16fda89d29
sync: update go.mod
2021-04-17 03:58:27 +00:00
66df8c7bf0
Merge pull request #100963 from enj/enj/i/authz_func_ctx
...
authorizer func: pass through context
Kubernetes-commit: f1c1379defd362a7156b0568c77b2f41583b1e00
2021-04-16 23:54:04 +00:00
db0339edde
Merge pull request #100969 from enj/enj/i/audit_stage_const
...
audit: make stage consts use correct type
Kubernetes-commit: 2ec888b2d0a23861a93e6599e0f993e12c7a79f4
2021-04-16 19:57:58 +00:00
4004e014d5
Merge pull request #100724 from liggitt/eviction-v1beta1
...
Add policy/v1 Eviction support
Kubernetes-commit: 27a625cf8921007eaf115425b6d61587eb253e92
2021-04-16 19:57:56 +00:00
f09aa9568e
Merge pull request #101086 from enj/enj/i/auth_owners_gen
...
Prune stale entries from OWNERS files
Kubernetes-commit: 24350a922ea2b1b2a8aeba58e150fa90370a282b
2021-04-15 15:59:31 +00:00
781f4a4107
Merge pull request #100959 from p0lyn0mial/upstream-delegated-authn-timeout
...
DelegatingAuthenticationOptions: TokenReview request timeout
Kubernetes-commit: dc2020eb9d59a19952cbdabd3d4f819c6f307899
2021-04-15 03:54:50 +00:00
584a6d3ae5
Merge pull request #101076 from kevindelgado/fix-diff
...
Chain the field manager creation calls in newDefaultFieldManager
Kubernetes-commit: 6cc27991e95a4bd242a9c631d520a909778d05e6
2021-04-13 21:08:42 -07:00
ea32c4f47f
Chain the field manager creation calls in newDefaultFieldManager and test
...
Kubernetes-commit: d37461180a1e5a52aeb85cf5853e000acfeb852d
2021-04-13 16:15:25 +00:00
56981b814f
Merge pull request #99237 from tkashem/audit-correlation
...
Use the audit ID of a request for better correlation
Kubernetes-commit: 46563b0abebbb00e21db967950a1343e83a0c6a2
2021-04-13 15:55:56 +00:00
3f59c51398
Merge pull request #100885 from enj/enj/i/auth_owners
...
Update sig-auth OWNERS
Kubernetes-commit: d51f15ed0d47aa81c572076877c69e3107ad3bfc
2021-04-13 07:30:31 +00:00
c5d971fadc
Merge pull request #100739 from pacoxu/update-zap
...
update uber zap to 1.16.0 to fix a nil pointer exception
Kubernetes-commit: 0b0727b563502e45802e2fc4536b2c6734781261
2021-04-12 03:34:26 +00:00
42edede127
Merge pull request #100868 from enj/enj/f/oidc_controller
...
oidc authenticator: make library usage easier
Kubernetes-commit: 7f200cb75b62647c0e0d7d7aa8ecf5129cd6b293
2021-04-11 03:30:42 +00:00
cba9cd88c4
Merge pull request #100784 from kevindelgado/smd-to-4-1-1
...
Update structured-merge-diff to v4.1.1
Kubernetes-commit: 442b3218b3d3eecdd9e55bffcb2c6b135f3084b7
2021-04-11 03:30:40 +00:00
bd0605a728
audit: make stage consts use correct type
...
Signed-off-by: Monis Khan <mok@vmware.com>
Kubernetes-commit: 84ac2398da2be7810d311c4bc9f7358618ed193b
2021-04-09 12:29:20 -04:00
2cc2936b04
Merge pull request #100678 from tkashem/apf-exempt-probes
...
apf: exempt probes /healthz /livez /readyz
Kubernetes-commit: 3294787f572e0fb22ce81c6fba89f631652e13b7
2021-04-09 15:37:41 +00:00
0ae9575f8c
Merge pull request #100671 from Niekvdplas/spelling-mistakes
...
Fixed several spelling mistakes
Kubernetes-commit: 4959cd6339ca5d44df5121efd86bb7b17f7a088b
2021-04-09 15:37:39 +00:00
0f7cee9856
Merge pull request #100141 from brendandburns/master
...
Fix api installer to indicate PATCH may return a 201 for server side apply
Kubernetes-commit: e5e18d5266413fa56cc1b708f3c9e6772e6690e8
2021-04-09 15:37:36 +00:00
e14444ffc5
authorizer func: pass through context
...
