Commit Graph

632 Commits

Author SHA1 Message Date
Di Xu
48388fec7e fix all the typos across the project 2018-02-11 11:04:14 +08:00
Daniel Kłobuszewski
2eb24f9ae1 Enable scaling fluentd-gcp resources using ScalingPolicy.
See https://github.com/justinsb/scaler for more details about ScalingPolicy resource.
2018-02-09 14:33:33 +01:00
Rohit Ramkumar
12d4eac038 Add a new environment variable to the startup scripts called
KUBE_PROXY_MODE
2018-02-08 15:10:07 -08:00
Tim Hockin
3586986416 Switch to k8s.gcr.io vanity domain
This is the 2nd attempt.  The previous was reverted while we figured out
the regional mirrors (oops).

New plan: k8s.gcr.io is a read-only facade that auto-detects your source
region (us, eu, or asia for now) and pulls from the closest.  To publish
an image, push k8s-staging.gcr.io and it will be synced to the regionals
automatically (similar to today).  For now the staging is an alias to
gcr.io/google_containers (the legacy URL).

When we move off of google-owned projects (working on it), then we just
do a one-time sync, and change the google-internal config, and nobody
outside should notice.

We can, in parallel, change the auto-sync into a manual sync - send a PR
to "promote" something from staging, and a bot activates it.  Nice and
visible, easy to keep track of.
2018-02-07 21:14:19 -08:00
Kubernetes Submit Queue
4edb82f0e8
Merge pull request #59259 from wojtek-t/configurable_quota_backend_bytes
Automatic merge from submit-queue (batch tested with PRs 55439, 58564, 59028, 59169, 59259). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Configurable etcd quota backend bytes

```release-note
Configurable etcd quota backend bytes in GCE
```
2018-02-02 17:17:45 -08:00
Wojciech Tyczynski
333d196995 Configurable etcd quota backend bytes 2018-02-02 10:36:34 +01:00
Mike Danese
0d39648775 cluster/gce: remove salt comments from manifests 2018-02-01 08:39:56 -08:00
Mike Danese
d6918bbbc0 cluster: remove kube-registry-proxy 2018-02-01 07:23:50 -08:00
Wojciech Tyczynski
617321e420 Expose etcd compaction time via environmental variable in GCE 2018-01-31 14:44:01 +01:00
Zihong Zheng
fd5dd9602d [GCE] Set --kubelet-preferred-address-types on apiserver by default 2018-01-29 19:23:32 -08:00
Kubernetes Submit Queue
bf05348e11
Merge pull request #57426 from mikedanese/reorder
Automatic merge from submit-queue (batch tested with PRs 56995, 58498, 57426, 58902, 58863). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

gce: reorder authorizers

to the order Node,Webhook,RBAC,ABAC

```release-note
NONE
```
2018-01-29 12:37:40 -08:00
Kubernetes Submit Queue
854adeb2d7
Merge pull request #56132 from jingax10/upgrade_aliases_branch
Automatic merge from submit-queue (batch tested with PRs 58412, 56132, 58506, 58542, 58394). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 Implement upgrade-aliases.sh to migrate a route-based k8s cluster to use IP aliases in GCE.

**What this PR does / why we need it**:
This PR implements upgrade-aliases.sh, which is used to migrate a route-based k8s cluster to use IP aliases in GCE.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
"NONE"
```
2018-01-22 22:57:39 -08:00
Jing Ai
dba2b58202 Merge branch 'master' into upgrade_aliases_branch 2018-01-18 14:37:51 -08:00
Isaac Hollander McCreery
99f507a68b Introduce METADATA_CONCEALMENT_NO_FIREWALL to prevent firewall from being set 2018-01-17 08:37:44 -08:00
Jing Ai
df8bbc611f Remove cluster/gce/container-linux dir. 2018-01-16 14:12:39 -08:00
Mike Danese
13116457ba cluster: remove gce dependencies out of salt
basically just:
* move all manifests into the new gce/manifests dir
* move limit-range into gce/addons/limit-range
* move abac jsonl into gce/manifests. this is gross but we will
  hopefully be able to delete this config soon. it only exists to support
  a deprecated feature.
* fix build, release, deploy to look for everything in its new home
2018-01-16 09:59:29 -08:00
Cheng Xing
e21ecc0166 Updated Flexvolume setup mechanisms for COS instance image.
- If REMOUNT_VOLUME_PLUGIN_DIR is set to true, VOLUME_PLUGIN_DIR is remounted with `exec` option during cluster startup. This allows any writable location to be used as the plugin directory.
- New HostPath added to controller-manager deployment to enable access to volume plugin directory.
- Improved how the default directory is passed to master and node setup.
2018-01-08 15:38:51 -08:00
Kubernetes Submit Queue
8dfd6dec4e
Merge pull request #57425 from yguo0905/passing-sched-policy-config
Automatic merge from submit-queue (batch tested with PRs 57906, 57425, 56939, 57317, 57762). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

cluster/gce/gci: Support passing kube-scheduler policy config

**What this PR does / why we need it**:

This allows us to specify a customized scheduler policy configuration.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

I'm aware of the ConfigMap but passing a file is much simpler in our case.

This PR is low risk, we will want to cherry pick this into 1.9.

**Release note**:

```release-note
None
```
2018-01-05 17:52:36 -08:00
Wojciech Tyczynski
c3b0a83a5c Configurable liveness probe initial delays for etcd and kube-apiserver in GCE 2018-01-02 15:10:33 +01:00
Tim Hockin
e9dd8a68f6 Revert k8s.gcr.io vanity domain
This reverts commit eba5b6092a.

Fixes https://github.com/kubernetes/kubernetes/issues/57526
2017-12-22 14:36:16 -08:00
Mike Danese
76f22a0200 gce: reorder authorizers
to the order Node,Webhook,RBAC,ABAC
2017-12-20 11:51:52 -08:00
Yang Guo
216ec16592 Support passing kube-scheduler policy config 2017-12-19 16:12:44 -08:00
Maciej Borsz
95dccb4b82 Add --retry-connrefused to all curl invocations.
By default 'Connection refused' error is not a transient error
and is not retried.
2017-12-19 14:10:37 +01:00
Maciej Borsz
249ddd762c
Revert "Add --retry-connrefused to all curl invocations." 2017-12-19 09:47:25 +01:00
Tim Hockin
eba5b6092a Use k8s.gcr.io vanity domain for container images 2017-12-18 09:18:34 -08:00
Maciej Borsz
d9bb71b1fe Add --retry-connrefused to all curl invocations.
By default 'Connection refused' error is not a transient error
and is not retried.
2017-12-18 13:34:33 +01:00
Kubernetes Submit Queue
0c6d76b0fc
Merge pull request #54805 from yujuhong/keep-net-checkpoint
Automatic merge from submit-queue (batch tested with PRs 52259, 53951, 54385, 54805, 55145). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

COS: Keep the docker network checkpoint

This is necessary for enabling the live-restore feature.



**What this PR does / why we need it**:
This is necessary for enabling the live-restore feature on COS.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:
```release-note
COS: Keep the docker network checkpoint
```
2017-12-13 21:26:02 -08:00
Jing Ai
305656c706 Merge branch 'master' into upgrade_aliases_branch 2017-12-11 11:57:33 -08:00
Kubernetes Submit Queue
d309681b7b
Merge pull request #56834 from msau42/override-recycler
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Override recycler pod in GCE

**What this PR does / why we need it**:
Override the default nfs and hostpath recycler pod with the busybox image from gcr.io/google-containers.  It does this by:
* writing out the new recycler pod spec to /home/kubernetes
* specifying recycler pod arguments to kube-controller-manager, 
* adding a hostpath volume to the recycler pod spec in the kube-controller-manager manfiest

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-12-08 12:59:30 -08:00
Jing Ai
805809b769 Merge branch 'master' into upgrade_aliases_branch 2017-12-06 13:06:15 -08:00
Mik Vyatskov
fe0577e1a1 Make audit webhook backend configurable in startup scripts
Signed-off-by: Mik Vyatskov <vmik@google.com>
2017-12-06 16:33:08 +01:00
Kubernetes Submit Queue
64ed037e68
Merge pull request #56861 from freehan/fix-gce-config-array
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix gce.conf multi-value parameter processing

fixes: https://github.com/kubernetes/kubernetes/issues/56833

alternative to: https://github.com/kubernetes/kubernetes/pull/56857


