Merge remote-tracking branch 'upstream/master' into test-cmd-what

.generated_files

@@ -25,5 +25,3 @@ file-name	types_swagger_doc_generated.go
 path-prefix	Godeps/
 path-prefix	vendor/
 path-prefix	pkg/generated/
-
-paths-from-repo	docs/.generated_docs

.github/ISSUE_TEMPLATE/bug-report.md

@@ -5,7 +5,10 @@ labels: kind/bug
 
 ---
 
-<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!-->
+<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!
+
+If the matter is security related, please disclose it privately via https://kubernetes.io/security/
+-->
 
 
 **What happened**:
@@ -19,7 +22,7 @@ labels: kind/bug
 **Environment**:
 - Kubernetes version (use `kubectl version`):
 - Cloud provider or hardware configuration:
-- OS (e.g. from /etc/os-release):
+- OS (e.g: `cat /etc/os-release`):
 - Kernel (e.g. `uname -a`):
 - Install tools:
 - Others:

.github/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 reviewers:
   - castrojo
   - cblecker

CHANGELOG-1.8.md

@@ -2390,7 +2390,7 @@ filename | sha256 hash
 * add fieldSelector spec.schedulerName ([#50582](https://github.com/kubernetes/kubernetes/pull/50582), [@dixudx](https://github.com/dixudx))
 * Change eviction manager to manage one single local ephemeral storage resource ([#50889](https://github.com/kubernetes/kubernetes/pull/50889), [@NickrenREN](https://github.com/NickrenREN))
 * Cloud Controller Manager now sets Node.Spec.ProviderID ([#50730](https://github.com/kubernetes/kubernetes/pull/50730), [@andrewsykim](https://github.com/andrewsykim))
-* Paramaterize session affinity timeout seconds in service API for Client IP based session affinity. ([#49850](https://github.com/kubernetes/kubernetes/pull/49850), [@m1093782566](https://github.com/m1093782566))
+* Parameterize session affinity timeout seconds in service API for Client IP based session affinity. ([#49850](https://github.com/kubernetes/kubernetes/pull/49850), [@m1093782566](https://github.com/m1093782566))
 * Changing scheduling part of the alpha feature 'LocalStorageCapacityIsolation' to manage one single local ephemeral storage resource ([#50819](https://github.com/kubernetes/kubernetes/pull/50819), [@NickrenREN](https://github.com/NickrenREN))
 * set --audit-log-format default to json ([#50971](https://github.com/kubernetes/kubernetes/pull/50971), [@CaoShuFeng](https://github.com/CaoShuFeng))
 * kubeadm: Implement a `--dry-run` mode and flag for `kubeadm` ([#51122](https://github.com/kubernetes/kubernetes/pull/51122), [@luxas](https://github.com/luxas))

CHANGELOG-1.9.md

@@ -2613,7 +2613,7 @@ filename | sha256 hash
 * add fieldSelector spec.schedulerName ([#50582](https://github.com/kubernetes/kubernetes/pull/50582), [@dixudx](https://github.com/dixudx))
 * Change eviction manager to manage one single local ephemeral storage resource ([#50889](https://github.com/kubernetes/kubernetes/pull/50889), [@NickrenREN](https://github.com/NickrenREN))
 * Cloud Controller Manager now sets Node.Spec.ProviderID ([#50730](https://github.com/kubernetes/kubernetes/pull/50730), [@andrewsykim](https://github.com/andrewsykim))
-* Paramaterize session affinity timeout seconds in service API for Client IP based session affinity. ([#49850](https://github.com/kubernetes/kubernetes/pull/49850), [@m1093782566](https://github.com/m1093782566))
+* Parameterize session affinity timeout seconds in service API for Client IP based session affinity. ([#49850](https://github.com/kubernetes/kubernetes/pull/49850), [@m1093782566](https://github.com/m1093782566))
 * Changing scheduling part of the alpha feature 'LocalStorageCapacityIsolation' to manage one single local ephemeral storage resource ([#50819](https://github.com/kubernetes/kubernetes/pull/50819), [@NickrenREN](https://github.com/NickrenREN))
 * set --audit-log-format default to json ([#50971](https://github.com/kubernetes/kubernetes/pull/50971), [@CaoShuFeng](https://github.com/CaoShuFeng))
 * kubeadm: Implement a `--dry-run` mode and flag for `kubeadm` ([#51122](https://github.com/kubernetes/kubernetes/pull/51122), [@luxas](https://github.com/luxas))

Godeps/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - dep-approvers

OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 filters:
   ".*":
     reviewers:

OWNERS_ALIASES

@@ -102,7 +102,7 @@ aliases:
     - tallclair
   sig-auth-policy-reviewers:
     - deads2k
-    - hongchaodeng    
+    - hongchaodeng
     - jianhuiz
     - liggitt
     - mbohlool
@@ -288,11 +288,13 @@ aliases:
     - jsafrane
     - jbeda
   dep-approvers:
+    - apelisse
+    - BenTheElder
     - cblecker
     - thockin
     - sttts
+    - soltysh
   feature-approvers:
-    - AdoHe           # CLI
     - bgrant0607      # Architecture
     - brancz          # Instrumentation
     - bsalamat        # Scheduling
@@ -323,6 +325,7 @@ aliases:
     - quinton-hoole   # Multicluster
     - roberthbailey   # Cluster Lifecycle
     - saad-ali        # Storage
+    - seans3          # CLI
     - soltysh         # CLI
     - tallclair       # Auth
     - thockin         # Network

SUPPORT.md

@@ -8,9 +8,9 @@ resources are available below, thanks for understanding.
 
