4c9524b9fb
Updated OWNERS files to include link to docs
...
Kubernetes-commit: b43c04452f3b563473b5c2a765d4ac18cc0ff58f
2019-01-30 20:05:00 +01:00
f60d1ce95c
Set the maximum size increase the copy operations in a json patch can cause
...
Kubernetes-commit: f001f9e1dbce644a1b7d22b370ab37fc7d770c7e
2019-02-04 11:15:16 -08:00
337fc9ccde
API Machinery, Kubectl and tests
...
Kubernetes-commit: 0e1d50e70fdc9ed838d75a7a1abbe5fa607d22a1
2019-01-16 21:14:42 -08:00
77c59f4906
update docs.go files under staging/src/k8s.io/apiserver/pkg/server
...
Kubernetes-commit: 03d892a44df6dbcac7ad28f1519d7d606f42e1ee
2019-02-03 20:43:13 +00:00
15d93876c8
Wait for post-hooks to run before checking the healthz output
...
Kubernetes-commit: 8a2f709b35e750a40b12ccf287e279b1da0f07ec
2019-01-30 09:34:43 +01:00
cb1e16cec7
sync: squashed up to merge 1f7e9fd9a2b31ee21babef2cbdd18caeb8c14cdc in e72b32558c8e9ed16690ef5a8e909c12fcc47f87
2019-02-01 14:44:40 +00:00
123cf8011f
Remove alpha InitializerConfiguration types, Initializers admission plugin
...
Kubernetes-commit: dc1fa870bff65c20f48a83ea3af54adb3f526e28
2019-01-16 10:19:44 -05:00
35fe690052
remove deprecated openapi paths in favor of /openapi/v2
...
Kubernetes-commit: 52519ecb1cfd1b55995684520196dd71e1886754
2019-01-21 16:33:41 -05:00
db5a1882b5
apiserver: sync with https server shutdown to flush existing connections
...
Kubernetes-commit: 5b47f99164d76b6b043d7de2d3834abeda6685b0
2019-01-16 15:58:53 +01:00
e0406b8675
Change endpoints metrics to conform guideline
...
Kubernetes-commit: 88c4b644005c5f674e9d03abae7e1cccda4fd23e
2018-12-26 22:29:13 +08:00
3039935d60
adds dynamic audit integration test
...
Kubernetes-commit: d995047366153d86f0061b829ee4e7657f17996b
2018-10-16 16:17:33 -06:00
0550db794e
move logs into component-base
...
all the code changes to move move /apiserver/pkg/util/logs into /component-base/logs
Kubernetes-commit: ba81a5409affb6b861d5994c1e2f7c74a05826e5
2019-01-17 09:06:12 -05:00
1e20513561
fix typo and instead of amd
...
Kubernetes-commit: 3e83f0f08abab4c10dfab7053529709883c9b834
2018-10-30 01:27:50 +08:00
2109711572
Remove build/verify scripts for swagger 1.2 API docs, API server swagger ui / swagger 1.2 config
...
Kubernetes-commit: 9229399bd6049bc7766829b436d5cb5fe0dfe2f1
2019-01-15 10:44:36 -05:00
0202761ce2
Ensure we set a content-type for healthz
...
Change-Id: I453b1433c69bf26c28da873dbdd1ac25006b8d60
Co-Authored-By: Tim Allclair (St. Clair) <tallclair@google.com>
Kubernetes-commit: eedb70355ad59f9d7054dba198a8352554274e0a
2019-01-03 10:05:58 -05:00
9c474d9c53
require timeout to be greater than zero.
...
add unit test to cover timeout behaviour.
Kubernetes-commit: 39aca564749cd92ed1cfec7129eb3f6593549137
2019-01-04 17:06:07 -08:00
d9414ee2ab
Expose kms timeout value via encryption config.
...
Kubernetes-commit: a4dc53cfeb91ee07cedcc6959e88e30cb0c3cca8
2019-01-03 14:26:57 -08:00
efb664a483
kube-apiserver: add e2e graceful shutdown integration test
...
Kubernetes-commit: a2e19f1228b365f17401b1e958a6bb684e65fd65
2018-12-19 12:42:22 +01:00
12d1c63697
apiserver: check that request fail after shutdown
...
