Commit Graph

48 Commits

Author SHA1 Message Date
Ben Luddy ca9c3d965e Add CBOR feature gates.
For alpha, there is one apiserver feature gate and two client-go feature gates controlling
CBOR. They were initially wired to separate test-only feature gate instances in order to prevent
them from being configurable at runtime via command-line flags or environment variables (for
client-go feature gates outside of Kubernetes components). All of the integration tests required by
the KEP as alpha criteria have been implemented. This adds the feature gates to the usual feature
gate instances and removes the temporary code to support separate test-only feature gate instances.

Kubernetes-commit: 072dfcb416fd4e1ddab0a89ac4faf519e268bc96
2024-11-04 10:40:19 -05:00
Kubernetes Prow Robot 4bece4d457 Merge pull request #128196 from richabanker/move-version
Move k8s.io/apiserver/pkg/util/version to component-base

Kubernetes-commit: 119f114f012ae6d1cd851bdb2c3f849307e83258
2024-10-29 18:49:35 +00:00
Ben Luddy f27bb5491e Wire test-only feature gate for CBOR serving.
To mitigate the risk of introducing a new protocol, integration tests for CBOR will be written using
a test-only feature gate instance that is not wired to runtime options. On alpha graduation, the
test-only feature gate instance will be replaced by a normal feature gate in the existing apiserver
feature gate instance.

Kubernetes-commit: 0cad1a89b6721308746cc1a12f12de31a259a0d3
2024-10-23 16:36:25 -04:00
Lukasz Szaszkiewicz 3257d91a56 server/config: assing system:apiserver user to system:authenticated group
Kubernetes-commit: dfeb560d4a2294c7a9a6233e2acb6b27039ed37a
2024-10-07 17:39:10 +02:00
Siyuan Zhang b26fefe178 add DefaultComponentGlobalsRegistry flags in ServerRunOptions
Signed-off-by: Siyuan Zhang <sizhang@google.com>

Kubernetes-commit: 379676c4bef48e5d2add28851302b55b41fcabcf
2024-06-10 17:50:22 +00:00
Siyuan Zhang 00857ca9ec Add version mapping in ComponentGlobalsRegistry.
Signed-off-by: Siyuan Zhang <sizhang@google.com>

Kubernetes-commit: 4352c4ad2762ce49ce30e62381f8ceb24723fbcc
2024-05-31 20:29:48 -07:00
Patrick Ohly 5ea67c789a apiserver + controllers: enhance context support
27a68aee3a4834 introduced context support for events. Creating an event
broadcaster with context makes tests more resilient against leaking goroutines
when that context gets canceled at the end of a test and enables per-test
output via ktesting.

The context could get passed to the constructor. A cleaner solution is to
enhance context support for the apiserver and then pass the context into the
controller's run method. This ripples up the call stack to all places which
start an apiserver.

Kubernetes-commit: b92273a760503cc57aba37c4d3a28554f7fec7f8
2023-12-01 09:00:59 +01:00
Ben Luddy 91d0f39545 Restrict supported media types for new apiservers.
This is to prevent the enablement of new data formats (CBOR) in the early stages of phased
implementation.

Kubernetes-commit: ced56a6adabdd86f99455b100b1c0c7a2b4f3c55
2023-10-17 14:06:46 -04:00
Stephen Kitt 7fb4ad7511 api-machinery: stop using deprecated io/ioutil
This replaces deprecated ioutil functions as follows:

* ioutil.ReadAll -> io.ReadAll
* ioutil.ReadFile -> os.ReadFile
* ioutil.TempDir -> os.MkdirTemp
* ioutil.TempFile -> os.CreateTemp
* ioutil.WriteFile -> os.WriteFile

Signed-off-by: Stephen Kitt <skitt@redhat.com>

Kubernetes-commit: b60a3a58df2791ae67764f6325be31aea5eca5a0
2023-05-02 15:08:18 +02:00
Tim Allclair 2a8bc69060 Initialize the AuditEvent with the AuditContext (#113611)
* Initialize the AuditEvent with the AuditContext

