f01be2e04b
Updated & added visibility to apiserver x509 test certificates expiring this year
...
Kubernetes-commit: 12795107a1685d3701425db9119546b3b77b6e19
2024-05-02 23:22:55 +00:00
2f368abc9f
Remove unused NewSecure function in requestheader.go
...
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
Kubernetes-commit: 699d1f1b7a14fea4d97c41854b6428e0b6313c2c
2024-04-29 11:19:54 -07:00
7d59581b90
apiserver/options: avoid segfault by handling unset core k8s client
...
Fixes: https://github.com/kubernetes/apiserver/issues/108
Signed-off-by: Andrew DeMaria <ademaria@cloudflare.com>
Kubernetes-commit: b2d1aef1e3800c73e266131e585069eb3b177591
2024-04-22 12:50:23 -06:00
eca9e91401
Fix data race in apiserver mux handler
...
Signed-off-by: cyclinder <kuocyclinder@gmail.com>
Kubernetes-commit: 6a194182a141665cfcb9b03815d77cd1e468d34e
2024-02-20 14:34:22 +08:00
fd60fafe9c
Deflake watchcache tests
...
Kubernetes-commit: 6d9edcc694415d4c1a897c4312ecd872a7f0fbf3
2024-04-29 14:26:25 +02:00
5ea67c789a
apiserver + controllers: enhance context support
...
27a68aee3a4834 introduced context support for events. Creating an event
broadcaster with context makes tests more resilient against leaking goroutines
when that context gets canceled at the end of a test and enables per-test
output via ktesting.
The context could get passed to the constructor. A cleaner solution is to
enhance context support for the apiserver and then pass the context into the
controller's run method. This ripples up the call stack to all places which
start an apiserver.
Kubernetes-commit: b92273a760503cc57aba37c4d3a28554f7fec7f8
2023-12-01 09:00:59 +01:00
d8646c593d
drop deprecated workqueue NewNamed package
...
Signed-off-by: liyuerich <yue.li@daocloud.io>
Kubernetes-commit: 98dfaed4bec33b4995572685eb084d8202ac235b
2023-10-16 18:11:17 +08:00
2b7a0cfef8
Add FeatureSupportChecker for etcd storage
...
Kubernetes-commit: 70e65eee46cbf72efabe8440a92117d1fedf6497
2024-04-23 16:58:01 +03:30
74fb076497
Cleanup defer from SetFeatureGateDuringTest function call
...
Kubernetes-commit: 3ee81787685e47a7a5da22423c8ca4455577ecb3
2024-04-23 10:39:47 +02:00
5571570302
Remove workarounds for https://github.com/etcd-io/etcd/issues/17507
...
Kubernetes-commit: a08d1b5f3286c6f3698abf59022055dc0b4b922f
2024-04-23 12:27:03 +02:00
0e8e550153
Upgrade etcd libraries to v3.5.13
...
Add otelgrpc.WithMessageEvents(otelgrpc.ReceivedEvents, otelgrpc.SentEvents) to tracing options due to https://github.com/open-telemetry/opentelemetry-go-contrib/pull/3964
Kubernetes-commit: 3e5b03eb433ee359782f5aa6e9368ab2a0d0370c
2024-04-23 11:10:37 +02:00
1412222ded
feature: add name formats library to CEL
...
Kubernetes-commit: 0ed65fca7a2e5fc643102952b5361fdeeedde4b5
2024-02-28 18:04:33 -08:00
26d34beacd
test: typecheck cel test cases
...
Kubernetes-commit: 11a6edfc887f3bc983165d19b05fca566ed82ba7
2024-04-19 13:52:22 -07:00
63c6cc2b91
add trivial FindStructFieldNames to TypeProvider.
...
Kubernetes-commit: 73d67d86132702795685bf43f47ad167c0108b5a
2024-04-15 14:02:36 -07:00
6f6178ef97
refit cost estimator with ast.Expr
...
Kubernetes-commit: ac5391fa21fc80559f70b72c42e64d3fa7569a42
2024-04-15 13:50:04 -07:00
dcdc23d1b3
apiserver/storage/cacher: decrease running time of TestCacheWatcherDrainingNoBookmarkAfterResourceVersionReceived
...
before:
go test -v -race -count 1 -run ^TestCacheWatcherDrainingNoBookmarkAfterResourceVersionReceived$
ok k8s.io/apiserver/pkg/storage/cacher 3.792s
after:
go test -v -race -count 1 -run ^TestCacheWatcherDrainingNoBookmarkAfterResourceVersionReceived$
ok k8s.io/apiserver/pkg/storage/cacher 1.783s
Kubernetes-commit: d21b86d53a3c4c42e41f8374e537c721251a00d2
2024-03-14 10:44:51 +01:00
f687e45ec2
prioritize user EtcdOptions.StorageConfig.StorageObjectCountTracker
...
Kubernetes-commit: 587ce02d90f3c1e1bb7418753009baf63f6039b7
2024-04-18 23:02:16 +08:00
70fb342c48
Fix: StorageObjectCountTracker is nil, apf estimator got ObjectCountNotFoundErr
...
Kubernetes-commit: 4abc2b387b188d694e369e05c08effce9d23e7e7
2024-04-08 11:09:27 +08:00
d4a69afe4c
Adds apiserver proxy doc.go
...
Kubernetes-commit: 98ecfd0468c8f05bb49ddade1b71eb9683bdc1a2
2024-04-09 17:56:46 +00:00
20894ccdfa
resourcequota: use singleflight.Group to reduce apiserver load
...
relates to #22422 and #123806
Kubernetes-commit: e13ff5ece2691988503d183b495cc7c39e899647
2024-04-03 09:58:27 +02:00
1d434b32e1
Added locks when accessing dummyStorage to prevent data race
...