```release-note
NONE
```
2017-12-05 16:45:14 -08:00
Minhan Xia
af42fbd3d0 fix gce.conf multi-value parameter processing 2017-12-05 13:30:04 -08:00
Michelle Au
972b6eef2a Override recycler pod image in GCE 2017-12-04 21:52:50 -08:00
Kubernetes Submit Queue
2175199646
Merge pull request #56576 from kawych/master
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix configuration of Metadata Agent daemon set

**What this PR does / why we need it**:
Fixes small errors in Stackdriver Metadata Agent configuration: port number and default version.

**Release note**:
```release-note
Fix port number and default Stackdriver Metadata Agent in daemon set configuration.
```
2017-12-04 17:57:44 -08:00
Kubernetes Submit Queue
084076dc72
Merge pull request #55360 from ihmccreery/iptables
Automatic merge from submit-queue (batch tested with PRs 55360, 56444, 56687, 56791, 56802). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Configure metadata concealment iptables rules in node startup.

**What this PR does / why we need it**: Configure iptables rule for metadata concealment at startup so the pod doesn't have to, to reduce memory consumption.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-12-04 13:40:11 -08:00
Jing Ai
4b5b9da489 Merge branch 'master' into upgrade_aliases_branch 2017-11-30 10:48:29 -08:00
Karol Wychowaniec
b314d18877 Fix configuration of Metadata Agent daemon set 2017-11-29 15:30:36 +01:00
Isaac Hollander McCreery
2ca9a3185c Configure metadata concealment iptables rules in node startup. 2017-11-28 14:08:57 -08:00
Aleksandra Malinowska
fa9ff6991e Add checking HPA_USE_REST_CLIENTS in addition to ENABLE_METRICS_SERVER when disabling REST clients use for HPA 2017-11-28 11:04:10 +01:00
Jing Ai
9288d26d26 Merge branch 'master' into upgrade_aliases_branch 2017-11-27 14:28:52 -08:00
Kubernetes Submit Queue
ca37d42048
Merge pull request #55728 from rajansandeep/kubeupcoredns
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add CoreDNS as an optional addon in kube-up

**What this PR does / why we need it**:
This PR adds the option of installing CoreDNS as an addon instead of kube-dns in kube-up.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #56439 

**Special notes for your reviewer**:

**Release note**:

```release-note
kube-up: Add optional addon CoreDNS. 
Install CoreDNS instead of kube-dns by setting CLUSTER_DNS_CORE_DNS value to 'true'.
```
2017-11-27 14:10:54 -08:00
Jing Ai
b40793e7dd Merge branch 'master' into upgrade_aliases_branch 2017-11-23 17:41:49 -08:00
Kubernetes Submit Queue
ba09291ba7
Merge pull request #56219 from kawych/agents_deployment
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add deployment for Stackdriver Metadata Agent with version and resource requirement controlled by env variable

**What this PR does / why we need it**:
Introduces Stackdriver Metadata Agent - a daemon set providing metadata for kubernetes objects connected to the same node.

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```
2017-11-23 02:35:21 -08:00
Jing Ai
3ca679dc80 Merge branch 'master' into upgrade_aliases_branch 2017-11-22 22:04:11 -08:00
Kubernetes Submit Queue
6caf34389b
Merge pull request #56151 from kawych/heapster_deployment
Automatic merge from submit-queue (batch tested with PRs 55952, 49112, 55450, 56178, 56151). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add environment variable to enable support for new Stackdriver resource model

To be merged after #56211 


**What this PR does / why we need it**:
This PR adds env variable to control Stackdriver sink in Heapster - whether it export metrics for new resource model or old resource model.

**Release note**:
```release-note
NONE
```
2017-11-22 21:48:51 -08:00
Jing Ai
90466391cb Merge branch 'master' into upgrade_aliases_branch 2017-11-22 09:55:37 -08:00
Karol Wychowaniec
52f7695f00 Add deployment for Stackdriver Metadata Agent with version and resource requirement controlled by env variable 2017-11-22 16:21:52 +01:00
Kubernetes Submit Queue
f85649c6cd
Merge pull request #55950 from crassirostris/fluentd-gcp-setting-resources-fix
Automatic merge from submit-queue (batch tested with PRs 56207, 55950). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix setting resources in fluentd-gcp plugin

Currently if some of the variables are not set, scripts prints error, which is not critical, since the function is executed in a separate process, but it leads to the wrong resulting values

```release-note
NONE
```

/cc @piosz @x13n 
/assign @roberthbailey @mikedanese 
Could you please approve?
2017-11-22 05:21:25 -08:00
Mik Vyatskov
e9322b929c Fix setting resources in fluentd-gcp plugin
Signed-off-by: Mik Vyatskov <vmik@google.com>
2017-11-22 12:40:50 +01:00
Karol Wychowaniec
db101f921b Add environment variable to enable support for new Stackdriver resource model 2017-11-21 16:09:55 +01:00
Jing Ai
391a9df925 Merge branch 'master' into upgrade_aliases_branch 2017-11-20 21:20:45 -08:00
Jing Ai
551ffbe7bf Implement upgrade-aliases.sh to migrate a route-based k8s cluster to use IP aliases in GCE. 2017-11-20 21:11:50 -08:00
Kubernetes Submit Queue
e24b5532a5
Merge pull request #55911 from davidz627/localSSDUUID
Automatic merge from submit-queue (batch tested with PRs 54824, 55911, 55730, 55979, 55961). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add options for mounting SCSI or NVMe local SSD though Block or Filesystem and do all of that with UUID

Fixes: #51431
Fixed version of: #53466

Mount SCSI local SSD by UUID in /mnt/disks/by-uuid/, also allows for users to request and mount NVMe disks. Both types of disks will be accessible either through block or file-system.

I have confirmed that it is no longer crashing when nodes are initialized on GKE.
2017-11-20 20:13:33 -08:00
David Zhu
f780eefd39 Set up alternate mount point for SCSI/NVMe local SSD by UUID in /mnt/disks/by-uuid/, set up ability to have unformatted disk symlinked in /dev/disk/by-uuid/. Added tests. Preserved backwards compatibility. 2017-11-17 10:56:48 -08:00
Daniel Kłobuszewski
ea64edd6e6 Set -w flag on all iptables calls during master startup
Lack of this flag sometimes causes iptables to return error code 4 (if
other process holds xtables lock). As a result, because of  `set -o errexit`,
whole startup script fails, leaving master in an incorrect state.

This is another occurence of (already closed) https://github.com/kubernetes/kubernetes/issues/7370
2017-11-17 15:04:32 +01:00
Mike Danese
0117006a54
Revert "Add options for mounting SCSI or NVMe local SSD though Block or Filesystem and do all of that with UUID" 2017-11-16 07:51:38 -08:00
Sandeep Rajan
939d1b3be9 fix indent 2017-11-16 09:13:13 -05:00
Kubernetes Submit Queue
c3ed0f2663
Merge pull request #53466 from davidz627/localSSDUUID
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add options for mounting SCSI or NVMe local SSD though Block or Filesystem and do all of that with UUID

Fixes: #51431

Mount SCSI local SSD by UUID in /mnt/disks/by-uuid/, also allows for users to request and mount NVMe disks. Both types of disks will be accessable either through block or filesystem

To see code in progress for NVMe and block support see working branch: https://github.com/davidz627/kubernetes/tree/localExt
2017-11-15 18:25:30 -08:00
Sandeep Rajan
134487191d create fn for dns manifests 2017-11-15 11:35:05 -05:00
David Zhu
028258244c Set up alternate mount point for SCSI/NVMe local SSD by UUID in /mnt/disks/by-uuid/, set up ability to have unformatted disk symlinked in /dev/disk/by-uuid/. Added tests. Preserved backwards compatibility. 2017-11-14 17:14:41 -08:00
Mike Danese
dc616dc29b Revert "allow configuring of the docker storage driver on gce"
This reverts commit 79f98a41f9.
2017-11-14 13:46:08 -08:00
Kubernetes Submit Queue
b2125f5aa8
Merge pull request #55509 from tallclair/psp-addons
Automatic merge from submit-queue (batch tested with PRs 54602, 54877, 55243, 55509, 55128). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

PodSecurityPolicies for addons

**What this PR does / why we need it**:

1. Colocate addon PodSecurityPolicy config with the addons (in a `podsecuritypolicies` subdirectory). 
2. Add policies for addons that are currently missing policies (not in the default GCE suite)
3. Remove HostPath SSL certs from several heapster deployments, so that heapster doesn't require a special PSP

**Which issue(s) this PR fixes**:
#43538

**Release note**:
```release-note
- Add PodSecurityPolicies for cluster addons
- Remove SSL cert HostPath volumes from heapster addons
```
2017-11-14 03:03:30 -08:00
Sandeep Rajan
5c7392368f Add CoreDNS as an optional addon in kube-up 2017-11-13 18:38:51 -05:00
Kubernetes Submit Queue
4f91113075
Merge pull request #54826 from mindprince/addon-manager
Automatic merge from submit-queue (batch tested with PRs 54826, 53576, 55591, 54946, 54825). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Run nvidia-gpu device-plugin daemonset as an addon on GCE nodes that have nvidia GPUs attached

- Instead of the old `Accelerators` feature that added `alpha.kubernetes.io/nvidia-gpu` resource, use the new `DevicePlugins` feature that adds vendor specific resources. (In case of nvidia GPUs it will
add `nvidia.com/gpu` resource.)

- Add node label to GCE nodes with accelerators attached. This node label is the same as what GKE attaches to node pools with accelerators attached. (For example, for nvidia-tesla-p100 GPU, the label would be `cloud.google.com/gke-accelerator=nvidia-tesla-p100`) This will help us target accelerator specific
daemonsets etc. to these nodes.

- Run nvidia-gpu device-plugin daemonset as an addon on GCE nodes that have nvidia GPUs attached.

- Some minor documentation improvements in addon manager.

**Release note**:
```release-note
GCE nodes with NVIDIA GPUs attached now expose `nvidia.com/gpu` as a resource instead of `alpha.kubernetes.io/nvidia-gpu`.
```

/sig cluster-lifecycle
/sig scheduling
/area hw-accelerators

https://github.com/kubernetes/features/issues/368
2017-11-13 14:46:55 -08:00
Kubernetes Submit Queue
d1cca169f8
Merge pull request #55512 from dashpole/docker_storage_driver
Automatic merge from submit-queue (batch tested with PRs 53337, 55465, 55512, 55522, 54554). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Allow configuring docker storage driver in GCE

**What this PR does / why we need it**:
For GCE, allow configuring of the docker storage driver.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:
```release-note
GCE: Provide an option to configure the docker storage driver.
```
2017-11-11 12:44:24 -08:00
David Ashpole
79f98a41f9 allow configuring of the docker storage driver on gce 2017-11-10 18:02:36 -08:00
Yang Guo
a3ad8391db Set CONTAINER_RUNTIME default value to 'docker' 2017-11-10 16:05:55 -08:00
Tim Allclair
29d556a03a
Source PodSecurityPolicies from addon subdir 2017-11-10 13:57:31 -08:00
Kubernetes Submit Queue
e64dc21ba6
Merge pull request #55385 from xiangpengzhao/remove-script-1.6
Automatic merge from submit-queue (batch tested with PRs 55265, 54092, 55353, 53733, 55385). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Symbol links of key and cert are no longer used.

**What this PR does / why we need it**:
This is unused for current cycle.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
ref #42660

**Special notes for your reviewer**:
/cc @mikedanese 

**Release note**:

