Commit Graph

3357 Commits

Author SHA1 Message Date
Andrew DeMaria 81abb60d67 generate fully qualified type references
Currently type references for non-local names are output as relative
types which is subject to the resolution rules as defined at
https://protobuf.com/docs/language-spec#reference-resolution
This works fine within the k8s.io namespace where no subpackages are
named k8s, but other users of go-to-protobuf likely have k8s in their
package name. This causes conflicts in the search resolution when
executing `go-to-protobuf`:

```
company.example.com/k8s/custom/pkg/apis/custom.k8s.example.com/v1/generated.proto:64:12: "k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta" is resolved to "company.example.com.k8s.custom.pkg.apis.custom.k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta", which is not defined. The innermost scope is searched first in name resolution. Consider using a leading '.'(i.e., ".k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta") to start from the outermost scope.
```

To avoid this we can output fully qualified type references using a
preceding dot (.)

This results in a change for k8s generated.proto files, but the
effect is a noop.

Fixes kubernetes/code-generator#147

Signed-off-by: Andrew DeMaria <ademaria@cloudflare.com>

Kubernetes-commit: 9edf1fc51c56d565348c48f3765cf094518ba7ed
2023-03-20 18:02:14 -06:00
Davanum Srinivas a22f7973bf Rename `cluster` to `storage_cluster_id` for apiserver_storage_size_bytes metric
Signed-off-by: Davanum Srinivas <davanum@gmail.com>

Kubernetes-commit: fb5140f562289f3ffe596b4a3af4650b850a0941
2024-04-11 15:06:03 -04:00
Marek Siarkowicz 7a3a726271 Undo double run of the TestWatchSemantics test to avoid hitting timeout
Kubernetes-commit: 225749eb68b3aa3485a1f2dc5d0cafb5dfe53421
2024-03-19 15:16:52 +01:00
Sean Sullivan 5e1f7568bd adds portforward streamtunnel unit tests
Kubernetes-commit: ffafb2b9ca94c14c07fb6c1fc75fccd3aba26f1f
2024-03-06 16:37:17 -08:00
Marek Siarkowicz 13a815b7c8 Serve watch without resourceVersion from cache and introduce a WatchFromStorageWithoutResourceVersion feature gate to allow serving watch from storage.
Kubernetes-commit: 0130072b053f85fb736c24d34552208cdd1bccfe
2024-03-14 15:20:29 +01:00
Marek Siarkowicz 67b6245fc3 Fix enabling consistent list from watch cache also works for resourceVersion=0
Kubernetes-commit: 0b8e79580eb3a63ca7707626b4894adfb9125586
2024-03-04 19:35:34 +01:00
Lukasz Szaszkiewicz b8c7d7868f apiserver/storage/cacher: deflake TestGetListNonRecursiveWithConsistentListFromCache
Kubernetes-commit: c44cc9a575f3bf1248b2fdc8e3a7ba61ab844618
2024-03-14 09:08:29 +01:00
Lukasz Szaszkiewicz a2c5722d64 apiserver/storage/cacher: decrease running time of TestWatchNotHangingOnStartupFailure
before:
go test -v -race -count 1 -run ^TestWatchNotHangingOnStartupFailure$
ok  	k8s.io/apiserver/pkg/storage/cacher	6.775s

after:
go test -v -race -count 1 -run ^TestWatchNotHangingOnStartupFailure$
ok  	k8s.io/apiserver/pkg/storage/cacher	2.781s

Kubernetes-commit: f5d945eb43c7bf8036a4bad8c22448e1146a7498
2024-03-14 08:59:47 +01:00
Lukasz Szaszkiewicz c14671349b apiserver/storage/cacher: decrease of running time of TestWaitUntilWatchCacheFreshAndForceAllEvents
The individual cases can be safely run in parallel.

Before
go test -race  -run TestWaitUntilWatchCacheFreshAndForceAllEvents
ok  	k8s.io/apiserver/pkg/storage/cacher	10.787s

After:
go test -race  -run TestWaitUntilWatchCacheFreshAndForceAllEvents
ok  	k8s.io/apiserver/pkg/storage/cacher	4.857s

Kubernetes-commit: 3ecbb4dee00a5dd1e43e24a5952c2a90ef507ef1
2024-03-12 10:50:44 +01:00
Lukasz Szaszkiewicz 361687d2ad apiserver/storage/cacher: decrease the running time of tests in the cacher package.
It turns out that kube has a custom timeout for tests of 3 minutes.
The tests in the cacher package are utilizing nearly the
entire time and are being terminated, resulting in failing jobs.