Removed redundant locks
Removed locks and used existing func
Kubernetes-commit: eb5d2ca9d8efd6dcbbea582920c700ae86db4132
2024-03-20 14:23:33 +05:30
b1a1768456
Relax WatchSemanticsTest to make it faster
...
Kubernetes-commit: a26ee123952eeb86467e61ff2eb744c9e736a045
2024-03-19 20:23:56 +01:00
8c4fa4e478
Remove k8s.io/apiserver ability to bind insecure ports
...
The project does not recommend using insecure ports. Even
unauthenticated TLS is an improvement since it provides confidentiality.
If you relied upon this, please update to secure serving options.
Kubernetes-commit: de302c73e9558c192fde1cd7d6dcbea7eb76e950
2024-03-18 09:25:49 -04:00
9bfd27dc1c
apiserver/storage: use metav1.InitialEventsAnnotationKey const
...
Kubernetes-commit: ed2b92c3dfb7d56155021824f0d9a61609dac051
2024-03-11 11:40:21 +01:00
d4f6eff589
apiserver/pkg/storage/utils: remove unused EverythingFunc
...
since we don't provide compatibility guarantees for the storage
package it is okay to simply remove unused function.
Kubernetes-commit: a40f25f8e6516d1a59169cf88db8b3850a8c48c7
2024-03-11 11:47:02 +01:00
561da9109f
cel: fix conversion of quantity to quantity
...
The code in ConvertToType checked for conversion into typeValue (=
"kubernetes.URL") instead of conversion into quantityTypeValue (=
"kubernetes.Quantity") and thus most likely failed with an incorrect "type
conversion error".
Kubernetes-commit: 02b4e99c9f0afa4ef9fa0283670c1515e40a5278
2024-03-04 12:23:54 +01:00
39347989da
fix for comments to ignore the request without request info
...
Signed-off-by: Ziqi Zhao <zhaoziqi9146@gmail.com>
Kubernetes-commit: 91af1145bf7b0e18a6b520a78875a1db6db29d96
2024-03-15 09:42:42 +08:00
54b3a0e7f5
add http method to span name
...
Signed-off-by: Ziqi Zhao <zhaoziqi9146@gmail.com>
Kubernetes-commit: 1aeb0ba314016f2a2cd94b0450ba097c2b165e5d
2024-03-13 13:25:36 +08:00
29913c19e4
change the integration test
...
Signed-off-by: Ziqi Zhao <zhaoziqi9146@gmail.com>
Kubernetes-commit: 02154293c76a0ea54293c82236c9025b96ea0125
2024-03-12 22:49:38 +08:00
68eb5caed4
rename apiserver trace span to http server guidelines
...
Signed-off-by: Ziqi Zhao <zhaoziqi9146@gmail.com>
Kubernetes-commit: 84b9fbbdefa3f0bcfb1c4787093aa7840079b7ce
2024-02-29 19:03:43 +08:00
d712a4ee7e
apimachinery runtime: support contextual logging
...
In contrast to the original HandleError and HandleCrash, the new
HandleErrorWithContext and HandleCrashWithContext functions properly do contextual
logging, so if a problem occurs while e.g. dealing with a certain request and
WithValues was used for that request, then the error log entry will also
contain information about it.
The output changes from unstructured to structured, which might be a breaking
change for users who grep for panics. Care was taken to format panics
as similar as possible to the original output.
For errors, a message string gets added. There was none before, which made it
impossible to find all error output coming from HandleError.
Keeping HandleError and HandleCrash around without deprecating while changing
the signature of callbacks is a compromise between not breaking existing code
and not adding too many special cases that need to be supported. There is some
code which uses PanicHandlers or ErrorHandlers, but less than code that uses
the Handle* calls.
In Kubernetes, we want to replace the calls. logcheck warns about them in code
which is supposed to be contextual. The steps towards that are:
- add TODO remarks as reminder (this commit)
- locally remove " TODO(pohly): " to enable the check with `//logcheck:context`,
merge fixes for linter warnings
- once there are none, remove the TODO to enable the check permanently
Kubernetes-commit: 5a130d2b71e5d70cfff15087f4d521c6b68fb01e
2023-11-20 20:25:00 +01:00
81abb60d67
generate fully qualified type references
...
Currently type references for non-local names are output as relative
types which is subject to the resolution rules as defined at
https://protobuf.com/docs/language-spec#reference-resolution
This works fine within the k8s.io namespace where no subpackages are
named k8s, but other users of go-to-protobuf likely have k8s in their
package name. This causes conflicts in the search resolution when
executing `go-to-protobuf`:
```
company.example.com/k8s/custom/pkg/apis/custom.k8s.example.com/v1/generated.proto:64:12: "k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta" is resolved to "company.example.com.k8s.custom.pkg.apis.custom.k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta", which is not defined. The innermost scope is searched first in name resolution. Consider using a leading '.'(i.e., ".k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta") to start from the outermost scope.
```
To avoid this we can output fully qualified type references using a
preceding dot (.)
This results in a change for k8s generated.proto files, but the
effect is a noop.
Fixes kubernetes/code-generator#147
Signed-off-by: Andrew DeMaria <ademaria@cloudflare.com>
Kubernetes-commit: 9edf1fc51c56d565348c48f3765cf094518ba7ed
2023-03-20 18:02:14 -06:00
a22f7973bf
Rename `cluster` to `storage_cluster_id` for apiserver_storage_size_bytes metric
...
