Commit Graph

1118 Commits

Author SHA1 Message Date
Kubernetes Publisher b77e344208 Merge pull request #56308 from yuexiao-wang/apiserver-vet
Automatic merge from submit-queue (batch tested with PRs 56308, 54304, 56364, 56388, 55853). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

fix wrong number of args in apiserver/pkg

Signed-off-by: yuexiao-wang <wang.yuexiao@zte.com.cn>

**What this PR does / why we need it**:
fix wrong number of args in apiserver/pkg

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Kubernetes-commit: 1a455f6f2da6237dc025557763b2287271735447
2017-12-15 11:49:13 +00:00
Kubernetes Publisher f274fcca88 Merge pull request #56268 from yanxuean/miss-fmt-args
Automatic merge from submit-queue (batch tested with PRs 56217, 56268, 56263, 56328, 56200). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

missing format args in apiserver/pkg/endpoints

Signed-off-by: yanxuean <yan.xuean@zte.com.cn>

**What this PR does / why we need it**:
missing format args in apiserver/pkg/endpoints

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #

**Special notes for your reviewer**:

**Release note**:
```release-note
NONE
```

Kubernetes-commit: 5aa03d978d4647afef55a3d8038cd7b494bc6b11
2017-12-15 07:49:38 +00:00
Kubernetes Publisher fd36c51190 Merge pull request #50603 from shiywang/loop
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Fix Content negotiation incorrect when Accept header uses type parame…

Fixes https://github.com/kubernetes/kubernetes/issues/50519
@smarterclayton @liggitt still wip,  I'll add some unit test soon, and simplify the logic

Kubernetes-commit: ee13444144e046a13824b5a92aa11fc16447b0c1
2017-12-12 09:30:55 +00:00
Kubernetes Publisher 73f85001b5 Merge pull request #56444 from mikedanese/morebuckets
Automatic merge from submit-queue (batch tested with PRs 55360, 56444, 56687, 56791, 56802). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

certs: add month buckets to expiration metric

7 days isn't enough warning for cert expiration alerting.

#56444

Kubernetes-commit: 3465aa93bf08fa435bd36b658e8839a3984cdd5e
2017-12-07 04:37:34 +00:00
Kubernetes Publisher ec7c680232 Merge pull request #52013 from FengyunPan/autoprobing-external-network
Automatic merge from submit-queue (batch tested with PRs 52013, 56719). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Support autoprobing floating-network-id for openstack cloud provider

Currently if user doesn't specify floatingnetwork-id and loadbalancer.openstack.org/floating-network-id annotation, openstack cloud provider can't create a external LoadBalancer service.
Actually we can get  floatingnetwork-id automatically.
If we get multiple  floatingnetwork-ids, then ask user to specify one, or we use the  floatingnetwork-id to create floatingip for external LoadBalancer service.

This is a part of #50726

**Special notes for your reviewer**:
/assign @dims

**Release note**:
```release-note
Support autoprobing floating-network-id for openstack cloud provider
```

Kubernetes-commit: 36ea6de4a0fd79b97768b9b58c634140f64fc73d
2017-12-07 04:37:06 +00:00
Kubernetes Publisher 59486b811f Merge pull request #56638 from crassirostris/audit-webhook-make-configurable
Automatic merge from submit-queue (batch tested with PRs 56790, 56638). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Make audit batch webhook backend configurable

This PR adds an ability to configure key parameters for the most important audit backend at-scale, so that if the default parameters don't fit and audit events are lost/delayed, it's possible to adjust these parameters to fix the problem. In the future those parameters will stay, but will be used to populate the values for the generic buffering backend, both for webhook and log backends.

/cc @kubernetes/sig-auth-pr-reviews @sttts @tallclair @ericchiang

```release-note
Audit webhook batching parameters are now configurable via command-line flags in the apiserver.
```

ref #54551

Kubernetes-commit: 31375e30ba64b8f25499d7271809d0b74a38c37d
2017-12-04 09:53:13 -08:00
Kubernetes Publisher f461eda4a5 Merge pull request #55704 from soltysh/return_real_error
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Return original error instead of negotiation one

**What this PR does / why we need it**:
When the requested type (eg. `text/html`) is not available and we're trying to hit an endpoint to which a user is for unauthorized we'll get 406, instead of 403. The reason for that is that, even if error happens we're trying to match the serializer, which fails and results in swallowing error, instead of returning raw json, for example.