Kubernetes-commit: c0d8ad1578efe52df3ca6bc57a90a623d1d2e482
2018-12-19 12:41:58 +01:00
b87560e3bd
Log Health Check failure at Verbosity Level - 4
...
Our default recommendation as well as our CI default is 4, so we should
be able to see the health check errors at the same level 4 itself.
Change-Id: I388f945d3522d1f63f0a85f35e765c2d4f2c548a
Kubernetes-commit: 3d6b3857b29b9c738f258344781ce4a9b40b9a0b
2019-01-06 21:32:57 -05:00
e2884e1186
Revert "Generate Stack Traces for http response with status code zero"
...
Does not help with the bug investigation. the http server is designed to
panic when the http status code is `0`.
This reverts commit 72792d59f46f822cf360e797d886e582a6a2dc60.
Kubernetes-commit: 85ae15621af1d71caf5d0bac2299d17ec1020664
2019-01-04 15:26:07 -05:00
fe4a2dbfb0
preserve behavior of ignoring invalid --runtime-config keys and api/all=false
...
Kubernetes-commit: fc3fca2857a18464cfff8aff5f9e4b062f293ac5
2019-01-04 13:50:21 -05:00
1702e95788
fix typo in warning advice for permissions
...
Kubernetes-commit: 1105e4e0d1c0e78e2a203a136e9f8bcaff5c36ab
2019-01-04 09:58:06 -05:00
e16a86073e
add a content-type filter to apiserver filters to autoset nosniff
...
Kubernetes-commit: d0532bdb9ab40e06ee0702481f623d5054c8831a
2019-01-04 14:06:46 -08:00
2b1eeee742
Generate Stack Traces for http response with status code zero
...
When we spit out a http reponse with a `0` http status code we
should log a trace back so we can easily find where things went wrong.
Change-Id: Ic2aadec3a3de85fbdf64da66d6d12e3c631f409d
Kubernetes-commit: 72792d59f46f822cf360e797d886e582a6a2dc60
2019-01-03 16:52:36 -05:00
7d47897b55
apiserver: separate transport setting from storagebackend.Config
...
Kubernetes-commit: 7b242533a217bd809e2c846c3e3fadf7bf6edee8
2018-09-12 10:59:01 +02:00
837d33c6f5
Allow enabling/disabling specific extensions/v1beta1 resources
...
Kubernetes-commit: e016e132f519dbfb63ce09f6084d6dd64617f615
2018-12-20 13:08:14 -05:00
7b0f961e27
Remove uses of extensions/v1beta1 clients
...
Kubernetes-commit: fd9e9b01b1c79c47c7edb4980468f2675daebf27
2018-12-19 11:18:53 -05:00
a3f2a871b3
Surface help for insecure ports to explain how to disable
...
Kubernetes-commit: 819b502768034b8104904cd7031db8c4838f900a
2018-11-30 10:52:37 -05:00
232ebfaeaf
Allow kube-scheduler to tolerate cluster auth config lookup failure
...
Kubernetes-commit: 416e11421590838f0022242bff1db10da595b074
2018-12-05 13:51:06 -05:00
b4ca200ede
apiserver: add component label to request metrics
...
Kubernetes-commit: 7190b17e5a52a7c0673c2e8a30cbe95f2847a6df
2018-11-29 16:30:15 +01:00
cc459864cf
remove duplicate word
...
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
Kubernetes-commit: b32bd6e812138faa218a0ab906989fdca27843a2
2018-12-03 19:24:45 +08:00
d294e6b5b4
Update non-test code to use DefaultMutableFeatureGate
...
Kubernetes-commit: d440ecdd3b41a4fc4a207195e1bb976422d6d35e
2018-11-20 23:59:52 -05:00
ee7fb67d6e
Clarified syntax doc on --watch-cache-sizes
...
Noted that group must be omitted for resources of apiVersion v1 (the
legacy core API) and included for others.
Fixes #65393
Kubernetes-commit: fc20359fed5e3d0e89a60653b9b0d638d4d757d8
2018-11-12 14:45:45 -05:00
e485f8578d
kubeapiserver: rename '--experimental-encryption-provider-config' to '--encryption-provider-config'.
...
This change renames the '--experimental-encryption-provider-config'
flag to '--encryption-provider-config'. The old flag is accepted but
generates a warning.
