Commit Graph

92 Commits

Author SHA1 Message Date
k8s-merge-robot
1784e99a1d Merge pull request #29102 from ping035627/ping035627-patch-0719
Automatic merge from submit-queue

Optimise getAPIGroupVersion function in genericapiserver.go

About the newAPIGroupVersion and the getAPIGroupVersion function  in genericapiserver.go, I think they can optimise.
2016-07-20 23:31:17 -07:00
k8s-merge-robot
411c32bc98 Merge pull request #27520 from olegshaldybin/format-apiserver-options
Automatic merge from submit-queue

Format apiserver options

Trivial change, code formatting only: it was hard to read long lines, and my editor was really slow when scrolling through them.
2016-07-19 19:58:01 -07:00
PingWang
4daea70ad7 Optimise getAPIGroupVersion function in genericapiserver.go
Signed-off-by: PingWang <wang.ping5@zte.com.cn>

gofmt -s -w

Signed-off-by: PingWang <wang.ping5@zte.com.cn>
2016-07-20 08:17:36 +08:00
Davanum Srinivas
2b0ed014b7 Use Go canonical import paths
Add canonical imports only in existing doc.go files.
https://golang.org/doc/go1.4#canonicalimports

Fixes #29014
2016-07-16 13:48:21 -04:00
k8s-merge-robot
bea5232790 Merge pull request #28946 from ping035627/ping035627-patch-0714-2
Automatic merge from submit-queue

Modify wrong description about "InsecurePort" in genericapiserver.go

Modify wrong description about "InsecurePort" in genericapiserver.go, avoid misleading.
2016-07-14 19:56:09 -07:00
k8s-merge-robot
e182520db6 Merge pull request #28944 from ping035627/ping035627-patch-0715
Automatic merge from submit-queue

Improve fatal error description for init in genericapiserver.go

When api.NewRequestContextFilter return error in the "init" function of genericapiserver.go, there are no handler info, add more information to indicate s.Handler or s.InsecureHandler, I suggest.
2016-07-14 19:56:04 -07:00
PingWang
a7cea72e66 modify two wrong description about InsecurePort
Signed-off-by: PingWang <wang.ping5@zte.com.cn>

Update genericapiserver.go

Signed-off-by: PingWang <wang.ping5@zte.com.cn>
2016-07-15 08:29:18 +08:00
PingWang
4e9b8b15c5 Improve fatal error description
Signed-off-by: PingWang <wang.ping5@zte.com.cn>
2016-07-14 15:03:31 +08:00
PingWang
97b4a6fa42 optimise the New function
Signed-off-by: PingWang <wang.ping5@zte.com.cn>
2016-07-14 11:43:53 +08:00
Aaron Levy
25ac0dd030 retry on apiserver insecure listen failures 2016-07-11 14:18:13 -07:00
mbohlool
0254679067 Represent unversioned.Time correctly in swagger spec 2016-07-01 23:23:19 -07:00
k8s-merge-robot
ff281525a8 Merge pull request #28143 from xiangpengzhao/service-node-port-range
Automatic merge from submit-queue

Should set default value for --service-node-port-range flag before verifying

For the flag `--service-node-port-range` of kube-apiserver, we know that it defaults to `30000-32767` if not specified. But if we only pass the flag `--kubernetes-service-node-port` with a valid value between `30000-32767` when starting kube-apiserver, a fatal error will occurs as the last below. It means that service port range is not 30000-32767 but empty. The log is from code [DefaultAndValidateRunOptions-->ValidateRunOptions-->verifyServiceNodePort](https://github.com/xiangpengzhao/kubernetes/blob/master/pkg/genericapiserver/genericapiserver.go#L580) where the flags are verified. 

After tracing the apiserver related code, we can find the call stack:
```
func main() {
	......
	s := options.NewAPIServer()
	......
	app.Run(s)
	......
}
```
In the `app.Run`, it calls [genericapiserver.DefaultAndValidateRunOptions(s.ServerRunOptions)](https://github.com/xiangpengzhao/kubernetes/blob/master/cmd/kube-apiserver/app/server.go#L80). But the `--kubernetes-service-node-port` hasn't been defaulted before there, so it's empty. It's then defaulted in `app.Run`-->[master.New](https://github.com/xiangpengzhao/kubernetes/blob/master/cmd/kube-apiserver/app/server.go#L276)-->[genericapiserver.New](https://github.com/xiangpengzhao/kubernetes/blob/master/pkg/master/master.go#L179)-->[setDefaults](https://github.com/xiangpengzhao/kubernetes/blob/master/pkg/genericapiserver/genericapiserver.go#L338)-->[defaultServiceNodePortRange](https://github.com/xiangpengzhao/kubernetes/blob/master/pkg/genericapiserver/genericapiserver.go#L281).

