kubernetes
/
apiserver
mirror of https://github.com/kubernetes/apiserver.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
6,970 Commits 30 Branches 1,482 Tags 31 MiB
Commit Graph

1036 Commits

Author SHA1 Message Date
Anish Ramasekar f6b16dddb3 Add `apiserver_encryption_config_controller_automatic_reloads_total` 
metric

- Adds `apiserver_encryption_config_controller_automatic_reloads_total`
  metric with status label for encryption config reload success/failure.
- Deprecated `apiserver_encryption_config_controller_automatic_reload_failures_total` and `apiserver_encryption_config_controller_automatic_reload_success_total`

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: 77241d31253baf051302fff7480c9601ad817399
 2024-02-07 19:44:41 +00:00
Abu Kashem eff38efc48 apiserver: warning should not panic when request times out 
Kubernetes-commit: 7cab0ad2d2b2688575c1d6c8b5ecee2bfa5a39ff
 2023-01-26 08:56:10 -05:00
Monis Khan 285e6ec394 Clean up encryption config reading and hashing logic 
This is a no-op change that makes the internal encryption config
hash more specific to it use and explicitly marks it as unstable.

Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: 9387a66c71fd85840cb199b468610b8fa950253f
 2024-01-10 14:48:30 -05:00
Anish Ramasekar e7eedd15ec move encryption config types to standard API server config location 
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: 75695dae1093cc08cb56a4930c0be8e7e4433be1
 2023-12-16 00:00:21 +00:00
Siyuan Zhang 06103a07ae k8s.io/apiserver: refactor GenericAPIServer healthz code. 
Signed-off-by: Siyuan Zhang <sizhang@google.com>

Kubernetes-commit: 12c9bfc21d6c9799c2cd6bf0e9dcca6f1534812d
 2023-11-15 12:36:04 -08:00
Monis Khan 3097e77b18 encryptionconfig/controller: run unit tests faster 
Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: 6ac7da1da87bb0e739806cad94676da915be6d9c
 2023-10-31 11:59:37 -04:00
Abu Kashem b3499eec62 apiserver: set APF featuregate to ga 
Kubernetes-commit: c7fcef187562e1b3ffdaa2e2109c65d800b8f5d5
 2023-10-31 08:35:52 -04:00
Abu Kashem b041969f97 apiserver: allow zero value for the 'nominalConcurrencyShares' field 
Kubernetes-commit: 9fd2ab419ad771790d3cb80ea7b8e6828d9ce305
 2023-10-27 19:26:08 -04:00
Abu Kashem 0b0a995736 apiserver: apf controller, bootstrap, tests should use flowcontrol v1 API 
Kubernetes-commit: 17bda3c3e05a75943591f61f37d7fdc0d07870ec
 2023-10-11 09:20:41 -04:00
Nilekh Chaudhari d93aaa8d93 feat: updates encryption config file watch logic to polling 
Signed-off-by: Nilekh Chaudhari <1626598+nilekhc@users.noreply.github.com>

fix (#2)

Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: e95b7c6d8b889e42ee44e626914e457e228ce8d4
 2023-10-17 21:21:00 +00:00
Ben Luddy cd9457dbfc Deep disablement for APF based on --enable-priority-and-fairness. 
Avoids starting informers or the config-consuming controller when
--enable-priority-and-fairness=false. For kube-apiserver, the config-producing controller runs if
and only if flowcontrol API storage is enabled.

Kubernetes-commit: 83f5b5c240e5cced1371bbd22e458dae43975238
 2023-06-26 17:00:26 -04:00
Yao Cheng 2b3f11cba2 Register metrics for apiserver handlers 
Signed-off-by: Yao Cheng <chengyao09@hotmail.com>

Kubernetes-commit: 18c3b6fce43edd76620a07707af2d851b52c3fad
 2023-09-06 17:25:12 +00:00
Rita Zhang 26219aabef [KMSv2] promote KMSv2 and KMSv2KDF to GA 
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>

Kubernetes-commit: a9b1adbafc7fe52f669dc98aada21bc3e46cdce3
 2023-10-24 09:50:45 -07:00
guangli.bao e59c50c660 Remove GAed feature gates OpenAPIV3 
Signed-off-by: guangli.bao <guangli.bao@daocloud.io>