```release-note
NONE
```
2017-11-10 01:30:31 -08:00
Rohit Ramkumar
f78775099a
Update configure-helper.sh
fixed a typo which was causing script to break while creating a GKE cluster.

Specifically, the line  "setup-addon-manifests "addons" "rbac/legacy-kubelet-user-disabled" was meant to refer to the directory cluster/addons/rbac/legacy-kubelet-user-disable. The extra "d" at the end of disable was causing the script to break.
2017-11-09 09:49:10 -08:00
xiangpengzhao
d5d4b4007c Symbol links of key and cert are no longer used. 2017-11-09 17:26:22 +08:00
Yu-Ju Hong
1842922b6b GCE: provide an option to disable docker's live-restore 2017-11-07 15:01:45 -08:00
Kubernetes Submit Queue
8eb0b39afe
Merge pull request #53144 from mikedanese/kubelet-revoke
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

gce: revoke kubelet binding permissions

and move the binding addon to EnsureExists, so new clusters will pickup
the new binding and old clusters will keep the old binding. The binding
is no longer required now that we are migrating to node authorizer.

fixes https://github.com/kubernetes/kubernetes/issues/53151
2017-11-07 04:13:38 -08:00
Kubernetes Submit Queue
ce90b54c0f
Merge pull request #55178 from dnardo/gke-setup
Automatic merge from submit-queue (batch tested with PRs 53866, 54852, 55178, 55185, 55130). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Set the NON_MASQUERADE_CIDR to 0/0 by default in GCE/GKE

This disables masquerade rules setup by the kubelet.  Additionally this adds masquerade rules based on NON_MASQUERADE_CIDR being set to 0/0.



**What this PR does / why we need it**:

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
Add masquerading rules by default to GCE/GKE
```
2017-11-06 22:20:31 -08:00
Kubernetes Submit Queue
2e0181afd1
Merge pull request #55181 from rramkumar1/custom-kube-proxy
Automatic merge from submit-queue (batch tested with PRs 51001, 55181). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Added logic for custom kube proxy yaml for GKE

Added yaml-replacement logic for custom kube-proxy daemon set on GKE. 

Release Note: 
```release-note
None
```
2017-11-06 16:28:48 -08:00
Kubernetes Submit Queue
01f205adf5
Merge pull request #54759 from sakshamsharma/remove-google-kms-in-tree
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Remove Google Cloud KMS's in-tree integration

Removes the following introduced by #48574 and others:
* `kms.go` which contained the cloudkms-specific code for Google Cloud KMS service.
* Registering the Google Cloud KMS in the KMS plugin registry.
* Google's `cloudkms` API package from `vendor` folder. 

The following changes are upcoming:
* Removal of KMSPluginRegistry. This would not be needed anymore, since KMS providers will be out-of-tree from now on (so no need of registering them, an address of the process would be enough).
* A service which allows encrypt/decrypt functionality (satisfies `envelope.Service` interface) if initialized with an IP/Port of an out-of-tree process serving KMS requests. Will tentatively use gRPC requests to talk to this external service.

Reference: https://github.com/kubernetes/kubernetes/pull/54439#issuecomment-340062801 and https://github.com/kubernetes/kubernetes/issues/51965#issuecomment-339333937.

```release-note
Google KMS integration was removed from in-tree in favor of a out-of-process extension point that will be used for all KMS providers.
```
2017-11-06 14:10:43 -08:00
Rohit Ramkumar
eeb643dd9e Added logic for custom kube proxy yaml for GKE 2017-11-06 12:30:42 -08:00
Daniel Nardo
8aef128640 Set the NON_MASQUERADE_CIDR to 0/0 by default in GCE/GKE which disables
masquerade rules setup by the kubelet.  Add masquerade rules based
on NON_MASQUERADE_CIDR being set to 0/0.
2017-11-06 10:01:55 -08:00
Isaac Hollander McCreery
be8aaf9ff8 Add prometheus-to-sd-exporter to metadata-proxy addon; bump to proxy to v0.1.4 and e2e to v0.0.2; remove configmag 2017-11-03 10:23:05 -07:00
Kubernetes Submit Queue
7a28aaffa7
Merge pull request #54964 from Random-Liu/add-containerd-e2e
Automatic merge from submit-queue (batch tested with PRs 54488, 54838, 54964). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add support to for alternative container runtime in `kube-up.sh`

For https://github.com/kubernetes/features/issues/286.

This PR added 4 new environment variables in `kube-up.sh` to support alternative container runtime:
1) `KUBE_MASTER_EXTRA_METADATA` and `KUBE_NODE_EXTRA_METADATA`. Add extra metadata on master and node instance. With this we could specify different cloud-init for a different container runtime, and also add extra metadata for the new cloud-init, e.g. [master.yaml](7d73966214/test/e2e/master.yaml)
2) `KUBE_CONTAINER_RUNTIME_ENDPOINT`. Specify different sock for different container runtime. It's only used when it's not empty.
3) `KUBE_LOAD_IMAGE_COMMAND`. Specify different load image command for different container runtime.