So, we have to set default value for `--kubernetes-service-node-port` in [NewServerRunOptions](https://github.com/xiangpengzhao/kubernetes/blob/master/pkg/genericapiserver/options/server_run_options.go#L105), as is done for `--secure-port` and/or `--insecure-port`. The `NewServerRunOptions` will be called in options.[NewAPIServer](https://github.com/xiangpengzhao/kubernetes/blob/master/cmd/kube-apiserver/app/options/options.go#L50)().

Hope that I have described the issue clearly. Thanks!

```
root@vm:~# kube-apiserver --etcd-servers=http://172.16.1.11:4001 --service-cluster-ip-range=192.168.122.0/24 --insecure-bind-address=0.0.0.0 --logtostderr=false --log-dir=/home/paas/zxp/log/kube --v=10 --kubernetes-service-node-port=30001 &
[2] 24629
root@vm:~# F0627 23:46:37.308726   24629 genericapiserver.go:580] Kubernetes service port range  doesn't contain 30001
goroutine 1 [running]:
k8s.io/kubernetes/vendor/github.com/golang/glog.stacks(0x44f2500, 0x0, 0x0, 0x0)
	/home/paas/zxp/code/k8s/fork/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/github.com/golang/glog/glog.go:766 +0xb8
k8s.io/kubernetes/vendor/github.com/golang/glog.(*loggingT).output(0x44d2020, 0xc800000003, 0xc820238000, 0x438c73b, 0x13, 0x244, 0x0)
	/home/paas/zxp/code/k8s/fork/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/github.com/golang/glog/glog.go:717 +0x259
k8s.io/kubernetes/vendor/github.com/golang/glog.(*loggingT).printf(0x44d2020, 0xc800000003, 0x3223dc0, 0x33, 0xc8204c4cc8, 0x2, 0x2)
	/home/paas/zxp/code/k8s/fork/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/github.com/golang/glog/glog.go:655 +0x1d4
k8s.io/kubernetes/vendor/github.com/golang/glog.Fatalf(0x3223dc0, 0x33, 0xc8204c4cc8, 0x2, 0x2)
	/home/paas/zxp/code/k8s/fork/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/github.com/golang/glog/glog.go:1145 +0x5d
k8s.io/kubernetes/pkg/genericapiserver.verifyServiceNodePort(0xc8202a8400)
	/home/paas/zxp/code/k8s/fork/kubernetes/_output/local/go/src/k8s.io/kubernetes/pkg/genericapiserver/genericapiserver.go:580 +0x1d5
k8s.io/kubernetes/pkg/genericapiserver.ValidateRunOptions(0xc8202a8400)
	/home/paas/zxp/code/k8s/fork/kubernetes/_output/local/go/src/k8s.io/kubernetes/pkg/genericapiserver/genericapiserver.go:605 +0x2f
k8s.io/kubernetes/pkg/genericapiserver.DefaultAndValidateRunOptions(0xc8202a8400)
	/home/paas/zxp/code/k8s/fork/kubernetes/_output/local/go/src/k8s.io/kubernetes/pkg/genericapiserver/genericapiserver.go:612 +0x4e
k8s.io/kubernetes/cmd/kube-apiserver/app.Run(0xc820224fc0, 0x0, 0x0)
	/home/paas/zxp/code/k8s/fork/kubernetes/_output/local/go/src/k8s.io/kubernetes/cmd/kube-apiserver/app/server.go:80 +0x70
main.main()
	/home/paas/zxp/code/k8s/fork/kubernetes/_output/local/go/src/k8s.io/kubernetes/cmd/kube-apiserver/apiserver.go:50 +0x121

[2]+  Exit 255                kube-apiserver --etcd-servers=http://172.16.1.11:4001 --service-cluster-ip-range=192.168.122.0/24 --insecure-bind-address=0.0.0.0 --logtostderr=false --log-dir=/home/paas/zxp/log/kube --v=10 --kubernetes-service-node-port=30001
root@vm:~#

```
2016-06-30 19:30:31 -07:00
David McMahon
ef0c9f0c5b Remove "All rights reserved" from all the headers. 2016-06-29 17:47:36 -07:00
Oleg Shaldybin
e722a41c40 Format apiserver options
Trivial change, code formatting only: it was really hard to read
apiserver options definition, formatted to follow the same pattern
throughout.
2016-06-28 12:34:22 -07:00
xiangpengzhao
716fb5ed7d Should set default value for --service-node-port-range flag before vefirying 2016-06-27 22:48:49 -04:00
xiangpengzhao
d8a7b4948b Should verify port value when starting kube-apiserver 2016-06-27 06:34:14 -04:00
k8s-merge-robot
076bf81b8b Merge pull request #23473 from AdoHe/kubelet_tls_overwrite
Automatic merge from submit-queue

fix kubelet tls overwrite issue

@lavalamp apply the same thing to kubelet. @dchen1107 ptal.