* Squash: Address PR feedback

* Squash: address PR feedback

Kubernetes-commit: 2b03f04ce589a57cf80b2153c7e5056c53c374d3
2023-07-03 18:28:13 +00:00
Richa Banker 6bb270e406 Enable ComponentSLIs as beta feature
Kubernetes-commit: 452343367c21c68f325078357c5dfe794169422c
2023-01-09 17:25:50 -08:00
Abu Kashem 9e60654b8a apiserver: refactor WithWaitGroup handler
Kubernetes-commit: 9093f126b87cb686784bb27b08be9eb12b4d5453
2023-01-10 15:55:19 -05:00
David Ashpole 0cf3af5b9f add otel tracing to latency filters
Kubernetes-commit: ed1610ad15f91b72017c5d69dc4f7d59a17c270f
2022-10-20 16:17:02 +00:00
Tim Allclair bd7c7f52c2 Consolidate AuditContext
Kubernetes-commit: f1d684b7b60b39b7dc1eb4156307c593f0ba74e1
2022-07-12 11:53:57 -07:00
Han Kang a26df69931 wire up feature-gate for component slis
Change-Id: Iba6ffbcac9dba4f4be3023ada6ac31691c1ae17b

Kubernetes-commit: 01bfbdff2dee3be93d286a8ff53f9e52a1ee9724
2022-10-05 15:56:06 -07:00
Han Kang 7ede3563fe enable health check SLI metrics for apiserver
Change-Id: I1b43e6dfea35b8c3bfdf5daaa8b42adff2fbc786

Kubernetes-commit: db13f51db97c114bb550b99efddd985548edc082
2022-09-26 16:10:58 -07:00
Wojciech Tyczyński f5d65d90e9 Avoid leaking StorageObjectCountTracker goroutine
Kubernetes-commit: 564b376812836fb1e77452d478ab16eee5101447
2022-05-15 09:57:26 +02:00
Tim Allclair 1e36b0a9fb Don't add audit annotations directly to the audit event
Kubernetes-commit: bdebc62d49293a0fbbd7e0d95bfd94b1ce21015c
2022-03-28 11:38:38 -07:00
Abu Kashem 1b651c5994 add latency tracker for storage and transform
Kubernetes-commit: eca90856940e9251ecf3fde95c5e4d2d16f5ad68
2022-02-01 18:13:03 -05:00
Lukasz Szaszkiewicz 5c13ee7dbf genericapiserver: indroduce muxCompleteSignals for holding signals that indicate all known HTTP paths have been registered
the new field exists primarily to avoid returning a 404 response when a resource actually exists but we haven't installed the path to a handler.
it is exposed for easier composition of the individual servers.
the primary users of this field are the WithMuxCompleteProtection filter and the NotFoundHandler.

Kubernetes-commit: ddfbb5d2bb57ee44b3e10f0b58f9cc7001f55802
2021-10-15 18:14:20 +02:00
Abu Kashem d53acfe201 apiserver: store (event, evaluated policy) pair in request context
Kubernetes-commit: 8be823b0b0270e1b979b3d4c6e683e1daa0f2e01
2021-09-20 17:43:16 -04:00
Abu Kashem 033ff70436 Revert "Merge pull request #104281 from tkashem/not-ready-429"
This reverts commit fc5863b8b276e0789f717859e8cce58d7d060181, reversing
changes made to 027fe2554fd18343b8be39eddc8ff6570a6c390f.

Kubernetes-commit: f9f08725907b7db2104ee5fe9f82ab0752726533
2021-08-31 10:10:46 -04:00
Antonio Ojea 38c6ad936b run hack/update-netparse-cve.sh
Kubernetes-commit: 0cd75e8fec62a2531637e80bb950ac9983cac1b0
2021-08-20 01:16:14 +02:00
Abu Kashem 450b7e8f12 rename audit Checker interface
Kubernetes-commit: 27f150351475adaef416bd893403e7066b70d33a
2021-03-24 13:07:21 -04:00
Abu Kashem f3ae70d0cf send retry-after until ready
Kubernetes-commit: 6e3923d0a4f4720d2d9f628eb9c073d2d3ee291a
2021-08-10 12:03:21 -04:00
pacoxu e11aa23b6b wait for poststarthook/max-in-flight-filter to be initialized asynchronously
Signed-off-by: pacoxu <paco.xu@daocloud.io>