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
Kubernetes-commit: fb5140f562289f3ffe596b4a3af4650b850a0941
2024-04-11 15:06:03 -04:00
7a3a726271
Undo double run of the TestWatchSemantics test to avoid hitting timeout
...
Kubernetes-commit: 225749eb68b3aa3485a1f2dc5d0cafb5dfe53421
2024-03-19 15:16:52 +01:00
5e1f7568bd
adds portforward streamtunnel unit tests
...
Kubernetes-commit: ffafb2b9ca94c14c07fb6c1fc75fccd3aba26f1f
2024-03-06 16:37:17 -08:00
13a815b7c8
Serve watch without resourceVersion from cache and introduce a WatchFromStorageWithoutResourceVersion feature gate to allow serving watch from storage.
...
Kubernetes-commit: 0130072b053f85fb736c24d34552208cdd1bccfe
2024-03-14 15:20:29 +01:00
67b6245fc3
Fix enabling consistent list from watch cache also works for resourceVersion=0
...
Kubernetes-commit: 0b8e79580eb3a63ca7707626b4894adfb9125586
2024-03-04 19:35:34 +01:00
b8c7d7868f
apiserver/storage/cacher: deflake TestGetListNonRecursiveWithConsistentListFromCache
...
Kubernetes-commit: c44cc9a575f3bf1248b2fdc8e3a7ba61ab844618
2024-03-14 09:08:29 +01:00
a2c5722d64
apiserver/storage/cacher: decrease running time of TestWatchNotHangingOnStartupFailure
...
before:
go test -v -race -count 1 -run ^TestWatchNotHangingOnStartupFailure$
ok k8s.io/apiserver/pkg/storage/cacher 6.775s
after:
go test -v -race -count 1 -run ^TestWatchNotHangingOnStartupFailure$
ok k8s.io/apiserver/pkg/storage/cacher 2.781s
Kubernetes-commit: f5d945eb43c7bf8036a4bad8c22448e1146a7498
2024-03-14 08:59:47 +01:00
c14671349b
apiserver/storage/cacher: decrease of running time of TestWaitUntilWatchCacheFreshAndForceAllEvents
...
The individual cases can be safely run in parallel.
Before
go test -race -run TestWaitUntilWatchCacheFreshAndForceAllEvents
ok k8s.io/apiserver/pkg/storage/cacher 10.787s
After:
go test -race -run TestWaitUntilWatchCacheFreshAndForceAllEvents
ok k8s.io/apiserver/pkg/storage/cacher 4.857s
Kubernetes-commit: 3ecbb4dee00a5dd1e43e24a5952c2a90ef507ef1
2024-03-12 10:50:44 +01:00
361687d2ad
apiserver/storage/cacher: decrease the running time of tests in the cacher package.
...
It turns out that kube has a custom timeout for tests of 3 minutes.
The tests in the cacher package are utilizing nearly the
entire time and are being terminated, resulting in failing jobs.
Before the change, the TestWatchSemantics took ~43s to run. With this simple change, it now takes ~18s.
When we created the tests, we didn't measure the running time and assumed that waiting 1 second on a watch channel
to make sure no more events are received was sufficient.
This PR decreases the waiting time to 300 milliseconds.
Modern computers can perform many tasks within that time.
In addition to that, the tests are serial in nature, meaning that there is no other
actor that could add items to the database, which could result in receiving new items.
After the change the total running time decreased by 17%.
Before the tests needed ~176s after they need ~146s.
The changes also improved TestWatchSemanticInitialEventsExtended.
Kubernetes-commit: 5a74c8e2202044b664efce4be5d86d700e74506f
2024-03-12 09:15:55 +01:00
80f9ab2a6a
apiserver/storage/cacher: decrease of running time of TestEmptyWatchEventCache
...
updates the test to wait 300 ms instead of 3s
the watch was established otherwise
we would be blocking on a call to cache.Watch(...)
in addition to that, the tests are serial in nature,
meaning that there is no other actor
that could add items to the database,
which could result in receiving new items.
Before:
go test -race -run TestEmptyWatchEventCache
ok k8s.io/apiserver/pkg/storage/cacher 8.450s
After:
go test -race -run TestEmptyWatchEventCache
ok k8s.io/apiserver/pkg/storage/cacher 2.635s
Kubernetes-commit: 926122c035a4f47a880db24d1a0be7ec129dd44d
2024-03-12 13:34:04 +01:00
483da2032d
Fix non-recursive list when consistent list from cache is enabled
...
Kubernetes-commit: a527cab9fce0b0234db8b4e1e95a0fc20e135df1
2024-03-04 17:59:04 +01:00
3a83dc12eb
Fix SetFeatureGateDuringTest handling of Parallel tests
...
Stop using defer as parallel subtest will might result in main test
finishing before subtest.
Fatal when same flag is set twice.
Kubernetes-commit: 9fcf279e2b91e7549190a433373f256fb5aebe85
2024-03-05 21:56:40 +01:00
aa18faf137
Mark StructuredAuthenticationConfiguration feature gate as beta
...
Signed-off-by: Monis Khan <mok@microsoft.com>
Kubernetes-commit: bc7aa13bf793148b0c6b3b51fd9a8e17bb412712
2024-03-05 10:39:44 -05:00
ee481149d7
Add metrics for authentication config reload
...
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
Kubernetes-commit: 62ac88b9ea5dace6a61b784f4654fcf379b958e2
2024-03-09 13:29:56 -08:00
5b4b237d07
Require email_verified to be used when email is set as username via CEL
...