An example for cri-containerd:
```
export KUBE_MASTER_EXTRA_METADATA="user-data=${GOPATH}/src/github.com/kubernetes-incubator/cri-containerd/test/e2e/master.yaml,cri-containerd-configure-sh=${GOPATH}/src/github.com/kubernetes-incubator/cri-containerd/test/configure.sh"
export KUBE_NODE_EXTRA_METADATA="user-data=${GOPATH}/src/github.com/kubernetes-incubator/cri-containerd/test/e2e/node.yaml,cri-containerd-configure-sh=${GOPATH}/src/github.com/kubernetes-incubator/cri-containerd/test/configure.sh"
export KUBE_CONTAINER_RUNTIME="remote"
export KUBE_CONTAINER_RUNTIME_ENDPOINT="/var/run/cri-containerd.sock"
export KUBE_LOAD_IMAGE_COMMAND="/home/cri-containerd/usr/local/bin/cri-containerd load"
export NETWORK_POLICY_PROVIDER="calico"
```

Signed-off-by: Lantao Liu <lantaol@google.com>

```release-note
none
```
/cc @yujuhong @dchen1107 @feiskyer @mikebrow @abhi @mrunalp @runcom 
/cc @kubernetes/sig-node-pr-reviews
2017-11-02 18:01:19 -07:00
Lantao Liu
8279916c65 Fix calico network policy for opensource.
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-11-02 21:56:46 +00:00
Kubernetes Submit Queue
96d81fe688
Merge pull request #52367 from tallclair/psp-config
Automatic merge from submit-queue (batch tested with PRs 52367, 53363, 54989, 54872, 54643). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Basic GCE PodSecurityPolicy Config

**What this PR does / why we need it**:

This PR lays the foundation for enabling PodSecurityPolicy in GCE and other default deployments. The 3 commits are:

1. Add policies, roles & bindings for the default addons on GCE.
2. Enable the PSP admission controller & load the addon policies when the`ENABLE_POD_SECURITY_POLICY=true` environment variable is set.
3. Support the PodSecurityPolicy in the E2E environment & add PSP tests.

NOTES:

- ~~Depends on https://github.com/kubernetes/kubernetes/pull/52301 for privileged capabilities~~
- ~~Depends on https://github.com/kubernetes/kubernetes/pull/52849 for sane mutations~~
- ~~Depends on https://github.com/kubernetes/kubernetes/pull/53479 for aggregator tests to pass~~
- ~~Depends on https://github.com/kubernetes/kubernetes/pull/54175 for dedicated fluentd service~~ account
- This PR is a fork of https://github.com/kubernetes/kubernetes/pull/46064, credit to @Q-Lee

**Which issue this PR fixes**: #43538

**Release note**:
```release-note
Add support for PodSecurityPolicy on GCE: `ENABLE_POD_SECURITY_POLICY=true` enables the admission controller, and installs policies for default addons.
```
2017-11-02 12:59:13 -07:00
Rohit Agarwal
cf292754ba Run nvidia-gpu device-plugin daemonset as an addon on GCE nodes that have nvidia GPUs attached. 2017-11-02 12:58:29 -07:00
Isaac Hollander McCreery
a051a54962 Explicitly set route_localnet on nodes & masters.
Allow for loopback addresses to be used for routing, specifically to
enable metadata proxy on master nodes.
2017-11-02 08:56:41 -07:00
Lantao Liu
75293ac7a2 Add containerd e2e.
Signed-off-by: Lantao Liu <lantaol@google.com>
2017-11-02 03:44:42 +00:00
Tim Allclair
88db819170
GCP PodSecurityPolicy configuration 2017-11-01 14:03:09 -07:00
Yu-Ju Hong
e067817a80 COS: Keep the docker network checkpoint
This is necessary for enabling the live-restore feature.
2017-10-30 12:07:15 -07:00
Saksham Sharma
261772b65c Remove Google Cloud KMS integration for encryption-at-rest. 2017-10-29 17:40:15 +05:30
Isaac Hollander McCreery
9f2b0188bc Fix ENABLE_METADATA_CONCEALMENT firewall rules to respect true/false 2017-10-27 16:01:08 -07:00
Kubernetes Submit Queue
abe9d2f736 Merge pull request #54150 from ihmccreery/mdc-e2e
Automatic merge from submit-queue (batch tested with PRs 54112, 54150, 53816, 54321, 54338). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Enable metadata concealment for tests

**What this PR does / why we need it**: Metadata concealment is going to beta for v1.9; enable it by default in tests.  Also, just use `ENABLE_METADATA_CONCEALMENT` instead of two different vars.  Work toward #8867.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: none

**Special notes for your reviewer**:

**Release note**:

```release-note
Metadata concealment on GCE is now controlled by the `ENABLE_METADATA_CONCEALMENT` env var.  See cluster/gce/config-default.sh for more info.
```
2017-10-26 17:07:24 -07:00
Mike Danese
3f7e1cccd2 don't add kubelet legacy binding if we aren't registering the master kubelet 2017-10-26 13:30:59 -07:00
Kubernetes Submit Queue
76f198399b Merge pull request #54518 from rramkumar1/custom-kube-dns-for-gke
Automatic merge from submit-queue (batch tested with PRs 52003, 54559, 54518). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Added functionality to replace default kube-dns deployment with a GKE specific one

**What this PR does / why we need it**:
In GKE, we need to use custom kube-dns deployments, which means replacing the default one with the custom. This PR adds the replacement functionality into the relevant configuration scripts.

Release Note: 
```release-note
NONE
```
2017-10-25 11:38:43 -07:00
Rohit Ramkumar
efc89c5833 Added functionality to replace default kube-dns deployment with a GKE specific one 2017-10-24 17:07:40 -07:00
Daniel Nardo
f9b329250a Set "--kubelet-preferred-address-types" if ssh tunnel is not used.
In additional don't advertise external address.
2017-10-24 11:13:52 -07:00
Kubernetes Submit Queue
060b4b8b84 Merge pull request #54403 from wojtek-t/dont_hardcode_etcd_hostname
Automatic merge from submit-queue (batch tested with PRs 54400, 54403). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Allow for configuring etcd hostname in the manifest

```release-note
Allow for configuring etcd hostname in the manifest
```
2017-10-23 06:40:00 -07:00
Wojciech Tyczynski
2fbe39fc8f Fix etcd hostnames 2017-10-23 13:49:28 +02:00
Jing Ai
4de8b47a40 Merge branch 'master' into fix_scripts_branch 2017-10-20 14:53:58 -07:00
Jing Ai
5cdbea5ded Fix typos: replace SECONDARY-RANGE-NAME with SECONDARY_RANGE_NAME. 2017-10-18 21:05:05 -07:00
Isaac Hollander McCreery
3ee03fd033 Enable metadata concealment for tests 2017-10-18 08:31:18 -07:00
Minhan Xia
5563fbfbe1 Add GCE_GLBC_IMAGE to allow override glbc image 2017-10-17 15:27:50 -07:00
Kubernetes Submit Queue
1c17d985ca Merge pull request #52183 from MrHohn/kube-proxy-incluster-host
Automatic merge from submit-queue (batch tested with PRs 52883, 52183, 53915, 53848). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[GCE kube-up] Don't provision kubeconfig file for kube-proxy service account

**What this PR does / why we need it**:

Offloading the burden of provisioning kubeconfig file for kube-proxy service account from GCE startup scripts. This also helps us decoupling kube-proxy daemonset upgrade from node upgrade.

Previous attempt on https://github.com/kubernetes/kubernetes/pull/51172, using InClusterConfig for kube-proxy based on discussions on https://github.com/kubernetes/client-go/issues/281.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #NONE 

**Special notes for your reviewer**:
/assign @bowei @thockin 
cc @luxas @murali-reddy

**Release note**:

```release-note
NONE
```
2017-10-13 17:33:31 -07:00
Zihong Zheng
476138c676 [GCE kube-up] Don't provision kubeconfig file on nodes when kube-proxy run as a DaemonSet 2017-10-13 14:40:40 -07:00
Kubernetes Submit Queue
0564d52985 Merge pull request #53205 from kawych/master
Automatic merge from submit-queue (batch tested with PRs 50223, 53205). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Create e2e tests for Custom Metrics - Stackdriver Adapter and HPA based on custom metrics from Stackdriver

**What this PR does / why we need it**:
- Add e2e test for Custom Metrics - Stackdriver Adapter
- Add 2e2 test for HPA based on custom metrics from Stackdriver
- Enable HorizontalPodAutoscalerUseRESTClients option

**Release note**:

```release-note
Horizontal pod autoscaler uses REST clients through the kube-aggregator instead of the legacy client through the API server proxy.
```
2017-10-11 03:54:33 -07:00
Joe Betz
2e362ea142 Add 'ETCD_DOCKER_REPOSITORY' environment variable override to 'cluster/' scripts.
This allows the etcd docker registry that is currently hard coded to
`gcr.io/google_containers/etcd` in the `etcd.manifest` template to be
overridden.  This can be used to test new versions of etcd with
kubernetes that have not yet been published to
`gcr.io/google_containers/etcd` and also enables cluster operators to
manage the etcd images used by their cluster in an internal
repository.
2017-10-10 12:38:18 -07:00
Karol Wychowaniec
f3fddaedd0 Enable HorizontalPodAutoscalerUseRESTClients option 2017-10-10 10:50:09 +02:00
Kubernetes Submit Queue
d2276079f6 Merge pull request #52956 from m1093782566/ipvs-params
Automatic merge from submit-queue (batch tested with PRs 53044, 52956, 53512, 53028). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add ipvs sync period parameters - align to iptables proxier