<!-- Reviewable:start -->
---
This change is [<img src="http://reviewable.k8s.io/review_button.svg" height="35" align="absmiddle" alt="Reviewable"/>](http://reviewable.k8s.io/reviews/kubernetes/kubernetes/23473)
<!-- Reviewable:end -->
2016-06-17 23:20:03 -07:00
nikhiljindal
6e71b4a2dc Fixing externalAddress in genericapiserver 2016-06-03 11:21:29 -07:00
k8s-merge-robot
0fc573296d Merge pull request #26169 from victorgp/master
Automatic merge from submit-queue

Setting TLS1.2 minimum because TLS1.0 and TLS1.1 are vulnerable

TLS1.0 is known as vulnerable since it can be downgraded to SSL
https://blog.varonis.com/ssl-and-tls-1-0-no-longer-acceptable-for-pci-compliance/

TLS1.1 can be vulnerable if cipher RC4-SHA is used, and in Kubernetes it is, you can check it with
`
openssl s_client -cipher RC4-SHA -connect apiserver.k8s.example.com:443
`

https://www.globalsign.com/en/blog/poodle-vulnerability-expands-beyond-sslv3-to-tls/

Test suites like Qualys are reporting this Kubernetes issue as a level 3 vulnerability, they recommend to upgrade to TLS1.2 that is not affected, quoting Qualys:

`
RC4 should not be used where possible. One reason that RC4 was still being used was BEAST and Lucky13 attacks against CBC mode ciphers in
SSL and
TLS. However, TLSv 1.2 or later address these issues.
`
2016-05-29 13:24:46 -07:00
Eric Chiang
ef40aa9572 pkg/master: enable certificates API and add rbac authorizer 2016-05-25 14:24:47 -07:00
Victor Garcia
d3f3e6c969 Setting TLS1.2 minimum because TLS1.0 and TLS1.1 are vulnerable
Adding comments to explain what is wrong with each version
2016-05-25 18:14:20 +02:00
AdoHe
973774b0ba fix kubelet tls overwrite issue 2016-05-23 23:25:12 -04:00
Jordan Liggitt
29252acd1a Change rest storage Update interface to retrieve updated object
Add OldObject to admission attributes

Update resthandler Patch/Update admission plumbing
2016-05-23 21:09:26 -04:00
CJ Cullen
d03dbbcc14 Add LRU Expire cache to webhook authorizer. 2016-05-21 14:50:50 -07:00
Clayton Coleman
633683c08d
kube-apiserver options should be decoupled from impls
A few months ago we refactored options to keep it independent of the
implementations, so that it could be used in CLI tools to validate
config or to generate config, without pulling in the full dependency
tree of the master.  This change restores that by separating
server_run_options.go back to its own package.

Also, options structs should never contain non-serializable types, which
storagebackend.Config was doing with runtime.Codec. Split the codec out.

Fix a typo on the name of the etcd2.go storage backend.

Finally, move DefaultStorageMediaType to server_run_options.
2016-05-18 10:39:21 -04:00
nikhiljindal
5dffe4a969 Moving federation apiserver to use genericapiserver.ServerRunOptions 2016-05-11 23:42:55 -07:00
nikhiljindal
2ffa3b4586 Moving StorageFactory building logic to genericapiserver 2016-05-10 00:57:11 -07:00
k8s-merge-robot
f9b8fd0c96 Merge pull request #25011 from zhouhaibing089/addclose
Automatic merge from submit-queue

followup to add http server close method

Fixes #25009, a follow up of https://github.com/kubernetes/kubernetes/pull/24595.
2016-05-09 22:32:02 -07:00
k8s-merge-robot
1a1229e206 Merge pull request #24795 from deads2k/use-all-attributes
Automatic merge from submit-queue

enable resource name and service account cases for impersonation

Adds the resource name check since that attribute was added for authorization.  Also adds a check against a separate resource for service accounts.  Allowing impersonation of service accounts to use a different resource check places control of impersonation with the same users to have the power to get the SA tokens directly.

@kubernetes/kube-iam 
@sgallagher FYI
2016-05-09 04:58:19 -07:00
k8s-merge-robot
ab36e0e35e Merge pull request #24710 from smarterclayton/store_proto_in_etcd
Automatic merge from submit-queue

Allow etcd to store protobuf objects

Split storage serialization from client negotiation, and allow API server to take flag controlling serialization.