Before the change, the TestWatchSemantics took ~43s to run. With this simple change, it now takes ~18s.

When we created the tests, we didn't measure the running time and assumed that waiting 1 second on a watch channel
to make sure no more events are received was sufficient.
This PR decreases the waiting time to 300 milliseconds.
Modern computers can perform many tasks within that time.
In addition to that, the tests are serial in nature, meaning that there is no other
actor that could add items to the database, which could result in receiving new items.

After the change the total running time decreased by 17%.
Before the tests needed ~176s after they need ~146s.
The changes also improved TestWatchSemanticInitialEventsExtended.

Kubernetes-commit: 5a74c8e2202044b664efce4be5d86d700e74506f
2024-03-12 09:15:55 +01:00
Lukasz Szaszkiewicz 80f9ab2a6a apiserver/storage/cacher: decrease of running time of TestEmptyWatchEventCache
updates the test to wait 300 ms instead of 3s
the watch was established otherwise
we would be blocking on a call to cache.Watch(...)
in addition to that, the tests are serial in nature,
meaning that there is no other actor
that could add items to the database,
which could result in receiving new items.

Before:
go test -race  -run TestEmptyWatchEventCache
ok  	k8s.io/apiserver/pkg/storage/cacher	8.450s

After:
go test -race  -run TestEmptyWatchEventCache
ok  	k8s.io/apiserver/pkg/storage/cacher	2.635s

Kubernetes-commit: 926122c035a4f47a880db24d1a0be7ec129dd44d
2024-03-12 13:34:04 +01:00
Marek Siarkowicz 483da2032d Fix non-recursive list when consistent list from cache is enabled
Kubernetes-commit: a527cab9fce0b0234db8b4e1e95a0fc20e135df1
2024-03-04 17:59:04 +01:00
Marek Siarkowicz 3a83dc12eb Fix SetFeatureGateDuringTest handling of Parallel tests
Stop using defer as parallel subtest will might result in main test
finishing before subtest.

Fatal when same flag is set twice.

Kubernetes-commit: 9fcf279e2b91e7549190a433373f256fb5aebe85
2024-03-05 21:56:40 +01:00
Monis Khan aa18faf137 Mark StructuredAuthenticationConfiguration feature gate as beta
Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: bc7aa13bf793148b0c6b3b51fd9a8e17bb412712
2024-03-05 10:39:44 -05:00
Anish Ramasekar ee481149d7 Add metrics for authentication config reload
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: 62ac88b9ea5dace6a61b784f4654fcf379b958e2
2024-03-09 13:29:56 -08:00
Monis Khan 5b4b237d07 Require email_verified to be used when email is set as username via CEL
Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: 121607e80963370c1838f9f620c2b8552041abfc
2024-03-05 17:20:18 -05:00
Anish Ramasekar bc65af8e04 Support multiple JWT authenticators with structured authn config
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: 39e1c9108c0802024ebb01ad2286b2f09f63798e
2024-02-21 15:19:25 -08:00
Anish Ramasekar f09dddfc89 Duplicate v1alpha1 AuthenticationConfiguration to v1beta1
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: b502aa6f31d3f55ce87cafdf3eb5e3fb87e74b50
2024-03-04 23:37:31 -08:00
Tim Allclair 337f031e71 Stop appending AppArmor status to node ready condition
Kubernetes-commit: 24537a91317f9fd125ee805cd0b781358ac86f35
2024-02-21 13:11:07 -08:00
cici37 be9c733e9d Promote ValidatingAdmissionPolicy to GA.
Kubernetes-commit: de506ce7ac9981c8253b2f818478bb4093fb7bb6
2024-01-23 22:10:40 +00:00
Jiahui Feng 8f8266ef89 update to inject only the list of excluded resources.
Kubernetes-commit: 6b03166beda6e550ebcbed1bb7d9ca2cc1d94df4
2024-03-05 10:27:35 -08:00
Jiahui Feng a86b013fb6 make ValidatingAdmissionPolicy ignore excluded resources.
Kubernetes-commit: 64ee859aa82c17daa8037e4e90e066ae4582d653
2024-02-28 15:31:44 -08:00
Jiahui Feng b1e2103ed5 add resource filter to admission initializer.
Kubernetes-commit: 5b1fffa3e40b812e81ede244f671c90e3428e2ec
2024-02-28 15:31:18 -08:00
Monis Khan 37809637af Fix AuthenticationConfiguration docs around nested claims via CEL
Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: 290f2a7e1b62d2bfce2363ec528155a9748e0adb
2024-03-05 12:01:11 -05:00
Lukasz Szaszkiewicz b3f5f43260 storage/cacher: mark the addition of a metric for waitUntilFreshAndBlock as completed
Kubernetes-commit: 221ad9f7c25cc4da36e97c5feca3fc60bbe5bbfa
2024-03-05 10:23:23 +01:00
Monis Khan 9432b4df38 Prevent conflicts between service account and jwt issuers
Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: 05e1eff7933a440595f4bea322b54054d3c1b153
2024-02-27 17:11:18 -05:00
Jordan Liggitt 4d70dec65c Promote StructuredAuthorizationConfiguration feature gate to beta
Kubernetes-commit: 30256c8909ab8c30a64f786361543768f2719c77
2024-03-02 02:12:36 -05:00
Marek Siarkowicz 743b53428c Test that separation of streams work by using progress notifies
Kubernetes-commit: 1cf4cec449cb29718a694e25f4750452af3f491d
2024-02-29 17:51:46 +01:00
Marek Siarkowicz e810084a4b Prevent watch cache starvation, by moving its watch to separate RPC and add a SeparateCacheWatchRPC feature flag to disable this behavior
Kubernetes-commit: 31d404b182d2985ce0d3c43f75d80c29a708beda
2024-02-27 11:25:42 +01:00
Sean Sullivan 0376e5de57 adds comments to tunnelingResponseWriter
Kubernetes-commit: 3d56ff21fd3c9c9da82ff22044691ef0671ac7b6
2024-03-04 11:10:17 -08:00
Jordan Liggitt 9610424488 Fix headerInterceptingConn handling
Kubernetes-commit: 2443b3fa694462ab0438f10dea38557edea4d4e7
2024-03-02 17:57:39 -05:00
Sean Sullivan f4bc37078e portforward: tunnel spdy through websockets
Kubernetes-commit: 8b447d8c97e8823b4308eb91cf7d75693e867c61
2024-02-21 08:56:07 +00:00
Jordan Liggitt 9adb3ee3c0 Add authorization webhook duration/count/failopen metrics
Kubernetes-commit: 79b344d85e3e2f8f3192a3dcabb384cfe87136a6
2024-03-02 01:44:28 -05:00
Sunil Shivanand 9ffd1e2039 Add apiserver_watch_cache_read_wait metric to cache refresh time
Signed-off-by: Sunil Shivanand <padlar@live.com>