 The Kubernetes Community is active on Stack Overflow, you can post your questions there: 
 
-* [Kubernetes on Stack Overflow](http://stackoverflow.com/questions/tagged/kubernetes)
+* [Kubernetes on Stack Overflow](https://stackoverflow.com/questions/tagged/kubernetes)
 
-  * Here are some tips for [about how to ask good questions](http://stackoverflow.com/help/how-to-ask).
+  * Here are some tips for [about how to ask good questions](https://stackoverflow.com/help/how-to-ask).
   * Don't forget to check to see [what's on topic](http://stackoverflow.com/help/on-topic).
 
 ### Documentation 

api/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 # Disable inheritance as this is an api owners file
 options:
   no_parent_owners: true

api/openapi-spec/README.md

@@ -10,7 +10,7 @@ extensions has been added.
 ### `x-kubernetes-group-version-kind`
 
 Operations and Definitions may have `x-kubernetes-group-version-kind` if they
-are associated with a [kubernetes resource](https://github.com/kubernetes/community/blob/master/contributors/devel/api-conventions.md#resources).
+are associated with a [kubernetes resource](https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources).
 
 
 For example:
@@ -35,7 +35,7 @@ For example:
 ### `x-kubernetes-action`
 
 Operations and Definitions may have `x-kubernetes-action` if they
-are associated with a [kubernetes resource](https://github.com/kubernetes/community/blob/master/contributors/devel/api-conventions.md#resources).
+are associated with a [kubernetes resource](https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources).
 Action can be one of `get`, `list`, `put`, `patch`, `post`, `delete`, `deletecollection`, `watch`, `watchlist`, `proxy`, or `connect`.
 
 
@@ -57,4 +57,4 @@ For example:
 ### `x-kubernetes-patch-strategy` and `x-kubernetes-patch-merge-key`
 
 Some of the definitions may have these extensions. For more information about PatchStrategy and PatchMergeKey see
-[strategic-merge-patch](https://git.k8s.io/community/contributors/devel/strategic-merge-patch.md).
+[strategic-merge-patch](https://git.k8s.io/community/contributors/devel/sig-api-machinery/strategic-merge-patch.md).

build/BUILD

 package(default_visibility = ["//visibility:public"])
 
 load("@io_bazel_rules_docker//container:container.bzl", "container_bundle", "container_image")
-load("@io_kubernetes_build//defs:build.bzl", "release_filegroup")
+load("@io_k8s_repo_infra//defs:build.bzl", "release_filegroup")
 load(":code_generation_test.bzl", "code_generation_test_suite")
 
 code_generation_test_suite(
@@ -71,7 +71,6 @@ DOCKERIZED_BINARIES = {
     images = {
         "k8s.gcr.io/%s:{STABLE_DOCKER_TAG}" % binary: binary + "-internal",
     },
-    stamp = True,
 ) for binary in DOCKERIZED_BINARIES.keys()]
 
 [genrule(

build/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 reviewers:
+  - bentheelder
   - cblecker
   - ixdy
   - jbeda

build/code_generation.bzl

@@ -14,7 +14,7 @@
 
 load("//build:kazel_generated.bzl", "go_prefix", "tags_values_pkgs")
 load("//build:openapi.bzl", "openapi_vendor_prefix")
-load("@io_kubernetes_build//defs:go.bzl", "go_genrule")
+load("@io_k8s_repo_infra//defs:go.bzl", "go_genrule")
 
 def bazel_go_library(pkg):
     """Returns the Bazel label for the Go library for the provided package.

build/code_generation_test.bzl

@@ -13,7 +13,7 @@
 # limitations under the License.
 
 load(":code_generation.bzl", "bazel_go_library", "go_pkg")
-load("@bazel_skylib//:lib.bzl", "asserts", "unittest")
+load("@bazel_skylib//lib:unittest.bzl", "asserts", "unittest")
 
 def _bazel_go_library_test_impl(ctx):
     env = unittest.begin(ctx)

build/common.sh

@@ -89,8 +89,8 @@ readonly KUBE_CONTAINER_RSYNC_PORT=8730
 # $1 - server architecture
 kube::build::get_docker_wrapped_binaries() {
   local arch=$1
-  local debian_base_version=0.4.0
-  local debian_iptables_version=v11.0
+  local debian_base_version=0.4.1
+  local debian_iptables_version=v11.0.1
   ### If you change any of these lists, please also update DOCKERIZED_BINARIES
   ### in build/BUILD. And kube::golang::server_image_targets
   local targets=(

build/debian-hyperkube-base/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 labels:
 - sig/release

build/debs/BUILD

 package(default_visibility = ["//visibility:public"])
 
