Commit Graph

25 Commits

Author SHA1 Message Date
Ravi Gudimetla 1ee261d219 API Server Changes
This commit includes all the changes needed for APIServer. Instead of modifying the existing signatures for the methods which either generate or return stopChannel, we generate a context from the channel and use the generated context to be passed to the controllers which are started in APIServer. This ensures we don't have to touch APIServer dependencies.

Kubernetes-commit: 8b84a793b39fed2a62af0876b2eda461a68008c9
2022-03-07 09:20:45 -05:00
Arda Güçlü 1fbc8d31a2 Rename ServeWithListenerStopped to Serve in secure_serving
This PR removes Serve function and uses all required places
ServeWithListenerStopped which takes place new Serve function.

This function returns ListenerStopped channel can be used to drain
requests before shutting down the server.

Kubernetes-commit: a8d2b3a7926394b1c53621804cdeb93e4a61b7c8
2021-11-08 17:20:31 +03:00
Jordan Liggitt 1e6293c86f Set idle and readheader timeouts
Kubernetes-commit: db48793269ef9eca63fa12abb1a25d017c0e09bb
2021-07-27 11:58:45 -04:00
Abu Kashem c1c949723d apiserver: NonBlockingRun should return a listener stopped channel
NonBlockingRun should also return a channel that gets closed when the
underlying http Server has stopped listening (during the graceful
shutdown period)

Kubernetes-commit: a84c1b71005930e8253c1348515020132c5c175b
2021-06-24 16:04:54 -04:00
Mike Danese a6a121887a force implementors of dyanmiccertificates providers to think about notify
Right now, `_, ok := provider.(Notifier); !ok` can mean one of two
things:

1. The provider does not support notification because the provided
   content is static.
2. The implementor of the provider hasn't gotten around to implementing
   Notifier yet.

These have very different implications. We should not force consumers of
these interfaces to have to figure out the static of Notifier across
sometimes numerous different implementations. Instead, we should force
implementors to implement Notifier, even if it's a noop.

Change-Id: Ie7a26697a9a17790bfaa58d67045663bcc71e3cb

Kubernetes-commit: 9b7d654a08d694d20226609f7075b112fb18639b
2021-04-09 16:59:17 -07:00
Li Bo 7f8013437d log tls handshake error at trace level to avoid error flooding, and add
metric to count such errors

Kubernetes-commit: eabb362aa37f7acc85bc64f2035dadc5511d3716
2020-05-20 11:29:44 +08:00
Dr. Stefan Schimanski 4b2cf85d1b apiserver: fix secure serving cast for non-tcp listeners
Kubernetes-commit: 2c3687c255c014f7049eed159de30a82082656b6
2020-06-16 13:31:32 +02:00
Paulo Gomes 749479fedb Warn when insecure TLS ciphers are selected.
Kubernetes-commit: 550a67869a7290688dde4aeedbcdd72a10e448cf
2020-05-13 16:11:28 +01:00
Davanum Srinivas 5879417a28 switch over k/k to use klog v2
Signed-off-by: Davanum Srinivas <davanum@gmail.com>

Kubernetes-commit: 442a69c3bdf6fe8e525b05887e57d89db1e2f3a5
2020-04-17 15:25:06 -04:00
Monis Khan 091c53ac7a dynamic certs: do not copy mutex via shallow copy of tls.Config
go vet error:

call of dynamiccertificates.NewDynamicServingCertificateController
copies lock value: crypto/tls.Config contains sync.Once contains
sync.Mutex

Signed-off-by: Monis Khan <mok@vmware.com>

Kubernetes-commit: 86a5993007e3c781749a5099b540307f65a4f377
2020-03-03 14:58:43 -05:00
David Eads 0de0bb0422 dynamic reload cluster authentication info for aggregated API servers
Kubernetes-commit: 3aede35b3b042e8a626e8fb9e1e181e73cd29d0a
2019-11-04 13:46:28 -05:00
Jack Kleeman c4dfb52a33 Dynamic SNI certificates
Reload SNI certificate cert and key file from disk every minute and notify
the dynamic certificate controller when they change, allowing serving
tls config to be updated.