Kubernetes-commit: e6ed0f37c65fb22c16f5afa408bc4de166070ebc
2024-02-08 12:39:50 +01:00
xigang 2eff540b7c cleanup: if triggerValue has a value, fast break
Signed-off-by: xigang <wangxigang2014@gmail.com>

Kubernetes-commit: d72448a41c24911a57b24cabdef3ca63ee048bd4
2024-03-04 10:29:31 +08:00
Anish Ramasekar f2c6133c7f Add `DiscoveryURL` to AuthenticationConfiguration
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: 84852ff56f952b4c3daab920d119d24c2e6a3476
2024-02-07 01:41:52 +00:00
Jordan Liggitt 4153027735 Duplicate v1alpha1 AuthorizationConfiguration to v1beta1
Kubernetes-commit: 0605a75c5e3590e2b0ab80d2163a76c4e77f4380
2024-03-02 01:56:29 -05:00
Jordan Liggitt 59cba35b06 Fix discovery v2 conversion registration data race
Kubernetes-commit: 0e9cdf76ad2e21166dd5b72f7b0c2450d648c906
2024-03-01 19:29:39 -05:00
Rita Zhang b7a30e3bfb add authz webhook matchcondition metrics
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>
Signed-off-by: Jordan Liggitt <liggitt@google.com>
Co-authored-by: Jordan Liggitt <liggitt@google.com>

Kubernetes-commit: e76fce75666beb2771dfa15a10700f18d2d15d85
2024-02-29 20:55:32 -08:00
Anish Ramasekar 7b0c197f53 cleanup structured authn/authz error logic
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: c2c4f4616d4ecea9fad5b994cdc72e3f96728962
2024-01-25 22:45:19 +00:00
Jefftree d8d3b8c351 Use v2 types with agg discovery
Kubernetes-commit: 462dd326c2e98d937a96d49002883000efe4b2d6
2024-01-19 16:13:47 -05:00
Jefftree 7c8cdebce9 Promote AggregatedDiscovery to GA
Kubernetes-commit: 301e804c3f2fb3935c2cf3d2a04967f47921fc99
2024-02-27 16:59:46 -05:00
Jefftree fc2ef69449 Remove test for disabling aggregated discovery
Kubernetes-commit: 0593746f6093a5a59a7a047f03a4139275fcaf11
2024-02-27 18:27:54 -05:00
Tim Hockin 5624a05672 Remove defunct references to "vendor"
Kubernetes-commit: d772f7719dc55ebfec2e9461b6e14bf17f5301df
2024-01-15 15:56:21 -08:00
Tim Hockin 541bc37de9 Fix go-to-protobuf wrt gengo/v2
There's some very fishy-smelling logic in here, but this commit is
trying to be as focused as possible.

