Commit Graph

483 Commits

Author SHA1 Message Date
Brendan Burns 5621f05378 Add 201/202 to the list of returned codes.
Kubernetes-commit: 449082f55d323bf4acf6963c4d093c044742762c
2017-09-26 22:31:19 -07:00
p0lyn0mial 1c446c37e3 adds two new fields to AdmissionOption.
The first one being RecommendedPluginOrder the second one being DefaultOffPlugins.
In case a cluster-admin did not provide plugin names they will be derived from these fields.

Kubernetes-commit: 7a92947588070a8eedd0bf50edcfbf0fcc1d4096
2017-08-24 21:36:39 +02:00
Clayton Coleman 2aa97c4081 Add a negotiate method media type for use in explicit contexts
Kubernetes-commit: 26d87e49cbbc4caa9e0eef47fce9115c1f43566e
2017-09-23 15:07:55 -04:00
Shyam Jeedigunta 649cc4c05e Modify traces in deletion handler
Kubernetes-commit: c4ca2c734963afd442ff6c43631d004092ea74e8
2017-09-27 00:48:06 +02:00
Clayton Coleman 4175a07239 Track gauge of all long running API requests
Allows a caller to know how many exec, log, proxy, and watch calls are
running at the current moment.

Kubernetes-commit: fabce1b893f96bdf466c1fdb1fcf825210c008ae
2017-09-19 20:35:29 -04:00
Clayton Coleman 1caba4b96e Collapse all metrics handlers into common code
Remove the MonitorRequest method and replace with a method that takes
request.RequestInfo, which is our default way to talk about API objects.
Preserves existing semantics for calls.

Kubernetes-commit: 10e6dc5ed3573118c56fa8823b387e47c8e8ae06
2017-09-11 14:53:18 -04:00
Jim Minter 4e1a340bd1 ProducesObject should only update the returned API object resource documentation
Kubernetes-commit: e18eeb2d63f67b1e0dd3e79982beb7879242c3bb
2017-09-05 15:34:15 -05:00
Jeff Grafton eabf5a2c6e Use buildozer to delete licenses() rules
Kubernetes-commit: 02fb4200dcdf8636eac5953d04b2c4af912f443b
2017-09-21 14:54:29 -07:00
Jeff Grafton ecbbfb0461 Use buildozer to remove deprecated automanaged tags
Kubernetes-commit: 532bd482dfbe25c6fc970d2175f7e02fec2fc8c0
2017-09-21 14:53:56 -07:00
Jordan Liggitt 78261d54df Preserve leading and trailing slashes on proxy subpaths
Kubernetes-commit: 04eede9b2a2a24571cb084fcb952c6a2a2a2bdd1
2017-09-22 22:35:20 -04:00
Walter Fender 9a6c2541ac Ensure we log the flag apiserver starts with.
Trying to make sure we always log the flags an instance of apiserver
starts with.
This can be especially valuable for emailed logs or e2e/kubemark tests.

Kubernetes-commit: 366459aee84a4de1f0342a464bd479a5d12e6f0f
2017-09-08 10:00:50 -07:00
Shiyang Wang 548cb7f4e2 move specialDefaultResourcePrefixes out of vendor/k8s.io/apiserver
Kubernetes-commit: 0084d70b56fb0b262f75f1b837001be04a694fb6
2017-09-07 10:19:30 +08:00
tengqm 65c833f23a Fix apiserver help message
Kubernetes-commit: acad74670dd1167ea0e90b2eeef6946d3871bdbf
2017-09-04 17:22:25 +08:00
Kubernetes Publisher 7b23343a61 conversion-gen: make staging dirs independent of living in vendor/
Kubernetes-commit: f5451127512e42294564efae97d4cb669df54f49
2017-09-22 11:42:06 +00:00
Kubernetes Publisher d7e7a0ab18 Update the test under audit policy
Kubernetes-commit: ea1694eab1a1b251b31ce006cc48594a7eb05add
2017-09-22 11:42:06 +00:00
Kubernetes Publisher 0f62a50c16 etcd3 store: retry w/live object on conflict
In GuaranteedUpdate, if it was called with a suggestion (e.g. via the
watch cache), and the suggested object is stale, perform a live lookup
and then retry the update.

