Commit Graph

417 Commits

Author SHA1 Message Date
Abdullah Gharaibeh
8a1c70b48c Graduate PodAffinityNamespaceSelector to GA 2022-02-18 12:07:29 -05:00
Tim Allclair
5f2b12e0d4 Move AppArmor profile validation to the API validation pkg 2022-02-15 16:17:37 -08:00
Davanum Srinivas
9682b7248f
OWNERS cleanup - Jan 2021 Week 1
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2022-01-10 08:14:29 -05:00
Kubernetes Prow Robot
a7905d76c7
Merge pull request #106397 from shawnhanx/core_validation
fix S1017 and S1002 in pkg/apis/core/validation/validation.go
2022-01-04 23:02:58 -08:00
Andrew Sy Kim
5d2702b0fd core/v1: add comments about why Service internalTrafficPolicy is not forbidden when type is ExternalName
Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>
2022-01-04 14:36:19 -05:00
Andrew Sy Kim
99cb5d2f21 core/v1: add unit tests that allow internalTrafficPolicy field when type is ExternalName
Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>
2022-01-04 14:36:19 -05:00
Andrew Sy Kim
60b38ee180 core/v1: add validation and defaulting unit tests for when internalTrafficPolicy is nil and Service type is ExternalName
Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>
2022-01-04 14:36:19 -05:00
Andrew Sy Kim
3a927cc6b3 core/v1: stop defaulting Service internalTrafficPolicy when Type=ExternalName
Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>
2022-01-04 14:36:19 -05:00
lsytj0413
c6bd8d6713 fix(*): display the diff as new-old 2021-12-21 14:00:57 +08:00
Lars Ekman
1ef96752da Mark ServiceLBNodePortControl as GA 2021-12-16 16:48:58 +01:00
Davanum Srinivas
497e9c1971
Cleanup OWNERS files (No Activity in the last year)
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2021-12-15 10:34:02 -05:00
Davanum Srinivas
9405e9b55e
Check in OWNERS modified by update-yamlfmt.sh
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2021-12-09 21:31:26 -05:00
Kubernetes Prow Robot
a90f31f85a
Merge pull request #106179 from vivek-koppuru/fix-secret-format
Fix string output format for secret validations
2021-12-07 17:26:10 -08:00
Sergey Kanzhelev
1918ecad04 update the grpc field name for consistency 2021-12-01 18:16:08 +00:00
Sergey Kanzhelev
b7affcced1 implement :grpc probe action 2021-11-17 17:31:23 +00:00
Hemant Kumar
63fffd37b1 Implement API changes necessary for recovery from resize failure 2021-11-15 18:39:30 -05:00
shawnhanx
063e64c4ec fix S1017 and S1002 in pkg/apis/core/validation/validation.go 2021-11-13 17:02:40 +08:00
Kubernetes Prow Robot
5d60c8d857
Merge pull request #102393 from mengjiao-liu/fix-sysctl-regex
Upgrade preparation to verify sysctl values containing forward slashes by regex
2021-11-09 18:23:26 -08:00
Vivek Koppuru
de680aec08 Fix string output format for secret validations 2021-11-05 18:29:48 +05:30
Mengjiao Liu
275d832ce2 Upgrade preparation to verify sysctl values containing forward slashes by regex 2021-11-04 11:49:56 +08:00
Tim Hockin
11a25bfeb6
De-share the Handler struct in core API (#105979)
* De-share the Handler struct in core API

An upcoming PR adds a handler that only applies on one of these paths.
Having fields that don't work seems bad.

This never should have been shared.  Lifecycle hooks are like a "write"
while probes are more like a "read". HTTPGet and TCPSocket don't really
make sense as lifecycle hooks (but I can't take that back). When we add
gRPC, it is EXPLICITLY a health check (defined by gRPC) not an arbitrary
RPC - so a probe makes sense but a hook does not.

In the future I can also see adding lifecycle hooks that don't make
sense as probes.  E.g. 'sleep' is a common lifecycle request. The only
option is `exec`, which requires having a sleep binary in your image.

