Commit Graph

515 Commits

Author SHA1 Message Date
Paco Xu 9388b76b21 add seperate health check/probe for multi etcd override servers
- grouping health checks for exclusion purposes & add exclude integration test

Signed-off-by: Paco Xu <paco.xu@daocloud.io>

Kubernetes-commit: 891e7fec6e17382389b01f590888375a29491afc
2025-01-26 15:05:59 +08:00
Paco Xu 2bff744497 add etcd server overrides to etcd probe factory for healthz and readyz
Kubernetes-commit: 8bc7e6c10e0a4dceb738318a3a34f6af94e06158
2024-12-31 16:29:35 +08:00
Anish Ramasekar dc0ee6eda8 Remove deprecated encryption config controller metrics
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: dc3836c49ed6683ebf6c13711a135752a0e611b0
2025-06-11 13:27:34 -07:00
Anish Ramasekar 2ce736f1ce Promote automatic_reloads of authn config metrics to BETA
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: 60b5338d46027c26cd29a829bea5dbff822b3b23
2025-05-15 11:23:10 -07:00
Anish Ramasekar 12fab5de10 Promote automatic_reloads of authz config metrics to BETA
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: 5314fcece315c6bab115de4ac723baa43f8d6ec0
2025-05-14 09:51:20 -07:00
Karl Isenberg 46dd96ca03 refactor: Stop using ioutil in apiserver
- The ioutl package is deprecated. Migrate to os package functions.

Kubernetes-commit: f93e4645c18c6f56bfddc158ef7b3f674b3c41dd
2025-05-08 11:28:52 -07:00
David Mengqi Yu c9834df380 Add example in etcd override flag help text
Kubernetes-commit: 44d31af29bf442520722024f7fa58a64b44d68de
2024-09-04 12:28:53 -07:00
Siyuan Zhang 5a4ec0a797 bug fix: fix version order in emulation forward compatibility.
Signed-off-by: Siyuan Zhang <sizhang@google.com>

Kubernetes-commit: b1a9cc347311012bade7230b55ab95229a1e22c9
2025-04-07 18:38:43 -07:00
Siyuan Zhang 942f114031 Add option to explicitly enable future gv or gvr in runtime-config.
Signed-off-by: Siyuan Zhang <sizhang@google.com>

Kubernetes-commit: 3d2d8db83509eadcad0529fda1f8ef81e1682ca5
2025-02-07 16:43:58 -08:00
Siyuan Zhang 5a72bc815b Add emulation forward compatibility into api enablement and RemoveDeletedKinds.
Signed-off-by: Siyuan Zhang <sizhang@google.com>

Kubernetes-commit: 819cb8fe22fe37bf691f460bc32d0f03f53cce09
2025-02-04 10:11:56 -08:00
yongruilin 2b4f068bdb refactor: detach Info from apimachinery util version
- Remove `info` field from `Version` struct
- Modify `WithInfo` and `Info` methods to be deprecated
- Update version information retrieval to use base version info
- Simplify version information generation in compatibility tests
- Remove unnecessary version info passing in build and test scenarios

Kubernetes-commit: 14934b481ef6522d6c1003ded19002ea45abe5d1
2025-03-05 23:55:08 +00:00
yongruilin b6717882da feat: extend version information with more detailed version fields
- Add new version fields to version.Info struct:
  * EmulationMajor and EmulationMinor to track emulated version
  * MinCompatibilityMajor and MinCompatibilityMinor for compatibility tracking
- Update related code to populate and use these new fields
- Improve version information documentation and OpenAPI generation
- Modify version routes and documentation to reflect new version information structure

Kubernetes-commit: a3094ccbe6f9f134da29aedf4d6d87a9a97bf463
2025-02-06 16:11:12 -08:00
HirazawaUi c533eff8e7 adjusting loopback certificate validity in kube-apiserver
Kubernetes-commit: 553e9bf84d199be3d6a3da6675671859723219f4
2025-02-08 19:43:48 +08:00
Siyuan Zhang 9bb4aa730a Refactor compatibility version code
Replace DefaultComponentGlobalsRegistry with new instance of componentGlobalsRegistry in test api server.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

move kube effective version validation out of component base.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

move DefaultComponentGlobalsRegistry out of component base.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

move ComponentGlobalsRegistry out of featuregate pkg.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

remove usage of DefaultComponentGlobalsRegistry in test files.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

change non-test DefaultKubeEffectiveVersion to use DefaultBuildEffectiveVersion.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