Kubernetes-commit: 3c4eb55b4acd4bc4740b15a58fc7da0d5b516300
2021-05-07 15:17:03 +08:00
staebler a541a1b602 do not allow inflight watermark histograms to fall too far behind
The MaxInFlight and PriorityAndFairness apiserver filters maintain
watermarks with histogram metrics that are observed when requests
are handled. When a request is received, the watermark observer
needs to fill out observations for the entire time period since the
last request was received. If it has been a long time since a
request has been received, then it can take an inordinate amount of
time to fill out the observations, to the extent that the request
may time out. To combat this, these changes will have the filters
fill out the observations on a 10-second interval, so that the
observations never fall too far behind.

This follows a similar approach taken in
9e89b92a92c02cdd2c70c0f52a30936e9c3309c7.

https://github.com/kubernetes/kubernetes/issues/95300

The Priority-and-Fairness and Max-in-Flight filters start goroutines to
handle some maintenance tasks on the watermarks for those filters. Once
started, these goroutines run forever. Instead, the goroutines should
have a lifetime tied to the lifetime of the apiserver.

These changes move the functionality for starting the goroutines to
a PostStartHook. The goroutines have been changed to accept a stop channel
and only run until the stop channel is closed.

Kubernetes-commit: 6c9b86646871f13a4431361310ba6a0785372053
2020-10-05 11:26:48 -04:00
Maciej Borsz ea82586fc5 Wait for all informers to sync in /readyz.
Kubernetes-commit: 3f680002038c81b02541e4cc4bd7c019b7e7d6e6
2020-06-18 15:21:12 +02:00
Monis Khan 1873d19869 Allow handlers early in the request chain to set audit annotations
This change adds the generic ability for request handlers that run
before WithAudit to set annotations in the audit.Event.Annotations
map.

Note that this change does not use this capability yet. Determining
which handlers should set audit annotations and what keys and values
should be used requires further discussion (this data will become
part of our public API).

Signed-off-by: Monis Khan <mok@vmware.com>

Kubernetes-commit: 0bc62112adf270ef4efada37286319c229324c7b
2020-03-19 20:02:37 -04:00
Han Kang 050d1b223c add /livez as a liveness endpoint for kube-apiserver
go fmt

make func private

refactor config_test

Two primary refactorings:

1. config test checkPath method is now each a distinct test
run (which makes it easier to see what is actually failing)

2. TestNewWithDelegate's root path check now parses the json output and
does a comparison against a list of expected paths (no more whitespace
and ordering issues when updating this test, yay).

go fmt

modify and simplify existing integration test for readyz/livez

simplify integration test

set default rbac policy rules for livez

rename a few functions and the entrypoint command line argument (and etcetera)

simplify interface for installing readyz and livez and make auto-register completion a bootstrapped check

untangle some of the nested functions, restructure the code

Kubernetes-commit: aa1b2d6d35c92a31be17357fc66cfc1eca8a67e0
2019-08-26 16:57:25 -07:00
Mike Spreitzer 0cc4524200 Make AuthorizeClientBearerToken actually return if authn or authz is nil
There was a typo, the test was there but the return was not.

Added test that exposes the difference.

Kubernetes-commit: 7056e216addc7203f24c37a95c5c14ad194dddca
2019-06-18 23:37:16 -04:00
Han Kang 7fd71e31ef add readyz endpoint for kube-apiserver readiness checks
add startup sequence duration and readyz endpoint