-load("@io_kubernetes_build//defs:deb.bzl", "k8s_deb", "deb_data")
-load("@io_kubernetes_build//defs:build.bzl", "release_filegroup")
-load("@io_kubernetes_build//defs:pkg.bzl", "pkg_tar")
+load("@io_k8s_repo_infra//defs:deb.bzl", "k8s_deb", "deb_data")
+load("@io_k8s_repo_infra//defs:build.bzl", "release_filegroup")
+load("@io_k8s_repo_infra//defs:pkg.bzl", "pkg_tar")
 load("//build:workspace.bzl", "CNI_VERSION", "CRI_TOOLS_VERSION")
 
 # We do not include kube-scheduler, kube-controller-manager,

build/debs/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 reviewers:
   - luxas
   - jbeda

build/kazel_generated.bzl

@@ -62,6 +62,7 @@ tags_values_pkgs = {"openapi-gen": {
         "staging/src/k8s.io/api/extensions/v1beta1",
         "staging/src/k8s.io/api/imagepolicy/v1alpha1",
         "staging/src/k8s.io/api/networking/v1",
+        "staging/src/k8s.io/api/networking/v1beta1",
         "staging/src/k8s.io/api/policy/v1beta1",
         "staging/src/k8s.io/api/rbac/v1",
         "staging/src/k8s.io/api/rbac/v1alpha1",
@@ -135,6 +136,7 @@ tags_pkgs_values = {"openapi-gen": {
     "staging/src/k8s.io/api/extensions/v1beta1": ["true"],
     "staging/src/k8s.io/api/imagepolicy/v1alpha1": ["true"],
     "staging/src/k8s.io/api/networking/v1": ["true"],
+    "staging/src/k8s.io/api/networking/v1beta1": ["true"],
     "staging/src/k8s.io/api/policy/v1beta1": ["true"],
     "staging/src/k8s.io/api/rbac/v1": ["true"],
     "staging/src/k8s.io/api/rbac/v1alpha1": ["true"],

build/release-tars/BUILD

 package(default_visibility = ["//visibility:public"])
 
-load("@io_kubernetes_build//defs:build.bzl", "release_filegroup")
-load("@io_kubernetes_build//defs:pkg.bzl", "pkg_tar")
+load("@io_k8s_repo_infra//defs:build.bzl", "release_filegroup")
+load("@io_k8s_repo_infra//defs:pkg.bzl", "pkg_tar")
 
 filegroup(
     name = "package-srcs",

build/root/BUILD.root

@@ -13,7 +13,7 @@
 
 package(default_visibility = ["//visibility:public"])
 
-load("@io_kubernetes_build//defs:build.bzl", "gcs_upload")
+load("@io_k8s_repo_infra//defs:build.bzl", "gcs_upload")
 
 filegroup(
     name = "_binary-artifacts-and-hashes",

build/root/WORKSPACE

@@ -3,23 +3,21 @@ load("//build:workspace_mirror.bzl", "mirror")
 load("//build:workspace.bzl", "CNI_VERSION", "CRI_TOOLS_VERSION")
 
 http_archive(
-    name = "io_bazel_rules_go",
-    sha256 = "ade51a315fa17347e5c31201fdc55aa5ffb913377aa315dceb56ee9725e620ee",
-    urls = mirror("https://github.com/bazelbuild/rules_go/releases/download/0.16.6/rules_go-0.16.6.tar.gz"),
+    name = "bazel_skylib",
+    sha256 = "eb5c57e4c12e68c0c20bc774bfbc60a568e800d025557bc4ea022c6479acc867",
+    strip_prefix = "bazel-skylib-0.6.0",
+    urls = mirror("https://github.com/bazelbuild/bazel-skylib/archive/0.6.0.tar.gz"),
 )
 
-http_archive(
-    name = "io_kubernetes_build",
-    sha256 = "21160531ea8a9a4001610223ad815622bf60671d308988c7057168a495a7e2e8",
-    strip_prefix = "repo-infra-b4bc4f1552c7fc1d4654753ca9b0e5e13883429f",
-    urls = mirror("https://github.com/kubernetes/repo-infra/archive/b4bc4f1552c7fc1d4654753ca9b0e5e13883429f.tar.gz"),
-)
+load("@bazel_skylib//lib:versions.bzl", "versions")
+
+versions.check(minimum_bazel_version = "0.18.0")
 
 http_archive(
-    name = "bazel_skylib",
-    sha256 = "bbccf674aa441c266df9894182d80de104cabd19be98be002f6d478aaa31574d",
-    strip_prefix = "bazel-skylib-2169ae1c374aab4a09aa90e65efe1a3aad4e279b",
-    urls = mirror("https://github.com/bazelbuild/bazel-skylib/archive/2169ae1c374aab4a09aa90e65efe1a3aad4e279b.tar.gz"),
+    name = "io_k8s_repo_infra",
+    sha256 = "4ce2d8576e786c8fb8bc4f7ed79f5fda543568d78c09306d16cc8d1b7d5621f0",
+    strip_prefix = "repo-infra-8a5707674e76b825bfd9a8624bae045bc6e5f24d",
+    urls = mirror("https://github.com/kubernetes/repo-infra/archive/8a5707674e76b825bfd9a8624bae045bc6e5f24d.tar.gz"),
 )
 