The *.pb.go diffs are the "name" encoded in the descriptor.  The
descriptor blobs can be decoded by this program (thanks StackOverflow!):

```
package main

import (
	"bytes"
	"compress/gzip"
	"encoding/json"
	"fmt"
	"os"

	"io/ioutil"

	proto "github.com/golang/protobuf/proto"
	dpb "github.com/golang/protobuf/protoc-gen-go/descriptor"
)

func main() {
	m := map[string][]byte{
		"before": blobv1,
		"after":  blobv2,
	}
	arg := os.Args[1]
	dump(m[arg])
}

func dump(bytes []byte) {
	fd, err := decodeFileDesc(bytes)
	if err != nil {
		panic(err)
	}
	b, err := json.MarshalIndent(fd, "", "  ")
	if err != nil {
		panic(err)
	}
	fmt.Println(string(b))
}

// decompress does gzip decompression.
func decompress(b []byte) ([]byte, error) {
	r, err := gzip.NewReader(bytes.NewReader(b))
	if err != nil {
		return nil, fmt.Errorf("bad gzipped descriptor: %v", err)
	}
	out, err := ioutil.ReadAll(r)
	if err != nil {
		return nil, fmt.Errorf("bad gzipped descriptor: %v", err)
	}
	return out, nil
}

func decodeFileDesc(enc []byte) (*dpb.FileDescriptorProto, error) {
	raw, err := decompress(enc)
	if err != nil {
		return nil, fmt.Errorf("failed to decompress enc: %v", err)
	}

	fd := new(dpb.FileDescriptorProto)
	if err := proto.Unmarshal(raw, fd); err != nil {
		return nil, fmt.Errorf("bad descriptor: %v", err)
	}
	return fd, nil
}

var blobv1 = []byte{
	// insert proto "before" blob here
}

var blobv2 = []byte{
	// insert proto "after" blob here
}
```

Running this with "before" and "after" args, and diffing the output
yields something like:

```diff
--- /tmp/a	2023-12-23 23:57:04.748090836 -0800
+++ /tmp/b	2023-12-23 23:57:11.000040973 -0800
@@ -1,5 +1,5 @@
 {
-  "name": "k8s.io/kubernetes/vendor/k8s.io/api/admission/v1/generated.proto",
+  "name": "k8s.io/api/admission/v1/generated.proto",
   "package": "k8s.io.api.admission.v1",
   "dependency": [
     "github.com/gogo/protobuf/gogoproto/gogo.proto",
```

Kubernetes-commit: b0a70dec4ab4cb9f972cf39a81ca5e5555417227
2023-12-24 10:01:42 -08:00
Igor Velichkovich fc7cf5fb84 kep-3716 GA, remove feature gate
Kubernetes-commit: a51a5b462236d5eb87e6d690065f884c281a833c
2024-02-28 10:45:51 -06:00
Anish Ramasekar b3e4dc29ef add min valid jwt payload to API docs for structured authn config
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: b57d7d6ad79ed0a2a8359144c07eadeef0ea3fd3
2024-02-22 16:33:24 -08:00
Lukasz Szaszkiewicz 816c9a3d12 apiserver/storage: improve RunWatchSemanticInitialEventsExtended test
changes the test to populate the underlying data store with
more data to trigger potential ordering issues.

Kubernetes-commit: 20ded275705a6e11c1113cbeedad4de94e2dc666
2024-01-10 11:08:35 +01:00
Joe Betz 414d2e2d63 Add selectableFields to CRDs
Kubernetes-commit: 291703482d58ae030da71c6d671a96a6f960fc6f
2024-02-28 14:06:06 -05:00
Wojciech Tyczyński 45b7f21179 Ensure that initial events are sorted for WatchList
Kubernetes-commit: 92bdc7b3873800e6130176e49acdf5e17110e5b9
2023-09-26 18:39:44 +02:00