This fix returns raw json for such situations.

**Release note**:
```release-note
NONE
```

Kubernetes-commit: 85f0a1ac42daac3fcd6e7a9431c0bcabc3c653a5
2017-12-07 04:36:37 +00:00
Kubernetes Publisher 155248fb28 Merge pull request #52910 from FengyunPan/volume-v3
Automatic merge from submit-queue (batch tested with PRs 56094, 52910, 55953, 56405, 56415). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Support VolumeV3 for OpenStack cloud Provider

Currently OpenStack supports Cinder v3 API, let Kubernetes support
it too.

Fix #52877

**Release note**:
```release-note
OpenStack cloud provider supports Cinder v3 API.
```

Kubernetes-commit: ba4b07a431a71f93d43cd7d58bcf9938a76fcb62
2017-12-07 04:36:37 +00:00
Kubernetes Publisher 922481fdd4 Merge pull request #56389 from jpbetz/metrics-memory-fix
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Reduce memory footprint of admission metrics

Fix #56061

Remove `SummaryVec` from all but the top level metric and reduce buckets for the histogram from 7 to 5.

For a small test cluster, the `Individual Memory Usage: kube-system kube-apiserver-kubernetes-master` grafana metric suggests showed the memory footprint of apiserver at 655MB before this change and 415MB after, suggesting this accounts for the vast majority of the ~200MB of memory increase found in #56061.

```release-note
None
```

Kubernetes-commit: 02a7c12cbd0dd366eb0f6ab6a1f671943a51d0a8
2017-12-07 04:36:09 +00:00
Kubernetes Publisher 2dd507a878 Merge pull request #49112 from gmarek/eventAPI
Automatic merge from submit-queue (batch tested with PRs 55952, 49112, 55450, 56178, 56151). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

New API group for Events.

Fix kubernetes/features#383

cc @shyamjvs

```release-note
Add events.k8s.io api group with v1beta1 API containing redesigned Event type.
```

Kubernetes-commit: 60c20901911c710491a57eb8b9c48850cdbab054
2017-12-07 04:36:09 +00:00
Kubernetes Publisher 97e1eeb6d9 Merge pull request #55148 from dixudx/controller_defaultGC_DeleteDependents
Automatic merge from submit-queue (batch tested with PRs 52767, 55065, 55148, 56228, 56221). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

change DefaultGarbageCollectionPolicy to DeleteDependents for workloads controllers

**What this PR does / why we need it**:
As part of the apps/v1 GA effort (kubernetes/features#353) for v1.9. For core controllers, like `Deployment`, `DaemonSet`, `ReplicaSet`, and `StatefulSet`, changing the `DefaultGarbageCollectionPolicy` from `OrphanDependents` to `DeleteDependents` will make these objects consistent with the default behavior for all new objects.

For legacy API versions, the `DefaultGarbageCollectionPolicy` remains `OrphanDependents`.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
ref #55027

**Special notes for your reviewer**:
/cc @enisoc @caesarxuchao @kow3ns
/assign @kubernetes/sig-apps-api-reviews

**Release note**:

```release-note
The default garbage collection policy for Deployment, DaemonSet, StatefulSet, and ReplicaSet has changed from OrphanDependents to DeleteDependents when the deletion is requested through an `apps/v1` endpoint. Clients using older endpoints will be unaffected. This change is only at the REST API level and is independent of the default behavior of particular clients (e.g. this does not affect the default for the kubectl `--cascade` flag).

If you upgrade your client-go libs and use the `AppsV1()` interface, please note that the default garbage collection behavior is changed.
```

Kubernetes-commit: 00b2d95c8665f9680f2c9cffb03cf5a457fdab98
2017-12-07 04:35:40 +00:00
Kubernetes Publisher cfc7b57cf2 Merge pull request #55976 from caesarxuchao/move-mutating-to-last
Automatic merge from submit-queue (batch tested with PRs 51321, 55969, 55039, 56183, 55976). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Move mutating to run last in the mutating admission plugin chain

ref: kubernetes/features#492

Follow up on #54892. (see https://github.com/kubernetes/kubernetes/pull/54892#discussion_r151333585)

Only the last commit is relevant.

The reasons are:
* Mutating webhooks are dynamic, they can always adjust according to the behavior of compiled-in admission plugins, but not the other-way around.
* We'll document that if user deploys mutating webhooks that over some built-in mutating plugins decision, user needs also to disable the built-in validating plugins, otherwise the cluster might block.

