Commit Graph

14527 Commits

Author SHA1 Message Date
Alexander Zielenski
14b67bece4 guard against modification of test inputs in TestNoOpChanges 2021-11-09 11:39:46 -08:00
Kubernetes Prow Robot
63c4a22ae9 Merge pull request #105819 from tosi3k/client-go-traces
Add more info to the ListAndWatch trace
2021-11-03 11:48:44 -07:00
Kubernetes Prow Robot
0b8ac0c0fc Merge pull request #106121 from wojtek-t/pf_watch_10
P&F fix watch tracker bug
2021-11-03 10:43:34 -07:00
Wojciech Tyczyński
b1d0fde370 P&F fix watch tracker bug 2021-11-03 15:02:51 +01:00
Jordan Liggitt
2567165182 PodSecurity: trim path when building webhook binary
Change-Id: I76650e2fab2186671f0534109d04846134e7525d
2021-11-03 13:00:11 +00:00
Kubernetes Prow Robot
9af2ece18a Merge pull request #106089 from liggitt/podsecurity-beta
PodSecurity: promote config and feature gate to beta
2021-11-02 22:22:57 -07:00
Kubernetes Prow Robot
e48cb8adb0 Merge pull request #106017 from tallclair/unit-test
[PodSecurity] Expand unit test coverage and fix error cases
2021-11-02 18:00:19 -07:00
Kubernetes Prow Robot
c2c0f91385 Merge pull request #101004 from lojies/cleanupforkubectl
code cleanup for kubectl
2021-11-02 17:58:58 -07:00
Tim Allclair
81661d5a34 [PodSecurity] Add metrics test coverage 2021-11-02 14:56:43 -07:00
Tim Allclair
c3398729e0 [PodSecurity] Include error audit annotation on all non-forbidden errors 2021-11-02 14:56:43 -07:00
Tim Allclair
98c86b350c [PodSecurity] Errors validating PodControllers are non blocking 2021-11-02 14:56:42 -07:00
Tim Allclair
e1c4e85b52 [PodSecurity] Add ValidatePod unit test 2021-11-02 14:56:40 -07:00
Kubernetes Prow Robot
47c63a39ed Merge pull request #106097 from liggitt/feature/pod-security/unique-controller-pods-validation
Update pods validation based on uniqueness of controller
2021-11-02 14:28:13 -07:00
Jordan Liggitt
34463dc71a PodSecurity: update pod prioritization to skip exempt pods, add unit tests 2021-11-02 13:37:09 -04:00
Akshit Grover
2a2758d14e PodSecurity: prioritize unique pods over replicated pods when validating a namespace 2021-11-02 13:29:11 -04:00
wongearl
50e4f24ea8 reuse previous evaluation 2021-11-02 12:53:17 -04:00
Jordan Liggitt
1f8f996dc9 PodSecurity: register/test v1beta1 config 2021-11-02 12:46:55 -04:00
Jordan Liggitt
d997607eb9 PodSecurity: find/replace v1alpha1 -> v1beta1 2021-11-02 11:42:31 -04:00
Jordan Liggitt
23e2f1a378 PodSecurity: copy v1alpha1 config to v1beta1 2021-11-02 11:35:18 -04:00
Kubernetes Prow Robot
9be67806cd Merge pull request #102945 from chenchun/fake
Pass DeleteOptions down to the Reactor
2021-11-02 07:14:58 -07:00
Kubernetes Prow Robot
07d3a92ce6 Merge pull request #105653 from p0lyn0mial/crd-503-refactor
apiextentionserver: refactor returning 503 for custom resource requests during server start
2021-11-02 06:12:58 -07:00
Kubernetes Prow Robot
2a821d787b Merge pull request #105525 from damemi/wire-contexts-core
Wire contexts to Core controllers
2021-11-02 03:32:58 -07:00
Kubernetes Prow Robot
6ebd6f38b9 Merge pull request #104909 from pacoxu/kubectl-qos
kubectl: include init containers when determining pod QoS
2021-11-01 20:00:58 -07:00
Chun Chen
888c049df6 Auto generated 2021-11-02 10:04:53 +08:00
Chun Chen
621970476f Pass DeleteOptions down to the Reactor
Co-authored-by: Mo Khan <theenjeru@gmail.com>
2021-11-02 10:04:48 +08:00
Kubernetes Prow Robot
349758d65d Merge pull request #105898 from tallclair/ps-metrics
[PodSecurity] Metrics improvements
2021-11-01 18:12:58 -07:00
Kubernetes Prow Robot
88f8974c8a Merge pull request #105974 from wojtek-t/pf_watch_support_8
P&F: Enable support for indexes in watch tracker
2021-11-01 17:12:58 -07:00
Kubernetes Prow Robot
764e219469 Merge pull request #105946 from prameshj/exclude-autoscaler-nodes
Remove nodes with Cluster Autoscaler taint from LB backends in service controller
2021-11-01 15:43:53 -07:00
Pavithra Ramesh
62799e33ee Remove nodes with Cluster Autoscaler taint from LB backends. 2021-11-01 14:41:21 -07:00
Tim Allclair
afad341759 Cache fast-path metrics & update unit tests 2021-11-01 14:23:00 -07:00
Tim Allclair
6c273020d3 [PodSecurity] Avoid the LegcayRegistry for metrics serving 2021-11-01 14:23:00 -07:00
Tim Allclair
21692e1683 [PodSecurity] Add error & exemption metrics 2021-11-01 14:22:58 -07:00
Tim Allclair
e46928c0b1 [PodSecurity] Fix up metrics & add tests
Update pod security metrics to match the spec in the KEP.
2021-11-01 14:11:19 -07:00
Kubernetes Prow Robot
ac2d872ed9 Merge pull request #105908 from stlaz/ps_annotations
[PodSecurity] Add annotations denoting the exemption reason and the enforcement policy used
2021-11-01 13:17:46 -07:00
Wojciech Tyczyński
21ec77dc19 Enable support for indexes in WatchTracker 2021-11-01 20:51:40 +01:00
Wojciech Tyczyński
12746f4bc1 P&F: Update WatchTracker interface to pass more information 2021-11-01 20:35:18 +01:00
Kubernetes Prow Robot
76694983a1 Merge pull request #105930 from wojtek-t/pf_watch_support_7
P&F: Update and cleanup mutating work estimator
2021-11-01 07:33:18 -07:00
Mike Dame
4960d0976a Wire contexts to Core controllers 2021-11-01 10:29:00 -04:00
Stanislav Laznicka
037daeb4fd podsecurity: add an annotation informing about which policy was enforced 2021-11-01 13:27:13 +01:00
Stanislav Laznicka
65f88c675c podsecurity: distinguish between audit and audit violation annotations 2021-11-01 13:27:11 +01:00
Stanislav Laznicka
4a79488ac2 podsecurity: annotations on responses allowed by exemption 2021-11-01 13:24:38 +01:00
Wojciech Tyczyński
4700cf622b P&F: update mutating request estimation 2021-11-01 09:35:28 +01:00
Kubernetes Prow Robot
aa6bb481ba Merge pull request #105839 from nilo19/bug/cherry-pick-856
fix: remove VMSS and VMSS instances from SLB backend pool only when necessary
2021-11-01 00:01:18 -07:00
Kubernetes Prow Robot
b403ed8578 Merge pull request #105777 from nilo19/bug/cherry-pick-860
fix: do not delete the lb that does not exist
2021-10-31 23:01:31 -07:00
Kubernetes Prow Robot
763e528e5b Merge pull request #105253 from nilo19/bug/cherry-pick-680
fix: leave the probe path empty for TCP probes
2021-10-31 23:01:19 -07:00
Monis Khan
249aefebe3 client-go exec: make sure round tripper can be unwrapped
Signed-off-by: Monis Khan <mok@vmware.com>
2021-10-29 17:59:52 -04:00
Wojciech Tyczyński
e262db7a4d P&F: move seat-seconds to a better location 2021-10-29 22:20:16 +02:00
Tim Hockin
11a25bfeb6 De-share the Handler struct in core API (#105979)
* De-share the Handler struct in core API