 ETCD_VERSION = "3.3.10"
@@ -33,18 +31,12 @@ http_archive(
 )
 
 http_archive(
-    name = "io_bazel_rules_docker",
-    sha256 = "29d109605e0d6f9c892584f07275b8c9260803bf0c6fcb7de2623b2bedc910bd",
-    strip_prefix = "rules_docker-0.5.1",
-    urls = mirror("https://github.com/bazelbuild/rules_docker/archive/v0.5.1.tar.gz"),
+    name = "io_bazel_rules_go",
+    sha256 = "492c3ac68ed9dcf527a07e6a1b2dcbf199c6bf8b35517951467ac32e421c06c1",
+    urls = mirror("https://github.com/bazelbuild/rules_go/releases/download/0.17.0/rules_go-0.17.0.tar.gz"),
 )
 
-load("@bazel_skylib//:lib.bzl", "versions")
-
-versions.check(minimum_bazel_version = "0.17.2")
-
-load("@io_bazel_rules_go//go:def.bzl", "go_download_sdk", "go_register_toolchains", "go_rules_dependencies")
-load("@io_bazel_rules_docker//docker:docker.bzl", "docker_pull", "docker_repositories")
+load("@io_bazel_rules_go//go:deps.bzl", "go_register_toolchains", "go_rules_dependencies")
 
 go_rules_dependencies()
 
@@ -52,7 +44,21 @@ go_register_toolchains(
     go_version = "1.11.5",
 )
 
-docker_repositories()
+http_archive(
+    name = "io_bazel_rules_docker",
+    sha256 = "aed1c249d4ec8f703edddf35cbe9dfaca0b5f5ea6e4cd9e83e99f3b0d1136c3d",
+    strip_prefix = "rules_docker-0.7.0",
+    urls = mirror("https://github.com/bazelbuild/rules_docker/archive/v0.7.0.tar.gz"),
+)
+
+load(
+    "@io_bazel_rules_docker//repositories:repositories.bzl",
+    container_repositories = "repositories",
+)
+
+container_repositories()
+
+load("@io_bazel_rules_docker//container:container.bzl", "container_pull")
 
 http_file(
     name = "kubernetes_cni",
@@ -68,31 +74,31 @@ http_file(
     urls = mirror("https://github.com/kubernetes-incubator/cri-tools/releases/download/v%s/crictl-v%s-linux-amd64.tar.gz" % (CRI_TOOLS_VERSION, CRI_TOOLS_VERSION)),
 )
 
-docker_pull(
+container_pull(
     name = "debian-base-amd64",
-    digest = "sha256:86176bc8ccdc4d8ea7fbf6ba4b57fcefc2cb61ff7413114630940474ff9bf751",
+    digest = "sha256:8ccb65cd2dd7e0c24193d0742a20e4a673dbd11af5a33f16fcd471a31486866c",
     registry = "k8s.gcr.io",
     repository = "debian-base-amd64",
-    tag = "0.4.0",  # ignored, but kept here for documentation
+    tag = "0.4.1",  # ignored, but kept here for documentation
 )
 
-docker_pull(
+container_pull(
     name = "debian-iptables-amd64",
-    digest = "sha256:d4ff8136b9037694a3165a7fff6a91e7fc828741b8ea1eda226d4d9ea5d23abb",
+    digest = "sha256:9c41b4c326304b94eb96fdd2e181aa6e9995cc4642fcdfb570cedd73a419ba39",
     registry = "k8s.gcr.io",
     repository = "debian-iptables-amd64",
-    tag = "v11.0",  # ignored, but kept here for documentation
+    tag = "v11.0.1",  # ignored, but kept here for documentation
 )
 
-docker_pull(
+container_pull(
     name = "debian-hyperkube-base-amd64",
-    digest = "sha256:4a77bc882f7d629c088a11ff144a2e86660268fddf63b61f52b6a93d16ab83f0",
+    digest = "sha256:5d4ea2fb5fbe9a9a9da74f67cf2faefc881968bc39f2ac5d62d9167e575812a1",
     registry = "k8s.gcr.io",
     repository = "debian-hyperkube-base-amd64",
-    tag = "0.12.0",  # ignored, but kept here for documentation
+    tag = "0.12.1",  # ignored, but kept here for documentation
 )
 
-docker_pull(
+container_pull(
     name = "official_busybox",
     digest = "sha256:cb63aa0641a885f54de20f61d152187419e8f6b159ed11a251a09d115fdff9bd",
     registry = "index.docker.io",

build/rpms/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 reviewers:
   - luxas
   - jbeda

build/visible_to/BUILD

@@ -193,6 +193,7 @@ package_group(
         "//pkg/kubectl/cmd/expose",
         "//pkg/kubectl/cmd/get",
         "//pkg/kubectl/cmd/help",
+        "//pkg/kubectl/cmd/kustomize",
         "//pkg/kubectl/cmd/label",
         "//pkg/kubectl/cmd/logs",
         "//pkg/kubectl/cmd/options",

build/visible_to/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 reviewers:
   - brendandburns
   - dchen1107

build/visible_to/README.md

@@ -157,7 +157,7 @@ q=//cmd/kubectl:kubectl
 bazel query "buildfiles(deps($q))" | \
     grep -v @bazel_tools | \
     grep -v @io_bazel_rules | \
-    grep -v @io_kubernetes_build | \
+    grep -v @io_k8s_repo_infra | \
     grep -v @local_config | \
     grep -v @local_jdk | \
     grep -v //visible_to: | \

cluster/BUILD

 package(default_visibility = ["//visibility:public"])
 