Kubernetes-commit: f8ffbd9d618324750a9f1bd9d0363fcef83786c1
2017-12-07 04:35:39 +00:00
Kubernetes Publisher a5cdb29c3c Merge pull request #51321 from mengqiy/kubectl_apply_openapi
Automatic merge from submit-queue (batch tested with PRs 51321, 55969, 55039, 56183, 55976). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Kubectl apply and strategic merge patch using openapi

- [x] support openapi in strategic merge patch
- [x] test openapi in strategic merge patch
- [x] kubectl apply use openapi to calculate diff be default. It will fall back to use baked-in types when openapi is not available.
- [x] test openapi in kubectl apply

Fixes: kubernetes/kubectl#55

```release-note
kubectl apply use openapi to calculate diff be default. It will fall back to use baked-in types when openapi is not available.
```

/assign @apelisse

Kubernetes-commit: e412ad5393b8c949474b904616fc411c3aa478a9
2017-12-07 04:35:39 +00:00
Kubernetes Publisher 21f96018e0 Merge pull request #56213 from deads2k/admission-18-validation
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

require webhook admission kubeconfigfile to be absolute

Minimal change to enforce absolute file paths when using webhook admission config.

Eventually we should resolve the local file paths relative to the original configuration file, but that requires fairly significant plumbing.

@caesarxuchao @sttts @liggitt

If this is not fixed, then inconsistent, seemingly random file resolution will happen and may pin this API to bad behavior that we will later have to break.

Kubernetes-commit: 65f5c1e8475c26dd503860ddb14356fe83c4e5a5
2017-12-07 04:35:11 +00:00
Kubernetes Publisher bcde3e688c Merge pull request #51498 from NickrenREN/pvc-resize-cinder
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Implement volume resize for cinder

**What this PR does / why we need it**:
resize for cinder
xref: [resize proposal](https://github.com/kubernetes/community/pull/657)

**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: xref https://github.com/kubernetes/community/pull/657
Follow up: #49727

**Special notes for your reviewer**:

**Release note**:
```release-note
Implement volume resize for cinder
```

wip, assign to myself first

/assign @NickrenREN

Kubernetes-commit: b18d86d5ccdb77c97425ba7fa451be7f250536d1
2017-12-07 04:35:11 +00:00
Kubernetes Submit Queue e16244b0bc Merge pull request #55812 from deads2k/admission-17-external
Automatic merge from submit-queue (batch tested with PRs 55812, 55752, 55447, 55848, 50984). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Make versioned types for webhook admission config

Versioned webhook admission config type as promised in https://github.com/kubernetes/kubernetes/pull/54414.

@kubernetes/sig-api-machinery-pr-reviews
@ericchiang as promised.  fyi.

```yaml
kind: AdmissionConfiguration
apiVersion: apiserver.k8s.io/v1alpha1
plugins:
- name: GenericAdmissionWebhook
  configuration:
    kind: WebhookAdmission
    apiVersion: apiserver.config.k8s.io/v1alpha1
    kubeConfigFile: /path/to/my/file
```

`ADMISSION_CONTROL_CONFIG_FILE=../foo.yaml hack/local-up-cluster.sh`

Kubernetes-commit: 25ebf875b4235cb8f43be2aec699d62e78339cec
2017-12-07 04:34:43 +00:00
Kubernetes Publisher ef87d82097 Merge pull request #56004 from caesarxuchao/admission-v1beta1
Automatic merge from submit-queue (batch tested with PRs 56128, 56004, 56083, 55833, 56042). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Graduate the admission and admissionregistration (webhook part) API to v1beta1

ref: kubernetes/features#492

Most changes are mechanical. Please take a look at the commit message to see if the commit is worth reviewing.

```release-note
Action required:
The `admission/v1alpha1` API has graduated to `v1beta1`. Please delete your existing webhooks before upgrading the cluster, and update your admission webhooks to use the latest API, because the API has backwards incompatible changes.
The webhook registration related part of the `admissionregistration` API has graduated to `v1beta1`. Please delete your existing configurations before upgrading the cluster, and update your configuration file to use the latest API.
```

