Merge pull request #708 from erikwilson/vendor-v1.14.5-k3s.1

trash.lock

@@ -239,7 +239,7 @@ import:
 - package: github.com/rancher/wrangler-api
   version: v0.1.4
 - package: github.com/robfig/cron
-  version: v1-53-gdf38d32658d878
+  version: v1.0.0-53-gdf38d32658d878
 - package: github.com/rootless-containers/rootlesskit
   version: v0.4.1
 - package: github.com/russross/blackfriday
@@ -316,7 +316,7 @@ import:
 - package: k8s.io/klog
   version: v0.2.0-14-g8e90cee79f8237
 - package: k8s.io/kubernetes
-  version: v1.14.4-k3s.1
+  version: v1.14.5-k3s.1
   repo: https://github.com/rancher/k3s.git
   transitive: true
   staging: true

vendor.conf

@@ -9,7 +9,7 @@ package=github.com/opencontainers/runc/libcontainer/nsenter
 package=github.com/opencontainers/runc/libcontainer/specconv
 package=github.com/opencontainers/runc/contrib/cmd/recvtty
 
-k8s.io/kubernetes                   v1.14.4-k3s.1                             https://github.com/rancher/k3s.git                transitive=true,staging=true
+k8s.io/kubernetes                   v1.14.5-k3s.1                             https://github.com/rancher/k3s.git                transitive=true,staging=true
 
 github.com/rancher/wrangler         7737c167e16514a38229bc64c839cee8cd14e6d3
 github.com/rancher/wrangler-api     v0.1.4

vendor/k8s.io/apiextensions-apiserver/pkg/apiserver/BUILD

@@ -52,6 +52,7 @@ go_library(
         "//staging/src/k8s.io/apimachinery/pkg/runtime/serializer/versioning:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/types:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/util/runtime:go_default_library",
+        "//staging/src/k8s.io/apimachinery/pkg/util/sets:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/util/wait:go_default_library",
         "//staging/src/k8s.io/apimachinery/pkg/version:go_default_library",
         "//staging/src/k8s.io/apiserver/pkg/admission:go_default_library",

vendor/k8s.io/apiextensions-apiserver/pkg/apiserver/customresource_handler.go

@@ -49,6 +49,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/serializer/versioning"
 	"k8s.io/apimachinery/pkg/types"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/apiserver/pkg/admission"
 	"k8s.io/apiserver/pkg/authorization/authorizer"
 	"k8s.io/apiserver/pkg/endpoints/handlers"
@@ -163,6 +164,10 @@ func NewCustomResourceDefinitionHandler(
 	return ret, nil
 }
 
+// possiblyAcrossAllNamespacesVerbs contains those verbs which can be per-namespace and across all
+// namespaces for namespaces resources. I.e. for these an empty namespace in the requestInfo is fine.
+var possiblyAcrossAllNamespacesVerbs = sets.NewString("list", "watch")
+
 func (r *crdHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	ctx := req.Context()
 	requestInfo, ok := apirequest.RequestInfoFrom(ctx)
@@ -198,10 +203,24 @@ func (r *crdHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
+
+	// if the scope in the CRD and the scope in request differ (with exception of the verbs in possiblyAcrossAllNamespacesVerbs
+	// for namespaced resources), pass request to the delegate, which is supposed to lead to a 404.
+	namespacedCRD, namespacedReq := crd.Spec.Scope == apiextensions.NamespaceScoped, len(requestInfo.Namespace) > 0
+	if !namespacedCRD && namespacedReq {
+		r.delegate.ServeHTTP(w, req)
+		return
+	}
+	if namespacedCRD && !namespacedReq && !possiblyAcrossAllNamespacesVerbs.Has(requestInfo.Verb) {
+		r.delegate.ServeHTTP(w, req)
+		return
+	}
+
 	if !apiextensions.HasServedCRDVersion(crd, requestInfo.APIVersion) {
 		r.delegate.ServeHTTP(w, req)
 		return
 	}
+
 	// There is a small chance that a CRD is being served because NamesAccepted condition is true,
 	// but it becomes "unserved" because another names update leads to a conflict
 	// and EstablishingController wasn't fast enough to put the CRD into the Established condition.

vendor/k8s.io/client-go/pkg/version/base.go

@@ -3,8 +3,8 @@ package version
 var (
 	gitMajor = "1"
 	gitMinor = "14"
-	gitVersion   = "v1.14.4-k3s.1"
-	gitCommit    = "ac992f3ef6c6d71e14366a1f65318e10eb3f4232"
+	gitVersion   = "v1.14.5-k3s.1"
+	gitCommit    = "52ef54a465650e500182c3836a6d3f88efb6a32e"
 	gitTreeState = "clean"
-	buildDate = "2019-07-14T07:04+00:00Z"
+	buildDate = "2019-08-05T18:08+00:00Z"
 )

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/cp/BUILD

@@ -32,6 +32,7 @@ go_test(
         "//staging/src/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
         "//staging/src/k8s.io/cli-runtime/pkg/genericclioptions:go_default_library",
         "//staging/src/k8s.io/client-go/rest/fake:go_default_library",
+        "//vendor/github.com/stretchr/testify/assert:go_default_library",
         "//vendor/github.com/stretchr/testify/require:go_default_library",
     ],
 )

vendor/k8s.io/kubernetes/pkg/kubectl/cmd/cp/cp.go

@@ -441,9 +441,14 @@ func (o *CopyOptions) untarAll(reader io.Reader, destDir, prefix string) error {
 