**What this PR does / why we need it**:

Add ipvs sync period parameters - align to iptables proxier

**Which issue this PR fixes**: 

fixes #52957

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-10-05 18:29:39 -07:00
Piotr Szczesniak
747dffcba0 Fixed metrics API group name in audit configuration 2017-10-05 16:54:13 +02:00
Zihong Zheng
f107e378c9 Allow setting --concurrent-service-syncs for kube-controller-manager in GCE startup scripts 2017-10-04 15:04:56 -07:00
Kubernetes Submit Queue
cf3fcf235f Merge pull request #53280 from MrHohn/merge-kube-dns-yamls
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

 Merge kube-dns templates into a single file

**What this PR does / why we need it**: Merge all of the kube-dns cluster yamls into a single file.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #42832

**Special notes for your reviewer**:
/assign @bowei @shashidharatd 
cc @kevin-wangzefeng @euank @lhuard1A

**Release note**:

```release-note
NONE
```
2017-10-03 11:46:43 -07:00
Zihong Zheng
db8f9ddcec Merge kube-dns templates into a single file 2017-10-03 09:43:52 -07:00
Kubernetes Submit Queue
f48eccad9e Merge pull request #53053 from shyamjvs/enable-audit-logging-kubemark
Automatic merge from submit-queue (batch tested with PRs 51765, 53053, 52771, 52860, 53284). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Add audit-logging, feature-gates & few admission plugins to kubemark

To make kubemark match real cluster settings. Also includes a few other settings like request-timeout, etcd-quorum, etc.

Fixes https://github.com/kubernetes/kubernetes/issues/53021
Related https://github.com/kubernetes/kubernetes/issues/51899 https://github.com/kubernetes/kubernetes/issues/44701

cc @kubernetes/sig-scalability-misc @wojtek-t @gmarek @smarterclayton
2017-10-03 09:02:32 -07:00
Shyam Jeedigunta
eadce7a180 Add audit-logging, feature-gates & few admission plugins to kubemark 2017-10-02 12:13:52 +02:00
Kubernetes Submit Queue
bff7821dab Merge pull request #53225 from crassirostris/fix-basic-audit
Automatic merge from submit-queue (batch tested with PRs 51021, 53225, 53094, 53219). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix basic audit in GCE deploy scripts

Fix https://github.com/kubernetes/kubernetes/issues/53154

Since AdvancedAudit feature gate is now enabled by default, we should explicitly disable it when using basic audit.
2017-09-29 12:38:19 -07:00
Mik Vyatskov
259260566f Fix basic audit in GCE deploy scripts
Signed-off-by: Mik Vyatskov <vmik@google.com>
2017-09-29 14:03:48 +02:00
Mike Danese
87e528d436 gce:restrict file permissions for PKI assets
from 644 to 600
2017-09-28 09:29:18 -07:00
Jordan Liggitt
20453f9e87
Adjust audit policy for scale issues 2017-09-25 13:13:14 -04:00
m1093782566
f4333f0a69 add ipvs sync period parameters 2017-09-24 10:48:08 +08:00
Kubernetes Submit Queue
5efab5a121 Merge pull request #52497 from jcbsmpsn/add-signing-duration-configuration-flag
Automatic merge from submit-queue (batch tested with PRs 48970, 52497, 51367, 52549, 52541). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>..

Add configuration support for signing duration.

Fixes https://github.com/kubernetes/kubernetes/issues/52286
Fixes https://github.com/kubernetes/kubernetes/issues/52282
Reverses revert (with fixes) https://github.com/kubernetes/kubernetes/pull/52299

```release-note
Add CLUSTER_SIGNING_DURATION environment variable to cluster
configuration scripts to allow configuration of signing duration of
certificates issued via the Certificate Signing Request API.
```
2017-09-19 01:17:42 -07:00
Kubernetes Submit Queue
549bd71ea7 Merge pull request #52488 from kawych/master
Automatic merge from submit-queue (batch tested with PRs 52488, 52548). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>..

Enable overriding Heapster resource requirements in GCP

This PR enables to override Heapster resource requirements in GCP.

**Release note:**
```release-note
```
2017-09-15 18:34:25 -07:00
Jacob Simpson
ca48fca127 Add configuration support for signing duration.
Add CLUSTER_SIGNING_DURATION environment variable to cluster
configuration scripts to allow configuration of signing duration of
certificates issued via the Certificate Signing Request API.
2017-09-15 10:22:19 -07:00
Karol Wychowaniec
8cfeb4f172 Enable overriding Heapster resource requirements in GCP 2017-09-15 11:45:37 +02:00
Kubernetes Submit Queue
0c1dcb01c5 Merge pull request #52115 from jcbsmpsn/flag-enable-kubelet-certificate-rotation
Automatic merge from submit-queue (batch tested with PRs 52452, 52115, 52260, 52290)

Add env var to enable kubelet rotation in kube-up.sh.

Fixes https://github.com/kubernetes/kubernetes/issues/52114

```release-note
Adds ROTATE_CERTIFICATES environment variable to kube-up.sh script for GCE
clusters. When that var is set to true, the command line flag enabling kubelet
client certificate rotation will be added to the kubelet command line.
```
2017-09-15 01:59:59 -07:00
Kubernetes Submit Queue
afdbfa251f Merge pull request #52358 from crassirostris/audit-policy-groups
Automatic merge from submit-queue (batch tested with PRs 52376, 52439, 52382, 52358, 52372)

Add new api groups to the GCE advanced audit policy

Fixes https://github.com/kubernetes/kubernetes/issues/52265

It introduces the missing api groups, that were introduced in 1.8 release.

@piosz there's also the 'metrics' api group, should we audit it?
2017-09-14 15:27:05 -07:00
Jacob Simpson
0ac34781c8 Add env var to enable kubelet rotation in kube-up.sh. 2017-09-14 11:30:03 -07:00
Kubernetes Submit Queue
cd343fd806 Merge pull request #52342 from crassirostris/audit-policy-gcp-variable
Automatic merge from submit-queue (batch tested with PRs 51601, 52153, 52364, 52362, 52342)

Make advanced audit policy on GCP configurable

Related to https://github.com/kubernetes/kubernetes/issues/52265

Make GCP audit policy configurable

/cc @tallclair
2017-09-13 09:30:19 -07:00
Mik Vyatskov
ccf40abd50 Make advanced audit policy on GCP configurable 2017-09-13 14:36:26 +02:00
Mik Vyatskov
a9fb3c8efb Add new api groups to the GCE advanced audit policy 2017-09-13 12:07:48 +02:00
Mik Vyatskov
0933f5c8e0 Switch default audit policy to beta and omit RequestReceived stage 2017-09-12 16:36:13 +02:00
Eric Chiang
cd3c8770c5 Revert "Add cluster up configuration for certificate signing duration."
This reverts commit bd0c16cc8e.
2017-09-11 16:28:17 -07:00
Kubernetes Submit Queue
ed154988c5 Merge pull request #51844 from jcbsmpsn/add-signing-duration-configuration-flag
Automatic merge from submit-queue

Add cluster up configuration for certificate signing duration.

```release-note
Add CLUSTER_SIGNING_DURATION environment variable to cluster configuration scripts
to allow configuration of signing duration of certificates issued via the Certificate
Signing Request API.
```
2017-09-08 13:24:20 -07:00
Kubernetes Submit Queue
fa916c1002 Merge pull request #51986 from yujuhong/docker-pids
Automatic merge from submit-queue (batch tested with PRs 51921, 51829, 51968, 51988, 51986)

COS/GCE: bump the max pids for the docker service

**What this PR does / why we need it**:
TasksMax limits how many threads/processes docker can create. Insufficient limit affects container starts.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*:
fixes #51977

**Special notes for your reviewer**:

**Release note**:
```release-note
Ensure TasksMax is sufficient for docker
```
2017-09-05 21:03:17 -07:00
Kubernetes Submit Queue
578690448a Merge pull request #51988 from zmerlynn/fix-pod-priority
Automatic merge from submit-queue (batch tested with PRs 51921, 51829, 51968, 51988, 51986)