In 1.14, we will drop support for '--experimental-encryption-provider-config'
entirely.
Co-authored-by: Stanislav Laznicka <slaznick@redhat.com>
Kubernetes-commit: 21c1bb883081b13244002271bccc9cf119d4db4f
2018-03-23 14:16:04 +03:00
877329b0f3
Add option to k8s apiserver to reject incoming requests upon audit failure
...
Kubernetes-commit: 7a10f4eda725f55bec9893eb1c03f2402dbcd32f
2018-07-03 14:40:55 +02:00
a7180e74a2
Revert "Merge pull request #67205 from roycaihw/crd-openapi-spec"
...
This reverts commit 54ee58b2d613c636f972312ca80357563292b57d, reversing
changes made to 9e2820e4c9541a7718e9d5b7a0ee62429552023a.
Kubernetes-commit: 8799eb4e2e12e5d144871a35c6288b8433a74c9b
2018-11-16 16:36:24 -05:00
e2bc8e4617
Introduce kubeapiserver.config.k8s.io/v1 with EncryptionConfiguration and use a standard method for parsing config file.
...
Co-authored-by: Stanislav Laznicka <slaznick@redhat.com>
Kubernetes-commit: c21cb548e6c7d4ab019fce8a35c9b99c035c2071
2018-05-02 18:21:38 +02:00
f78d7e624c
fix a description error in DynamicAuditing feature
...
Kubernetes-commit: 84aa00c03df00eade6615ca009fa9b2943a98b8c
2018-11-17 01:49:02 +08:00
3c9d1f5b21
Apiextensions-apiserver aggregates CRD schemas
...
efficiently without checking conflicts, and wire up CRD discovery
controller to serve OpenAPI spec.
Kubernetes-commit: 3222a7033cf9128b76c0677887f4e383821d0475
2018-11-15 11:02:11 -08:00
bb8c155568
apiserver: preserve stack trace in handler panic beyond timeout handler
...
Kubernetes-commit: 96fd0482f41ff34ef7d9b7de07ded38152a35141
2018-11-15 09:56:49 +01:00
0837aa9e3a
apiserver: in timeout_test separate out handler
...
Kubernetes-commit: e43e5e2e4547c7cfb50190d67556352ef0aee9e8
2018-11-15 09:26:02 +01:00
7cc3f112fb
Build OpenAPI Definitions per group instead of per resource
...
Kubernetes-commit: 758e8623e9b08065f053bedf4474626696b6346c
2018-11-14 12:50:02 -08:00
9fd62b6f47
adds dynamic audit configuration
...
Kubernetes-commit: eb89d3dddd3792b0a6cd724e64bbbc11d6c15380
2018-10-18 21:34:17 -05:00
f61020971c
add ability to exclude health checks from failing healthz by passing in a query param
...
Kubernetes-commit: f1f1bc83fd07450a191ecf94b945f1b772d1dc7c
2018-11-12 16:17:36 -08:00
2710b17b80
Move from glog to klog
...
- Move from the old github.com/golang/glog to k8s.io/klog
- klog as explicit InitFlags() so we add them as necessary
- we update the other repositories that we vendor that made a similar
change from glog to klog
* github.com/kubernetes/repo-infra
* k8s.io/gengo/
* k8s.io/kube-openapi/
* github.com/google/cadvisor
- Entirely remove all references to glog
- Fix some tests by explicit InitFlags in their init() methods
Change-Id: I92db545ff36fcec83afe98f550c9e630098b3135
Kubernetes-commit: 954996e231074dc7429f7be1256a579bedd8344c
2018-11-09 13:49:10 -05:00
85a1725c91
fix healthz checkerNames test so that it tests against the expected output
...
Kubernetes-commit: 0623f630ab37ad75961bf836195e190e6bcf560e
2018-11-07 09:26:11 -08:00
631dda550e
kube-scheduler: enable secure ports 10259
...
Kubernetes-commit: cb95edafe8bf4f294beb53d0a7bc04d62584577c
2018-09-05 16:42:16 +08:00
032ec9d79b
Switch to sigs.k8s.io/yaml from ghodss/yaml
...