* Run update scripts
2021-10-29 13:15:11 -07:00
ravisantoshgudimetla
d7d0beb65f api: Handle validation of PodOS field presence 2021-10-28 17:31:52 -04:00
Kubernetes Prow Robot
7fbb384e15
Merge pull request #105682 from pohly/generic-ephemeral-volume-raw-block
storage validation: accept generic ephemeral volumes as volume device
2021-10-22 18:04:50 -07:00
Kubernetes Prow Robot
18104ecf1f
Merge pull request #105405 from verb/1.23-ec-beta
Promote EphemeralContainers to beta
2021-10-20 09:24:10 -07:00
Lee Verberne
d33bbb8940 Allow volumeDevices in ephemeral containers 2021-10-19 23:04:05 -04:00
Lee Verberne
d874cf8ffd List disallowed ephemeral container fields
Listing these explicitly makes it easier to determine whether a new
Container field has been evaluated for use with ephemeral containers.
This does not change the behavior of ephemeral containers.
2021-10-19 23:03:57 -04:00
Lee Verberne
f81c48cd0a Disallow subpath for ephemeral container mounts 2021-10-19 23:01:15 -04:00
Lee Verberne
764859081a Validate ephemeralContainerStatuses during update 2021-10-19 23:00:51 -04:00
Patrick Ohly
a40d2eb18c storage validation: accept generic ephemeral volumes as volume device
Raw block devices are possible with generic ephemeral volumes, so rejecting a
pod with that combination is wrong.
2021-10-19 13:30:32 +02:00
Mark Rossetti
3ddff55fe6 Adding unit test coverage for API validation for emphermal contaienrs in hostprocess pods on Windows
Signed-off-by: Mark Rossetti <marosset@microsoft.com>
2021-10-18 15:46:27 -07:00
Lee Verberne
8b24dc07ff Test ephemeral container/pod conflicting fields
This adds a test case to cover the scenario where the fields of an
ephemeral container conflict with other fields in the pod and must be
detected by full PodSpec validation.
2021-09-30 21:47:19 +02:00
Lee Verberne
4451138bfa Validate PodSpec in EphemeralContainersUpdate
Previously this only validated the ephemeral containers, but it's safer
to validate the entire PodSpec in case other parts of validation add
logic that checks ephemeral containers.
2021-09-27 22:58:08 +02:00
Khaled Henidak (Kal)
a53e2eaeab
move IPv6DualStack feature to stable. (#104691)
* kube-proxy

* endpoints controller

* app: kube-controller-manager

* app: cloud-controller-manager

* kubelet

* app: api-server

* node utils + registry/strategy

* api: validation (comment removal)

* api:pod strategy (util pkg)

* api: docs

* core: integration testing

* kubeadm: change feature gate to GA

* service registry and rest stack

* move feature to GA

* generated
2021-09-24 16:30:22 -07:00
saad-ali
beb17fe10b Remove VolumeSubpath feature gate
Remove the VolumeSubpath feature gate.

Feature gate convention has been updated since this was introduced to
indicate that they "are intended to be deprecated and removed after a
feature becomes GA or is dropped.".
2021-09-17 01:59:23 -07:00
h4ghhh
0734820279
'New' Event namespace validate failed (#100125) 2021-09-16 04:29:45 -07:00
Tim Hockin
650f8cfd35 Svc REST: Validate input before IP allocation
This commit started as removing FIXME comments, but in doing so I
realized that the IP allocation process was using unvalidated user
input.  Before de-layering, validation was called twice - once before
init and once after, which the init code depended on.

Fortunately (or not?) we had duplicative checks that caught errors but
with less friendly messages.

This commit calls validation before initializing the rest of the
IP-related fields.