Fix unbound variable in configure-helper.sh

This isn't plumbed yet on GKE, so results in an unbound variable.

```release-note
NONE
```
2017-09-05 21:03:15 -07:00
Zach Loafman
bd86be402c Fix unbound variable in configure-helper.sh
This isn't plumbed yet on GKE, so results in an unbound variable.
2017-09-05 16:21:58 -07:00
Yu-Ju Hong
d6de90e8f7 COS/GCE: Ensure TasksMax is sufficient for docker
This affects how many threads/processes docker can create, and should
not be limited.
2017-09-05 16:18:43 -07:00
Jacob Simpson
bd0c16cc8e Add cluster up configuration for certificate signing duration. 2017-09-05 15:56:33 -07:00
Jing Xu
3d4bc931d3 Set up DNS server in containerized mounter path
During NFS/GlusterFS mount, it requires to have DNS server to be able to
resolve service name. This PR gets the DNS server ip from kubelet and
add it to the containerized mounter path. So if containerized mounter is
used, service name could be resolved during mount
2017-09-05 11:40:23 -07:00
Kubernetes Submit Queue
ffed1d3408 Merge pull request #51792 from piosz/metrics-server
Automatic merge from submit-queue (batch tested with PRs 49727, 51792)

Introducing metrics-server

ref https://github.com/kubernetes/features/issues/271

There is still some work blocked on problems with repo synchronization:
- migrate to `v1beta1` introduced in #51653 
- bump deps to HEAD
Will do it in a follow up PRs once the issue is resolved.

```release-note
Introduced Metrics Server
```
2017-09-04 03:37:59 -07:00
Kubernetes Submit Queue
53ee4397e7 Merge pull request #51827 from bowei/2ndary-range-name
Automatic merge from submit-queue (batch tested with PRs 51682, 51546, 51369, 50924, 51827)

Add `secondary-range-name` to the gce.conf

```release-note
NONE
```
2017-09-03 15:54:25 -07:00
Kubernetes Submit Queue
47d0db0e87 Merge pull request #51237 from gunjan5/calico-2.5-rbac
Automatic merge from submit-queue

Add RBAC, healthchecks, autoscalers and update Calico to v2.5.1

**What this PR does / why we need it**:
- Updates Calico to `v2.5`
  - Calico/node to `v2.5.1`
  - Calico CNI to `v1.10.0`
  - Typha to `v0.4.1`
- Enable health check endpoints
  - Add Readiness probe for calico-node and Typha
  - Add Liveness probe for calico-node and Typha
- Add RBAC manifest
  - With calico ClusterRole, ServiceAccount and ClusterRoleBinding
- Add Calico CRDs in the Calico manifest (only works for k8s v1.7+)
- Add vertical autoscaler for calico-node and Typha
- Add horizontal autoscaler for Typha 

**Release note**:

```release-note
NONE
```
2017-09-03 14:01:04 -07:00
Piotr Szczesniak
55c21ac801 Introduced Metrics Server 2017-09-03 22:13:59 +02:00
Kubernetes Submit Queue
9637f46122 Merge pull request #51725 from nicksardo/gce-plumb-netvars
Automatic merge from submit-queue (batch tested with PRs 51805, 51725, 50925, 51474, 51638)

GCE: Plumb network & subnetwork to master

**Which issue this PR fixes** *
Fixes #51714

/assign @bowei 

**Release note**:
```release-note
NONE
```
2017-09-03 11:10:00 -07:00
Kubernetes Submit Queue
5632613c5b Merge pull request #51069 from MrHohn/kube-proxy-pod-priority
Automatic merge from submit-queue (batch tested with PRs 51553, 51538, 51663, 51069, 51737)

Allow enable pod priority feature gate for GCE and configure priority for kube-proxy

**What this PR does / why we need it**:
From #23225, this PR adds an option for user to enable pod priority feature gate using GCE startup scripts, and configure pod priority for kube-proxy when enabled.

The setup `priorityClassName: system` derives from: ce1485c626/staging/src/k8s.io/api/core/v1/types.go (L2536-L2542)

The plan is to configure pod priority for kube-proxy daemonset (https://github.com/kubernetes/kubernetes/pull/50705) in the same way.

**Special notes for your reviewer**:
cc @bsalamat @davidopp @thockin 

**Release note**:

```release-note
When using kube-up.sh on GCE, user could set env `ENABLE_POD_PRIORITY=true` to enable pod priority feature gate.
```
2017-09-02 21:58:04 -07:00
Kubernetes Submit Queue
2e69d4e625 Merge pull request #51564 from verult/MasterFlexDir
Automatic merge from submit-queue

Adding Flexvolume plugin dir piping for controller manager on COS

**What this PR does / why we need it**: Sets the default Flexvolume plugin directory correctly for controller manager running on COS images.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #51563

```release-note
NONE
```

/release-note-none
/sig storage
/assign @msau42 
/cc @wongma7
2017-09-02 08:20:13 -07:00
Bowei Du
1aeebcf6d3 Add secondary-range-name to the gce.conf 2017-09-01 14:28:16 -07:00
Gunjan Patel
05661b68eb Add RBAC, healthchecks, autoscaler and update Calico to v2.5.0, Typha to 0.4.0 2017-09-01 12:52:53 -07:00
Nick Sardo
506064376b Set NODE_NETWORK and NODE_SUBNETWORK in kube-up 2017-08-31 17:23:30 -07:00
Matt Liggett
ef0503b834 Add KUBE_APISERVER_REQUEST_TIMEOUT_SEC env var.
If set, connect it to kube-apiserver's --request-timeout flag.
2017-08-31 14:33:10 -07:00
Cheng Xing
da2a7a0bcc Adding Flexvolume plugin dir piping for master on COS 2017-08-29 15:09:29 -07:00
Kubernetes Submit Queue
0d17e9deb7 Merge pull request #48574 from sakshamsharma/kms-transformer
Automatic merge from submit-queue

Add Google cloud KMS service for envelope encryption transformer

This adds the required pieces which will allow addition of KMS based encryption providers (envelope transformer).

For now, we will be implementing it using Google Cloud KMS, but the code should make it easy to add support for any other such provider which can expose Decrypt and Encrypt calls.

Writing tests for Google Cloud KMS Service may cause a significant overhead to the testing framework. It has been tested locally and on GKE though.

Upcoming after this PR:
* Complete implementation of the envelope transformer, which uses LRU cache to maintain decrypted DEKs in memory.
* Track key version to assist in data re-encryption after a KEK rotation.

Development branch containing the changes described above: https://github.com/sakshamsharma/kubernetes/pull/4

Envelope transformer used by this PR was merged in #49350 

Concerns #48522 

Planned configuration:
```
kind: EncryptionConfig
apiVersion: v1
resources:
  - resources:
    - secrets
    providers:
    - kms:
        cachesize: 100
        configfile: gcp-cloudkms.conf
        name: gcp-cloudkms
    - identity: {}
```

gcp-cloudkms.conf:
```
[GoogleCloudKMS]
    kms-location: global
    kms-keyring: google-container-engine
    kms-cryptokey: example-key
```
2017-08-29 11:11:10 -07:00
Zihong Zheng
f2def6575c Configure pod priority for kube-proxy when enabled 2017-08-29 10:06:51 -07:00
Kubernetes Submit Queue
04b3ab9aba Merge pull request #50705 from MrHohn/kube-proxy-ds
Automatic merge from submit-queue (batch tested with PRs 50932, 49610, 51312, 51415, 50705)

Allow running kube-proxy as a DaemonSet when using kube-up.sh on GCE

**What this PR does / why we need it**:
From #23225, this PR adds an option for user to run kube-proxy as a DaemonSet instead of static pods using GCE startup scripts. By default, kube-proxy will run as static pods.

This is the first step for moving kube-proxy into a DaemonSet in GCE, remaining tasks will be tracked on #23225.

**Special notes for your reviewer**:
The last commit are purely for testing out kube-proxy as daemonset via CIs.

cc @kubernetes/sig-network-misc @kubernetes/sig-cluster-lifecycle-misc 

**Release note**:

```release-note
When using kube-up.sh on GCE, user could set env `KUBE_PROXY_DAEMONSET=true` to run kube-proxy as a DaemonSet. kube-proxy is run as static pods by default.
```
2017-08-29 01:17:45 -07:00
Saksham Sharma
3e11baf702 Add Google Cloud KMS plugin for encryption 2017-08-29 11:15:27 +05:30
Zihong Zheng
6d35b94fc3 Add kube-proxy daemonset track to GCE startup scripts (GCI, Debian and CoreOS). 2017-08-28 13:31:07 -07:00
Kubernetes Submit Queue
16a438b56e Merge pull request #50063 from dixudx/manifests_use_hostpath_type
Automatic merge from submit-queue (batch tested with PRs 51038, 50063, 51257, 47171, 51143)

update related manifest files to use hostpath type

**What this PR does / why we need it**:
Per [discussion in #46597](https://github.com/kubernetes/kubernetes/pull/46597#pullrequestreview-53568947)

