Commit Graph

244 Commits

Author SHA1 Message Date
Walter Fender 9bdac68d70 Get network-proxy working with GCE.
Got the proxy-server coming up in the master.
Added certs and have it comiung up with those certs.
Added a daemonset to run the network-agent.
Adding support for agent running as a sameon set on every node.

Added quick hack to test that proxy server/agent were correctly
tunneling traffic to the kubelet.

Added more WIP for reading network proxy configuration.
Get flags set correctly and fix connection services.
Adding missing ApplyTo
Added ConnectivityService.
Fixed build directives. Added connectivity service configuration.
Fixed log levels.
Fixed minor issues for feature turned off.
Fixed boilerplate and format.
Moved log dialer initialization earlier as per Liggits suggestion.
Fixed a few minor issues in the configuration for GCE.
Fixed scheme allocation
Adding unit test.
Added test for direct connectivity service.

Switching to injecting the Lookup method rather than using a Singleton.
First round of mikedaneses feedback.
Fixed deployment to use yaml and other changes suggested by MikeDanese.

Switched network proxy server/agent which are kebab-case not camelCase.
Picked up DIAL_RSP fix.
Factored in deads2k feedback.
Feedback from mikedanese
Factored in second round of feedback from David.
Fix path in verify.
Factored in anfernee's feedback.
First part of lavalamps feedback.
Factored in more changes from lavalamp and mikedanese.

Renamed network-proxy to konnectivity-server and konnectivity-agent.
Fixed tolerations and config file checking.
Added missing strptr
Finished lavalamps requested rename.
Disambiguating konnectivity service by renaming it egress selector.

Switched feature flag to KUBE_ENABLE_EGRESS_VIA_KONNECTIVITY_SERVICE

Kubernetes-commit: ebb65c5f4c51340f42c260cf00bde8629ed68d74
2019-05-20 12:44:51 -07:00
Dr. Stefan Schimanski 5f126c4400 apiserver: add --shutdown-delay-duration to keep serving until LBs stop serving traffic
Kubernetes-commit: 408f36b8825136c2b1771f642d88557e83a2ddb7
2019-02-22 15:13:28 +01:00
immutablet 5faffb9123 Allow kube-apiserver to test the status of kms-plugin.
Kubernetes-commit: 05fdbb201ffbaff4e92f0899f9e2ca038febb88d
2019-05-30 11:15:35 -07:00
Andy Goldstein 637cea444b Fix max port value to 65535
Signed-off-by: Andy Goldstein <goldsteina@vmware.com>

Kubernetes-commit: 9bba2c93ec6042fc4140afecc672f025ba491928
2019-06-24 15:13:27 -04:00
Han Kang 7fd71e31ef add readyz endpoint for kube-apiserver readiness checks
add startup sequence duration and readyz endpoint

add rbac bootstrapping policy for readyz

add integration test around grace period and readyz

rename startup sequence duration flag

copy health checks to fields

rename health-check installed boolean, refactor clock injection logic

cleanup clock injection code

remove todo about poststarthook url registration from healthz

Kubernetes-commit: 54dcf5c9c46fc4782d4861936309349b5a71a1ac
2019-05-30 11:19:49 -07:00
Andrew Kim ef71315b08 update import of generic featuregate code from k8s.io/apiserver/pkg/util/feature -> k8s.io/component-base/featuregate
Kubernetes-commit: c91913924543e1d29f3f3d51354701df9df75def
2019-03-04 12:46:52 -05:00
Daniel (Shijun) Qian 3a0abf14e5 fix duplicated imports of k8s code (#77484)
* fix duplicated imports of api/core/v1