Signed-off-by: Monis Khan <mok@microsoft.com>
Kubernetes-commit: 121607e80963370c1838f9f620c2b8552041abfc
2024-03-05 17:20:18 -05:00
bc65af8e04
Support multiple JWT authenticators with structured authn config
...
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
Kubernetes-commit: 39e1c9108c0802024ebb01ad2286b2f09f63798e
2024-02-21 15:19:25 -08:00
f09dddfc89
Duplicate v1alpha1 AuthenticationConfiguration to v1beta1
...
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
Kubernetes-commit: b502aa6f31d3f55ce87cafdf3eb5e3fb87e74b50
2024-03-04 23:37:31 -08:00
337f031e71
Stop appending AppArmor status to node ready condition
...
Kubernetes-commit: 24537a91317f9fd125ee805cd0b781358ac86f35
2024-02-21 13:11:07 -08:00
be9c733e9d
Promote ValidatingAdmissionPolicy to GA.
...
Kubernetes-commit: de506ce7ac9981c8253b2f818478bb4093fb7bb6
2024-01-23 22:10:40 +00:00
8f8266ef89
update to inject only the list of excluded resources.
...
Kubernetes-commit: 6b03166beda6e550ebcbed1bb7d9ca2cc1d94df4
2024-03-05 10:27:35 -08:00
a86b013fb6
make ValidatingAdmissionPolicy ignore excluded resources.
...
Kubernetes-commit: 64ee859aa82c17daa8037e4e90e066ae4582d653
2024-02-28 15:31:44 -08:00
b1e2103ed5
add resource filter to admission initializer.
...
Kubernetes-commit: 5b1fffa3e40b812e81ede244f671c90e3428e2ec
2024-02-28 15:31:18 -08:00
37809637af
Fix AuthenticationConfiguration docs around nested claims via CEL
...
Signed-off-by: Monis Khan <mok@microsoft.com>
Kubernetes-commit: 290f2a7e1b62d2bfce2363ec528155a9748e0adb
2024-03-05 12:01:11 -05:00
b3f5f43260
storage/cacher: mark the addition of a metric for waitUntilFreshAndBlock as completed
...
Kubernetes-commit: 221ad9f7c25cc4da36e97c5feca3fc60bbe5bbfa
2024-03-05 10:23:23 +01:00
9432b4df38
Prevent conflicts between service account and jwt issuers
...
Signed-off-by: Monis Khan <mok@microsoft.com>
Kubernetes-commit: 05e1eff7933a440595f4bea322b54054d3c1b153
2024-02-27 17:11:18 -05:00
4d70dec65c
Promote StructuredAuthorizationConfiguration feature gate to beta
...
Kubernetes-commit: 30256c8909ab8c30a64f786361543768f2719c77
2024-03-02 02:12:36 -05:00
743b53428c
Test that separation of streams work by using progress notifies
...
Kubernetes-commit: 1cf4cec449cb29718a694e25f4750452af3f491d
2024-02-29 17:51:46 +01:00
e810084a4b
Prevent watch cache starvation, by moving its watch to separate RPC and add a SeparateCacheWatchRPC feature flag to disable this behavior
...
Kubernetes-commit: 31d404b182d2985ce0d3c43f75d80c29a708beda
2024-02-27 11:25:42 +01:00
0376e5de57
adds comments to tunnelingResponseWriter
...
Kubernetes-commit: 3d56ff21fd3c9c9da82ff22044691ef0671ac7b6
2024-03-04 11:10:17 -08:00
9610424488
Fix headerInterceptingConn handling
...
Kubernetes-commit: 2443b3fa694462ab0438f10dea38557edea4d4e7
2024-03-02 17:57:39 -05:00
f4bc37078e
portforward: tunnel spdy through websockets
...
Kubernetes-commit: 8b447d8c97e8823b4308eb91cf7d75693e867c61
2024-02-21 08:56:07 +00:00
9adb3ee3c0
Add authorization webhook duration/count/failopen metrics
...
Kubernetes-commit: 79b344d85e3e2f8f3192a3dcabb384cfe87136a6
2024-03-02 01:44:28 -05:00
9ffd1e2039
Add apiserver_watch_cache_read_wait metric to cache refresh time
...
Signed-off-by: Sunil Shivanand <padlar@live.com>
Kubernetes-commit: e6ed0f37c65fb22c16f5afa408bc4de166070ebc
2024-02-08 12:39:50 +01:00
2eff540b7c
cleanup: if triggerValue has a value, fast break
...
Signed-off-by: xigang <wangxigang2014@gmail.com>
Kubernetes-commit: d72448a41c24911a57b24cabdef3ca63ee048bd4
2024-03-04 10:29:31 +08:00
f2c6133c7f
Add `DiscoveryURL` to AuthenticationConfiguration
...
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
Kubernetes-commit: 84852ff56f952b4c3daab920d119d24c2e6a3476
2024-02-07 01:41:52 +00:00
4153027735
Duplicate v1alpha1 AuthorizationConfiguration to v1beta1
...
Kubernetes-commit: 0605a75c5e3590e2b0ab80d2163a76c4e77f4380
2024-03-02 01:56:29 -05:00
59cba35b06
Fix discovery v2 conversion registration data race
...
Kubernetes-commit: 0e9cdf76ad2e21166dd5b72f7b0c2450d648c906
2024-03-01 19:29:39 -05:00
b7a30e3bfb
add authz webhook matchcondition metrics
...
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>
Signed-off-by: Jordan Liggitt <liggitt@google.com>
Co-authored-by: Jordan Liggitt <liggitt@google.com>
Kubernetes-commit: e76fce75666beb2771dfa15a10700f18d2d15d85
2024-02-29 20:55:32 -08:00
7b0c197f53
cleanup structured authn/authz error logic
...
