Commit Graph

156 Commits

Author SHA1 Message Date
Wojciech Tyczyński f5d65d90e9 Avoid leaking StorageObjectCountTracker goroutine
Kubernetes-commit: 564b376812836fb1e77452d478ab16eee5101447
2022-05-15 09:57:26 +02:00
Wojciech Tyczyński 0a7c4bcca1 Cleanup etcd healthcheck on shutdown
Kubernetes-commit: cb80082f666e0e5fe220df32e31a8face18e9393
2022-05-10 11:12:08 +02:00
Jefftree e4486afb41 Separate OpenAPI V2 and V3 Config
Kubernetes-commit: 67d3dbfaae87a5bf3325fadda7266ed223766a53
2022-03-28 13:18:56 -07:00
Abu Kashem 1b651c5994 add latency tracker for storage and transform
Kubernetes-commit: eca90856940e9251ecf3fde95c5e4d2d16f5ad68
2022-02-01 18:13:03 -05:00
Kermit Alexander c679395394 Add maxLength/maxItems/maxProperties support to cel.Compile.
Kubernetes-commit: 83e4d192b136ac3a28ea26a9d09dc9fee7c6b665
2022-02-15 08:49:37 +00:00
Abu Kashem 72aa2c42fc refactor: rename webhook duration tracker
Kubernetes-commit: 4a9b9028153c6984b9cf69067cc0a1aa12a00e73
2022-02-01 15:44:59 -05:00
Paweł Banaszewski 78c055e084 Added requestSloLatencies metric
Kubernetes-commit: 0afa569499d480df4977568454a50790891860f5
2021-10-25 22:19:24 +00:00
Lukasz Szaszkiewicz 67be998d0f rename to muxAndDiscoveryComplete
Kubernetes-commit: 9e2bdfee02a6851fbb13ffe28611e9d2b6242785
2021-10-19 12:24:00 +02:00
Lukasz Szaszkiewicz 5c13ee7dbf genericapiserver: indroduce muxCompleteSignals for holding signals that indicate all known HTTP paths have been registered
the new field exists primarily to avoid returning a 404 response when a resource actually exists but we haven't installed the path to a handler.
it is exposed for easier composition of the individual servers.
the primary users of this field are the WithMuxCompleteProtection filter and the NotFoundHandler.

Kubernetes-commit: ddfbb5d2bb57ee44b3e10f0b58f9cc7001f55802
2021-10-15 18:14:20 +02:00
wojtekt c18ab3e1b1 Estimate width of the request based on watchers count in P&F
Kubernetes-commit: 223f9be59778b6ec2e44fd57df523f00e246bd95
2021-07-07 10:48:29 +02:00
wojtekt b898581360 Migrate to k8s.io/utils/clock in apiserver
Kubernetes-commit: 859a98c0358610e2c127cd2fba1be601ca975188
2021-09-14 20:36:07 +02:00
Abu Kashem 033ff70436 Revert "Merge pull request #104281 from tkashem/not-ready-429"
This reverts commit fc5863b8b276e0789f717859e8cce58d7d060181, reversing
changes made to 027fe2554fd18343b8be39eddc8ff6570a6c390f.

Kubernetes-commit: f9f08725907b7db2104ee5fe9f82ab0752726533
2021-08-31 10:10:46 -04:00
Abu Kashem 450b7e8f12 rename audit Checker interface
Kubernetes-commit: 27f150351475adaef416bd893403e7066b70d33a
2021-03-24 13:07:21 -04:00
Abu Kashem f3ae70d0cf send retry-after until ready
Kubernetes-commit: 6e3923d0a4f4720d2d9f628eb9c073d2d3ee291a
2021-08-10 12:03:21 -04:00
Abu Kashem 030819c510 apiserver: refactor WithRetryAfter server filter
Kubernetes-commit: 83889ae5940036d89b9822a1e38f0f939308e408
2021-08-09 18:25:29 -04:00
Abu Kashem ffb869e08f apiserver: add a new mode for graceful termination
add a new mode for graceful termination with the new server run option
'shutdown-send-retry-after'
- shutdown-send-retry-after=true: we initiate shutdown of the
  HTTP Server when all in-flight request(s) have been drained. during
  this window all incoming requests are rejected with status code
  429 and the following response headers:
    - 'Retry-After: N' - client should retry after N seconds
    - 'Connection: close' - tear down the TCP connection
- shutdown-send-retry-after=false: we initiate shutdown of the
  HTTP Server as soon as shutdown-delay-duration has elapsed. This
  is in keeping with the current behavior.