Dependes on #46597

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

Fixes: https://github.com/kubernetes/kubeadm/issues/298

**Special notes for your reviewer**:
/cc @euank @thockin @tallclair @Random-Liu 

**Release note**:

```release-note
None
```
2017-08-25 12:31:02 -07:00
Di Xu
7c72594c85 update related files 2017-08-24 17:49:18 +08:00
Kubernetes Submit Queue
8bfde3a03f Merge pull request #51160 from yujuhong/alpha-feature-env
Automatic merge from submit-queue (batch tested with PRs 51108, 51035, 50539, 51160, 50947)

Set GCE_ALPHA_FEATURES environment variable in gce.conf

This allows us to gate alpha features in the pkg/cloudprovider/providers/gce.
2017-08-24 02:32:11 -07:00
Yu-Ju Hong
ab07115ff2 Set GCE_ALPHA_FEATURES environment variable in gce.conf 2017-08-22 17:17:56 -07:00
Marian Lobur
d48e2d338d Add flags for prometheus-to-sd components.
Configure prometheus-to-sd-endpoint and prometheus-to-sd-prefix base on
the environment.
2017-08-22 08:30:08 +02:00
Michael Taufen
102e4ee9e6 Fix duplicate field in kubeconfig
The server field was accidentally duplicated during a rebase of #40050.
2017-08-18 16:16:20 -07:00
Kubernetes Submit Queue
a755d3e577 Merge pull request #50386 from crassirostris/change-audit-policy
Automatic merge from submit-queue (batch tested with PRs 50386, 50374, 50444, 50382)

Add explicit API kind and version to the audit policy file on GCE

Adds an explicit API version and kind to the audit policy file in GCE configuration scripts. It's a prerequisite for https://github.com/kubernetes/kubernetes/pull/49115

/cc @tallclair @piosz
2017-08-10 05:33:54 -07:00
Kubernetes Submit Queue
4e1d1dedab Merge pull request #50372 from x13n/fluentd
Automatic merge from submit-queue (batch tested with PRs 50300, 50328, 50368, 50370, 50372)

Bugfix: set resources only for fluentd-gcp container.

There is more than one container in fluentd-gcp deployment. Previous
implementation was setting resources for all containers, not just
the fluent-gcp one.

**What this PR does / why we need it**:

Bugfix; https://github.com/kubernetes/kubernetes/pull/49009 without this is eating more resources.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #50366

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```
2017-08-09 22:58:30 -07:00
Mik Vyatskov
782d87c405 Add explicit API kind and version to the audit policy file on GCE 2017-08-09 19:14:41 +02:00
Daniel Kłobuszewski
b7935b9699 Bugfix: set resources only for fluentd-gcp container.
There is more than one container in fluentd-gcp deployment. Previous
implementation was setting resources for multiple containers, not just
the fluent-gcp one.
2017-08-09 15:44:06 +02:00
Marcin Wielgus
d0bedba9e1 Ensure that pricing expander is used by default in Cluster Autoscaler 2017-08-08 20:52:07 +02:00
Daniel Kłobuszewski
b48b1b80bc Enable overriding fluentd resources in GCP 2017-08-03 11:58:43 +02:00
Kubernetes Submit Queue
968ebc6603 Merge pull request #49649 from shiliangxue/master
Automatic merge from submit-queue (batch tested with PRs 49989, 49806, 49649, 49412, 49512)

Use existing k8s binaries and images on disk when they are preloaded to gce cos image.

**What this PR does / why we need it**:
This change is to accelerate K8S startup time on gce when k8s tarballs and images are already preloaded in VM image, by skipping the downloading, extracting and file transfer steps.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```
2017-08-02 17:06:00 -07:00
Kubernetes Submit Queue
a2f2a220c5 Merge pull request #49953 from gmarek/logrotate
Automatic merge from submit-queue

Allow configuration of logrorate in GCE

Fix #49941
2017-08-02 07:53:15 -07:00
Kubernetes Submit Queue
49955b1594 Merge pull request #49897 from mikedanese/atomic-append
Automatic merge from submit-queue (batch tested with PRs 49898, 49897, 49919, 48860, 49491)

gce: make append_or_replace.. atomic

Before this change,
* the final echo is not atomically written to the target file
* two concurrent callers will use the same tempfile

Helps with https://github.com/kubernetes/kubernetes/issues/49895

cc @miekg
2017-08-01 17:57:14 -07:00
gmarek
54f43f5f56 Allow configuration of logrorate in GCE 2017-08-01 17:07:44 +02:00
Mike Danese
a120906756 gce: extend CLOBBER_CONFIG to support known_tokens.csv 2017-07-31 13:39:18 -07:00
Mike Danese
1c2feb02fa gce: make append_or_replace.. atomic
Before this change,
* the final echo is not atomically written to the target file
* two concurrent callers will use the same tempfile
2017-07-31 13:14:51 -07:00
shiliang
994275aa55 skip downloading and extracting tarballs and docker images when they are preloaded. 2017-07-25 15:40:03 -07:00
Michael Taufen
38aee0464d Providing kubeconfig file is now the switch for standalone mode
Replaces use of --api-servers with --kubeconfig in Kubelet args across
the turnup scripts. In many cases this involves generating a kubeconfig
file for the Kubelet and placing it in the correct location on the node.
2017-07-24 11:03:00 -07:00
Ajit Kumar
f45cc00440 Use custom port for node-problem-detector 2017-07-20 11:25:44 -07:00
Kubernetes Submit Queue
c5b47482ae Merge pull request #49121 from mikedanese/remove-kubelet-bearer-token
Automatic merge from submit-queue (batch tested with PRs 47509, 46821, 45319, 49121, 49125)

gce: don't add kubelet bearer token to known tokens
2017-07-19 16:16:31 -07:00
Mike Danese
9ee240dfcf aggr: don't write empty CA files
write now if the metadata is not supplied, we write an empty file for
these certs. we should just fail
2017-07-18 14:40:24 -07:00
Mike Danese
65cc002877 gce: don't add kubelet bearer token to known tokens
since it is no longer used after kubelet TLS bootstrap.
2017-07-18 08:52:08 -07:00
gmarek
afe1a2c71b Revert "Merge pull request #48560 from nicksardo/gce-network-project"
This reverts commit d4881dd491, reversing
changes made to b5c4346130.
2017-07-13 18:34:24 +02:00
Kubernetes Submit Queue
7001b9d9d1 Merge pull request #48425 from kawych/master
Automatic merge from submit-queue

Pass cluster name to Heapster with Stackdriver sink.

**What this PR does / why we need it**:
Passes cluster name as argument to Heapster when it's used with Stackdriver sink to allow setting resource label 'cluster_name' in exported metrics.

**Release note**:
```release-note
NONE
```
2017-07-12 10:51:09 -07:00
Nick Sardo
ebce7d2497 Allow missing NETWORK_PROJECT_ID env var 2017-07-10 14:26:47 -07:00
Nick Sardo
06e328627c Use network project id for firewall/route mgmt and zone listing 2017-07-06 16:58:27 -07:00
Wojciech Tyczynski
37b5a214bc Add ability to enable patch conversion detector 2017-07-04 14:33:24 +02:00
Karol Wychowaniec
ca5581edcc Pass cluster name to Heapster with Stackdriver sink. 2017-07-03 11:55:57 +02:00
Kubernetes Submit Queue
c0337c92cc Merge pull request #47881 from cadmuxe/endpoint
Automatic merge from submit-queue (batch tested with PRs 47918, 47964, 48151, 47881, 48299)

Add ApiEndpoint support to GCE config.

**What this PR does / why we need it**:
Add the ability to change ApiEndpoint  for GCE.

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:
```release-note
None
```
2017-06-30 18:42:40 -07:00
Kubernetes Submit Queue
87c6fb5de2 Merge pull request #42376 from jingxu97/Feb/mounter
Automatic merge from submit-queue (batch tested with PRs 43558, 48261, 42376, 46803, 47058)

Add bind mount /etc/resolv.conf from host to containerized mounter

Currently, in containerized mounter rootfs, there is no DNS setup. If client
try to set up volume with host name instead of IP address, it will fail to resolve
the host name. 
By bind mount the host's /etc/resolv.conf to mounter rootfs, VM hosts name
could be resolved when using host name during mount. 

```release-note
Fixes issue where you could not mount NFS or glusterFS volumes using hostnames on GCI/GKE with COS images.
```
2017-06-30 16:28:46 -07:00
Koonwah Chen
c4e84e263c Change KUBE_GCE_API_ENDPOINT to GCE_API_ENDPOINT 2017-06-29 10:04:53 -07:00
Koonwah Chen
b3956a689e Add KUBE_GCE_API_ENDPOINT for GCE API endpoint config. 2017-06-28 16:03:18 -07:00
Kubernetes Submit Queue
63d4af44ac Merge pull request #48004 from dnardo/gke
Automatic merge from submit-queue (batch tested with PRs 48004, 48205, 48130, 48207)

Do not set CNI in cases where there is a private master and network policy provider is set.