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
Kubernetes-commit: c2c4f4616d4ecea9fad5b994cdc72e3f96728962
2024-01-25 22:45:19 +00:00
d8d3b8c351
Use v2 types with agg discovery
...
Kubernetes-commit: 462dd326c2e98d937a96d49002883000efe4b2d6
2024-01-19 16:13:47 -05:00
7c8cdebce9
Promote AggregatedDiscovery to GA
...
Kubernetes-commit: 301e804c3f2fb3935c2cf3d2a04967f47921fc99
2024-02-27 16:59:46 -05:00
fc2ef69449
Remove test for disabling aggregated discovery
...
Kubernetes-commit: 0593746f6093a5a59a7a047f03a4139275fcaf11
2024-02-27 18:27:54 -05:00
5624a05672
Remove defunct references to "vendor"
...
Kubernetes-commit: d772f7719dc55ebfec2e9461b6e14bf17f5301df
2024-01-15 15:56:21 -08:00
541bc37de9
Fix go-to-protobuf wrt gengo/v2
...
There's some very fishy-smelling logic in here, but this commit is
trying to be as focused as possible.
The *.pb.go diffs are the "name" encoded in the descriptor. The
descriptor blobs can be decoded by this program (thanks StackOverflow!):
```
package main
import (
"bytes"
"compress/gzip"
"encoding/json"
"fmt"
"os"
"io/ioutil"
proto "github.com/golang/protobuf/proto"
dpb "github.com/golang/protobuf/protoc-gen-go/descriptor"
)
func main() {
m := map[string][]byte{
"before": blobv1,
"after": blobv2,
}
arg := os.Args[1]
dump(m[arg])
}
func dump(bytes []byte) {
fd, err := decodeFileDesc(bytes)
if err != nil {
panic(err)
}
b, err := json.MarshalIndent(fd, "", " ")
if err != nil {
panic(err)
}
fmt.Println(string(b))
}
// decompress does gzip decompression.
func decompress(b []byte) ([]byte, error) {
r, err := gzip.NewReader(bytes.NewReader(b))
if err != nil {
return nil, fmt.Errorf("bad gzipped descriptor: %v", err)
}
out, err := ioutil.ReadAll(r)
if err != nil {
return nil, fmt.Errorf("bad gzipped descriptor: %v", err)
}
return out, nil
}
func decodeFileDesc(enc []byte) (*dpb.FileDescriptorProto, error) {
raw, err := decompress(enc)
if err != nil {
return nil, fmt.Errorf("failed to decompress enc: %v", err)
}
fd := new(dpb.FileDescriptorProto)
if err := proto.Unmarshal(raw, fd); err != nil {
return nil, fmt.Errorf("bad descriptor: %v", err)
}
return fd, nil
}
var blobv1 = []byte{
// insert proto "before" blob here
}
var blobv2 = []byte{
// insert proto "after" blob here
}
```
Running this with "before" and "after" args, and diffing the output
yields something like:
```diff
--- /tmp/a 2023-12-23 23:57:04.748090836 -0800
+++ /tmp/b 2023-12-23 23:57:11.000040973 -0800
@@ -1,5 +1,5 @@
{
- "name": "k8s.io/kubernetes/vendor/k8s.io/api/admission/v1/generated.proto",
+ "name": "k8s.io/api/admission/v1/generated.proto",
"package": "k8s.io.api.admission.v1",
"dependency": [
"github.com/gogo/protobuf/gogoproto/gogo.proto",
```
Kubernetes-commit: b0a70dec4ab4cb9f972cf39a81ca5e5555417227
2023-12-24 10:01:42 -08:00
fc7cf5fb84
kep-3716 GA, remove feature gate
...
Kubernetes-commit: a51a5b462236d5eb87e6d690065f884c281a833c
2024-02-28 10:45:51 -06:00
b3e4dc29ef
add min valid jwt payload to API docs for structured authn config
...
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
Kubernetes-commit: b57d7d6ad79ed0a2a8359144c07eadeef0ea3fd3
2024-02-22 16:33:24 -08:00
816c9a3d12
apiserver/storage: improve RunWatchSemanticInitialEventsExtended test
...
changes the test to populate the underlying data store with
more data to trigger potential ordering issues.
Kubernetes-commit: 20ded275705a6e11c1113cbeedad4de94e2dc666
2024-01-10 11:08:35 +01:00
414d2e2d63
Add selectableFields to CRDs
...
Kubernetes-commit: 291703482d58ae030da71c6d671a96a6f960fc6f
2024-02-28 14:06:06 -05:00
45b7f21179
Ensure that initial events are sorted for WatchList
...
Kubernetes-commit: 92bdc7b3873800e6130176e49acdf5e17110e5b9
2023-09-26 18:39:44 +02:00
e53bac21d8
storage/watch_cache: rework getAllEventsSinceLocked
...
Kubernetes-commit: ecaf2093f51fed5f544520b0ac00fb33a474b7f5
2024-02-26 12:22:05 +01:00
19bd56380e
storage/cacher: add TestGetWatchCacheResourceVersion, TestGetBookmarkAfterResourceVersionLockedFunc
...
Kubernetes-commit: d629d3fa355ec90f618663b0933d28d335489c54
2024-02-21 10:06:42 +01:00
76172aaa1f
storage/cacher: ensure the cache is at the Most Recent ResourceVersion when streaming was requested
...
Kubernetes-commit: f90bcf649e0f3dc233f49882468f949b0f00ac4f
2024-01-17 14:10:04 +01:00
b5f79f8dae
streamtranslator counter metric by status code
...