Restore useDefaultBuildBinaryVersion in effective version.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

rename DefaultKubeEffectiveVersion to DefaultKubeEffectiveVersionForTest.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

pass options.ComponentGlobalsRegistry into config for controller manager and scheduler.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

Pass apiserver effective version to DefaultResourceEncodingConfig.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

change statusz registry to take effective version from the components.

Signed-off-by: Siyuan Zhang <sizhang@google.com>

Address review comments

Signed-off-by: Siyuan Zhang <sizhang@google.com>

update vendor

Signed-off-by: Siyuan Zhang <sizhang@google.com>

Kubernetes-commit: 8fc3a33454ba38783bb63de41ecf5343e2ced67c
2024-12-20 07:03:03 +00:00
Krzysztof Dąbrowski 2146712740 apiserver: decrease timeout for TestKMSHealthzEndpoint
Kubernetes-commit: ee3e9a7bd448b26f49e07a89247276687b8a535d
2024-03-27 20:58:35 +01:00
Jefftree 15b54ba29c Expand emulated version range to n-3 with 1.31 floor
Kubernetes-commit: cf28c0405c02e82e1028193a4ce1aa75d473ae8e
2024-12-10 16:34:34 +00:00
Patrick Ohly b84662911c remove import doc comments
The "// import <path>" comment has been superseded by Go modules.
We don't have to remove them, but doing so has some advantages:

- They are used inconsistently, which is confusing.
- We can then also remove the (currently broken) hack/update-vanity-imports.sh.
- Last but not least, it would be a first step towards avoiding the k8s.io domain.

This commit was generated with
   sed -i -e 's;^package \(.*\) // import.*;package \1;' $(git grep -l '^package.*// import' | grep -v 'vendor/')

Everything was included, except for
   package labels // import k8s.io/kubernetes/pkg/util/labels
because that package is marked as "read-only".

Kubernetes-commit: 8a908e0c0bd96a3455edf7e3b5f5af90564e65b0
2024-12-02 14:43:58 +01:00
Stanislav Láznička 5047b8fe41 featuregate UID in RequestHeader authenticator
Kubernetes-commit: a051b067cdffc92fbe40bcc5a8e8f1bf974348c4
2024-12-04 15:44:45 +01:00
Joe Betz a5e93cb37c Add MutatingAdmissionPolicy plugin to admission chain
This expands the generic plugin support to both validating and mutating policies.  It also adds the
mutating policy admission plugin using the generics plugin support.

This also implements both ApplyConfiguration and JSONPatch support.

Co-authored-by: Alexander Zielensk <alexzielenski@gmail.com>

Kubernetes-commit: 25e11cd1c143ef136418c33bfbbbd4f24e32e529
2024-10-25 13:46:58 -04:00
Kubernetes Prow Robot 4bece4d457 Merge pull request #128196 from richabanker/move-version
Move k8s.io/apiserver/pkg/util/version to component-base

Kubernetes-commit: 119f114f012ae6d1cd851bdb2c3f849307e83258
2024-10-29 18:49:35 +00:00
Mangirdas Judeikis 3e52ced45d fully remove StopCh
Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt>

Kubernetes-commit: fd76176811654c409cd6799de4a174bcb051a90d
2024-09-13 12:08:57 +03:00
Monis Khan 4f8e2cfe4c kmsv2: run KDF tests in parallel
This change updates the KDF "feature flag" to be per KMS provider
instead of global to the API server.  This allows integration tests
that use distinct provider names to run in parallel.

Locally this change reduced the runtime of
test/integration/controlplane/transformation by 3.5 minutes.

Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: 43740c0def10f22a0ab7f522c1569188913b35a3
2024-10-16 15:01:35 -04:00
Sean Sullivan e6b796812a TracingConfiguration is now validated strictly
Kubernetes-commit: a9c8061b1e4c2ac38c223fa6bf9c5c1bf8b01606
2024-10-14 18:09:16 -07:00
Stanislav Láznička cf15325096 delegate authn: don't default the ReqHeaders UID header
Kubernetes-commit: 26902de531620d2df5ce1bb572d2ea6965a7b7e9
2024-05-20 13:43:22 +02:00
Stanislav Láznička b9e6a66c69 requestheaders: add a "requestheader-uid-headers" flag and wire it up
Kubernetes-commit: 7fabd06c2be41f4134f425fa967d79ac31dc5756
2023-02-16 11:28:50 +01:00
David Ashpole daa75f8bec fix memory leak from global MeterProvider
Kubernetes-commit: b86cab8c4c3421c6b195fc82990a63c859449072
2024-08-28 14:20:46 +00:00
Monis Khan cd5bba1780 Ensure transformers have access to the resource via request info
This guarantees that logs and metrics that rely on this information
work as expected.

Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: 49d7b4c97e4f7ee5c664b068c207a39b8c3f759e
2024-08-14 10:33:36 -04:00
Monis Khan 272e9eba82 Remove KMSv2 and KMSv2KDF feature gates
These have been GA since v1.29 and can be safely removed.

Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: 6398b8a19fe0e113cf250c13b0639dea258a174f
2024-08-14 15:59:01 -04:00
0x5457 27c3ca736b apiserver: declare kubeClient and dynamicClient as interface types to avoid panic
Kubernetes-commit: 81824b7c2e673f64f70a6e99180bb6bfc6b738d9
2024-08-13 11:25:11 +08:00
Wojciech Tyczyński a643e14347 Implement resilient watchcache initialization post-start-hook
Kubernetes-commit: a5772bd42593f6492f5169eef49bc9884f95abba
2024-06-13 11:02:18 +02:00
Vinayak Goyal 77f498853b KEP-4633: Allow health-only anonymous auth mode.
Signed-off-by: Vinayak Goyal <vinaygo@google.com>

Kubernetes-commit: 5e6a4937f5a3e20dd77238946220461332ecddff
2024-05-16 21:18:34 +00:00
Siyuan Zhang b26fefe178 add DefaultComponentGlobalsRegistry flags in ServerRunOptions
Signed-off-by: Siyuan Zhang <sizhang@google.com>

Kubernetes-commit: 379676c4bef48e5d2add28851302b55b41fcabcf
2024-06-10 17:50:22 +00:00
Siyuan Zhang 00857ca9ec Add version mapping in ComponentGlobalsRegistry.
Signed-off-by: Siyuan Zhang <sizhang@google.com>

Kubernetes-commit: 4352c4ad2762ce49ce30e62381f8ceb24723fbcc
2024-05-31 20:29:48 -07:00
Siyuan Zhang 22612a3528 apiserver: Add API emulation versioning.
Co-authored-by: Siyuan Zhang <sizhang@google.com>
Co-authored-by: Joe Betz <jpbetz@google.com>
Co-authored-by: Alex Zielenski <zielenski@google.com>

Signed-off-by: Siyuan Zhang <sizhang@google.com>

Kubernetes-commit: 403301bfdf2c7312591077827abd2e72f445a53a
2024-01-19 16:07:00 -08:00
Monis Khan b0c3a41fa5 encryptionconfig: detect typos
Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: 2503fa55ff13e3211e9f17fa97f70f9a67f3f6fc
2024-05-16 12:38:42 -04:00
Mangirdas Judeikis 65ef30865d move to generics for sets in kubeapiserver
Kubernetes-commit: b14936f6795028b1d8dd9f6a4cb0361b4c7bb9bc
2024-05-12 11:49:42 +03:00
Jayapriya Pai c05e83dd40 Expose DisableHTTP2 flag in SecureServingOptions
This is to mitigate CVE-2023-44487
until the Go standard library and golang.org/x/net
are fully fixed.

