when using the `exec` network plugin.
The CNI and kubenet network plugins ignore the name/namespace arguments,
so they are not impacted by this bug.

I verified the second included test failed prior to correcting the
argument order.

Fixes #29161 

cc @yujuhong
2016-07-20 12:26:37 -07:00
deads2k
2256c6e619 fix String protobuf generator 2016-07-20 15:11:57 -04:00
deads2k
2c4a9f2e8d interesting changes to add tokenreviews endpoint to implement webhook 2016-07-20 15:11:56 -04:00
deads2k
bfa2ff00b9 generated code changes 2016-07-20 15:11:56 -04:00
k8s-merge-robot
c09956e13f Merge pull request #29215 from ericchiang/http-probe-checker-test-dont-sr-compare-errors
Automatic merge from submit-queue

pkg/probe/http: don't compare error strings in tests

TestHTTPProbeChecker fails on the Go1.7 release candidates. The
package's history show that this was the case for Go1.5 and Go1.6
as well.

The test depend on errors holding specific string values, behavior
not guarenteed in the standard library API, and causing new test
failures every minor Go release. Just look for an error rather than
trying to inspect it using string comparison. If we feel this
impacts coverage we can add more test cases.

Fixes #15952
2016-07-20 11:51:52 -07:00
k8s-merge-robot
1ecd4efce6 Merge pull request #29169 from kevinjkj/kevinjkj-patch-4
Automatic merge from submit-queue

Add defer

Add defer?
2016-07-20 11:51:47 -07:00
k8s-merge-robot
8043baf12d Merge pull request #29071 from albatross0/fix_rbac_for_serviceaccounts
Automatic merge from submit-queue

Fix RBAC authorizer of ServiceAccount

RBAC authorizer assigns a role to a wrong service account.

How to reproduce

1.Create role and rolebinding to allow default user in kube-system namespace to read secrets in kube-system namespace.

```
# kubectl create -f role.yaml
# kubectl create -f binding.yaml
```

```yaml
# role.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: secret-reader
  namespace: kube-system
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "watch", "list"]
    nonResourceURLs: []
```

```yaml
# binding.yaml
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: read-secrets
  namespace: kube-system
subjects:
  - kind: ServiceAccount
    name: default
    namespace: kube-system
roleRef:
  kind: Role
  namespace: kube-system
  name: secret-reader
  apiVersion: rbac.authorization.k8s.io/v1alpha1
```

2.Set a credential of default user

```
$ kubectl config set-credentials default_user --token=<token_of_system:serviceaccount:kube-system:default>
$ kubectl config set-context default_user-context --cluster=test-cluster --user=default_user
$ kubectl config use-context default_user-context
```

3.Try to get secrets as default user in kube-system namespace

```
$ kubectl --namespace=kube-system get secrets
the server does not allow access to the requested resource (get secrets)
```

As shown above, default user could not access to secrets.
But if I have kube-system user in default namespace, it is allowed access to secrets.


4.Create a service account and try to get secrets as kube-system user in default namespace

```
# kubectl --namespace=default create serviceaccount kube-system
serviceaccount "kube-system" created
$ kubectl config set-credentials kube-system_user --token=<token_of_system:serviceaccount:default:kube-system>
$ kubectl config set-context kube-system_user-context --cluster=test-cluster --user=kube-system_user
$ kubectl config use-context kube-system_user-context
$ kubectl --namespace=kube-system get secrets
NAME                  TYPE                                  DATA      AGE
default-token-8pyb3   kubernetes.io/service-account-token   3         4d

```
2016-07-20 11:51:42 -07:00
k8s-merge-robot
10211f4df2 Merge pull request #29268 from lixiaobing10051267/masterExpected2
Automatic merge from submit-queue

Information is opposite to real meaning to express

master is not equal to expectedMaster, the meaning should be the master is unexpected:
	master, err := mesosCloud.Master(clusterName)
	if master != expectedMaster {
		t.Fatalf("Master returns the expected value: (expected: %#v, actual: %#v", expectedMaster, master)
2016-07-20 11:11:51 -07:00
k8s-merge-robot
a0da4153b6 Merge pull request #29260 from lixiaobing10051267/masterErr
Automatic merge from submit-queue

Modify err output format from %s to %v

t.Errorf err output format should be %v
2016-07-20 11:11:46 -07:00
k8s-merge-robot
60f9ce8a41 Merge pull request #29253 from lixiaobing10051267/masterLBname
Automatic merge from submit-queue

format number not consistent with real variable number

glog.Infof format number not consistent with real variable number, should add %s for second var because loadBalancerName is string:
func (c *Cloud) ensureLoadBalancer(namespacedName types.NamespacedName, loadBalancerName string, ...
2016-07-20 11:11:42 -07:00
k8s-merge-robot
6df62ff39c Merge pull request #29162 from xiangpengzhao/fix_err_to_cerr
Automatic merge from submit-queue

Fix wrong variable of error

Should not log `err` but `cerr`.
2016-07-20 11:11:33 -07:00
k8s-merge-robot
7620ed4b52 Merge pull request #28963 from cdrage/better-warning-kubecontroller
Automatic merge from submit-queue

Warn when missing cloud-provider on kube controller
2016-07-20 11:11:23 -07:00
k8s-merge-robot
a0a0760027 Merge pull request #25307 from derekwaynecarr/set_uid_from_context
Automatic merge from submit-queue

Allow handlers earlier in a request flow to inject a UID for an object

This lets admission controllers specify a stable UID for an object prior to its creation.  That lets the admission controller then record a reference to the object on another resource using that stable UID prior to the object being created.  This would be a prerequisite for supporting quota reservations.