Kubernetes-commit: 03812ddb169725b0652744c2ecaa151f5c03887b
2024-02-24 03:55:17 +00:00
8485f72a96
add support for map
...
to CEL mutation library.
Kubernetes-commit: dc4c92f5a5646ed8d131a8bb8ff96b5e6b3e4bb8
2024-02-27 13:55:08 -08:00
dd139db676
refactor: use shared CollectParams from VAP
...
Kubernetes-commit: 4760e0cc44fb0ee2a92d12ee2b17f094e7ea94ec
2024-02-15 17:00:45 -08:00
9a4b2b3543
refactor: use match from generic pkg in vap
...
It is same exact code, but uses accessors now
Kubernetes-commit: 64cd09f7208e7a45d87ab6436c833c984fa6e594
2024-02-20 09:22:18 -08:00
ed64edd4e0
add generic policy dispatcher
...
similar to the generic policy source, applies common match logic
for code sharing with validating/mutating
Kubernetes-commit: 96c418a7b73f2f85be530ad9b987d70eeeab14b0
2024-02-21 13:09:49 -08:00
48e4f369ee
test: infer gvk of objects
...
avoids relying on the GVK to be written to the object
Kubernetes-commit: 11ed3032c091bab4c56d471c8d0049ccb9c20efb
2024-02-16 10:43:05 -08:00
eed515aa23
refactor: handle paramKind directly
...
remove hacks that might conceal errors
Kubernetes-commit: acf1d850c6153aae10f26ef3d3e21fa8a63b20e0
2024-02-20 09:22:35 -08:00
223ffcc3b0
add functions to policy accessors for getting match information and params
...
Kubernetes-commit: 6d5133f3ecd4ddb38a29dac69641fb56576491a2
2024-02-15 16:33:41 -08:00
c8d2257e3a
[KEP-3962]Add feature gate for MAP ( #123425 )
...
* Add feature gate for MAP
* sort feature gates.
---------
Co-authored-by: Jiahui Feng <jhf@google.com>
Kubernetes-commit: 9bc5257c450f7dfda187bfadd96f32310a2eaa18
2024-02-21 17:00:13 -08:00
d38e8187d9
Cleanup: s/depreciated/deprecated/g
...
Kubernetes-commit: 9f4b82bf3b079fe868effbd2498b61464db6d459
2024-02-18 14:50:55 -08:00
f615696539
bump the stability level of apiserver_storage_size_bytes to STABLE
...
Kubernetes-commit: f38852768e312fe7b9775b92f7228371a0a96f90
2024-02-16 09:13:46 -08:00
8e917a7cef
flake: avoid flake by ensuring params appear in the initial list
...
sometimes they would not appear in the initial list if they were added while the informer was starting up due to ObjectTracker race
Kubernetes-commit: def05a20e22f069a60f4190755e8c7244d18781c
2024-02-15 13:58:29 -08:00
fe847b31f4
Add allowed/denied metrics for authorizers
...
Kubernetes-commit: d5d3eddb95b657f03677c21498f185d70d87cdda
2024-02-16 02:26:18 -05:00
000601bdbe
Add handler to run watch serving in separate goroutine
...
This handler allows running execution prior to actual serving in a separate
goroutine when serving requests. Doing so benefits cases in serving long running
requests because it allows freeing memory used by the separate goroutine
and keeps the serving routines slim.
Signed-off-by: Eric Lin <exlin@google.com>
Kubernetes-commit: 7b2698a5e5c61b303481c2006847409fc8704746
2023-10-10 08:53:26 +00:00
c2310e1279
Implement authz config file reloading
...
Kubernetes-commit: 5dc92ada068cb80a2866cfaa1f9aa760d2524680
2023-11-08 08:49:58 -06:00
7e9e7fe668
move OWNERS from validating to all new parent policy folder
...
meant to do this in refactor PR
Kubernetes-commit: bd27c99262e73955af6af19a1d6d72fce6739522
2024-02-14 16:32:08 -08:00
1bc99127a6
Add integration test for multiple audience in structured authn
...
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
Kubernetes-commit: 0feb1d5173c94e28da79963fb296296b005dd6a1
2024-02-14 17:04:21 -08:00
6f648c15a2
Add retry around create
...
Kubernetes-commit: a05db0dd22a68a9c443a9f01cc1b8f6397fd6a9f
2024-01-19 16:10:30 -05:00
fb760be3fc
support multiple audiences with jwt authenticator
...
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
Kubernetes-commit: 18c563546a764b559ce5b74f09eaaaf9c1f0e5fb
2024-01-24 17:15:11 +00:00
26996e3679
Add AudienceMatchPolicy to AuthenticationConfiguration
...
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
Kubernetes-commit: 19da90d6396ce9471f612d6e9a31f1b1c8d605b1
2024-01-25 22:35:16 +00:00
1672796601
bugfix: avoid NPE possibility by making composition environment global
...
Kubernetes-commit: 3094395fa76210f33118d10d6a7c8214c50a7f33
2024-01-29 13:45:27 -08:00
9fd47abbb1
refactor: implement VAP off of policy plugin fw
...
Kubernetes-commit: 18fbc48b0155485cd78ec4d0e6050ccbb7d8e058
2024-01-22 17:31:52 -08:00
f8d65cf3a6
refactor: create generic policy plugin type similar to webhook
...
Kubernetes-commit: a6366573d5ca328438b80d72d0ae5a5bf6b178be
2024-01-22 17:31:34 -08:00
06be9d025c
refactor: move matching logic into parent policy folder
...