* fix duplicated imports of client-go/kubernetes

* fix duplicated imports of rest code

* change import name to more reasonable

Kubernetes-commit: 5268f69405251a4a74130fa903e055a59071179a
2019-05-08 18:39:56 +00:00
yue9944882 735ce2f371 add new flag for enabling requests mgmt handler
Kubernetes-commit: 87d09301e59ac65e55dba32614b8e8b3bae2dd8f
2019-04-15 14:57:55 +08:00
Yassine TIJANI 72bd8c7a64 use cache size to signal undecorated storage
Kubernetes-commit: 8261d3d9a63f0972453f6503b62299a96ecee657
2019-02-20 22:15:24 +01:00
Justin SB cc4525538b Remove executable permission from testdata
Kubernetes-commit: 19a5528a65bf59bed6289703e1811640b53b2087
2019-01-03 12:21:19 -05:00
Andrew Lytvynov 3604e0cbb0 Extract new keyutil package from client-go/util/cert
This package contains public/private key utilities copied directly from
client-go/util/cert. All imports were updated.

Future PRs will actually refactor the libraries.

Updates #71004

Kubernetes-commit: 18458392ca24c85c688e655aace1afd04f864cbd
2018-12-09 16:24:38 -08:00
Mehdy Bohlool 0fbb46dc25 Remove the propagated scheme from the Admission chain
Kubernetes-commit: cebb4ee2ac9e19fe90f78c3285978e585e67a3ac
2019-02-16 13:28:14 -08:00
Justin SB 3883f41494 Add code comments to guard inadvertent removal of insecure-bind-address
Though the flags are deprecated, the deprecation process revealed that
the flag is important for health checks in more secure environments.
Add a link to #43784 to help developers understand why the flags have
not yet been removed.

Issue #43784
Issue #74172
Issue #59018

Kubernetes-commit: 7dbbab0476b35b74f600f62b6751212ed3afe574
2019-02-18 12:58:59 -05:00
David Eads 743057093a allow apiservers to override the list of decorators
Kubernetes-commit: ad740bbba58e48d5ff8353419066b7fd30abfa45
2019-02-18 14:24:14 -05:00
David Eads af92b436cc prevent unhandled errors on colliding poststarthook registration
Kubernetes-commit: 8d0c56e22f73fdb1a82a12475909e7d69f4bec08
2019-02-14 14:07:18 -05:00
Marek Counts c7299d9da0 Moved flag and globalflag
Moved all flag code from `staging/src/k8s.io/apiserver/pkg/util/[flag|globalflag]` to `component-base/cli/[flag|globalflag]` except for the term function because of unwanted dependencies.

Kubernetes-commit: 7744f908306e5131be5a94815ac76a7cba6454f2
2019-02-15 10:28:13 -05:00
Justin SB bf98046128 Remove executable file permission from OWNERS files
Kubernetes-commit: dd19b923b7c26420af39fcf4eedfa213b236c8d3
2019-01-03 12:18:20 -05:00
Chao Xu 4ebbf20f41 Adding a limit on the maximum bytes accepted to be decoded in a resource
write request.

Kubernetes-commit: b971b12d3cfa8887aa87957fbba92b90e3e99dc6
2019-02-06 16:58:24 -08:00
Roy Lenferink 4c9524b9fb Updated OWNERS files to include link to docs
Kubernetes-commit: b43c04452f3b563473b5c2a765d4ac18cc0ff58f
2019-01-30 20:05:00 +01:00
Chao Xu f60d1ce95c Set the maximum size increase the copy operations in a json patch can cause
Kubernetes-commit: f001f9e1dbce644a1b7d22b370ab37fc7d770c7e
2019-02-04 11:15:16 -08:00
Jordan Liggitt 123cf8011f Remove alpha InitializerConfiguration types, Initializers admission plugin
Kubernetes-commit: dc1fa870bff65c20f48a83ea3af54adb3f526e28
2019-01-16 10:19:44 -05:00
Patrick Barker 3039935d60 adds dynamic audit integration test
Kubernetes-commit: d995047366153d86f0061b829ee4e7657f17996b
2018-10-16 16:17:33 -06:00
qingsenLi 1e20513561 fix typo and instead of amd
Kubernetes-commit: 3e83f0f08abab4c10dfab7053529709883c9b834
2018-10-30 01:27:50 +08:00
Jordan Liggitt 2109711572 Remove build/verify scripts for swagger 1.2 API docs, API server swagger ui / swagger 1.2 config
Kubernetes-commit: 9229399bd6049bc7766829b436d5cb5fe0dfe2f1
2019-01-15 10:44:36 -05:00
immutableT 9c474d9c53 require timeout to be greater than zero.
add unit test to cover timeout behaviour.