 		// basic file information
 		mode := header.FileInfo().Mode()
-		destFileName := path.Join(destDir, header.Name[len(prefix):])
-		baseName := path.Dir(destFileName)
+		destFileName := filepath.Join(destDir, header.Name[len(prefix):])
 
+		if !isDestRelative(destDir, destFileName) {
+			fmt.Fprintf(o.IOStreams.ErrOut, "warning: file %q is outside target destination, skipping\n", destFileName)
+			continue
+		}
+
+		baseName := filepath.Dir(destFileName)
 		if err := os.MkdirAll(baseName, 0755); err != nil {
 			return err
 		}
@@ -457,15 +462,14 @@ func (o *CopyOptions) untarAll(reader io.Reader, destDir, prefix string) error {
 		// We need to ensure that the destination file is always within boundries
 		// of the destination directory. This prevents any kind of path traversal
 		// from within tar archive.
-		dir, file := filepath.Split(destFileName)
-		evaledPath, err := filepath.EvalSymlinks(dir)
+		evaledPath, err := filepath.EvalSymlinks(baseName)
 		if err != nil {
 			return err
 		}
 		// For scrutiny we verify both the actual destination as well as we follow
 		// all the links that might lead outside of the destination directory.
-		if !isDestRelative(destDir, destFileName) || !isDestRelative(destDir, filepath.Join(evaledPath, file)) {
-			fmt.Fprintf(o.IOStreams.ErrOut, "warning: link %q is pointing to %q which is outside target destination, skipping\n", destFileName, header.Linkname)
+		if !isDestRelative(destDir, filepath.Join(evaledPath, filepath.Base(destFileName))) {
+			fmt.Fprintf(o.IOStreams.ErrOut, "warning: file %q is outside target destination, skipping\n", destFileName)
 			continue
 		}
 
@@ -474,7 +478,11 @@ func (o *CopyOptions) untarAll(reader io.Reader, destDir, prefix string) error {
 			// We need to ensure that the link destination is always within boundries
 			// of the destination directory. This prevents any kind of path traversal
 			// from within tar archive.
-			if !isDestRelative(destDir, linkJoin(destFileName, linkname)) {
+			linkTarget := linkname
+			if !filepath.IsAbs(linkname) {
+				linkTarget = filepath.Join(evaledPath, linkname)
+			}
+			if !isDestRelative(destDir, linkTarget) {
 				fmt.Fprintf(o.IOStreams.ErrOut, "warning: link %q is pointing to %q which is outside target destination, skipping\n", destFileName, header.Linkname)
 				continue
 			}
@@ -499,23 +507,10 @@ func (o *CopyOptions) untarAll(reader io.Reader, destDir, prefix string) error {
 	return nil
 }
 
-// linkJoin joins base and link to get the final path to be created.
-// It will consider whether link is an absolute path or not when returning result.
-func linkJoin(base, link string) string {
-	if filepath.IsAbs(link) {
-		return link
-	}
-	return filepath.Join(base, link)
-}
-
 // isDestRelative returns true if dest is pointing outside the base directory,
 // false otherwise.
 func isDestRelative(base, dest string) bool {
-	fullPath := dest
-	if !filepath.IsAbs(dest) {
-		fullPath = filepath.Join(base, dest)
-	}
-	relative, err := filepath.Rel(base, fullPath)
+	relative, err := filepath.Rel(base, dest)
 	if err != nil {
 		return false
 	}

vendor/k8s.io/kubernetes/pkg/version/base.go

@@ -3,8 +3,8 @@ package version
 var (
 	gitMajor = "1"
 	gitMinor = "14"
-	gitVersion   = "v1.14.4-k3s.1"
-	gitCommit    = "ac992f3ef6c6d71e14366a1f65318e10eb3f4232"
+	gitVersion   = "v1.14.5-k3s.1"
+	gitCommit    = "52ef54a465650e500182c3836a6d3f88efb6a32e"
 	gitTreeState = "clean"
-	buildDate = "2019-07-14T07:04+00:00Z"
+	buildDate = "2019-08-05T18:08+00:00Z"
 )

vendor/k8s.io/kubernetes/vendor.conf

@@ -99,7 +99,7 @@ github.com/kisielk/sqlstruct 648daed35d49dac24a4bff253b190a80da3ab6a5
 github.com/kr/fs 2788f0dbd16903de03cb8186e5c7d97b69ad387b
 github.com/kr/pretty go.weekly.2011-12-22-24-gf31442d60e5146
 github.com/kr/text 6807e777504f54ad073ecef66747de158294b639
-github.com/libopenstorage/openstorage 093a0c3888753c2056e7373183693d670c6bba01
+github.com/libopenstorage/openstorage v1.0.0
 github.com/lib/pq 88edab0803230a3898347e77b474f8c1820a1f20
 github.com/liggitt/tabwriter 89fcab3d43de07060e4fd4c1547430ed57e87f24
 github.com/lithammer/dedent v1.1.0
@@ -150,7 +150,7 @@ github.com/PuerkitoBio/urlesc 5bd2802263f21d8788851d5305584c82a5c75d7e
 github.com/quobyte/api v0.1.2
 github.com/rancher/go-rancher v0.1.0-196-g09693a8743ba5e
 github.com/Rican7/retry v0.1.0-9-g272ad122d6e5ce
-github.com/robfig/cron v1-53-gdf38d32658d878
+github.com/robfig/cron v1.0.0-53-gdf38d32658d878
 github.com/rubiojr/go-vhd 0bfd3b39853cdde5762efda92289f14b0ac0491b
 github.com/russross/blackfriday v1.4-2-g300106c228d52c
 github.com/satori/go.uuid v1.2.0