Kubernetes-commit: d697f43d73870679ad4cd46939ad28e06926b6d3
2024-01-17 18:12:41 -08:00
57e06e43f7
refactor: move vap into parent `policy` folder
...
also renames to remove stutter
comment
Kubernetes-commit: 8b14116509ac19234924878ab08f7e9e8f03549a
2024-01-17 18:09:30 -08:00
3769e5c054
refactor: move celmetrics close to its usage in vap
...
does not need to be accessed from anywhere else, and removed an excessive lonesome `cel` pkg with just the metrics
Kubernetes-commit: 8b26b6eec1b0d99518e7c53879e1d44ade2eebc7
2024-01-17 17:05:53 -08:00
f6b16dddb3
Add `apiserver_encryption_config_controller_automatic_reloads_total`
...
metric
- Adds `apiserver_encryption_config_controller_automatic_reloads_total`
metric with status label for encryption config reload success/failure.
- Deprecated `apiserver_encryption_config_controller_automatic_reload_failures_total` and `apiserver_encryption_config_controller_automatic_reload_success_total`
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
Kubernetes-commit: 77241d31253baf051302fff7480c9601ad817399
2024-02-07 19:44:41 +00:00
6f620d4d18
add test case for error inside variables.
...
Kubernetes-commit: 3e777540fda8dda01bb72702b1e39675f21d2955
2024-02-08 13:39:25 -08:00
ab64beb117
add support of variables for Type Checking.
...
Kubernetes-commit: dc832c6e59e98f8b842efe42d3f18a67e781779d
2024-02-01 15:28:21 -08:00
1501159ecb
refactor type checking to use CompositedCompiler.
...
Kubernetes-commit: 21ba0d59d3a29b5668d4ba712d5b130d458121c6
2024-02-01 13:20:21 -08:00
f099bff723
chore: adds consistent vanity import to files and provides tooling for verifying and updating them. ( #120642 )
...
* chore: drops update vanity imports from script.
* chore: changes copyright year to 2024.
* chore: makes lint happy.
Kubernetes-commit: 6d6398ef9266abce3518a4c9a3d4e4d8feeffdc1
2024-02-08 14:10:27 +00:00
554c2d262b
apiserver: allow zero value for the 'nominalConcurrencyShares' field
...
Kubernetes-commit: 5f75c35edf1ea0a10a64615c43b5868484c94f46
2024-01-26 14:27:09 -05:00
e6f368f3b9
apiserver: refactor handleError in endpoints/filters
...
Kubernetes-commit: 9e37ccedc7fbbbacf07ecc79949c75e1e250ba58
2024-01-09 13:32:09 -05:00
c60b23f298
use authentication.kubernetes.io/issued-credential-id audit annotation in serviceaccount token registry endpoint
...
Kubernetes-commit: 7f12735fffdc490eae59e98d0f03638067b028de
2024-02-02 16:57:16 +00:00
586f61dd0f
Fix the syntax error in the comment of the checkQuotas method. ( #121428 )
...
* Update controller.go
Fix comment error.
From "It there was no quota change mark the waiter as succeeded." to "If there was no quota change mark the waiter as succeeded."
* Adjust the comments to maintain consistent tense throughout.
Adjust the comments to maintain consistent tense throughout.
Kubernetes-commit: 5855f5178f42dbc114b6c5ac1964a5dd62bb0957
2024-02-06 00:45:00 +08:00
eff38efc48
apiserver: warning should not panic when request times out
...
Kubernetes-commit: 7cab0ad2d2b2688575c1d6c8b5ecee2bfa5a39ff
2023-01-26 08:56:10 -05:00
bc8676d59a
Add decoding time to the audit log
...
Kubernetes-commit: 20fe2a3539e90f7554f94359ac3b4058a5bbb363
2023-10-25 22:52:11 +08:00
43f24ff9ee
fix comment of rbac decision for NoOpinion
...
Signed-off-by: lowang_bh <lhui_wang@163.com>
Kubernetes-commit: 3579674df2df72956b34fa2593e526c02beea9d6
2023-06-06 22:36:14 +08:00
69adaecb9e
bugfix: dont skip reconcile for unchanged policy if last sync failed
...
Kubernetes-commit: 71559bd02670f53a2d6640714eeb4e7fbc554e86
2024-01-26 18:57:30 -08:00
95a53374a5
convert the expectedValues to be cel.Val.
...
Kubernetes-commit: c89dcf52b12bf5e32f71f3ed600315242f7e44f6
2024-01-25 13:52:39 -08:00
f0c47558ed
extra case for affirmative has(map) test.
...
Kubernetes-commit: d6991638029be493e5c197b6cd0d268d8ce55457
2024-01-25 13:36:42 -08:00
eb407cc3dd
fix convertField and its comments.
...
Kubernetes-commit: d0c323fb8fbfa5c1b91ae445cbda60a416e85e65
2024-01-23 16:47:33 -08:00
3a5a43790e
add support for equality check.
...
Kubernetes-commit: df9620c9f6f6a60f7cbcacb3ad9fa40d79d1d73e
2024-01-23 16:07:39 -08:00
8b89a41f3f
mutation library for CEL.
...
- TypeRef, TypeProvider interfaces.
- TypeRef, TypeProvider, ObjectVal, FieldType implementations
for unstructured.
- Tests for using optional in mutation.
Kubernetes-commit: 9bbdbc510ebf8e2dcb243d6fbbf57449f895196e
2024-01-19 17:03:34 -08:00
f709e954ab
drop deprecated pointer package
...
