Automatic merge from submit-queue (batch tested with PRs 54602, 54877, 55243, 55509, 55128). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
stop timer
**What this PR does / why we need it**:
stop the timer after using it
Kubernetes-commit: 8bdd6614f16d62b4ea31809749162c6a4c0d1162
Automatic merge from submit-queue (batch tested with PRs 54005, 55127, 53850, 55486, 53440). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Validation webhook plugin converts objects to the external version before sending to webhooks
**What this PR does / why we need it**:
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
https://github.com/kubernetes/features/issues/492
**Special notes for your reviewer**:
**Release note**:
```release-note
The apiserver sends external versioned object to the admission webhooks now. Please update the webhooks to expect admissionReview.spec.object.raw to be serialized external versions of objects.
```
Kubernetes-commit: cba5aa05906d51d07f0b4b613f6c82651e2313dc
Automatic merge from submit-queue (batch tested with PRs 55283, 55461, 55288, 53970, 55487). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
[authorize] rename test file and remove unused code
**What this PR does / why we need it**:
rename go test filename and remove unused code in builtin.go
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #
**Special notes for your reviewer**:
nit fix, no impact to function.
**Release note**:
```release-note
NONE
```
Kubernetes-commit: 14674f450855de54cf9632c00157d4f0fd9b6d70
Move the namespace selector code to package webhook/namespace
Move the conversion related code to package to webhook/versioned
Move errors related code to package webhook/errors
Move admission review related code to package webhook/request
Kubernetes-commit: 51774697b35314b078270e9da24fbe0ff843b981
Scheme conversion should support unstructured conversion natively to
allow going from unstructured to typed and back. It is not a higher
level responsibility to do that conversion because the scheme is the
only one who knows what types it supports.
Kubernetes-commit: 557f9ddfe6300ecdbdd70ea67dca63bf6b710ea7
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Add namespace selector to admission webhook
Implementing the [design](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/admission-webhook-bootstrapping.md).
* Added the NamespaceSelector field to the webhook configuration API
* Let the webhook plugin respect the NamespaceSelector
* Added unit test and e2e test
cc @kubernetes/sig-api-machinery-api-reviews
```release-note
Added namespaceSelector to externalAdmissionWebhook configuration to allow applying webhooks only to objects in the namespaces that have matching labels.
```
Kubernetes-commit: e52e79342c610def76885b751c6533079f7bc17b
Automatic merge from submit-queue (batch tested with PRs 53047, 54861, 55413, 55395, 55308). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
cache admission webhook restClient
**What this PR does / why we need it**:
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes#54860
**Special notes for your reviewer**:
**Release note**:
```release-note
NONE
```
Kubernetes-commit: 331c52c0fd4890ce999bad29265600d16cbb7abd
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
remove redundant code in admission initializer
**What this PR does / why we need it**:
remove unused return error in `k8s.io\kubernetes\staging\src\k8s.io\apiserver\pkg\admission\initializer\initializer.go`
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes #
**Special notes for your reviewer**:
**Release note**:
```release-note
NONE
```
Kubernetes-commit: a43c6e41d58efff5308120f74eac339eb631e9bc
Automatic merge from submit-queue (batch tested with PRs 46581, 55426, 54849). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
apiserver shutdown gracefully
**What this PR does / why we need it**:
apiserver shutdown gracefully and wait all non-long running requests finish before process exit.
**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
Fixes#54793
**Special notes for your reviewer**:
remove waitGroup, use atomic to count.
**Release note**:
```release-note
NONE
```
Kubernetes-commit: d12d711ba67af9c63c6497a3d73357729a76e9ab
Automatic merge from submit-queue (batch tested with PRs 55268, 55282, 55419, 48340, 54829). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Add MutatingWebhookConfiguration type
As part of Mutating Webhook support, this PR adds the configuration for Mutating webhooks. It also renames existing ReadOnly webhook configurations from ExternalAdmissionHookConfiguration to ValidatingWebhookConfiguration. As part of the process some sub-types are also renamed.
Lastly, the mutating webhook configurations are sorted by name to make the serial executing of them deterministic.
ref: https://github.com/kubernetes/features/issues/492
Kubernetes-commit: 61f210859d9c4bd64af254ba696f6f693596ced9
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
Move core API to pkg/apis/core
Fixes https://github.com/kubernetes/kubernetes/issues/55304.
This moves the types in pkg/api and most of pkg/api/v1 to pkg/apis/core to match the other api groups, following-up on what https://github.com/kubernetes/kubernetes/pull/44784 did for the external types.