**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
In GCE and in a "private master" setup, do not set the network-plugin provider to CNI by default if a network policy provider is given.
```
2017-06-28 10:35:10 -07:00
Kubernetes Submit Queue
0dad2d0803 Merge pull request #47983 from yguo0905/memcg
Automatic merge from submit-queue (batch tested with PRs 48092, 47894, 47983)

Enables memcg notification in cluster/node e2e tests

Ref: https://github.com/kubernetes/kubernetes/issues/42676

This PR sets Kubelet flag `--experimental-kernel-memcg-notification=true` when running cluster/node e2e tests on COS and Ubuntu images.

Tested:
```
e2e-node-cos:
I0623 00:09:06.641776    1080 server.go:147] Starting server "kubelet" with command "/usr/bin/systemd-run --unit=kubelet-777178888.service --slice=runtime.slice --remain-after-exit /tmp/node-e2e-20170622T170739/kubelet --kubelet-cgroups=/kubelet.slice --cgroup-root=/ --api-servers http://localhost:8080 --address 0.0.0.0 --port 10250 --read-only-port 10255 --volume-stats-agg-period 10s --allow-privileged true --serialize-image-pulls false --pod-manifest-path /tmp/node-e2e-20170622T170739/pod-manifest571288056 --file-check-frequency 10s --pod-cidr 10.100.0.0/24 --eviction-pressure-transition-period 30s --feature-gates  --eviction-hard memory.available<250Mi,nodefs.available<10%%,nodefs.inodesFree<5%% --eviction-minimum-reclaim nodefs.available=5%%,nodefs.inodesFree=5%% --v 4 --logtostderr --network-plugin=kubenet --cni-bin-dir /tmp/node-e2e-20170622T170739/cni/bin --cni-conf-dir /tmp/node-e2e-20170622T170739/cni/net.d --hostname-override tmp-node-e2e-bfe5799d-cos-stable-59-9460-64-0 --experimental-mounter-path=/tmp/node-e2e-20170622T170739/cluster/gce/gci/mounter/mounter --experimental-kernel-memcg-notification=true"

e2e-node-ubuntu:
I0623 00:03:28.526984    2279 server.go:147] Starting server "kubelet" with command "/usr/bin/systemd-run --unit=kubelet-1407651753.service --slice=runtime.slice --remain-after-exit /tmp/node-e2e-20170622T170203/kubelet --kubelet-cgroups=/kubelet.slice --cgroup-root=/ --api-servers http://localhost:8080 --address 0.0.0.0 --port 10250 --read-only-port 10255 --volume-stats-agg-period 10s --allow-privileged true --serialize-image-pulls false --pod-manifest-path /tmp/node-e2e-20170622T170203/pod-manifest083943734 --file-check-frequency 10s --pod-cidr 10.100.0.0/24 --eviction-pressure-transition-period 30s --feature-gates  --eviction-hard memory.available<250Mi,nodefs.available<10%%,nodefs.inodesFree<5%% --eviction-minimum-reclaim nodefs.available=5%%,nodefs.inodesFree=5%% --v 4 --logtostderr --network-plugin=kubenet --cni-bin-dir /tmp/node-e2e-20170622T170203/cni/bin --cni-conf-dir /tmp/node-e2e-20170622T170203/cni/net.d --hostname-override tmp-node-e2e-e48cdd73-ubuntu-gke-1604-xenial-v20170420-1 --experimental-kernel-memcg-notification=true"

e2e-node-containervm:
I0623 00:14:35.392383    2774 server.go:147] Starting server "kubelet" with command "/tmp/node-e2e-20170622T171318/kubelet --runtime-cgroups=/docker-daemon --kubelet-cgroups=/kubelet --cgroup-root=/ --system-cgroups=/system --api-servers http://localhost:8080 --address 0.0.0.0 --port 10250 --read-only-port 10255 --volume-stats-agg-period 10s --allow-privileged true --serialize-image-pulls false --pod-manifest-path /tmp/node-e2e-20170622T171318/pod-manifest507536807 --file-check-frequency 10s --pod-cidr 10.100.0.0/24 --eviction-pressure-transition-period 30s --feature-gates  --eviction-hard memory.available<250Mi,nodefs.available<10%,nodefs.inodesFree<5% --eviction-minimum-reclaim nodefs.available=5%,nodefs.inodesFree=5% --v 4 --logtostderr --network-plugin=kubenet --cni-bin-dir /tmp/node-e2e-20170622T171318/cni/bin --cni-conf-dir /tmp/node-e2e-20170622T171318/cni/net.d --hostname-override tmp-node-e2e-9e3fdd7c-e2e-node-containervm-v20161208-image"

e2e-cos:
Jun 23 17:54:38 e2e-test-ygg-minion-group-t5r0 kubelet[2005]: I0623 17:54:38.646374    2005 flags.go:52] FLAG: --experimental-kernel-memcg-notification="true"

e2e-ubuntu:
Jun 23 18:25:27 e2e-test-ygg-minion-group-19qp kubelet[1547]: I0623 18:25:27.722253    1547 flags.go:52] FLAG: --experimental-kernel-memcg-notification="true"

e2e-containervm:
I0623 18:55:51.886632    3385 flags.go:52] FLAG: --experimental-kernel-memcg-notification="false"
```

**Release note**:
```
None
```

/sig node
/area node-e2e
/assign @dchen1107 @dashpole
2017-06-26 21:08:10 -07:00
Yang Guo
50d49d9c51 Enables memcg notification in cluster/node e2e tests 2017-06-26 11:40:22 -07:00
Kubernetes Submit Queue
14edc46c2e Merge pull request #47892 from ajitak/npd-config
Automatic merge from submit-queue (batch tested with PRs 47993, 47892, 47591, 47469, 47845)

Bump up npd version to v0.4.1

```
Bump up npd version to v0.4.1
```

Fixes #47219
2017-06-23 18:05:46 -07:00
Kubernetes Submit Queue
de86a83535 Merge pull request #47993 from dnardo/ip-masq-agent
Automatic merge from submit-queue (batch tested with PRs 47993, 47892, 47591, 47469, 47845)

Use a different env var to enable the ip-masq-agent addon.

We shouldn't mix setting the non-masq-cidr with enabling the addon.



**What this PR does / why we need it**:

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
```

https://github.com/kubernetes/kubernetes/issues/47865
2017-06-23 18:05:44 -07:00
Daniel Nardo
00b62df554 Do not set CNI on a private master when enabling network policy. 2017-06-23 17:07:56 -07:00
Daniel Nardo
c75de4e39f Use a different env var to enable the ip-masq-agent addon.
We shouldn't mix setting the non-masq-cidr with enabling the addon.
2017-06-23 14:47:49 -07:00
Tim St. Clair
ed8ea24f65
Strip versions from known api groups in audit policy 2017-06-23 11:55:45 -07:00
Tim St. Clair
dcdcb19c47
Don't audit log tokens in TokenReviews 2017-06-22 13:38:44 -07:00
Ajit Kumar
caff16c678 Bump up npd version to v0.4.1 2017-06-22 13:13:50 -07:00
Kubernetes Submit Queue
26c431affa Merge pull request #47632 from mwielgus/node-taints-scripts
Automatic merge from submit-queue (batch tested with PRs 45268, 47573, 47632, 47818)

NODE_TAINTS in gce startup scripts

Currently there is now way to pass a list of taints that should be added on node registration (at least not in gce or other saltbased deployment). This PR adds necessary plumbing to pass the taints from user or instance group template to kubelet startup flags. 

```release-note
Taints support in gce/salt startup scripts. 
```

The PR was manually tested. 
```
NODE_TAINTS: 'dedicated=ml:NoSchedule'
```
in kube-env results in 
```
spec:
[...]
  taints:
  - effect: NoSchedule
    key: dedicated
    timeAdded: null
    value: ml
```

cc: @davidopp @gmarek @dchen1107 @MaciekPytel
2017-06-20 18:18:59 -07:00
Kubernetes Submit Queue
d746cbbb39 Merge pull request #47634 from mwielgus/expander-price
Automatic merge from submit-queue (batch tested with PRs 46604, 47634)

Set price expander in Cluster Autoscaler for GCE

With CA 0.6 we will make price-preferred node expander the default one for GCE. For other cloud providers we will stick to the default one (random) until the community implement the required interfaces in CA repo.

https://github.com/kubernetes/autoscaler/issues/82

cc: @MaciekPytel @aleksandra-malinowska
2017-06-20 03:15:57 -07:00