An upcoming PR adds a handler that only applies on one of these paths.
Having fields that don't work seems bad.

This never should have been shared.  Lifecycle hooks are like a "write"
while probes are more like a "read". HTTPGet and TCPSocket don't really
make sense as lifecycle hooks (but I can't take that back). When we add
gRPC, it is EXPLICITLY a health check (defined by gRPC) not an arbitrary
RPC - so a probe makes sense but a hook does not.

In the future I can also see adding lifecycle hooks that don't make
sense as probes.  E.g. 'sleep' is a common lifecycle request. The only
option is `exec`, which requires having a sleep binary in your image.

* Run update scripts
2021-10-29 13:15:11 -07:00
Shivanshu Raj Shrivastava
c2fba6b84d referenced the V1Secret type (#105901) 2021-10-29 12:13:11 -07:00
Bryan Boreham
a988182f59 'kubectl events' command (#99557)
* Basic scaffolding for kubectl events command

* Simple implementation of 'kubectl events'

* Print event fields

Borrowing code from 'kubectl describe'

* Sort events before printing

* Make output more like 'kubectl get events'

Print namespace if fetching from all

* Refactor: extract print functions

To make it easier to add watch function next.

* Implement watch for new events

Run the list function same as before, so those events come out in order,
then watch from the ResourceVersion after the last event.

* Clear up some lint warnings

* Update description and example text

* refactor: introduce a listOptions variable

* Implement --for option

splitResourceTypeName() function borrowed from cli-runtime because we
need similar behaviour to Builder.ResourceNames(), but applying to
Event.InvolvedObject.

* Add kubectl/pkg/cmd/events to vendor/modules.txt

* Add back cmdutil.Factory

Needed in NewCmdAlpha to construct the 'events' command

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

* Fix lint

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

* Make package alias go-cromulent

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

* Use genericclioptions.RESTClientGetter instead of cmdutil.Factory

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

* Decode object parameter to GroupVersionKind and name

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

* Merge two files into one

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

* Include example for --for option

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

* Fix inconsistent option name in error message

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

* Remove unnecessary Validate call

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

* Use fields from event series

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

* Support chunking of list of events

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

* Use watchtools utility to receive watch events

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

* Split struct into flags and options

Flags represents the inputs from the CLI; options are what the running
command needs. This structure parallels the 'wait' command, and should
be easier to write tests for.

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

* Add some parameters to usage string

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

* Do only one of list or watch

We tried to print the list first then start a watch after the last
event, but sometimes the server will return "watch is too old" on that
ResourceVersion.
Instead, if we need to watch just start it from the beginning.

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>

* Print message if no events found

Also, if watching, don't print the headings until the first event
arrives.

Signed-off-by: Bryan Boreham <bjboreham@gmail.com>
2021-10-29 09:12:50 -07:00