Kubernetes-commit: 3182b69e970bd1fd036ff839fdf811f14e790244
2021-07-14 10:39:29 -04:00
Abu Kashem bd2ef9810a apf: estimate list width
Kubernetes-commit: 296c18ec323328bf1c6a621a9ca3a094d78bb9d0
2021-06-22 19:38:00 -04:00
Abu Kashem feb4eefe1c apiserver: add callback to get notified of object count
Kubernetes-commit: 2c60feffbee690af4632d068158e640abe10f678
2021-07-14 16:44:34 -04:00
wojtekt b4c306e1e8 Rename width to workEstimate in P&F code
Kubernetes-commit: 73211256e8f15cf84ee69d6fe8258c3a912e0f94
2021-07-13 15:10:58 +02:00
Ryan Phillips 7afffd8ef3 Revert "apiserver: add callback to get notified of object count"
Kubernetes-commit: d95b14e1abfb5ec87248e5dd826b89d0c738af42
2021-07-08 13:56:39 -05:00
Abu Kashem d929410e13 apiserver: add callback to get notified of object count
Kubernetes-commit: 1002b0d163dd948334f10b0e25d0e91d253791e8
2021-06-18 10:44:07 -04:00
Lukasz Szaszkiewicz 3f407f0668 rename terminationSignals to lifecycleSignals
Kubernetes-commit: dae08bc3a735e50845af7cf639bdbb8971a2115a
2021-07-02 12:28:07 +02:00
Abu Kashem 5c1642946b apiserver: refactor graceful termination logic
- refactor graceful termination logic so we can write unit tests
  to assert on the expected behavior.

Kubernetes-commit: d85619030e3a5fec5960ad00136e8d9bd030b5f8
2021-06-24 15:51:38 -04:00
David Ashpole 5927da0040 Add distributed tracing to the apiserver using OpenTelemetry
Kubernetes-commit: 79550ed40c67a70534c1cb697e1fb7e7dbf96335
2021-06-25 05:20:16 -07:00
Daniel Smith a08d7d5ddf Make logged verbs match metric-reported verbs
Kubernetes-commit: 54fde5d119f8bb55aec18cb5aef01b6ea58dfea0
2021-06-16 17:08:54 -07:00
Abu Kashem 3c7f54740f apf: add plumbing to estimate width" of a request
- add plumbing that allows us to estimated "width" of a request
- the default implementation returns 1 as the "width" of all
  incoming requests, this is in keeping with the current behavior.

Kubernetes-commit: 9b72eb1929a64b9d5a5234090a631ba312fb4d41
2021-05-11 07:03:05 -04:00
David Eads 2286099903 update integration tests to reflect the kube version to stop serving removed APIs
Kubernetes-commit: d6a4afa5b8f6b7a17868649ea40b370c7f12a37f
2021-05-11 15:17:40 -04:00
Gautier Delorme af9424d2c9 remove go-openapi/spec
Signed-off-by: Gautier Delorme <gautier.delorme@gmail.com>

Kubernetes-commit: 34b0fcef5fc47e3fcddf7f6ca1b3e6176b2a5323
2021-04-20 17:48:33 +02:00
Shihang Zhang 87ac3f57d4 allow multiple of --service-account-issuer
Kubernetes-commit: 925900317e43e58435082f624f5969e3cfe25c67
2021-04-15 09:50:43 -07:00
Abu Kashem f1a76db888 apiserver: manage audit ID associated with a request
Manage the audit ID early in the request handling logic so that it can
be used by different layers to improve correlation.
- If the caller does not specify a value for Audit-ID in the request
  header, we generate a new audit ID
- If a user specified Audit-ID is too large, we truncate it
- We echo the Audit-ID value to the caller via the response
  Header 'Audit-ID'