Kubernetes-commit: 39aca564749cd92ed1cfec7129eb3f6593549137
2019-01-04 17:06:07 -08:00
immutableT d9414ee2ab Expose kms timeout value via encryption config.
Kubernetes-commit: a4dc53cfeb91ee07cedcc6959e88e30cb0c3cca8
2019-01-03 14:26:57 -08:00
David Eads 1702e95788 fix typo in warning advice for permissions
Kubernetes-commit: 1105e4e0d1c0e78e2a203a136e9f8bcaff5c36ab
2019-01-04 09:58:06 -05:00
Dr. Stefan Schimanski 7d47897b55 apiserver: separate transport setting from storagebackend.Config
Kubernetes-commit: 7b242533a217bd809e2c846c3e3fadf7bf6edee8
2018-09-12 10:59:01 +02:00
Jordan Liggitt a3f2a871b3 Surface help for insecure ports to explain how to disable
Kubernetes-commit: 819b502768034b8104904cd7031db8c4838f900a
2018-11-30 10:52:37 -05:00
Jordan Liggitt 232ebfaeaf Allow kube-scheduler to tolerate cluster auth config lookup failure
Kubernetes-commit: 416e11421590838f0022242bff1db10da595b074
2018-12-05 13:51:06 -05:00
Jordan Liggitt d294e6b5b4 Update non-test code to use DefaultMutableFeatureGate
Kubernetes-commit: d440ecdd3b41a4fc4a207195e1bb976422d6d35e
2018-11-20 23:59:52 -05:00
Mike Spreitzer ee7fb67d6e Clarified syntax doc on --watch-cache-sizes
Noted that group must be omitted for resources of apiVersion v1 (the
legacy core API) and included for others.

Fixes #65393

Kubernetes-commit: fc20359fed5e3d0e89a60653b9b0d638d4d757d8
2018-11-12 14:45:45 -05:00
Sergei Orlov e485f8578d kubeapiserver: rename '--experimental-encryption-provider-config' to '--encryption-provider-config'.
This change renames the '--experimental-encryption-provider-config'
flag to '--encryption-provider-config'. The old flag is accepted but
generates a warning.

In 1.14, we will drop support for '--experimental-encryption-provider-config'
entirely.

Co-authored-by: Stanislav Laznicka <slaznick@redhat.com>

Kubernetes-commit: 21c1bb883081b13244002271bccc9cf119d4db4f
2018-03-23 14:16:04 +03:00
Daniel Kłobuszewski 877329b0f3 Add option to k8s apiserver to reject incoming requests upon audit failure
Kubernetes-commit: 7a10f4eda725f55bec9893eb1c03f2402dbcd32f
2018-07-03 14:40:55 +02:00
Slava Semushin e2bc8e4617 Introduce kubeapiserver.config.k8s.io/v1 with EncryptionConfiguration and use a standard method for parsing config file.
Co-authored-by: Stanislav Laznicka <slaznick@redhat.com>