Kubernetes-commit: 4cafc5459bf987d2476efd0a4c17158a158887a3
2017-12-07 04:34:42 +00:00
Kubernetes Publisher 3512a43e44 Merge pull request #55859 from hzxuzhonghu/listener-genericapiserver
Automatic merge from submit-queue (batch tested with PRs 56021, 55843, 55088, 56117, 55859). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

apiserver:  pass a listener into genericapiserver bootstrapping

**What this PR does / why we need it**:

>At the moment we pass a port via the options into the config. A zero port does not work because the loopback clients created during apiserver initialization need to know the port before. Passing a listener into the server instead would allow us to use a zero port beforehand and bootstrapping order should be fine.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #55784

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Kubernetes-commit: 5337ff8009d02fad613440912e540bb41e3a88b1
2017-12-07 04:34:15 +00:00
Kubernetes Publisher ea48a9ca18 Merge pull request #55938 from sttts/sttts-compositional-admission-metrics
Automatic merge from submit-queue (batch tested with PRs 55938, 56055, 53385, 55796, 55922). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

admission: make admission metrics compositional

Metrics emission of admission plugins and the admission chain can be implemented compositionally, i.e. completely independently from the chain logic. This PR does that, moves the whole metrics code into a sub-package to contain complexity. The plumbing logic for the emitted metrics finally is cleanly done in the apiserver bootstrapping code, instead of being totally interleaved with the core admission logic.

Ratio:
- considerably less complexity
- admission plugins are compositional, including the chain. We cannot assume that there is only one chain at the outside of the admission plugin structure. Downstream projects might have more complex admission chains, i.e. multiple chain object nested.
- addition of metrics is plumbing and should be in the apiserver plumbing code. This makes it much easier to reason about the security critical admission chain.

Follow-up of #55183 and based on #55919.

Kubernetes-commit: aca386059d753f3014c96ef5240f005d73299ab9
2017-12-07 04:33:47 +00:00
Kubernetes Publisher 0d5eeff30b Merge pull request #54634 from CaoShuFeng/omit_stage
Automatic merge from submit-queue (batch tested with PRs 52322, 54634). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

[advanced audit]add a policy wide omitStage

Related to: https://github.com/kubernetes/kubernetes/issues/54551
For example:
1. only log panic events
```
apiVersion: audit.k8s.io/v1beta1
kind: Policy
omitStages:
  - "RequestReceived"
  - "ResponseStarted"
  - "ResponseComplete"
rules:
  - level: Request
```

2. only log events inRequestReceived stage:
```
apiVersion: audit.k8s.io/v1beta1
kind: Policy
omitStages:
  - "ResponseStarted"
  - "ResponseComplete"
  - "Panic"
rules:
  - level: Request
```

**Release note**:
```
support a policy wide omitStage for advanced audit
```

Kubernetes-commit: 7b9affae660fda1c2e476eeb267c8543ddbab704
2017-12-07 04:33:47 +00:00
Kubernetes Publisher ebd588ca12 Merge pull request #56103 from caesarxuchao/validating-webhook-validator
Automatic merge from submit-queue (batch tested with PRs 54811, 54292, 56103). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Update the validating webhook plugin to implement the ValidatingInterface

ref: kubernetes/features#492

This makes sure the validating admission webhook runs in the validation phase.

Kubernetes-commit: 44f24d219f9d28121eb1f16863312f790e144882
2017-12-07 04:33:46 +00:00
Kubernetes Publisher 7f29011cb8 Merge pull request #55979 from lavalamp/wh-api
Automatic merge from submit-queue (batch tested with PRs 54824, 55911, 55730, 55979, 55961). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

add detail to flag help

**What this PR does / why we need it**:

The admission control flag is impossible to understand.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Ref #https://github.com/kubernetes/features/issues/492

**Special notes for your reviewer**:

**Release note**:

```release-note
NONE
```

Kubernetes-commit: f5b8c15799b5d2b00978353e0eea3146f6f17672
2017-12-07 04:33:46 +00:00
Kubernetes Publisher df0340422b Merge pull request #55790 from sttts/sttts-webhook-initializers
Automatic merge from submit-queue (batch tested with PRs 55963, 55790, 55670, 55931). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

admission/webhook: move webhook initializer into plugin

Follow-up of https://github.com/kubernetes/kubernetes/pull/55132.

Non-generic plugin intitializers should go into the admission plugin itself. No need leak that into the generic apiserver. Keeping them contained in the webhook package makes it easier (it was already possible) for extension apiservers to provide one, but we don't need to leak it into the generic plugin initializer.