Change-Id: Ic72b5131bf441d159012d67a6a3d87088d0e6d31
Kubernetes-commit: 43f523d405b012fa8d90dd95b667f520e036f6bc
2018-11-02 16:41:57 -04:00
257a06e88a
add With method for allowed URL options on delegated authorization
...
Kubernetes-commit: 77b56ec9e36dd721c341ce838d608e8af10ce51f
2018-11-06 10:44:29 -05:00
136e478e9f
encryption-at-rest approvers/reviewers
...
Kubernetes-commit: 666c93a8343029a499ea64de8a6d09596097ccb3
2018-11-02 17:38:17 -04:00
83c8e657ed
allow delegated authorization to have privileged groups
...
Kubernetes-commit: 0b70b7a7c975589f7019e5017c334cf0ee6b819f
2018-11-05 16:23:20 -05:00
f8fa426bd3
Use `audit.k8s.io/v1` as default value of option --audit-webhook-version and --audit-log-version in release 1.13
...
Kubernetes-commit: 9671a035f7e7308ac804b4637af19bac2ecce0f4
2018-10-31 17:22:37 +08:00
1692373df9
move audience context functions to authenticator package
...
Kubernetes-commit: 817cf70191b73d1ee9f4e7af83089e5854e5131d
2018-10-31 14:50:11 -07:00
22df332aff
Allow components to generate certificates in-memory
...
Kubernetes-commit: b7160d4ee2073f06293d7c3b20acdf4620fadf61
2018-10-16 17:22:13 -04:00
7c1e7ec029
echo audiences in anonymous and insecure authenticators
...
part of https://github.com/kubernetes/kubernetes/issues/69893
Kubernetes-commit: f94bc6193e1e299b1cb258b59504fab81cf8da1c
2018-10-26 15:29:55 -07:00
47845b88c3
Update usages of http.ResponseWriter.WriteHeader to use http.Error
...
Signed-off-by: Ibrahim AshShohail <me@ibrasho.com>
Kubernetes-commit: 2fb3ba71f196031e9b36095d64c921cacc54f44e
2018-10-08 22:20:52 +03:00
2ced48ac6e
rebase authenticators onto new interface.
...
Kubernetes-commit: e5227216c0796d725c695e36cfc1d54e7631d3a6
2018-10-15 15:17:36 -07:00
c7c9a358c2
etcd2 code cleanup, remove deserialization cache
...
Kubernetes-commit: c8db31b84adc40aa875917fbca27b2a787902088
2018-10-15 22:17:44 -04:00
37ab80320b
tokenreview: add APIAudiences config to generic API server and augment context
...
Kubernetes-commit: 21fd8f204128a7847786927b460d95be34a6dbde
2018-10-09 22:04:52 -07:00
13ab2dca08
Remove ericchiang from OWNERS files
...
Kept myself in the OpenID Connect ones for now.
Kubernetes-commit: 766f5875bfa0d8ce4d52cdb87d12faea527e1492
2018-10-11 18:11:15 -07:00
bd604a62aa
Remove deprecated --etcd-quorum-read flag
...
Kubernetes-commit: cff79c542130831f4a212099974570244a0c9586
2018-10-08 11:04:28 -04:00
92e87e143a
Update gofmt for go1.11
...
Kubernetes-commit: 97b2992dc191a357e2167eff5035ce26237a4799
2018-10-05 12:59:38 -07:00
fbe89f5f9b
Remove useless named return value
...
This cleans up the useless named return value stopCh at
SetupSignalHandler().
Kubernetes-commit: 2e560e797e22c44ac628581486d847c2d5bdbd59
2018-08-02 19:28:17 +08:00
41e5031224
Populate ClientCA in delegating auth setup
...
kubernetes/kubernetes#67768 accidentally removed population of the the ClientCA
in the delegating auth setup code. This restores it.
Kubernetes-commit: 65cea86e4413cb5899c3b89bda375bb326de5093
2018-10-04 12:48:18 -04:00
3b6fc08803
Remove etcd2 storage backend
...
Kubernetes-commit: 85ae79500fba7d6e51292b12daff829027b59872
2018-10-01 16:48:14 -04:00
e9bce895cf
Lazily dial kms-plugin.
...