This also re-organizes that code a bit, cleans up error messages and
comments, and adds a test SPECIFICALLY for the errors in those cases.
2021-09-11 11:30:01 -07:00
Tim Hockin
8bcba526b6 Svc REST: Better errors on stack-downgrades
Converting dual-stack to single-stack needs good errors.
2021-09-11 11:30:01 -07:00
Tim Hockin
f4521aa75a Fix validation on ETP: "" is not valid
This was causing tests to pass which ought not be passing.  This is not
an API change because we default the value of it when needed.  So we
would never see this in the wild, but it makes the tests sloppy.
2021-09-11 11:30:01 -07:00
Tim Hockin
ccf3376570 Svc REST: De-layer Update
This is the last layered method.  All allocator logic is moved to the
beginUpdate() path.  Removing the now-useless layer will happen in a
subsequent commit.
2021-09-11 11:30:00 -07:00
Tim Hockin
14d0571a5f Svc REST: Don't call validation directly
The validation is called soon after anyway.
2021-09-11 10:49:13 -07:00
Antonio Ojea
0cd75e8fec run hack/update-netparse-cve.sh 2021-08-20 10:42:09 +02:00
Kubernetes Prow Robot
e375563732
Merge pull request #103245 from wzshiming/fix/prober-termination
Add validation for Prober TerminationGracePeriodSeconds
2021-07-13 09:30:30 -07:00
Kubernetes Prow Robot
e799d7b191
Merge pull request #99023 from verb/1.21-securitycontext
Allow setting securityContext in ephemeral containers
2021-07-09 20:50:46 -07:00
Shiming Zhang
513bd93f76 update test for feature gate 2021-07-09 10:37:38 +08:00
Kubernetes Prow Robot
36a7426aa5
Merge pull request #99144 from bart0sh/PR0094-promote-HugePageStorageMediumSize-to-GA
promote huge page storage medium size to GA
2021-07-07 18:09:05 -07:00
Kubernetes Prow Robot
eaba61b4de
Merge pull request #103276 from NetApp/data-source-ref
Add DataSourceRef field to PVC spec
2021-07-07 08:56:44 -07:00
Shiming Zhang
d8fe255f41 Add test for validateProbe 2021-07-07 11:31:23 +08:00
Shiming Zhang
e378600c90 Add validation for Prober TerminationGracePeriodSeconds 2021-07-07 10:51:30 +08:00
Ben Swartzlander
00dba76918 Add DataSourceRef field to PVC spec
Modify the behavior of the AnyVolumeDataSource alpha feature gate to enable
a new field, DataSourceRef, rather than modifying the behavior of the
existing DataSource field. This allows addition Volume Populators in a way
that doesn't risk breaking backwards compatibility, although it will
result in eventually deprecating the DataSource field.
2021-07-06 21:17:41 -04:00
Andrew Sy Kim
28f3f36505
Promote the ServiceInternalTrafficPolicy field to Beta and on by default (#103462)
* pkg/features: promote the ServiceInternalTrafficPolicy field to Beta and on by default

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>

* pkg/api/service/testing: update Service test fixture functions to set internalTrafficPolicy=Cluster by default

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>

* pkg/apis/core/validation: add more Service validation tests for internalTrafficPolicy

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>

* pkg/registry/core/service/storage: fix failing Service REST storage tests to use internalTrafficPolicy: Cluster

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>

* pkg/registry/core/service/storage: add two test cases for Service REST TestServiceRegistryInternalTrafficPolicyClusterThenLocal and TestServiceRegistryInternalTrafficPolicyLocalThenCluster

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>

* pkg/registry/core/service: update strategy unit tests to expect default
internalTrafficPolicy=Cluster

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>

* pkg/proxy/ipvs: fix unit test Test_EndpointSliceReadyAndTerminatingLocal to use internalTrafficPolicy=Cluster

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>

* pkg/apis/core: update fuzzers to set Service internalTrafficPolicy field

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>

* pkg/api/service/testing: refactor Service test fixtures to use Tweak funcs

Signed-off-by: Andrew Sy Kim <kim.andrewsy@gmail.com>
2021-07-06 06:16:30 -07:00