Kubernetes-commit: 7fd2b627766613829908fff4785c40f8f013577e
2017-12-07 04:33:45 +00:00
Kubernetes Publisher 3679c01a72 Merge pull request #55963 from sttts/sttts-drop-registrytester-scheme
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

apiserver: remove unneeded scheme from registry tester

Follow-up of https://github.com/kubernetes/kubernetes/pull/55622, removing an unused scheme.

Kubernetes-commit: bebb9c9175d808c2a5e856ca0e24ecf151cc1a73
2017-12-07 04:33:45 +00:00
Mik Vyatskov 8977dcee4a Make audit batch webhook backend configurable
Signed-off-by: Mik Vyatskov <vmik@google.com>

Kubernetes-commit: 7e717ef3a6a57d31251ccee94d9e2dd29a70c27b
2017-11-30 18:47:48 +01:00
FengyunPan 976b400a1e Update gophercloud networking for autoprobing external network
Kubernetes-commit: 62fb6447812525e549ed304326eb1d8458a010b8
2017-11-28 10:07:54 +08:00
Mike Danese c463eb3137 certs: add month buckets
Kubernetes-commit: e08c98b171ff9dd3982377103f9e43c311c7a78d
2017-11-27 10:59:56 -08:00
Joe Betz 1f633a162d Reduce memory footprint of admission metrics
Kubernetes-commit: 92dd8b50f304ce19d62b8acf23d1b8c4f9bae00b
2017-11-26 21:54:50 -08:00
yuexiao-wang 46f7a60026 wrong number of args in apiserver/pkg
Signed-off-by: yuexiao-wang <wang.yuexiao@zte.com.cn>

Kubernetes-commit: 235df842fafe21fe90f5691ca5eb1ab775fbe54d
2017-11-24 10:01:54 +08:00
yanxuean 48fc8a399d missing format args in apiserver/pkg/endpoints
Signed-off-by: yanxuean <yan.xuean@zte.com.cn>

Kubernetes-commit: 08b0883734ab39b3b789c225b14e62f5c25be660
2017-11-23 09:52:56 +08:00
David Eads 6d575ed0c4 require webhook admission kubeconfigfile to be absolute
Kubernetes-commit: 7e6ce2a04ce8ede20e3bdbcb8a5680a8e54c47a2
2017-11-22 08:17:47 -05:00
Marek Grabowski c0bf39c778 generated
Kubernetes-commit: ef6f0b8c6e73fb8167e5debf7641f30a62c4e30c
2017-11-22 10:14:31 +00:00
FengyunPan daf9b66e6c Update gophercloud for supporting OpenStack Cinder v3
Kubernetes-commit: deba6937e3b94aaa476c876b70f2a2e777674f8d
2017-11-22 18:01:14 +08:00
ymqytw cca656de1d update godep
Kubernetes-commit: be20a6753748bbece8c07fd9dfc9e31e22c06dfc
2017-11-20 15:36:05 -08:00
Chao Xu 86dc6e7b4e Update the validating webhook plugin to be a ValidatingInterface, rather than a MutatingInterface
Kubernetes-commit: cbfc9d33b7c6b9e767e4259910f783c047e83583
2017-11-20 14:57:07 -08:00
Chao Xu 70de900800 update-all generated
Kubernetes-commit: fcf4f15c89c8faf3f23171ea50b9c460ea67a76b
2017-11-19 13:41:10 -08:00
Chao Xu cb45850604 manual fix required to run hack/update-all.sh
Kubernetes-commit: a6d955e91fb9021d89ec2cb22e57b605b7b3ee9f
2017-11-19 13:41:20 -08:00
Chao Xu 98e2d6d11f remove reference to v1alpha1
Kubernetes-commit: 7945ae68d0c7cffb070d60ad4d8bfe6ef585c279
2017-11-19 13:54:50 -08:00
Cao Shufeng 0ff8c2c2e4 run hack/update-all.sh
Kubernetes-commit: 4a20d729cc22a9d5adef1f778c0b81960f3b10f3
2017-11-19 12:45:21 +08:00
Kubernetes Publisher 2f3164c8f6 Merge pull request #55988 from caesarxuchao/rename-generic-webhook
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Rename generic webhook

Ref #https://github.com/kubernetes/features/issues/492

A pure gred & sed change. The `GenericAdmissionWebhook` is renamed as `ValidatingAdmissionWebhook`.

```release-note
The `GenericAdmissionWebhook` is renamed as `ValidatingAdmissionWebhook`. Please update you apiserver configuration file to use the new name to pass to the apiserver's `--admission-control` flag.
```