Kubernetes-commit: 07cbf2545f705d0448631f479a18d0b86b7055dc
2018-09-12 14:56:44 -07:00
1a58e1c6ad
apiserver: make InClusterConfig errs for delegated authn/z non-fatal
...
Kubernetes-commit: 04e793e65ad70df5c4ab280c42740864e54163cd
2018-09-05 09:12:19 +02:00
c8f47fd79c
apiserver: fix misleading delegated authn/z warnings
...
Kubernetes-commit: 059fce63b755ef6052db273fd6c91f3090036389
2018-09-05 09:11:45 +02:00
f91709c7f9
kube-controller-manager: disable authn/z on insecure port
...
This is the old behaviour and we did not intent to change it due to enabled authn/z in general.
As the kube-apiserver this sets the "system:unsecured" user info.
Kubernetes-commit: 8aa0eefce8fbd801a38da46c8704f2d74996e5cd
2018-08-30 19:20:19 +02:00
ecbc9eada2
Fix grammar in secure-port flag help
...
The phrasing made it difficult to understand the message.
Kubernetes-commit: c0ded2d9f5beb5eb02b356076166c365073a639a
2018-08-30 18:50:26 -04:00
c726863192
apiserver: make not-found external-apiserver-authn configmap non-fatal
...
Kubernetes-commit: 5d56e791bb932cc297de08db302540684e6f9d4c
2018-08-24 18:30:58 +02:00
7dbcbd39e2
Remove deprecated legacy audit logging code.
...
Kubernetes-commit: 3f730d4c255e7c8ee67a020eed0b8f0a8f634750
2018-07-05 13:57:17 +02:00
fdd6b9e860
apiserver: forward panic in WithTimeout filter
...
Kubernetes-commit: eec1b521117aa7271be3a3f0919c88caf5b73c54
2018-08-29 13:44:16 +02:00
16d4968bf9
authn/z: optionally opt-out of mandatory authn/authz kubeconfig
...
Kubernetes-commit: a671d65673590f0dfcf5c2b673e1518d11510bdb
2018-08-22 11:56:07 +02:00
24a0ab5db2
Size http2 buffers to allow concurrent streams
...
Kubernetes-commit: 554c0d73282ce7c30f11e0f4d985a6c30cf6e418
2018-08-27 11:46:49 -04:00
34ff0933dd
expose generic storage factory primitives
...
Kubernetes-commit: 81b9213ac2cc7744b8a62ac42b269b97c1d17b5a
2018-08-27 10:45:52 -04:00
cfb1e16b55
apiserver: unify handling of unspecified options in authn+z
...
Kubernetes-commit: 0ede948e47d33474a4e30c845d7896c58a319e39
2018-08-21 16:42:13 +02:00
a8bd1ddbf7
delegated authz: add AlwaysAllowPaths mechanism to exclude e.g. /healthz
...
Kubernetes-commit: 6142e2f8f7c8b1c5d32a2f9aa3715ea0b5baf167
2018-08-17 17:03:16 +02:00
c27f181946
add unit test func TestServerRunOptionsValidate
...
Kubernetes-commit: cdef8029d4aea52e607da4101ad44b1b4163f869
2018-08-22 10:19:13 +08:00
7e18a5d0a6
add unit test func TestToAuthenticationRequestHeaderConfig
...
Kubernetes-commit: 0da04d61ab4b70817083c8208af12397b818546a
2018-08-22 10:18:30 +08:00
769565b214
add unit test func TestAPIEnablementOptionsValidate
...
Kubernetes-commit: 73ee10495b5be414b9fae718e5129765c7c3ed19
2018-08-22 10:17:58 +08:00
c872082b0a
add unit test func TestEtcdOptionsValidate and TestParseWatchCacheSizes
...
Kubernetes-commit: 67a1d53bd74265637718b67c80f48a26b6e653cf
2018-08-22 10:17:26 +08:00
a549f2934f
kube-apiserver: switch apiserver's DeprecatedInsecureServingOptions
...
Kubernetes-commit: d787213d1b8802d370032d17157ac1de7573ad15
2018-08-06 16:31:23 +02:00
3698d7a898
apiserver: move controller-manager's insecure config into apiserver
...
Kubernetes-commit: 1d9a896066b3e10e8c1a0d506e00bc354b7772f0
2018-08-16 20:47:15 +02:00
8e1390d9d4
Synchronous & unbatched audit log writes
...