Signed-off-by: Jayapriya Pai <janantha@redhat.com>

Kubernetes-commit: e2503e50381cc9cc2e4a4c90f0738e54992558f8
2023-12-05 11:41:58 +05:30
Alvaro Aleman da88853b95 Use the generic/typed workqueue throughout
This change makes us use the generic workqueue throughout the project in
order to improve type safety and readability of the code.

Kubernetes-commit: 6d0ac8c561a7ac66c21e4ee7bd1976c2ecedbf32
2024-04-28 18:26:18 +02:00
Andrew DeMaria 7d59581b90 apiserver/options: avoid segfault by handling unset core k8s client
Fixes: https://github.com/kubernetes/apiserver/issues/108
Signed-off-by: Andrew DeMaria <ademaria@cloudflare.com>

Kubernetes-commit: b2d1aef1e3800c73e266131e585069eb3b177591
2024-04-22 12:50:23 -06:00
Patrick Ohly 5ea67c789a apiserver + controllers: enhance context support
27a68aee3a4834 introduced context support for events. Creating an event
broadcaster with context makes tests more resilient against leaking goroutines
when that context gets canceled at the end of a test and enables per-test
output via ktesting.

The context could get passed to the constructor. A cleaner solution is to
enhance context support for the apiserver and then pass the context into the
controller's run method. This ripples up the call stack to all places which
start an apiserver.

Kubernetes-commit: b92273a760503cc57aba37c4d3a28554f7fec7f8
2023-12-01 09:00:59 +01:00
Marek Siarkowicz 74fb076497 Cleanup defer from SetFeatureGateDuringTest function call
Kubernetes-commit: 3ee81787685e47a7a5da22423c8ca4455577ecb3
2024-04-23 10:39:47 +02:00
chenk008 f687e45ec2 prioritize user EtcdOptions.StorageConfig.StorageObjectCountTracker
Kubernetes-commit: 587ce02d90f3c1e1bb7418753009baf63f6039b7
2024-04-18 23:02:16 +08:00
chenk008 70fb342c48 Fix: StorageObjectCountTracker is nil, apf estimator got ObjectCountNotFoundErr
Kubernetes-commit: 4abc2b387b188d694e369e05c08effce9d23e7e7
2024-04-08 11:09:27 +08:00
David Eads 8c4fa4e478 Remove k8s.io/apiserver ability to bind insecure ports
The project does not recommend using insecure ports.  Even
unauthenticated TLS is an improvement since it provides confidentiality.
If you relied upon this, please update to secure serving options.

Kubernetes-commit: de302c73e9558c192fde1cd7d6dcbea7eb76e950
2024-03-18 09:25:49 -04:00
Anish Ramasekar ee481149d7 Add metrics for authentication config reload
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: 62ac88b9ea5dace6a61b784f4654fcf379b958e2
2024-03-09 13:29:56 -08:00
cici37 be9c733e9d Promote ValidatingAdmissionPolicy to GA.
Kubernetes-commit: de506ce7ac9981c8253b2f818478bb4093fb7bb6
2024-01-23 22:10:40 +00:00
Jordan Liggitt fe847b31f4 Add allowed/denied metrics for authorizers
Kubernetes-commit: d5d3eddb95b657f03677c21498f185d70d87cdda
2024-02-16 02:26:18 -05:00
Jordan Liggitt c2310e1279 Implement authz config file reloading
Kubernetes-commit: 5dc92ada068cb80a2866cfaa1f9aa760d2524680
2023-11-08 08:49:58 -06:00
Alexander Zielenski 57e06e43f7 refactor: move vap into parent `policy` folder
also renames to remove stutter

comment

Kubernetes-commit: 8b14116509ac19234924878ab08f7e9e8f03549a
2024-01-17 18:09:30 -08:00
Anish Ramasekar f6b16dddb3 Add `apiserver_encryption_config_controller_automatic_reloads_total`
metric

- Adds `apiserver_encryption_config_controller_automatic_reloads_total`
  metric with status label for encryption config reload success/failure.
- Deprecated `apiserver_encryption_config_controller_automatic_reload_failures_total` and `apiserver_encryption_config_controller_automatic_reload_success_total`

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: 77241d31253baf051302fff7480c9601ad817399
2024-02-07 19:44:41 +00:00