Kubernetes-commit: 27bb40a9d839589ac9f97b6ce80b18a7635e9ae4
 2023-10-19 22:30:58 +08:00
Wojciech Tyczyński 5bf4f58ab8 Remove storageConfig.Paging parameter 
Kubernetes-commit: b386120da239bf9652fc02b2d2cbbd0fcc3cd121
 2023-10-20 15:35:58 +02:00
Wojciech Tyczyński 71519801e7 Remove disablePaging param 
Kubernetes-commit: 106f58686d58a790a86dc05b4c93a5da041de389
 2023-10-20 15:30:03 +02:00
tao.yang 47998d1ee6 cleanup: omit comparison with bool constants 
Signed-off-by: tao.yang <tao.yang@daocloud.io>

Kubernetes-commit: b35357b6c08f21ba0fd312536051394c2567ec79
 2023-09-04 16:59:23 +08:00
Ben Luddy a270d45ae5 Add validation for --storage-media-type option. 
Kubernetes-commit: cf836309dc278d8d4f046e1580649179b1531143
 2023-10-19 10:54:16 -04:00
Ben Luddy 91d0f39545 Restrict supported media types for new apiservers. 
This is to prevent the enablement of new data formats (CBOR) in the early stages of phased
implementation.

Kubernetes-commit: ced56a6adabdd86f99455b100b1c0c7a2b4f3c55
 2023-10-17 14:06:46 -04:00
Jefftree 2e1024671d Fix v3 spec 
Kubernetes-commit: b30c6bdff817cec28b3d88b3bb3e12f1e86488d0
 2023-10-04 12:55:49 -04:00
Abu Kashem 28ed1d7ad4 fix data race in apf unit test 
Kubernetes-commit: 52c58d970e54bf10b78512c68602f70b0a970f31
 2023-09-22 14:42:43 -04:00
Monis Khan 445b713906 Prevent rapid reset http2 DOS on API server 
This change fully addresses CVE-2023-44487 and CVE-2023-39325 for
the API server when the client is unauthenticated.

The changes to util/runtime are required because otherwise a large
number of requests can get blocked on the time.Sleep calls.

For unauthenticated clients (either via 401 or the anonymous user),
we simply no longer allow such clients to hold open http2
connections.  They can use http2, but with the performance of http1
(with keep-alive disabled).

Since this change has the potential to cause issues, the
UnauthenticatedHTTP2DOSMitigation feature gate can be disabled to
remove this protection (it is enabled by default).  For example,
when the API server is fronted by an L7 load balancer that is set up
to mitigate http2 attacks, unauthenticated clients could force
disable connection reuse between the load balancer and the API
server (many incoming connections could share the same backend
connection).  An API server that is on a private network may opt to
disable this protection to prevent performance regressions for
unauthenticated clients.

For all other clients, we rely on the golang.org/x/net fix in
b225e7ca6d
That change is not sufficient to adequately protect against a
motivated client - future changes to Kube and/or golang.org/x/net
will be explored to address this gap.

The Kube API server now uses a max stream of 100 instead of 250
(this matches the Go http2 client default).  This lowers the abuse
limit from 1000 to 400.

Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: 800a8eaba7f25bd223fefe6e7613e39a5d7f1eeb
 2023-10-07 21:50:37 -04:00
Abu Kashem d64c9b18da apf: remove RequestWaitLimit from queueset config 
Kubernetes-commit: 11ef9514dad6f46a4315198978fee14132c4bbca
 2023-08-29 12:11:08 -04:00
Abu Kashem a2e63604f2 apf: use context for queue wait 
Kubernetes-commit: f39213a7e44f21a8cedcdf38d3c2531456a526d6
 2023-08-28 17:01:16 -04:00
Dr. Stefan Schimanski 2f3285287e controlplane: make option structs uniformly optional 
Signed-off-by: Dr. Stefan Schimanski <stefan.schimanski@gmail.com>

Kubernetes-commit: 63950491764535a8635cb2c4810db59a9a1fad25
 2023-09-24 11:50:38 +02:00
Han Kang bd7db816d7 promote component SLIs to GA; remove feature gates for component slis 
Kubernetes-commit: e6435e98eda93fbf96e94110af6ca5a10ad1e926
 2023-09-11 08:52:50 -07:00
Rita Zhang cdb2cea24a kms: remove livez check 
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>