Kubernetes-commit: 47a80424ed9d5cc2b5d50e614cf1038a55702931
2017-11-18 20:28:23 -08:00
Kubernetes Publisher f4eef190f3 Merge pull request #55835 from smarterclayton/table_printer_meta
Automatic merge from submit-queue (batch tested with PRs 55642, 55897, 55835, 55496, 55313). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Table printers and server generation should always copy ListMeta

Tables should be a mapping from lists, so if the incoming object has these add them to the table. Paging over server side tables was broken without this. Add tests on the generic creater and on the resttest compatibility.

@deads2k

Kubernetes-commit: 941c6aa1db828c9f687780bea21f1d94319a1abe
2017-12-07 04:33:44 +00:00
Kubernetes Publisher 6ad2703872 Merge pull request #55650 from smarterclayton/make_unstructured_conversion
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Move unstructured conversion into pkg/runtime

Scheme conversion should support unstructured conversion natively to
allow going from unstructured to typed and back. It is not a higher
level responsibility to do that conversion because the scheme is the
only one who knows what types it supports.

@liggitt @kubernetes/sig-cli-api-reviews I am going to make Scheme support unstructured in ConvertToVersion and Convert, which means resource.Builder and the CLI can get simpler for all existing use cases where versioned and unstructured need to coexist.

Kubernetes-commit: a67abac7654cc3e05618d41191d71730cf9565ac
2017-12-07 04:33:43 +00:00
Kubernetes Publisher 6674aa75f1 Merge pull request #54892 from caesarxuchao/add-mutating-webhook-plugin
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Adding mutating webhook admission plugin

Ref #https://github.com/kubernetes/features/issues/492

I made a change to the API to plumb the `Patch` into the response. I'll rebase onto the actual API once https://github.com/kubernetes/kubernetes/pull/55829 is merged.

We should update the release notes to point to the user docs when we have any.

```release-note
Added mutation supports to admission webhooks.
```

TODO: 
- [ ] update test image to v6 after #55829 is merged
- [ ] rename the GenericAdmissionWebhook to ValidatingAdmissionWebhook
- [ ] reduce json marshal/unmarshal roundtrip: https://github.com/kubernetes/kubernetes/pull/54892#discussion_r151336838
- [ ] move the matching function to a common package that validating and mutating webhooks can both import.
- [ ] handle namespace GET failure gracefully for fail open webhook?

Kubernetes-commit: 638add6ddfb6d2f9fbc3224d0ce1e8cab9aa3049
2017-11-18 01:20:47 -08:00
Chao Xu 8a572a63d4 Rename GenericAdmissionWebhook to ValidatingAdmissionWebhook
Kubernetes-commit: d3c0765780fed5576670d6624cc3cc8d691d6392
2017-11-17 21:05:11 -08:00
Kubernetes Publisher d9e2152e99 Merge pull request #55829 from cheftako/admissionResponseAlt
Automatic merge from submit-queue (batch tested with PRs 55908, 55829, 55293, 55653, 55665). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Admission response alt

**What this PR does / why we need it**: This reflects the imperative nature of AdmissionReview. It adds AdmissionRequest and AdmissionResponse in place of status/spec. The AdmissionResponse the allows the mutating webhook  to send back a json path with the mutated version of the requested object.

**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Ref #https://github.com/kubernetes/features/issues/492

**Special notes for your reviewer**:Port of caesarxuchao's fix with outcome of https://github.com/kubernetes/kubernetes/issues/55729

**Release note**:
```release-note
action-required: please update your admission webhook to use the latest [Admission API](https://github.com/kubernetes/api/tree/master/admission).

`admission/v1alpha1#AdmissionReview` now contains `AdmissionRequest` and `AdmissionResponse`. `AdmissionResponse` includes a `Patch` field to allow mutating webhooks to send json patch to the apiserver.
```

Kubernetes-commit: cae4208e261089fb278f254092c399c807210897
2017-11-17 17:11:08 -08:00
Daniel Smith 4406561b46 add detail to flag help
Kubernetes-commit: 2956314cde74f0481be1da6107cc266f56127173
2017-11-17 15:22:53 -08:00
Chao Xu 53b8960359 move the MutatingAdmissionWebhook to the last in the mutating amdission
plugin chain.