It's a nearly 100% mechanical package move with a number of trivial fixups in code-generators and in tests which do string comparisons of types via reflection.
**Most importantly:**
- group names are unchanged
- apimachinery semantics are unchanged
- the outside api is unchanged.
Note that some packages for helpers are left in pkg/api/v1. Splitting them into helpers which belong tightly to the api and those which are not is left to follow-ups.
@kubernetes/sig-api-machinery-pr-reviews
Kubernetes-commit: dd9981d038012c120525c9e6df98b3beb3ef19e1
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
audit policy: reject audit policy files without apiVersion and kind
Closes https://github.com/kubernetes/kubernetes/issues/54254
/cc @sttts @CaoShuFeng @crassirostris @tallclair
/sig auth
/kind cleanup
```release-note
Audit policy files without apiVersion and kind are treated as invalid.
```
Kubernetes-commit: ab44ec9d7702e973f01ef716c06c8aa69441813c
Automatic merge from submit-queue (batch tested with PRs 55331, 55272, 55228, 49763, 55242). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
use versiond group clients from client-go
**What this PR does / why we need it**:
Some **Deprecated** group clients are still used, replace them with versioned group clients.
**Which issue this PR fixes**: fixes#49760
**Special notes for your reviewer**:
/assign @caesarxuchao
**Release note**:
```release-note
NONE
```
Kubernetes-commit: a701a42a82da8c3dec18cb35124ee9038c91cca6
Automatic merge from submit-queue (batch tested with PRs 55331, 55272, 55228, 49763, 55242). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
apiserver: add validating admission tests
Follow-up of https://github.com/kubernetes/kubernetes/pull/54484
This includes tests
- in endpoint tests,
- in generic registry,
- in patch handler,
- in admission chain.
Kubernetes-commit: ee7f1b6e74fab4ed77592f29264575c634e4f2c1
Automatic merge from submit-queue (batch tested with PRs 53592, 52562, 55175, 55213). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
apiserver: protect registry cleanup against concurrent access
The mechanism uses global state during testing. Better protect it and fail early when a race is happening.
Related to https://github.com/kubernetes/kubernetes/issues/54095
Kubernetes-commit: 47d1973c18e278621b8843ab9d18f8eb348d224c
Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
add support for short-circuit deny in union authorizer
This change has no behavioral changes.
Fixes https://github.com/kubernetes/kubernetes/issues/51862
```release-note
Add support for the webhook authorizer to make a Deny decision that short-circuits the union authorizer and immediately returns Deny.
```
Kubernetes-commit: d33077526af1e22c4d7124836a987ce108c1533b
Automatic merge from submit-queue (batch tested with PRs 55061, 55157, 55231). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
apiserver: remove scheme arg from NewUnsecuredEtcd3TestClientServer
Not necessary anymore.
Kubernetes-commit: eb578813cba0e835c1079c5b1b570c16e8a3dd47
Automatic merge from submit-queue (batch tested with PRs 55093, 54966, 55047, 54971, 54786). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
vendor update: github.com/golang/protobuf
When I'm working on PR: https://github.com/kubernetes/kubernetes/pull/54782, I met a problem here: https://github.com/golang/protobuf/issues/372, which I think we need to update our vendor of protobuf
and I ask Dr. Stefan for suggestion, here is our coversation
shiywang [5:09 PM]
hi, Dr. Stefan i'm sorry to bother, I have a simple question, I was working on a pr which need to use protobuf custom field, and I run into this problem here: https://github.com/golang/protobuf/issues/372 which I think is due to our codebase's protobuf vendor is too old `vendor/github.com/golang/protobuf`, do you think I can update that vendor to lastest one ? also I noticed there's also an extend package called `vendor/github.com/gogo/protobuf/proto` what's the releationship between those two ? which one should I update ?
sttts
[5:11 PM]
hi
[5:11]
don't know much about the proto internals either, @claytonc is probably the only one
[5:12]
create a vendor/github.com/golang/protobuf bump PR and assign it to him
shiywang [5:12 PM]
sounds good, thank you sir
so
/assign @smarterclayton
for suggestion, thanks
```release-note
NONE
```
Kubernetes-commit: 5b7ce60fcebea445b7852d8dc2bce141a2bd7a3a
Wu Qiang
Kubernetes Publisher
Chao Xu
Joe Betz
Maciej Szulik
hzxuzhonghu
Wu Qiang
Cao Shufeng
Davanum Srinivas
Clayton Coleman
Dr. Stefan Schimanski
Daniel Smith
Saad Ali