-load("@io_kubernetes_build//defs:pkg.bzl", "pkg_tar")
+load("@io_k8s_repo_infra//defs:pkg.bzl", "pkg_tar")
 
 filegroup(
     name = "package-srcs",

cluster/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 reviewers:
+  - bentheelder
   - eparis
   - jbeda
   - mikedanese

cluster/addons/BUILD

 package(default_visibility = ["//visibility:public"])
 
-load("@io_kubernetes_build//defs:pkg.bzl", "pkg_tar")
+load("@io_k8s_repo_infra//defs:pkg.bzl", "pkg_tar")
 
 filegroup(
     name = "addon-srcs",

cluster/addons/addon-manager/Makefile

@@ -18,7 +18,7 @@ TEMP_DIR:=$(shell mktemp -d)
 VERSION=v9.0
 KUBECTL_VERSION?=v1.13.2
 
-BASEIMAGE=k8s.gcr.io/debian-base-$(ARCH):0.4.0
+BASEIMAGE=k8s.gcr.io/debian-base-$(ARCH):0.4.1
 
 SUDO=$(if $(filter 0,$(shell id -u)),,sudo)
 

cluster/addons/addon-manager/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 reviewers:
 - mrhohn

cluster/addons/calico-policy-controller/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - bowei
 - caseydavenport

cluster/addons/cluster-loadbalancing/MAINTAINERS.md

-# Maintainers
-
-Prashanth.B <beeps@google.com>
-
-
-[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/cluster/addons/cluster-loadbalancing/MAINTAINERS.md?pixel)]()

cluster/addons/cluster-loadbalancing/OWNERS

@@ -2,7 +2,9 @@ approvers:
 - bowei
 - rramkumar1
 - mrhohn
+- freehan
 reviewers:
 - bowei
 - rramkumar1
 - mrhohn
+- freehan

cluster/addons/cluster-loadbalancing/glbc/README.md

 # GCE Load-Balancer Controller (GLBC) Cluster Addon
 
-This cluster addon is composed of:
-* A [Google L7 LoadBalancer Controller](https://github.com/kubernetes/contrib/tree/master/ingress/controllers/gce)
-* A [404 default backend](https://github.com/kubernetes/contrib/tree/master/404-server) Service + RC
+This cluster addon is composed of a 404 default backend service and deployment.
+On GCE, this 404 service is used in conjunction with the
+[Ingress-GCE](https://github.com/kubernetes/ingress-gce) controller.
 
-It relies on the [Ingress resource](https://kubernetes.io/docs/user-guide/ingress.md) only available in Kubernetes version 1.1 and beyond.
+See the Ingress-GCE docs for more information.
 