Signed-off-by: Andy Goldstein <andy.goldstein@gmail.com>

Kubernetes-commit: bf33df16b52508974ddedacd814010cfe0fb79f0
2017-09-22 11:42:06 +00:00
Kubernetes Publisher 8fc21589fe Increase sliding window to 5hr for request_latencies metric
Kubernetes-commit: e1ba3da16c9bebccb3902952d56b59f2e2dbb900
2017-09-22 11:42:05 +00:00
Kubernetes Publisher 24ccf40372 Add extra steps to delete resource handler trace
Kubernetes-commit: 6089cadab3d136455b1b4376d819464fb0d2379a
2017-09-22 11:42:05 +00:00
Kubernetes Publisher 7d0b0b91fc Report "resource" scope where possible
Also rename the variables to match the concept

Kubernetes-commit: c13a3c03201c9082c4b373b7af8b99d7effd5a62
2017-09-22 11:42:04 +00:00
Kubernetes Publisher 7727b5a3a8 Report scope on all apiserver metrics
Counting list of namespaces is != list across all namespaces (same for
latency)

Kubernetes-commit: 545aba778d5d039a3b8a0f0939fdf8f8261ae1a8
2017-09-22 11:42:04 +00:00
Kubernetes Publisher 4c578f11a1 Normalize WATCHLIST to WATCH in metrics
This causes confusion and doesn't match what we authorize on

Kubernetes-commit: 5e46d5b5450f7e7db87e860440f1bb1f8f523ffa
2017-09-22 11:42:04 +00:00
Clayton Coleman 644d9a8cf1 Allow watch cache to be disabled per type
Currently setting watch cache size for a given resource does not disable
the watch cache. This commit adds a new `default-watch-cache-size` flag
to map to the existing field, and refactors how watch cache sizes are
calculated to bring all of the code into one place. It also adds debug
logging to startup to allow us to verify watch cache enablement in
production.

Kubernetes-commit: fc2d201e155296f311ae0a9278b00dcae2d68708
2017-09-09 21:44:33 +00:00
Maciej Szulik 6959d4a79a Fill in creationtimestamp in audit events
Kubernetes-commit: 3dd3e7aa5243228b49211f4bb40022a719cc57ac
2017-09-09 21:44:33 +00:00
Chao Wang 221a6a181e A policy with 0 rules should return an error
Kubernetes-commit: 0ad4282fd0b31e1d12b711696efb134bdc2f83cc
2017-09-09 21:44:32 +00:00
Dr. Stefan Schimanski 9f41d17af2 Update bazel
Kubernetes-commit: fbd310dbc7312fcae4267dd64326a1e7b4a0a8ae
2017-09-09 21:44:32 +00:00
Dr. Stefan Schimanski a063c5336d apiserver: avoid panics on nil sub-option structs
Kubernetes-commit: b153268da79d2acf14e042945959801c3dba8221
2017-09-09 21:44:32 +00:00
Dr. Stefan Schimanski 97e22b00fa apiserver: split core API creation from secure serving
Kubernetes-commit: 2b64d3a0fd2ccdad4b2f21acb484a36e04381856
2017-09-09 21:44:32 +00:00
Dr. Stefan Schimanski 75cf96f31e apiserver: stratify versioned informer construction
Kubernetes-commit: ca3f7453464f6866a3bf467c8b9d8e132484cfb4
2017-09-09 21:44:32 +00:00
Dr. Stefan Schimanski 8ec769da6b apiserver: allow disabling authz/n via options
Kubernetes-commit: dffe50f8bd820295f7f1fbc56a6269b6b8c6966b
2017-09-09 21:44:32 +00:00
Dr. Stefan Schimanski e4b1b0656b apiserver: make config completion structural recursion
Kubernetes-commit: 1bcea54104cb7f53e58924dd5413cf4ba7ceb587
2017-09-09 21:44:32 +00:00
Cao Shufeng d2f7a0c820 Log a warning when --audit-policy-file not passed to apiserver
Kubernetes-commit: 3b91f1cc0d32278a9baf2a4b9b4e416cbfb2457f
2017-09-09 21:44:31 +00:00
Di Xu e69ddb7b01 fix format of forbidden messages
Kubernetes-commit: 95738d5a0eeb179325858e52ff83ff86de6fce0b
2017-09-09 21:44:31 +00:00
Clayton Coleman 702960b762 Provide field info in storage configuration
Kubernetes-commit: 1fde2698ec152901856062eb89cc5d2742925ce2
2017-09-09 21:44:30 +00:00
CaoShufeng 5d22e67a97 enhance unit tests of advance audit feature
This change does three things:
    1. use auditinternal for unit test in filter stage
    2. add a seperate unit test for Audit-ID http header
    3. add unit test for audit log backend