Kubernetes-commit: 7710128636a16c73045291d4729675339a7d57f7
 2023-09-11 16:47:29 -07:00
Rita Zhang 2bed5d11d9 kmsv2: add apiserver identity to metrics 
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>

Kubernetes-commit: 43ccf6c4e8f173d981edebb6146c58b523fc21b7
 2023-09-05 13:03:18 -07:00
Monis Khan 9c40486020 kmsv2: enable KMSv2KDF feature gate by default 
Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: 657cc2045ee46922b00d4fd7c126f57d1e8ecc43
 2023-09-05 12:27:55 -04:00
Anish Ramasekar 9b1c514777 register API types only once for encryption config 
Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: 418af0f4dcbe15147b21462b9e5db5a5ba769c12
 2023-09-01 17:24:20 +00:00
Wojciech Tyczyński 3030f660a8 Graduate APIListChunking to GA 
Kubernetes-commit: 6acfa3cb4ac876e46ead5ba4772ba18e480435ce
 2023-07-21 11:35:21 +02:00
seantywork bf05e35835 kubernetes mutual (2-way) x509 comment 
Kubernetes-commit: 48260b4a77b423b178ec5e262ac67be52d49f455
 2023-08-18 01:31:22 +00:00
Rita Zhang 2eac3ca68c kmsv2 test feature enablement unit test 
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>

Kubernetes-commit: d86e72202c4b039e1dceccbfbae559fb1c54471d
 2023-08-01 10:17:01 -07:00
Dr. Stefan Schimanski 13a3aab581 apiserver/httplog: pretty up impersonation output 
```
I0807 09:09:16.419239       1 httplog.go:132] "HTTP" verb="GET" URI="/apis/batch/v1?timeout=32s" latency="214.666µs" userAgent="kubernetes-provider/v0.0.0 (linux/arm64) kubernetes/$Format" audit-ID="948ef6b2-474d-45a7-ad5f-894ce93d05f7" srcIP="192.168.139.202:35542" apf_pl="exempt" apf_fs="exempt" apf_execution_time="129.5µs" resp=200 addedInfo=<

      &{kubernetes-admin  [system:masters system:authenticated] map[]} is acting as &{foo  [system:authenticated] map[]}
       >
```

to

```
I0807 09:09:16.419239       1 httplog.go:132] "HTTP" verb="GET" URI="/apis/batch/v1?timeout=32s" latency="214.666µs" userAgent="kubernetes-provider/v0.0.0 (linux/arm64) kubernetes/$Format" audit-ID="948ef6b2-474d-45a7-ad5f-894ce93d05f7" srcIP="192.168.139.202:35542" apf_pl="exempt" apf_fs="exempt" apf_execution_time="129.5µs" resp=200 addedInfo="kubernetes-admin[system:masters system:authenticated] is impersonating foo[system:authenticated]"
```

Signed-off-by: Dr. Stefan Schimanski <stefan.schimanski@gmail.com>

Kubernetes-commit: 37730c07dd658ba585ffee3861780e18947ca534
 2023-08-07 11:23:30 +02:00
Stephen Kitt 7fb4ad7511 api-machinery: stop using deprecated io/ioutil 
This replaces deprecated ioutil functions as follows:

* ioutil.ReadAll -> io.ReadAll
* ioutil.ReadFile -> os.ReadFile
* ioutil.TempDir -> os.MkdirTemp
* ioutil.TempFile -> os.CreateTemp
* ioutil.WriteFile -> os.WriteFile

Signed-off-by: Stephen Kitt <skitt@redhat.com>

Kubernetes-commit: b60a3a58df2791ae67764f6325be31aea5eca5a0
 2023-05-02 15:08:18 +02:00
Monis Khan 8e93c650b5 kmsv2: KDF based nonce extension 
Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: bf49c727ba10881d5378e9242f31dc00dede51be
 2023-03-25 14:41:04 -04:00
Marek Siarkowicz e9acd0c76d Fix the semantic meaning of etcd server within component statuses and metrics. 
Instead of numerating all the etcd endpoints known by apiserver, we will
group them by purpose. `etcd-0` will be the default etcd, `etcd-1` will
be the first resource override, `etcd-2` will be the second override and
so on.