Signed-off-by: liyuerich <yue.li@daocloud.io>
Kubernetes-commit: e490439262fad619d83c5647a42a5382cb9c787b
2023-09-15 21:03:36 +08:00
8b49df5c88
Update env version, Add cost for previous func, add tests, etc.
...
Kubernetes-commit: 3fb679016423e80b87cf3e540d296471223460e6
2023-12-05 23:26:13 +00:00
ca8d0aaf91
client-go/reflector: make UseWatchList a pointer
...
until #115478(use streaming against the etcd storage)
is resolved the cacher need a way to disable the streaming.
Kubernetes-commit: 41e706600aea7468f486150d951d3b8948ce89d5
2024-01-19 13:48:29 +01:00
ff6a2dc722
Negative index regression test for json-patch ( #122625 )
...
* add testcase with negative index
* exercise successful negative index patching
* use different values for testing
Co-authored-by: Chris Bandy <bandy.chris@gmail.com>
---------
Co-authored-by: Chris Bandy <bandy.chris@gmail.com>
Kubernetes-commit: 83ff8a2f49f820fb355b24c65b8629710dca8a54
2024-01-18 09:31:12 +00:00
aa358081a5
fix evaluate resource quota if a resource is updated when the InPlacePodVerticalScaling feature-gate is on
...
Kubernetes-commit: 041e97af1f0ee40029dcd44abd63f84514eca59e
2024-01-11 16:04:02 +08:00
285e6ec394
Clean up encryption config reading and hashing logic
...
This is a no-op change that makes the internal encryption config
hash more specific to it use and explicitly marks it as unstable.
Signed-off-by: Monis Khan <mok@microsoft.com>
Kubernetes-commit: 9387a66c71fd85840cb199b468610b8fa950253f
2024-01-10 14:48:30 -05:00
fa628fd528
Use http/2 for localhost webhook
...
Signed-off-by: Eric Lin <exlin@google.com>
Kubernetes-commit: 246e69fb99007412c4903fe8e7ad1d8c5f25cd8e
2024-01-03 13:49:51 +00:00
7751f0aa90
remove import hack about k8s.io/utils/clock/testing
...
Kubernetes-commit: 81d040d538101b89bd8edd51bb78a58ea5bf793c
2023-11-16 12:30:14 +08:00
4e1e99b0ca
remove GA featuregate RemoveSelfLink
...
Kubernetes-commit: 3b67181c93be39244370b560f83fa7546f7c65c0
2023-12-25 00:29:38 +08:00
e7eedd15ec
move encryption config types to standard API server config location
...
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
Kubernetes-commit: 75695dae1093cc08cb56a4930c0be8e7e4433be1
2023-12-16 00:00:21 +00:00
6bad17ce50
[StructuredAuthnConfig] add comment for extra keys unique requirement
...
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
Kubernetes-commit: af8da8e01c28286feedf528e94683781a0387a99
2024-01-02 19:58:20 +00:00
febd537a31
use build-in max and min func to instead of k8s.io/utils/integer funcs
...
Kubernetes-commit: eb8f3f194fed16484162aebdaab69168e02f8cb4
2023-12-15 15:09:11 +08:00
a2e6b85db4
handlers/watch: refactor watch serving to prepare offloading
...
Signed-off-by: Eric Lin <exlin@google.com>
Kubernetes-commit: 87d817e62d8c6e93cf45bf90a7ecadfe4156ab1f
2023-11-27 10:06:50 +00:00
b6487a8ac1
Fix etcd repository path to prevent redirects.
...
Signed-off-by: James Blair <mail@jamesblair.net>
Kubernetes-commit: b6c1f8ef08c3451f17048447e107c509a8ed950e
2023-11-02 09:31:37 +13:00
ccc28d3f49
Add tests for CIDR type
...
Kubernetes-commit: b3285fa8df494ef174bbee1ccffcc5e3a58afcdd
2023-12-15 11:01:55 +00:00
f16e0c2a18
Add tests for IP type
...
Kubernetes-commit: 31f9384646a5cfd001f176454feb9c1040591e96
2023-12-08 18:16:30 +00:00
e5f605855d
Add costing estimations for IP and CIDR
...
Kubernetes-commit: e1f9aa450b7ecd62ce7284486a159d14f66c1761
2023-11-17 17:34:46 +00:00
e4fb1f737e
Add IP and CIDR libraries to CEL environment for 1.30
...
Kubernetes-commit: 4710f085b3d4dbf242085f4cb53708efc7ebbefd
2023-11-17 13:57:29 +00:00
f4ae0b7ca6
Add CIDR network CEL extension
...
This adds new CEL functions to the library for validating if a string is a CIDR notation.
This will work in conjunction with the IPAddr to allow checking if an IPAddr exists within a particular network.
Kubernetes-commit: 2f585b451232814d6563329241e96f09bfd1cb73
2023-11-15 19:04:48 +00:00
3fe1439ba9
Add special IP validations to IP CEL type
...
Kubernetes-commit: 13b22b23a1a5f8976fa608c7bc8b3048470b5c51
2023-11-17 12:51:32 +00:00
ccfdc9aba1
Add IP address CEL extension
...
This adds new CEL functions to the library for validating if a string is an IP address,
and, if it can be parsed as an IP address, adds additional accessors to get properties
of the IP address.
Kubernetes-commit: c6aa360d3ef9895323b239686719dd9223ee4f37
2023-11-15 18:35:34 +00:00
2b59a3f14c
Don't sort under lock
...
Kubernetes-commit: 3e1dbccf4d3de59b31596f1664ff5ac9c02d1eea
2023-11-23 18:13:43 +01:00
Taehoon Yoon