Signed-off-by: Monis Khan <mok@vmware.com>
Kubernetes-commit: 8f00e918d84a76ea43d76a8d5b96c3f2535afa99
2021-04-09 09:33:46 -04:00
49d90ce0ad
DelegatingAuthenticationOptions TokenReview request timeout
...
it turns out that setting a timeout on HTTP client affect watch requests made by the delegated authentication component.
with a 10 second timeout watch requests are being re-established exactly after 10 seconds even though the default request timeout for them is ~5 minutes.
this is because if multiple timeouts were set, the stdlib picks the smaller timeout to be applied, leaving other useless.
for more details see a937729c2c/src/net/http/client.go (L364)
2021-04-09 13:20:51 +02:00
faa33164d5
Merge pull request #100523 from tkashem/refactor-finish-request
...
Refactor rest.FinishRequest function
Kubernetes-commit: a5489431cfc0598dad421fccd2d713f84bf520bd
2021-04-09 07:50:34 +00:00
6de9cb2087
Merge pull request #100032 from apelisse/strip-before-updating-timestamp
...
fieldmanager: Strip managedfields BEFORE we update the timestamp
Kubernetes-commit: 53fac160e530311703d77c2e23f2dcd633b628b6
2021-04-09 03:27:41 +00:00
fa8a40ce7f
Merge pull request #99868 from tkashem/httplog-started-timestamp
...
Use the 'request received timestamp' value inside httplog
Kubernetes-commit: ff7ac966267c68400ac2d3c9b8681fb7f0482858
2021-04-08 23:31:35 +00:00
6baff345cb
Merge pull request #99775 from p0lyn0mial/upstream-delegated-auth-custom-rt
...
DelegatingAuthOptions: custom RoundTripper
Kubernetes-commit: 8fb400c475cefb8a40898d29a086a9b0fc20eb02
2021-04-08 23:31:32 +00:00
13b386f3f6
Merge pull request #99528 from pandaamanda/apiserver_validation_code_optimization
...
fix log message and optimize log format check logic
Kubernetes-commit: 26fba1403b6189537be75325a484aeb04144b36e
2021-04-08 23:31:30 +00:00
e61fc2bced
Merge pull request #97989 from Danil-Grigorev/atomic-label-selectors
...
Make selectors atomic
Kubernetes-commit: 1e05d25890afa9b4547c5585d0978ef56dcf07ca
2021-04-08 23:31:28 +00:00
0ac9d4bf6d
Update auth OWNERS files to only use aliases
...
Signed-off-by: Monis Khan <mok@vmware.com>
Kubernetes-commit: bca4993004953041c91ad56e37ef195b32066c27
2021-04-07 10:42:00 -04:00
2ad661f8c5
Prune stale entries from OWNERS files
...
Signed-off-by: Monis Khan <mok@vmware.com>
Kubernetes-commit: 91241eac9b7a7e62cc31e663147294bf6dc8f875
2021-04-07 10:38:27 -04:00
725e1d4432
oidc authenticator: allow specifying a KeySet directly
...
This change updates the oidc authenticator to allow specifying an
oidc.KeySet as an input option. This makes it possible to
synchronously initialize the KeySet instead of relying on the
asynchronous initialization that is normally done to support
self-hosted providers. This makes it easier to use this code as a
library.
Signed-off-by: Monis Khan <mok@vmware.com>
Kubernetes-commit: b5a1a45d48b4e90e54f512fc829b2ab9866b282e
2021-04-06 12:20:57 -04:00
1fd6a1891c
oidc authenticator: allow passing in CA via bytes
...
This change updates the OIDC authenticator code to use a subset of
the dynamiccertificates.CAContentProvider interface to provide the
root CA bytes. This removes the hard dependency on a file based CA
and makes it easier to use this code as a library.
Signed-off-by: Monis Khan <mok@vmware.com>
Kubernetes-commit: 5dd4c89df38d4a5389c0cbf2c7fe4f6a5d5534ce
2021-04-06 11:04:05 -04:00
00544e72ca
Update structured-merge-diff to v4.1.1
...
Kubernetes-commit: 5f1b146852124e6c5ebfc2b69aee7dfa4fe6d158
2021-04-02 17:42:54 +00:00
fb16abfa53
update uber zap to 1.16.0 to fix a nil pointer exception
...
Signed-off-by: pacoxu <paco.xu@daocloud.io>
Kubernetes-commit: 54bc0ff250aa5615233d2f1219f2daecd73ad3c7
2021-04-01 14:53:49 +08:00
b97dfc761c
allow evictions subresource to accept policy/v1 and policy/v1beta1
...
Kubernetes-commit: 33ad842480353f2816873bf728d75333948e4817
2021-03-31 16:54:55 -04:00
64517a3e40
apf: exempt probes /healthz /livez /readyz
...
Kubernetes-commit: 4447f2459aae1d916742eb1cb129d9438adcea9a
2021-03-30 12:55:30 -04:00
c74d3bdddc
Fixed several spelling mistakes
...
Kubernetes-commit: fec272a7b290a34776eac6698f12be043367a4c2
2021-03-30 15:28:23 +02:00
bf34b41185
refactor finishRequest
...