Kubernetes-commit: 03aad1f823cb719fa6e6b6d33fefa2a2140cc760
 2023-07-19 14:25:54 +02:00
Richa Banker 8a38d429d8 Add impl for uvip 
Kubernetes-commit: cd5f3d9f9d5ae3153206178e6114d573dc24ad73
 2023-03-29 17:20:25 -07:00
Andrew Sy Kim f00505bddc priority & fairness: support dynamically configuring work estimator max seats 
Max seats from prioriy & fairness work estimator is now min(0.15 x
nominalCL, nominalCL/handSize)

'Max seats' calculated by work estimator is currently hard coded to 10.
When using lower values for --max-requests-inflight, a single
LIST request taking up 10 seats could end up using all if not most seats in
the priority level. This change updates the default work estimator
config such that 'max seats' is at most 10% of the
maximum concurrency limit for a priority level, with an upper limit of 10.
This ensures seats taken from LIST request is proportional to the total
available seats.

Signed-off-by: Andrew Sy Kim <andrewsy@google.com>

Kubernetes-commit: d3ef2d4fe95c3ef7b1c606ad01be1183659da391
 2023-04-26 11:13:14 +00:00
David Eads 5ed33dc31d add list of served versions to storage version 
Kubernetes-commit: 90ab7580aaeca1c6e949df15554ad5bc408dca8e
 2023-07-12 18:27:27 -04:00
Nilekh Chaudhari 1668629f57 feat: implements metrics for encryption config hot reload 
Signed-off-by: Nilekh Chaudhari <1626598+nilekhc@users.noreply.github.com>

Kubernetes-commit: c291e6355c44e84c2e1d503d1d9bf3e8fab9e194
 2023-07-05 22:28:15 +00:00
Nilekh Chaudhari 36a1803532 chore: hashes keyID 
Signed-off-by: Nilekh Chaudhari <1626598+nilekhc@users.noreply.github.com>

Kubernetes-commit: 131216fa8f2dd13f2585e2010717733f4cb2c1e2
 2023-06-29 20:32:27 +00:00
Monis Khan c534f8e2b9 Add enj to apiserver options approver 
Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: b81f07ac9a61d425f1e457132803ed94f6b8a52d
 2023-07-11 16:07:44 -04:00
Marek Siarkowicz 573a8d6d05 Improve apiserver storage size metric to allow it's graduation 
Change name to make it compliant with prometheus guidelines.
Calculate it on demand instead of periodic to comply with prometheus standards.
Replace "endpoint" with "server" label to make it semantically consistent with storage factory

Kubernetes-commit: 7a63997c8a1a9ba14f2bdc478fdf33cf88f48d80
 2023-06-22 11:56:09 +02:00
Jad Haj Yahya a01ccc2e32 Document address family of listening INET sockets 
Kubernetes-commit: de0764309571f0989847b2322db1906c5b34949e
 2023-07-10 15:01:13 +03:00
Anish Ramasekar 5d08b1abe9 [KMSv2] Mark KMS v1beta1 as deprecated with no further fixes (#119007) 
* add feature gate

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

* add validation and warning in load config

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

* mark v1beta1 proto message deprecated

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

---------

Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>

Kubernetes-commit: 1acdb4ae86e0e43475c31f108a6106b1f5ea5027
 2023-07-06 23:55:47 +00:00
Tim Allclair 2a8bc69060 Initialize the AuditEvent with the AuditContext (#113611) 
* Initialize the AuditEvent with the AuditContext

* Squash: Address PR feedback

* Squash: address PR feedback

Kubernetes-commit: 2b03f04ce589a57cf80b2153c7e5056c53c374d3
 2023-07-03 18:28:13 +00:00
Monis Khan aa8212180e kmsv2: no-op refactor priming logic into its own function 
Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: 55b690ee018bfa2e32c4d2dab13123a336c7d013
 2023-03-23 11:49:20 -04:00
Monis Khan 296a76b0b7 kmsv2: refine probing logic to avoid slow starts 
Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: 15003c609d0ad4aea79895530b1dd4517514154d
 2023-03-23 11:35:36 -04:00
Monis Khan cb83ab1a45 kmsv2: add a sanity check to confirm that new state is always valid 
Signed-off-by: Monis Khan <mok@microsoft.com>

Kubernetes-commit: d8150b816014427b9fec342f2cf303e1472c62c7
 2023-03-23 10:42:05 -04:00