Kubernetes-commit: c9670d0652f8d7da662f71caac6fca2044296ae6
2018-03-15 00:44:46 -07:00
e767cd8dbf
kube-apiserver make use of GlogSetter
...
Kubernetes-commit: 38d48e8d025a9cceccfc8a80d72f751b8bb65dab
2018-06-05 10:32:46 +08:00
0fc525d3c8
fix typo
...
fix typo
Kubernetes-commit: 18f1ad7dc5392cb4537fa33bd73cdb8dc2c1e523
2018-08-13 17:36:15 +08:00
b0b043eda2
list the default enabled admission plugins
...
Kubernetes-commit: ee96a5638d21f0da111b1106a82976cc59bbbf67
2018-08-06 17:25:24 +08:00
4e7be504bf
Support pulling requestheader CA from extension-apiserver-authentication ConfigMap without client CA
...
This commit prevents extension API server from erroring out during bootstrap when the core
API server doesn't support certificate based authentication for it's clients i.e. client-ca isn't
present in extension-apiserver-authentication ConfigMap in kube-system.
This can happen in cluster setups where core API server uses Webhook token authentication.
Fixes: https://github.com/kubernetes/kubernetes/issues/65724
Kubernetes-commit: db828a44406efe09e2db91e6dc88d1292c9a29e1
2018-07-18 15:07:09 -07:00
b40373204e
use Audit v1 api and add it to some unit tests
...
Kubernetes-commit: 716dc87a1095027f9ab08ee59abfffab1d15ec29
2018-07-27 14:06:29 +08:00
300db50c66
fix apiserver pprof redirect bug
...
Kubernetes-commit: 981f2397815248e12663b01d6cc6d6d963012c95
2018-08-06 19:35:01 +08:00
42da2694e6
Autoset OpenAPI version w/o SecurityDefinitions
...
There's code to automatically populate OpenAPI info based on existing
generic apiserver config, but it only fires if securitydefinitions are
present. This doesn't make much sense, since this info is both required
and independent of security definitions, and there's no easy, generic
way to generate security definitions for an aggregated API server.
Kubernetes-commit: ef73bb684bcc4402f66160f254193d2690b80f11
2018-07-19 17:32:40 -04:00
0ba502e8f9
Handle errors
...
Kubernetes-commit: 5cab7f9a57dbbd6e2a181018aae523235843f77d
2018-07-17 20:29:55 +10:00
4c6f8fdc17
apiserver: make loopback logic in SecureServingOptions reusable
...
Kubernetes-commit: dc0a736d1ea924dfa35ece64cb59d551c2a0b51f
2018-07-04 17:08:23 +02:00
55957fdc66
apiserver: add SecureServingOptions.ExternalAddress
...
Before this the advertised IP (which shows up in the server cert) in case of
listening to loopback was the first host interface IP. This makes self-signed
certs non-constant, such that we cannot use fixtures.
Kubernetes-commit: c1c564fd4d21dd68ea14d7ea678d8619f47fe445
2018-07-06 12:32:01 +02:00
fa6b67b429
apiserver: use fixtures for self-signed certs in test server
...
Kubernetes-commit: 7deccb5b7a7c5224d3d90e1391dd22b2d1f1b9b9
2018-07-06 12:04:38 +02:00
9cfed8df8c
Convert TestServerRunWithSNI to subtests to isolate flake
...
This test is flaking - make it easier to pin down where and why by
converting to subtests and making cleanup logic easier. Also turn an
ignored listen error into a "fatal".
Make the test run in parallel to speed up individual runs and hopefully
flush out issues.
Kubernetes-commit: 09463975c379114ef9cd42d3c7efb6254b2c3b33
2018-07-09 21:32:15 -04:00
9fb7dcda85
kube-apiserver: fix tests which don't use tls yet
...
Kubernetes-commit: 6bb3aba23dfbfd8b145a33e9d1a461658bd60fc0
2018-07-06 19:20:45 +02:00
ad29bd83ae
kube-apiserver: disallow --secure-port 0
...
Kubernetes-commit: e15ac9eb72c4e105e7a3d84711e5a6056c0f6a48
2018-07-06 12:58:59 +02:00
Roy Lenferink