Kubernetes-commit: 31653bacb9b979ee2f878ebece7e25f79d3f9aa6
2021-03-02 19:22:39 -05:00
Abu Kashem 1e7338b1ea use request received timestamp in httplog
Kubernetes-commit: 71199664be6d26e435a78566818379ff43110352
2021-03-02 18:05:51 -05:00
Kevin Delgado a11399dd98 Add ability to skip OpenAPI handler installation
Kubernetes-commit: 66d2f4359efadd2cf85f9d901676f2ea28555951
2021-03-17 00:26:23 +00:00
Marek Siarkowicz f4899d2eda Allow adding healthz and livez checks independent to each other
Kubernetes-commit: 67f3204b408ce71bab1f3c6102f8c06f50919337
2021-02-13 17:29:34 +01:00
Abu Kashem 026eb846a4 apiserver: plumb context with request deadline
- as soon as a request is received by the apiserver, determine the
  timeout of the request and set a new request context with the deadline.
- the timeout filter that times out non-long-running requests should
  use the request context as opposed to a fixed 60s wait today.
- admission and storage layer uses the same request context with the
  deadline specified.

we use the default timeout enforced by the apiserver:
- if the user has specified a timeout of 0s, this implies no timeout on the user's part.
- if the user has specified a timeout that exceeds the maximum deadline allowed by the apiserver.

Kubernetes-commit: e416c9e574c49fd0190c8cdac58322aa33a935cf
2020-11-26 23:53:20 -05:00
KeZhang 23abb6c50f Fix HSTS Missing From HTTPS Server(Nessus Scanner)
Kubernetes-commit: 4801f4d25506dbfed834c67e3fc363bfab54a48e
2020-11-12 16:10:58 +08:00
drfish 385e831c2d Fix typo in apiserver config.file file
Kubernetes-commit: 3d51cbef6b099db14bd5bf966be46cecc1514a47
2020-06-20 22:26:18 +08:00
Jordan Liggitt cec339c07a Revert "plumb context with request deadline"
This reverts commit 83f869ee1350da1b65d508725749fb70d0f535f2.

Kubernetes-commit: afd92b3b3ea8fa8e3dbe2521d6ce213c809d25c7
2020-11-19 18:15:04 -05:00
Abu Kashem 46e3e4810e plumb context with request deadline
- as soon as a request is received by the apiserver, determine the
timeout of the request and set a new request context with the deadline.
- the timeout filter that times out non-long-running requests should
use the request context as opposed to a fixed 60s wait today.
- admission and storage layer uses the same request context with the
deadline specified.

Kubernetes-commit: 83f869ee1350da1b65d508725749fb70d0f535f2
2020-10-30 16:30:05 -04:00
yue9944882 a4a3fc9b87 APF: graduate API and types to beta
Signed-off-by: Adhityaa Chandrasekar <adtac@google.com>

Kubernetes-commit: 849be447f563fc93a27a0827fb1185b885b57114
2020-11-04 16:33:14 +08:00
Lukasz Szaszkiewicz 383e99f309 stops puting a stacktrace of aborted requests in the logs
Aborted requests are the ones that were disrupted with http.ErrAbortHandler.
For example, the timeout handler will panic with http.ErrAbortHandler when a response to the client has been already sent
and the timeout elapsed.

Additionally, a new metric requestAbortsTotal was defined to count aborted requests. The new metric allows for aggregation for each group, version, verb, resource, subresource and scope.