Kubernetes-commit: d9adf535f35051be1d79d1309c72762939593d7c
2019-10-24 17:38:21 +01:00
Jack Kleeman 51b8ce994d Dynamic serving certificate
Reload certificate cert and key file from disk every minute and notify
the dynamic certificate controller when they change, allowing serving
tls config to be updated.

Kubernetes-commit: 3f5fbfbfac281f40c11de2f57d58cc332affc37b
2019-10-22 19:10:40 +01:00
David Eads 84d21cfff4 wire up a means to dynamically reload ca bundles for kube-apiserver
Kubernetes-commit: 6beb96261e29754f2b7d0e44829eb6d15422cebf
2019-10-07 14:06:42 -04:00
Jack Kleeman 40fefa1b37 Plumb dynamic SNI certificates
We create and use a dynamic certificate provider for the SNI serving
certificates. Currently we only use static serving certificate
providers, so the files are not reloaded, but we should be able to move
to a provider that is able to reload later on.

Kubernetes-commit: 84bc6b151d0726db0c737443874577f044e0e9c8
2019-10-08 19:03:56 +01:00
Jack Kleeman 8da4640a3d Plumb dynamic serving certificates
We create and use a dynamic certificate provider for the main apiserver
serving certificates: SNI will be handled separately later. Currently we
only use static serving certificate providers, so the files are not
reloaded, but we should be able to move to a provider that is able to
reload later on.

Kubernetes-commit: 6f89f1027488aeba4af0786988c2fd2ace9a6f1d
2019-10-07 18:49:24 +01:00
David Eads 695d42bf49 wire dynamic tlsconfig up to apiserver
Kubernetes-commit: abddbd87cdcf69053e9fc6e752ade7d92c6b9fd7
2019-10-04 08:37:26 -04:00
David Eads 11d75d5283 refactor tlsConfig creation for secure serving
Kubernetes-commit: e7b41d08270f0b8035b423050e96c7affd4bd8e1
2019-10-04 09:52:49 -04:00
David Eads 47da497af8 allow an apiserver to only serve http1
Kubernetes-commit: 6eb62506e05d7181caf552e50d9b78609aea1943
2019-08-23 15:02:26 -04:00
YAMAMOTO Takashi 0acf11d3c3 apiserver: Update a comment
Kubernetes-commit: 6066246656f532beb04b74e5ea3959e08ecb375b
2019-03-11 15:23:26 +09:00
Dr. Stefan Schimanski db5a1882b5 apiserver: sync with https server shutdown to flush existing connections
Kubernetes-commit: 5b47f99164d76b6b043d7de2d3834abeda6685b0
2019-01-16 15:58:53 +01:00
Jintao Zhang cc459864cf remove duplicate word
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>

Kubernetes-commit: b32bd6e812138faa218a0ab906989fdca27843a2
2018-12-03 19:24:45 +08:00
Davanum Srinivas 2710b17b80 Move from glog to klog
- Move from the old github.com/golang/glog to k8s.io/klog
- klog as explicit InitFlags() so we add them as necessary
- we update the other repositories that we vendor that made a similar
change from glog to klog
  * github.com/kubernetes/repo-infra
  * k8s.io/gengo/
  * k8s.io/kube-openapi/
  * github.com/google/cadvisor
- Entirely remove all references to glog
- Fix some tests by explicit InitFlags in their init() methods

Change-Id: I92db545ff36fcec83afe98f550c9e630098b3135

Kubernetes-commit: 954996e231074dc7429f7be1256a579bedd8344c
2018-11-09 13:49:10 -05:00
Jordan Liggitt 24a0ab5db2 Size http2 buffers to allow concurrent streams
Kubernetes-commit: 554c0d73282ce7c30f11e0f4d985a6c30cf6e418
2018-08-27 11:46:49 -04:00
Dr. Stefan Schimanski 3698d7a898 apiserver: move controller-manager's insecure config into apiserver
Kubernetes-commit: 1d9a896066b3e10e8c1a0d506e00bc354b7772f0
2018-08-16 20:47:15 +02:00