-## Prerequisites
 
-Before you can receive traffic through the GCE L7 Loadbalancer Controller you need:
-* A Working Kubernetes 1.1 cluster
-* At least 1 Kubernetes [NodePort Service](https://kubernetes.io/docs/user-guide/services.md#type-nodeport) (this is the endpoint for your Ingress)
-* Firewall-rules that allow traffic to the NodePort service, as indicated by `kubectl` at Service creation time
-* Adequate quota, as mentioned in the next section
-* A single instance of the L7 Loadbalancer Controller pod (if you're using the default GCE setup, this should already be running in the `kube-system` namespace)
-
-## Quota
-
-GLBC is not aware of your GCE quota. As of this writing users get 3 [GCE Backend Services](https://cloud.google.com/compute/docs/load-balancing/http/backend-service) by default. If you plan on creating Ingresses for multiple Kubernetes Services, remember that each one requires a backend service, and request quota. Should you fail to do so the controller will poll periodically and grab the first free backend service slot it finds. You can view your quota:
-
-```console
-$ gcloud compute project-info describe --project myproject
-```
-See [GCE documentation](https://cloud.google.com/compute/docs/resource-quotas#checking_your_quota) for how to request more.
-
-## Latency
-
-It takes ~1m to spin up a loadbalancer (this includes acquiring the public ip), and ~5-6m before the GCE api starts healthchecking backends. So as far as latency goes, here's what to expect:
-
-Assume one creates the following simple Ingress:
-```yaml
-apiVersion: extensions/v1beta1
-kind: Ingress
-metadata:
-  name: test-ingress
-spec:
-  backend:
-    # This will just loopback to the default backend of GLBC
-    serviceName: default-http-backend
-    servicePort: 80
-```
-
-* time, t=0
-  ```console
-  $ kubectl get ing
-  NAME           RULE      BACKEND                   ADDRESS
-  test-ingress   -         default-http-backend:80
-  $ kubectl describe ing
-  No events.
-  ```
-
-* time, t=1m
-  ```console
-  $ kubectl get ing
-  NAME           RULE      BACKEND                   ADDRESS
-  test-ingress   -         default-http-backend:80   130.211.5.27
-
-  $ kubectl describe ing
-  target-proxy:		k8s-tp-default-test-ingress
-  url-map:		    k8s-um-default-test-ingress
-  backends:		    {"k8s-be-32342":"UNKNOWN"}
-  forwarding-rule:	k8s-fw-default-test-ingress
-  Events:
-    FirstSeen	LastSeen	Count	From				SubobjectPath	Reason	Message
-    ─────────	────────	─────	────				─────────────	──────	───────
-    46s		46s		1	{loadbalancer-controller }	Success	Created loadbalancer 130.211.5.27
-  ```
-
-* time, t=5m
-  ```console
-  $ kubectl describe ing
-  target-proxy:		k8s-tp-default-test-ingress
-  url-map:		    k8s-um-default-test-ingress
-  backends:		    {"k8s-be-32342":"HEALTHY"}
-  forwarding-rule:	k8s-fw-default-test-ingress
-  Events:
-    FirstSeen	LastSeen	Count	From				SubobjectPath	Reason	Message
-    ─────────	────────	─────	────				─────────────	──────	───────
-    46s		46s		1	{loadbalancer-controller }	Success	Created loadbalancer 130.211.5.27
-  ```
-
-## Disabling GLBC
-
-Since GLBC runs as a cluster addon, you cannot simply delete the RC. The easiest way to disable it is to do as follows:
-
-* IFF you want to tear down existing L7 loadbalancers, hit the /delete-all-and-quit endpoint on the pod:
-
-  ```console
-  $ kubectl get pods --namespace=kube-system
-  NAME                                               READY     STATUS    RESTARTS   AGE
-  l7-lb-controller-7bb21                             1/1       Running   0          1h
-  $ kubectl exec l7-lb-controller-7bb21 -c l7-lb-controller curl http://localhost:8081/delete-all-and-quit --namespace=kube-system
-  $ kubectl logs l7-lb-controller-7b221 -c l7-lb-controller --follow
-  ...
-  I1007 00:30:00.322528       1 main.go:160] Handled quit, awaiting pod deletion.
-  ```
-
-* Nullify the RC (but don't delete it or the addon controller will "fix" it for you)
-  ```console
-  $ kubectl scale rc l7-lb-controller --replicas=0 --namespace=kube-system
-  ```
-
-## Limitations
-
-* This cluster addon is still in the Beta phase. It behooves you to read through the GLBC documentation mentioned above and make sure there are no surprises.
-* The recommended way to tear down a cluster with active Ingresses is to either delete each Ingress, or hit the /delete-all-and-quit endpoint on GLBC as described below, before invoking a cluster teardown script (eg: kube-down.sh). You will have to manually cleanup GCE resources through the [cloud console](https://cloud.google.com/compute/docs/console#access) or [gcloud CLI](https://cloud.google.com/compute/docs/gcloud-compute/) if you simply tear down the cluster with active Ingresses.
-* All L7 Loadbalancers created by GLBC have a default backend. If you don't specify one in your Ingress, GLBC will assign the 404 default backend mentioned above.
-* All Kubernetes services must serve a 200 page on '/', or whatever custom value you've specified through GLBC's `--health-check-path argument`.
-* GLBC is not built for performance. Creating many Ingresses at a time can overwhelm it. It won't fall over, but will take its own time to churn through the Ingress queue. It doesn't understand concepts like fairness or backoff just yet.
-
-[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/cluster/addons/cluster-loadbalancing/glbc/README.md?pixel)]()

cluster/addons/cluster-monitoring/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - DirectXMan12
 - kawych

cluster/addons/cluster-monitoring/influxdb/influxdb-grafana-controller.yaml

@@ -49,7 +49,6 @@ spec:
             mountPath: /data
         - name: grafana
           image: k8s.gcr.io/heapster-grafana-amd64:v4.4.3
-          env:
           resources:
             # keep request = limit to keep this container in guaranteed class
             limits:

cluster/addons/dashboard/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - bryk
 reviewers:

cluster/addons/dns-horizontal-autoscaler/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - bowei
 - mrhohn

cluster/addons/dns/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - bowei
 - mrhohn

cluster/addons/dns/coredns/coredns.yaml.base

@@ -106,6 +106,7 @@ spec:
       annotations:
         seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
     spec:
+      priorityClassName: system-cluster-critical
       serviceAccountName: coredns
       tolerations:
         - key: "CriticalAddonsOnly"
@@ -146,6 +147,11 @@ spec:
           timeoutSeconds: 5
           successThreshold: 1
           failureThreshold: 5
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+            scheme: HTTP
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:

cluster/addons/dns/coredns/coredns.yaml.in

@@ -106,6 +106,7 @@ spec:
       annotations:
         seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
     spec:
+      priorityClassName: system-cluster-critical
       serviceAccountName: coredns
       tolerations:
         - key: "CriticalAddonsOnly"
@@ -146,6 +147,11 @@ spec:
           timeoutSeconds: 5
           successThreshold: 1
           failureThreshold: 5
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+            scheme: HTTP
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:

cluster/addons/dns/coredns/coredns.yaml.sed

@@ -106,6 +106,7 @@ spec:
       annotations:
         seccomp.security.alpha.kubernetes.io/pod: 'docker/default'
     spec:
+      priorityClassName: system-cluster-critical
       serviceAccountName: coredns
       tolerations:
         - key: "CriticalAddonsOnly"
@@ -146,6 +147,11 @@ spec:
           timeoutSeconds: 5
           successThreshold: 1
           failureThreshold: 5
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+            scheme: HTTP
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:

cluster/addons/dns/nodelocaldns/README.md

@@ -2,7 +2,7 @@
 
 This addon runs a node-local-dns pod on all cluster nodes. The pod runs CoreDNS as the dns cache. It runs with `hostNetwork:True` and creates a dedicated dummy interface with a link local ip(169.254.20.10/32 by default) to listen for DNS queries. The cache instances connect to clusterDNS in case of cache misses.
 