/cc @smarterclayton @lavalamp @deads2k
2016-07-20 09:58:51 -07:00
albatross0
d1b14e2fae Fix RBAC authorizer of ServiceAccount
RBAC authorizer assigns a role to a wrong service account.
2016-07-21 01:50:08 +09:00
Ron Lai
367a683273 Wrapping image pullers inside ImageManager 2016-07-20 09:47:11 -07:00
Ron Lai
56b9daf50f Moving image pullers to images directory 2016-07-20 09:47:11 -07:00
Timothy St. Clair
8cb799c789 Revert "Follow on for 1.4 to default HTTP2 on by default"
This reverts commit efe25553cd.
2016-07-20 08:47:15 -05:00
Wojciech Tyczynski
2794cf538c Use sharedPodInformer in ReplicaSet controller 2016-07-20 12:25:26 +02:00
lixiaobing10051267
025135de6a Information is opposite to real meaning to express 2016-07-20 16:54:19 +08:00
saadali
afd8a58e5c Reduce DSW populator sleep period from 5 min to 1 2016-07-20 01:03:04 -07:00
saadali
d210c2231f Check pod exist in attach controller DSW populator
Fix bug in desired_state_of_the_world_populator.go to check exists so
that it can delete pods even if the delete event is missed (or fails)
2016-07-20 01:03:04 -07:00
lixiaobing10051267
e3bff25dbb Modify err output format from %s to %v 2016-07-20 15:06:47 +08:00
k8s-merge-robot
ad7ececcd0 Merge pull request #28765 from nhlfr/api-proxy-regex
Automatic merge from submit-queue

Make "attach" and "exec" rejection in proxy more explicit

```release-note
kubectl proxy changed to now allow urls to pods with "attach" or "exec" in the pod name
```

The more explicit regular expression for rejection makes a possibility of accessing pods (or any other resources) which contain "attach" or "exec" in their names via proxy API. It was not possible before.

Also, the reference for "run" resource was removed, because it doesn't exist in any of k8s APIs currently.

Fixes: #21464
2016-07-19 23:06:58 -07:00
k8s-merge-robot
8c84fae03e Merge pull request #28701 from pmorie/bandwidth-test
Automatic merge from submit-queue

Move ExtractPodBandwidthResources test into appropriate package

Found during #28511, this test is in the wrong package currently.

cc @kubernetes/sig-network
2016-07-19 21:57:30 -07:00
saadali
88d495026d Allow mounts to run in parallel for non-attachable
Allow mount volume operations to run in parallel for non-attachable
volume plugins.

Allow unmount volume operations to run in parallel for all volume
plugins.
2016-07-19 21:54:26 -07:00
k8s-merge-robot
a3110dcb41 Merge pull request #28417 from kevensen/awszonefix
Automatic merge from submit-queue

AWS: Added experimental option to skip zone check

This pull request resolves #28380.  In the vast majority of cases, it is appropriate to validate the AWS region against a known set of regions.  However, there is the edge case where this is undesirable as Kubernetes may be deployed in an AWS-like environment where the region is not one of the known regions.

By adding the optional **DisableStrictZoneCheck true** to the **[Global]** section in the aws.conf file (e.g. /etc/aws/aws.conf) one can bypass the ragion validation.
2016-07-19 21:03:28 -07:00
lixiaobing10051267
6de7bc0085 format number not consistent with real variable number 2016-07-20 11:14:45 +08:00
k8s-merge-robot
411c32bc98 Merge pull request #27520 from olegshaldybin/format-apiserver-options
Automatic merge from submit-queue

Format apiserver options

Trivial change, code formatting only: it was hard to read long lines, and my editor was really slow when scrolling through them.
2016-07-19 19:58:01 -07:00
Random Liu
51184db4df Set PruneChildren when removing image. 2016-07-20 02:07:28 +00:00
k8s-merge-robot
a279673de6 Merge pull request #25764 from gtank/certificates-api-controller-v3
Automatic merge from submit-queue

Certificate signing controller for TLS bootstrap (alpha)

The controller handles generating and signing certificates when a CertificateSigningRequest has the "Approved" condition. Uses cfssl to support a wide set of possible keys and algorithms. Depends on PR #25562, only the last two commits are relevant to this PR.

cc @mikedanese

[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/.github/PULL_REQUEST_TEMPLATE.md?pixel)]()
2016-07-19 18:45:31 -07:00
k8s-merge-robot
a95180e06f Merge pull request #29228 from janetkuo/available-time-log
Automatic merge from submit-queue

Log the time when checking deployment's pod availability

https://github.com/kubernetes/kubernetes/issues/26834#issuecomment-233764007
2016-07-19 17:35:45 -07:00
PingWang
4daea70ad7 Optimise getAPIGroupVersion function in genericapiserver.go
Signed-off-by: PingWang <wang.ping5@zte.com.cn>

gofmt -s -w

Signed-off-by: PingWang <wang.ping5@zte.com.cn>
2016-07-20 08:17:36 +08:00
Michael Taufen
1e13b9b2de Remove duplicate code 2016-07-19 14:51:25 -07:00
Ivan Shvedunov
02baa44948 Fix update validation for pods w/init containers. 2016-07-20 00:30:12 +03:00
Janet Kuo
07d25fdc47 Log the time when checking deployment's pod availability 2016-07-19 14:08:28 -07:00
k8s-merge-robot
9ada26d6cd Merge pull request #29219 from caesarxuchao/fix-testeventf
Automatic merge from submit-queue

Don't do string(int)

This is causing https://github.com/kubernetes/kubernetes/pull/29147 to fail the unit test, because the bug prints control character to the test log, and the grep at this [line](https://github.com/kubernetes/kubernetes/blob/master/hack/make-rules/test.sh#L190) returns `Binary file (standard input) matches` error. I don't know why this bug isn't caught before.
2016-07-19 14:06:57 -07:00