Kubernetes-commit: 057986e32c1bb7284b0edbc161f0380f1548492f
2020-09-24 10:07:24 +02:00
Haowei Cai 21ce34e628 return a Status formatted JSON response
Kubernetes-commit: 8a1d8f7fd58ee7eaa9a8985048a56e02c9ad40c1
2020-11-04 22:29:52 -08:00
Chao Xu 5533252037 Add a generic filter that blocks certain write requests before
StorageVersions are updated during apiserver bootstrap.

Also add a poststarthook to the aggregator which updates the
StorageVersions via the storageversion.Manager

Kubernetes-commit: 721897871697db007c2439ac298c579c0f201388
2020-02-24 15:36:08 -08:00
Haowei Cai 8e0bbdb835 add kube-apiserver-lease-controller poststart hook
Kubernetes-commit: 3761a00e5b4bd1fab01f0b6682830aa1ef86a131
2020-10-26 13:17:00 -07:00
staebler a541a1b602 do not allow inflight watermark histograms to fall too far behind
The MaxInFlight and PriorityAndFairness apiserver filters maintain
watermarks with histogram metrics that are observed when requests
are handled. When a request is received, the watermark observer
needs to fill out observations for the entire time period since the
last request was received. If it has been a long time since a
request has been received, then it can take an inordinate amount of
time to fill out the observations, to the extent that the request
may time out. To combat this, these changes will have the filters
fill out the observations on a 10-second interval, so that the
observations never fall too far behind.

This follows a similar approach taken in
9e89b92a92c02cdd2c70c0f52a30936e9c3309c7.

https://github.com/kubernetes/kubernetes/issues/95300

The Priority-and-Fairness and Max-in-Flight filters start goroutines to
handle some maintenance tasks on the watermarks for those filters. Once
started, these goroutines run forever. Instead, the goroutines should
have a lifetime tied to the lifetime of the apiserver.

These changes move the functionality for starting the goroutines to
a PostStartHook. The goroutines have been changed to accept a stop channel
and only run until the stop channel is closed.

Kubernetes-commit: 6c9b86646871f13a4431361310ba6a0785372053
2020-10-05 11:26:48 -04:00
Abu Kashem 130dbfbda2 Enable filter latency tracking for request filters
Enable filter latency tracking for the following request filters:
- apf (priority and fairness)
- authentication
- authorization
- impersonation
- audit

Kubernetes-commit: 62431047b46c5949eaf592825712098d7280c4c0
2020-10-13 18:22:49 -04:00
Abu Kashem 50cce843c9 Take into account latency incurred in server filters
apiserver_request_duration_seconds does not take into account the
time a request spends in the server filters. If a filter takes longer
then the latency incurred will not be reflected in the apiserver
latency metrics.

For example, the amount of time a request spends in priority and
fairness machineries or in shuffle queues will not be accounted for.

- Add a server filter that attaches request received timestamp to the
request context very early in in the handler chain (as soon as
net/http hands over control to us).
- Use the above received timestamp in the apiserver latency metrics
apiserver_request_duration_seconds.
- Use the above received timestamp in the audit layer to set
RequestReceivedTimestamp.

Kubernetes-commit: d74ab9e1a4929be208d4529fd12b76d3fcd5d546
2020-09-18 16:46:07 -04:00
Mike Spreitzer b1ede52e21 Make sampleAndWaterMarkHistograms not fall very far behind
Kubernetes-commit: 9e89b92a92c02cdd2c70c0f52a30936e9c3309c7
2020-08-20 16:43:11 -04:00
wojtekt 54adf136f5 Fix /readyz to contain informer-sync
Kubernetes-commit: 5b4ab8f41ba574d5b3a70d7141dc348835c9f5e4
2020-08-04 08:51:40 +02:00
Joe Betz 97937c66f2 Revert nested trace PR#88936
Kubernetes-commit: 02cf58102a61b6d1e021e256381ff750573ce55d
2020-07-20 09:55:05 -07:00
Joe Betz 7a467399ac Enable nested tracing, add request filter chain tracing incl. authn/authz tracing
Kubernetes-commit: b12ac0abc64adb71d97fbde12f373b1424631f20
2020-03-06 16:11:21 -08:00