TODO:

* [x] API server still doesn't start - range allocation object doesn't seem to round trip correctly to etcd
* [ ] Verify that third party resources are ignoring protobuf (add a test)
* [ ] Add integration tests that verify storage is correctly protobuf
* [ ] Add a global default for which storage format to prefer?
2016-05-05 19:00:20 -07:00
Seth Jennings
62d6fea561 fix log message for self-signed cert generation 2016-05-05 16:56:47 -05:00
Clayton Coleman
e0ebcf4216
Split the storage and negotiation parts of Codecs
The codec factory should support two distinct interfaces - negotiating
for a serializer with a client, vs reading or writing data to a storage
form (etcd, disk, etc). Make the EncodeForVersion and DecodeToVersion
methods only take Encoder and Decoder, and slight refactoring elsewhere.

In the storage factory, use a content type to control what serializer to
pick, and use the universal deserializer. This ensures that storage can
read JSON (which might be from older objects) while only writing
protobuf. Add exceptions for those resources that may not be able to
write to protobuf (specifically third party resources, but potentially
others in the future).
2016-05-05 12:08:23 -04:00
Clayton Coleman
7e1089bb75
Storage, not Storgage 2016-05-05 12:08:22 -04:00
zhouhaibing089
5923fd352e followup to add http server close method 2016-05-05 12:04:41 +08:00
nikhiljindal
16c0e0a21c Deleting duplicate code from federated-apiserver 2016-05-03 14:04:09 -07:00
Hongchao Deng
c0071a1595 add flags to enable etcd3 2016-04-28 09:48:16 +08:00
jianhuiz
fdfe42ea44 move install of version handler to genericapiserver 2016-04-27 10:21:08 -07:00
Timothy St. Clair
24b4286960 In preparation for new storage backends renaming generic registry store 2016-04-26 08:32:13 -05:00
deads2k
622932422d enable resource name and service account cases for impersonation 2016-04-26 09:31:43 -04:00
k8s-merge-robot
b04f6ffc48 Merge pull request #24646 from nikhiljindal/removeMasterDep
Automatic merge from submit-queue

Move SSHTunneler to genericapiserver and remove federated-apiserver's dependency on pkg/master

cc @jianhuiz
2016-04-25 19:50:37 -07:00
nikhiljindal
f9f1e21e08 Moving master.SSHTunneler to genericapiserver 2016-04-22 11:47:05 -07:00
Clayton Coleman
3111985564 Handle streaming serializers more consistently
Add tests to watch behavior in both protocols (http and websocket)
against all 3 media types. Adopt the
`application/vnd.kubernetes.protobuf;stream=watch` media type for the
content that comes back from a watch call so that it can be
distinguished from a Status result.
2016-04-22 11:07:24 -04:00
deads2k
6670b73b18 make storage enablement, serialization, and location orthogonal 2016-04-21 08:18:55 -04:00
nikhiljindal
50a9aceabb Moving more logic to genericapiserver 2016-04-19 00:03:28 -07:00
k8s-merge-robot
62fd60565a Merge pull request #24048 from liggitt/apiserver-defaults
Automatic merge from submit-queue

Use correct defaults when binding apiserver flags

defaults should be set in the struct-creating function, then the current struct field value used as the default when binding the flag
2016-04-17 20:59:38 -07:00
k8s-merge-robot
a275a045d1 Merge pull request #23914 from sky-uk/make-etcd-cache-size-configurable
Automatic merge from submit-queue

Make etcd cache size configurable

Instead of the prior 50K limit, allow users to specify a more sensible size for their cluster.

I'm not sure what a sensible default is here. I'm still experimenting on my own clusters. 50 gives me a 270MB max footprint. 50K caused my apiserver to run out of memory as it exceeded >2GB. I believe that number is far too large for most people's use cases.

There are some other fundamental issues that I'm not addressing here:
- Old etcd items are cached and potentially never removed (it stores using modifiedIndex, and doesn't remove the old object when it gets updated)
- Cache isn't LRU, so there's no guarantee the cache remains hot. This makes its performance difficult to predict. More of an issue with a smaller cache size.
- 1.2 etcd entries seem to have a larger memory footprint (I never had an issue in 1.1, even though this cache existed there). I suspect that's due to image lists on the node status.

This is provided as a fix for #23323
2016-04-17 00:06:31 -07:00
deads2k
ac4c545b91 add act-as powers 2016-04-14 12:49:10 -04:00
Jordan Liggitt
6c1bcfa28d Use correct defaults when binding apiserver flags 2016-04-14 10:12:51 -04:00
k8s-merge-robot
429228d403 Merge pull request #23953 from nikhiljindal/u8sServer
Automatic merge from submit-queue

moving genericapiserver command line flags to genericapiserver

cc @kubernetes/sig-api-machinery
2016-04-13 23:15:24 -07:00
nikhiljindal
8d7a8c6ae6 moving genericapiserver command line flags to genericapiserver 2016-04-13 13:28:18 -07:00