Kubernetes-commit: a8ff821a19b819a54a54d027ec631eab2ffaedc3
2021-03-22 18:01:33 -04:00
28c097bee7
move FinishRequest to its own package
...
Kubernetes-commit: 393a1f73fbaa1bf1facb8882eaf4fead16b94f58
2021-03-22 16:39:14 -04:00
3ba2299cd2
Fix api installer to indicate PATCH may return a 201 for server side apply
...
Kubernetes-commit: cb72ce975630b44ec8786d5b72b1e0ee8bb1a0e4
2021-03-11 17:06:33 +00:00
49b6ebdaae
fieldmanager: Strip managedfields BEFORE we update the timestamp
...
Kubernetes-commit: c8be9651ce0de1eee3fa785882fe01dee4b15d37
2021-03-09 12:46:07 -08:00
b5be45a80f
DelegatingAuthOptions: allows for specifying a middleware function for custom HTTP behaviour for the auth webhook client
...
Kubernetes-commit: ea7d94497b5fef2fe7b925d378f425b94448f01b
2021-03-04 12:35:09 +01:00
bb69e234a6
apiserver: improve correlation by using the audit ID
...
- when we forward the request to the aggregated server, set the audit
ID in the new request header. This allows audit logs from aggregated
apiservers to be correlated with the kube-apiserver.
- use the audit ID in the current tracer
- use the audit ID in httplog
- when a request panics, log an error with the audit ID.
Kubernetes-commit: b607ca1bf3e1cf6152c446ea61ac7fdd9014e1f1
2021-03-02 19:27:43 -05:00
f1a76db888
apiserver: manage audit ID associated with a request
...
Manage the audit ID early in the request handling logic so that it can
be used by different layers to improve correlation.
- If the caller does not specify a value for Audit-ID in the request
header, we generate a new audit ID
- If a user specified Audit-ID is too large, we truncate it
- We echo the Audit-ID value to the caller via the response
Header 'Audit-ID'
Kubernetes-commit: 31653bacb9b979ee2f878ebece7e25f79d3f9aa6
2021-03-02 19:22:39 -05:00
1e7338b1ea
use request received timestamp in httplog
...
Kubernetes-commit: 71199664be6d26e435a78566818379ff43110352
2021-03-02 18:05:51 -05:00
fbe8ccc9bd
Optimize some codes
...
Kubernetes-commit: 4a24a08f936a295bf332b9567bea182e2feff554
2021-02-28 01:00:09 +08:00
de3d390777
Make selectors atomic
...
Ensure that all label selectors are treated as atomic values,
to exclude situations when selectors are being corrupted by
different actors attempting to apply their overlapping definition
for this field with server-side-apply.
Kubernetes-commit: d8a7764b6396b90313ae7bd50a845f4da4705d67
2021-01-12 18:29:56 +01:00
8d97c871d9
Merge pull request #100638 from tkashem/fix-98697
...
apf: fix data race in queueset
Kubernetes-commit: b6ff1370bd2310eab0518d22aaca303df1f17c2f
2021-03-30 05:15:57 -07:00
7c07064678
apf: fix test flake
...
Kubernetes-commit: fa0952ee778aaf7df3e593305575f5d121b55cf1
2021-03-29 16:09:49 -04:00
cb7fbc9590
Merge pull request #100632 from logicalhan/etcd_deprecation
...
bump the deprecated version to 1.22
Kubernetes-commit: ff09d509ca67a92638e30b2aa1d446ed46e6d0da
2021-03-29 19:58:11 +00:00
d21d96225a
bump the deprecated version to 1.22
...
Change-Id: Ibefaa94151704fcaaa920541bbb9a8ad714c1d24
Kubernetes-commit: e7ee76efc0813da419045c80cc06a513fba6fc37
2021-03-29 07:54:12 -07:00
92392ef221
Merge pull request #95783 from roycaihw/flake/wait-for-webhook-registration
...
webhook config manager: HasSynced returns true when the manager is synced with existing webhookconfig objects at startup
Kubernetes-commit: ae6ceaa78d6891f97589a0ffcf405f45c2caae79
2021-03-23 06:58:15 +00:00
04bf549f9a
Merge pull request #100341 from kevindelgado/apiservices-stacktrace
...
Add ability to skip OpenAPI handler installation
Kubernetes-commit: 019080fc4d32bc7acc994605afbc2fac416188d7
2021-03-18 20:58:35 -07:00
Kubernetes Publisher
Kevin Delgado
Monis Khan
Lukasz Szaszkiewicz
pacoxu
Jordan Liggitt
Abu Kashem
Niekvdplas
Brendan Burns
Antoine Pelisse
xiongzhongliang
Danil-Grigorev
Han Kang