Kubernetes-commit: 8e8e32fa05f02331f724930933dfa34be995247c
2017-11-17 14:16:37 -08:00
Kubernetes Publisher 24c7792935 Merge pull request #55254 from mtaufen/iterative-manifest-url-header
Automatic merge from submit-queue (batch tested with PRs 55254, 55525, 50108, 54674, 55263). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

ColonSeparatedMultimapStringString: allow multiple Set invocations with default override

The first call to Set will clear the map before adding entries;
subsequent calls will simply append to the map.
This makes it possible to override default values with a command-line
option rather than appending to defaults,
while still allowing the distribution of key-value pairs across
multiple flag invocations.

For example: `--flag "a:hello" --flag "b:again" --flag "b:beautiful"
--flag "c:world"` results in `{"a": ["hello"], "b": ["again",
"beautiful"], "c": ["world"]}`

Related: #53833, https://github.com/kubernetes/kubernetes/pull/54643#discussion_r148651257

```release-note
NONE
```

Kubernetes-commit: dc315b8e37a73e5c036701eaee868909aa9333f7
2017-11-17 13:34:06 -08:00
Kubernetes Publisher 504ba4093d Merge pull request #54823 from mtaufen/structure-eviction-thresholds
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Lift embedded structure out of eviction-related KubeletConfiguration fields

- Changes the following KubeletConfiguration fields from `string` to
`map[string]string`:
  - `EvictionHard`
  - `EvictionSoft`
  - `EvictionSoftGracePeriod`
  - `EvictionMinimumReclaim`
- Adds flag parsing shims to maintain Kubelet's public flags API, while
enabling structured input in the file API.
- Also removes `kubeletconfig.ConfigurationMap`, which was an ad-hoc flag
parsing shim living in the kubeletconfig API group, and replaces it
with the `MapStringString` shim introduced in this PR. Flag parsing
shims belong in a common place, not in the kubeletconfig API.
I manually audited these to ensure that this wouldn't cause errors
parsing the command line for syntax that would have previously been
error free (`kubeletconfig.ConfigurationMap` was unique in that it
allowed keys to be provided on the CLI without values. I believe this was
done in `flags.ConfigurationMap` to facilitate the `--node-labels` flag,
which rightfully accepts value-free keys, and that this shim was then
just copied to `kubeletconfig`). Fortunately, the affected fields
(`ExperimentalQOSReserved`, `SystemReserved`, and `KubeReserved`) expect
non-empty strings in the values of the map, and as a result passing the
empty string is already an error. Thus requiring keys shouldn't break
anyone's scripts.
- Updates code and tests accordingly.

Regarding eviction operators, directionality is already implicit in the
signal type (for a given signal, the decision to evict will be made when
crossing the threshold from either above or below, never both). There is
no need to expose an operator, such as `<`, in the API. By changing
`EvictionHard` and `EvictionSoft` to `map[string]string`, this PR
simplifies the experience of working with these fields via the
`KubeletConfiguration` type. Again, flags stay the same.

Other things:
- There is another flag parsing shim, `flags.ConfigurationMap`, from the
shared flag utility. The `NodeLabels` field still uses
`flags.ConfigurationMap`. This PR moves the allocation of the
`map[string]string` for the `NodeLabels` field from
`AddKubeletConfigFlags` to the defaulter for the external
`KubeletConfiguration` type. Flags are layered on top of an internal
object that has undergone conversion from a defaulted external object,
which means that previously the mere registration of flags would have
overwritten any previously-defined defaults for `NodeLabels` (fortunately
there were none).

Related: #53833 (lifting embedded structures out of string fields is part of getting this API to beta)

```release-note
The EvictionHard, EvictionSoft, EvictionSoftGracePeriod, EvictionMinimumReclaim, SystemReserved, and KubeReserved fields in the KubeletConfiguration object (kubeletconfig/v1alpha1) are now of type map[string]string, which facilitates writing JSON and YAML files.
```

Kubernetes-commit: 00fe2cfe6cfa2513f8165b696a2570cbbd2498cf
2017-12-07 04:33:14 +00:00
Kubernetes Publisher bdf668456b Merge pull request #55836 from smarterclayton/status_errors
Automatic merge from submit-queue (batch tested with PRs 55392, 55491, 51914, 55831, 55836). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Guarantee that status errors have a kind set

Kubernetes-commit: d20b156995be157292571a59f874f77d335ecb9b
2017-12-07 04:33:13 +00:00