Kubernetes-commit: c21cb548e6c7d4ab019fce8a35c9b99c035c2071
2018-05-02 18:21:38 +02:00
WanLinghao f78d7e624c fix a description error in DynamicAuditing feature
Kubernetes-commit: 84aa00c03df00eade6615ca009fa9b2943a98b8c
2018-11-17 01:49:02 +08:00
Patrick Barker 9fd62b6f47 adds dynamic audit configuration
Kubernetes-commit: eb89d3dddd3792b0a6cd724e64bbbc11d6c15380
2018-10-18 21:34:17 -05:00
Davanum Srinivas 2710b17b80 Move from glog to klog
- Move from the old github.com/golang/glog to k8s.io/klog
- klog as explicit InitFlags() so we add them as necessary
- we update the other repositories that we vendor that made a similar
change from glog to klog
  * github.com/kubernetes/repo-infra
  * k8s.io/gengo/
  * k8s.io/kube-openapi/
  * github.com/google/cadvisor
- Entirely remove all references to glog
- Fix some tests by explicit InitFlags in their init() methods

Change-Id: I92db545ff36fcec83afe98f550c9e630098b3135

Kubernetes-commit: 954996e231074dc7429f7be1256a579bedd8344c
2018-11-09 13:49:10 -05:00
tanshanshan 631dda550e kube-scheduler: enable secure ports 10259
Kubernetes-commit: cb95edafe8bf4f294beb53d0a7bc04d62584577c
2018-09-05 16:42:16 +08:00
Davanum Srinivas 032ec9d79b Switch to sigs.k8s.io/yaml from ghodss/yaml
Change-Id: Ic72b5131bf441d159012d67a6a3d87088d0e6d31

Kubernetes-commit: 43f523d405b012fa8d90dd95b667f520e036f6bc
2018-11-02 16:41:57 -04:00
David Eads 257a06e88a add With method for allowed URL options on delegated authorization
Kubernetes-commit: 77b56ec9e36dd721c341ce838d608e8af10ce51f
2018-11-06 10:44:29 -05:00
Jordan Liggitt 136e478e9f encryption-at-rest approvers/reviewers
Kubernetes-commit: 666c93a8343029a499ea64de8a6d09596097ccb3
2018-11-02 17:38:17 -04:00
David Eads 83c8e657ed allow delegated authorization to have privileged groups
Kubernetes-commit: 0b70b7a7c975589f7019e5017c334cf0ee6b819f
2018-11-05 16:23:20 -05:00
Chao Wang f8fa426bd3 Use `audit.k8s.io/v1` as default value of option --audit-webhook-version and --audit-log-version in release 1.13
Kubernetes-commit: 9671a035f7e7308ac804b4637af19bac2ecce0f4
2018-10-31 17:22:37 +08:00
Jordan Liggitt 22df332aff Allow components to generate certificates in-memory
Kubernetes-commit: b7160d4ee2073f06293d7c3b20acdf4620fadf61
2018-10-16 17:22:13 -04:00
Jordan Liggitt c7c9a358c2 etcd2 code cleanup, remove deserialization cache
Kubernetes-commit: c8db31b84adc40aa875917fbca27b2a787902088
2018-10-15 22:17:44 -04:00
Eric Chiang 13ab2dca08 Remove ericchiang from OWNERS files
Kept myself in the OpenID Connect ones for now.

Kubernetes-commit: 766f5875bfa0d8ce4d52cdb87d12faea527e1492
2018-10-11 18:11:15 -07:00
Jordan Liggitt bd604a62aa Remove deprecated --etcd-quorum-read flag
Kubernetes-commit: cff79c542130831f4a212099974570244a0c9586
2018-10-08 11:04:28 -04:00
Christoph Blecker 92e87e143a Update gofmt for go1.11
Kubernetes-commit: 97b2992dc191a357e2167eff5035ce26237a4799
2018-10-05 12:59:38 -07:00
Solly Ross 41e5031224 Populate ClientCA in delegating auth setup
kubernetes/kubernetes#67768 accidentally removed population of the the ClientCA
in the delegating auth setup code.  This restores it.

Kubernetes-commit: 65cea86e4413cb5899c3b89bda375bb326de5093
2018-10-04 12:48:18 -04:00