-Design details [here](https://github.com/kubernetes/community/blob/master/keps/sig-network/0030-nodelocal-dns-cache.md)
+Design details [here](https://git.k8s.io/enhancements/keps/sig-network/0030-nodelocal-dns-cache.md)
 
 ## nodelocaldns addon template
 

cluster/addons/fluentd-elasticsearch/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - coffeepac
 - monotek

cluster/addons/fluentd-gcp/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - piosz
 - x13n

cluster/addons/ip-masq-agent/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - bowei
 - dnardo

cluster/addons/kube-proxy/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - bowei
 - freehan

cluster/addons/metadata-agent/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - kawych
 - piosz

cluster/addons/metadata-proxy/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - q-lee
 - cjcullen

cluster/addons/metrics-server/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - DirectXMan12
 - kawych

cluster/addons/prometheus/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - kawych
 - piosz

cluster/addons/runtimeclass/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - tallclair
 - dchen1107

cluster/addons/runtimeclass/README.md

@@ -7,6 +7,6 @@ To enable RuntimeClass, set the feature gate `RuntimeClass=true`, and ensure the
 directory is installed.
 
 For more information, see:
-https://github.com/kubernetes/community/blob/master/keps/sig-node/0014-runtime-class.md
+https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md
 
 [![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/cluster/addons/runtimeclass/README.md?pixel)]()

cluster/addons/storage-crds/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - saad-ali
 - jsafrane

cluster/centos/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 reviewers:
   - zouyee

cluster/common.sh

@@ -299,6 +299,7 @@ function set_binary_version() {
 function find-tar() {
   local -r tarball=$1
   locations=(
+    "${KUBE_ROOT}/node/${tarball}"
     "${KUBE_ROOT}/server/${tarball}"
     "${KUBE_ROOT}/_output/release-tars/${tarball}"
     "${KUBE_ROOT}/bazel-bin/build/release-tars/${tarball}"
@@ -317,6 +318,7 @@ function find-tar() {
 # Assumed vars:
 #   KUBE_ROOT
 # Vars set:
+#   NODE_BINARY_TAR
 #   SERVER_BINARY_TAR
 #   KUBE_MANIFESTS_TAR
 function find-release-tars() {

cluster/gce/BUILD

 package(default_visibility = ["//visibility:public"])
 
-load("@io_kubernetes_build//defs:build.bzl", "release_filegroup")
-load("@io_kubernetes_build//defs:pkg.bzl", "pkg_tar")
+load("@io_k8s_repo_infra//defs:build.bzl", "release_filegroup")
+load("@io_k8s_repo_infra//defs:pkg.bzl", "pkg_tar")
 
 filegroup(
     name = "package-srcs",

cluster/gce/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 reviewers:
   - bowei
   - gmarek

cluster/gce/addons/BUILD

 package(default_visibility = ["//visibility:public"])
 
-load("@io_kubernetes_build//defs:pkg.bzl", "pkg_tar")
+load("@io_k8s_repo_infra//defs:pkg.bzl", "pkg_tar")
 
 filegroup(
     name = "addon-srcs",

cluster/gce/config-test.sh

@@ -368,7 +368,7 @@ if [[ -n "${GCE_GLBC_IMAGE:-}" ]]; then
 fi
 
 if [[ -z "${KUBE_ADMISSION_CONTROL:-}" ]]; then
-  ADMISSION_CONTROL="NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,PodPreset,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,Priority,StorageObjectInUseProtection"
+  ADMISSION_CONTROL="NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,PodPreset,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,Priority,StorageObjectInUseProtection,PersistentVolumeClaimResize"
   if [[ "${ENABLE_POD_SECURITY_POLICY:-}" == "true" ]]; then
     ADMISSION_CONTROL="${ADMISSION_CONTROL},PodSecurityPolicy"
   fi

cluster/gce/delete-stranded-load-balancers.sh

@@ -18,16 +18,16 @@
 PROJECT=${PROJECT:-kubernetes-jenkins}
 REGION=${REGION:-us-central1}
 
-LIST=$(gcloud --project=${PROJECT} compute target-pools list --format='value(name)')
+LIST=$(gcloud --project="${PROJECT}" compute target-pools list --format='value(name)')
 
 result=0
 for x in ${LIST}; do
-    if ! gcloud compute --project=${PROJECT} target-pools get-health "${x}" --region=${REGION} 2>/dev/null >/dev/null; then
+    if ! gcloud compute --project="${PROJECT}" target-pools get-health "${x}" --region="${REGION}" 2>/dev/null >/dev/null; then
 	echo DELETING "${x}"
-	gcloud compute --project=${PROJECT} firewall-rules delete "k8s-fw-${x}" -q
-	gcloud compute --project=${PROJECT} forwarding-rules delete "${x}" --region=${REGION} -q
-	gcloud compute --project=${PROJECT} addresses delete "${x}" --region=${REGION} -q
-	gcloud compute --project=${PROJECT} target-pools delete "${x}" --region=${REGION} -q
+	gcloud compute --project="${PROJECT}" firewall-rules delete "k8s-fw-${x}" -q
+	gcloud compute --project="${PROJECT}" forwarding-rules delete "${x}" --region="${REGION}" -q
+	gcloud compute --project="${PROJECT}" addresses delete "${x}" --region="${REGION}" -q
+	gcloud compute --project="${PROJECT}" target-pools delete "${x}" --region="${REGION}" -q
         result=1
     fi
 done