Kubernetes-commit: c030026b544da2dd7ef7201019bdc0ac255c2d23
2017-09-09 21:44:30 +00:00
Cao Shufeng 0c7ac2906f set AdvancedAuditing feature gate to true by default
Kubernetes-commit: 1388426898f46de5e8730c3f71ce3ccaf50337b8
2017-09-09 21:44:30 +00:00
Cao Shufeng 26f73b45d4 fix docstring of advanced audit policy
Kubernetes-commit: 22f4c1ad4db102d66ec829a64ab601919f2019f5
2017-09-05 14:03:27 +00:00
Dr. Stefan Schimanski 433a5a01a7 audit: fix fuzzer
Kubernetes-commit: 58dd0879a754baff151913184ab5e1cd924fb19d
2017-09-05 14:03:26 +00:00
Cao Shufeng 3827624a56 generated: update API resources
./hack/update-codegen.sh
./hack/update-generated-protobuf.sh

Kubernetes-commit: b50acbdf0152f59e5fd6b065560aed4f85717a7a
2017-09-04 14:03:48 +00:00
Cao Shufeng 4905dd9b0c Provide a way to omit Event stages in audit policy
Updates https://github.com/kubernetes/kubernetes/issues/48561
This provide a way to omit some stages for each audit policy rule.

For example:
  apiVersion: audit.k8s.io/v1beta1
  kind: Policy
  - level: Metadata
    resources:
       - group: "rbac.authorization.k8s.io"
         resources: ["roles"]
    omitStages:
      - "RequestReceived"

RequestReceived stage will not be emitted to audit backends with
previous config.

Kubernetes-commit: 47ba91450fbe7d9002bfc9d4a48a73256252821f
2017-09-04 14:03:48 +00:00
David Eads 9f885389e9 make url parsing in apiserver configurable
Kubernetes-commit: ccc7c9bdfa80caee93953a96dec0d689d93f08e5
2017-09-04 14:03:48 +00:00
Cao Shufeng 92f836da87 update generated protobuf for audit v1beta1 api
Kubernetes-commit: ea519bc06020d2b2a68fa46a3f57c9d66827659d
2017-09-04 14:03:47 +00:00
mbohlool eaf131e1fc Provide whole delegate chain to kube aggregator
Kubernetes-commit: 7cbdb90890ac89ec15be2b21b5cbdc51e94e42d6
2017-09-04 14:03:46 +00:00
Maciej Szulik 3c2866020c Switch audit output to v1beta1
Kubernetes-commit: f3487f08c6c2444adde9ba110263c9132769332b
2017-09-03 14:04:14 +00:00
David Eads 56e7f5b9c2 expose discovery information on scalable resources
Kubernetes-commit: 65d0f188f68f6428ccc0a776adff496d972faa56
2017-09-03 14:04:14 +00:00
Cao Shufeng d781318aca audit real impersonated user info
Log the newest impersonated user info in the second audit event. This
will help users to debug rbac problems.

Kubernetes-commit: 1c3dc52531b7761921c8855cafc58b669da111f1
2017-09-03 14:04:13 +00:00
Chao Xu 6a1592b4e4 update initializer names to valid ones in tests
Kubernetes-commit: 85ee09e4c901e9fcf725bb4797ea2b3c278ee96c
2017-09-03 14:04:13 +00:00
Clayton Coleman 460257fd61 Server side implementation of paging for etcd3
Add a feature gate in the apiserver to control whether paging can be
used. Add controls to the storage factory that allow it to be disabled
per resource. Use a JSON encoded continuation token that can be
versioned. Create a 410 error if the continuation token is expired.

Adds GetContinue() to ListMeta.

Kubernetes-commit: 8952a0cb722b77459cf2701632a30f5b264f5aba
2017-09-03 14:04:12 +00:00
Maciej Szulik 677d724b3a Allow audit to log authorization failures
Kubernetes-commit: 9fef244d4ccce0ea8daf37ab86a7af4892d000cf
2017-09-03 14:04:12 +00:00
Morgan Bauer c5c5445b49 basic logging for healthz installer
- InstallHandler is the public interface through which all interaction
   occurs.
 - It is good to know whether the default ping is occurring to know due
   to manual installation or automatic installation.
 - It is good to know how many handlers are installed to see whether
   code changes are taking effect.
 - It is good to know the names of the handlers that are installed to
   make sure that a handler a user thinks is installed is being
   installed at runtime.
 - Print all the checkers once

Kubernetes-commit: efa66227d4fbcfad9fec21755b898f5d10d3344c
2017-09-03 14:04:11 +00:00
Chen Rong b4c851a534 generated
Kubernetes-commit: ed8adf6e51d76b3652be3b433b2dab590f1ff1f0
2017-09-03 14:04:11 +00:00