add rbac bootstrapping policy for readyz

add integration test around grace period and readyz

rename startup sequence duration flag

copy health checks to fields

rename health-check installed boolean, refactor clock injection logic

cleanup clock injection code

remove todo about poststarthook url registration from healthz

Kubernetes-commit: 54dcf5c9c46fc4782d4861936309349b5a71a1ac
2019-05-30 11:19:49 -07:00
David Eads af92b436cc prevent unhandled errors on colliding poststarthook registration
Kubernetes-commit: 8d0c56e22f73fdb1a82a12475909e7d69f4bec08
2019-02-14 14:07:18 -05:00
Michal Fojtik 15d93876c8 Wait for post-hooks to run before checking the healthz output
Kubernetes-commit: 8a2f709b35e750a40b12ccf287e279b1da0f07ec
2019-01-30 09:34:43 +01:00
Jordan Liggitt 2109711572 Remove build/verify scripts for swagger 1.2 API docs, API server swagger ui / swagger 1.2 config
Kubernetes-commit: 9229399bd6049bc7766829b436d5cb5fe0dfe2f1
2019-01-15 10:44:36 -05:00
Dr. Stefan Schimanski 9fb7dcda85 kube-apiserver: fix tests which don't use tls yet
Kubernetes-commit: 6bb3aba23dfbfd8b145a33e9d1a461658bd60fc0
2018-07-06 19:20:45 +02:00
Jordan Liggitt 6c34ac4aa5 Add healthz check to ensure logging is not blocked
Kubernetes-commit: b7b4b84afe4405cde976ceeeccb62acecac1c4f0
2018-06-09 17:32:14 -04:00
Dr. Stefan Schimanski 1075399c96 apiserver: enforce shared RequestContextMapper in delegation chain
Kubernetes-commit: 9f906618f04baceaf923e873530f9741e80ad2cb
2018-04-04 10:05:06 +02:00
David Eads 416f1ae672 update metrics to true like it is for kube-apiserver
Kubernetes-commit: 456fd386dc6db8ba5ced338a5935de8229c14047
2018-03-09 14:36:04 -05:00
Ryan Hitchman bbfe695b05 Remove unused variables (only assigned to) from test code.
This is revealed by the go/types package, which is stricter than
the Go compiler about unused variables. See also: golang/go#8560

Kubernetes-commit: e04b91facf180c17557a44e8e462858ea2936301
2018-02-02 13:34:57 -08:00
Dr. Stefan Schimanski 75cf96f31e apiserver: stratify versioned informer construction
Kubernetes-commit: ca3f7453464f6866a3bf467c8b9d8e132484cfb4
2017-09-09 21:44:32 +00:00
Dr. Stefan Schimanski e4b1b0656b apiserver: make config completion structural recursion
Kubernetes-commit: 1bcea54104cb7f53e58924dd5413cf4ba7ceb587
2017-09-09 21:44:32 +00:00
deads2k 10de73bc53 move CRD behind TPR
Kubernetes-commit: 18177e2bdeafbddeb3d66fec0b8cb88794cd69ff
2017-06-13 20:47:29 +00:00
p0lyn0mial ceeef3670c This PR implements AdmissionOptions.ApplyTo
ApplyTo adds the admission chain to the server configuration the method lazily initializes a generic plugin
that is appended to the list of pluginInitializers.

apiserver.Config will hold an instance of SharedInformerFactory to ensure we only have once instance.
The field will be initialized in apisever.SecureServingOptions

Kubernetes-commit: 8cea69aa9812d6627ebdfa4f8b9c1d7624a8f3f5
2017-05-16 17:27:50 +00:00
deads2k 00b83db9b8 plumb stopch to post start hook index since many of them are starting go funcs
Kubernetes-commit: be39283923650ad96539640ca988fbf194db2be4
2017-05-12 17:30:09 +00:00
deads2k 49f3eb05d8 refactor names for the apiserver handling chain
Kubernetes-commit: 4389f715768661731f0aae7438b2cc8414c9746a
2017-05-12 17:30:09 +00:00
deads2k 8c644986dc require codecfactory
Kubernetes-commit: 087a03022106c02f82a497f65b945f3cbab3f643
2017-03-31 20:37:15 +00:00
deads2k 43ba6dde7a allow combining API servers
Kubernetes-commit: bccef75d7ae43be333e068748bb6f998dafa6d9d
2017-03-31 20:37:15 +00:00