cluster/gce/gci/BUILD

 load("@io_bazel_rules_go//go:def.bzl", "go_test")
-load("@io_kubernetes_build//defs:pkg.bzl", "pkg_tar")
-load("@io_kubernetes_build//defs:build.bzl", "release_filegroup")
+load("@io_k8s_repo_infra//defs:pkg.bzl", "pkg_tar")
+load("@io_k8s_repo_infra//defs:build.bzl", "release_filegroup")
 
 go_test(
     name = "go_default_test",

cluster/gce/gci/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - dchen1107
 - filbranden

cluster/gce/gci/configure.sh

@@ -123,6 +123,12 @@ function validate-hash {
   fi
 }
 
+# Get default service account credentials of the VM.
+function get-credentials {
+  curl "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token" -H "Metadata-Flavor: Google" -s | python -c \
+    'import sys; import json; print(json.loads(sys.stdin.read())["access_token"])'
+}
+
 # Retry a download until we get it. Takes a hash and a set of URLs.
 #
 # $1 is the sha1 of the URL. Can be "" if the sha1 is unknown.
@@ -136,7 +142,12 @@ function download-or-bust {
     for url in "${urls[@]}"; do
       local file="${url##*/}"
       rm -f "${file}"
-      if ! curl -f --ipv4 -Lo "${file}" --connect-timeout 20 --max-time 300 --retry 6 --retry-delay 10 ${CURL_RETRY_CONNREFUSED} "${url}"; then
+      # if the url belongs to GCS API we should use oauth2_token in the headers
+      local curl_headers=""
+      if [[ "$url" =~ ^https://storage.googleapis.com.* ]]; then
+        curl_headers="Authorization: Bearer $(get-credentials)"
+      fi
+      if ! curl ${curl_headers:+-H "${curl_headers}"} -f --ipv4 -Lo "${file}" --connect-timeout 20 --max-time 300 --retry 6 --retry-delay 10 ${CURL_RETRY_CONNREFUSED} "${url}"; then
         echo "== Failed to download ${url}. Retrying. =="
       elif [[ -n "${hash}" ]] && ! validate-hash "${file}" "${hash}"; then
         echo "== Hash validation of ${url} failed. Retrying. =="

cluster/gce/manifests/BUILD

 package(default_visibility = ["//visibility:public"])
 
-load("@io_kubernetes_build//defs:build.bzl", "release_filegroup")
-load("@io_kubernetes_build//defs:pkg.bzl", "pkg_tar")
+load("@io_k8s_repo_infra//defs:build.bzl", "release_filegroup")
+load("@io_k8s_repo_infra//defs:pkg.bzl", "pkg_tar")
 
 pkg_tar(
     name = "gce-master-manifests",

cluster/gce/manifests/kube-apiserver.manifest

@@ -45,6 +45,7 @@
         "port": 8080,
         "path": "/healthz"
       },
+      "periodSeconds": 1,
       "timeoutSeconds": 15
     },
     "ports":[

cluster/gce/upgrade.sh

@@ -213,7 +213,7 @@ function setup-base-image() {
     
     source "${KUBE_ROOT}/cluster/gce/${NODE_OS_DISTRIBUTION}/node-helper.sh"
     # Reset the node image based on current os distro
-    set-node-image
+    set-linux-node-image
   fi
 }
 
@@ -263,12 +263,12 @@ function prepare-node-upgrade() {
 
   # TODO(zmerlynn): How do we ensure kube-env is written in a ${version}-
   #                 compatible way?
-  write-node-env
+  write-linux-node-env
 
   # TODO(zmerlynn): Get configure-vm script from ${version}. (Must plumb this
-  #                 through all create-node-instance-template implementations).
+  #                 through all create-linux-node-instance-template implementations).
   local template_name=$(get-template-name-from-version ${SANITIZED_VERSION})
-  create-node-instance-template "${template_name}"
+  create-linux-node-instance-template "${template_name}"
   # The following is echo'd so that callers can get the template name.
   echo "Instance template name: ${template_name}"
   echo "== Finished preparing node upgrade (to ${KUBE_VERSION}). ==" >&2

cluster/gce/util.sh

@@ -2247,6 +2247,7 @@ function delete-all-firewall-rules() {
   fi
 }
 
+# Ignores firewall rule arguments that do not exist in NETWORK_PROJECT.
 function delete-firewall-rules() {
   for fw in $@; do
     if [[ -n $(gcloud compute firewall-rules --project "${NETWORK_PROJECT}" describe "${fw}" --format='value(name)' 2>/dev/null || true) ]]; then
@@ -3139,6 +3140,7 @@ function kube-down() {
       "${CLUSTER_NAME}-default-internal-master" \
       "${CLUSTER_NAME}-default-internal-node" \
       "${NETWORK}-default-ssh" \
+      "${NETWORK}-default-rdp" \
       "${NETWORK}-default-internal"  # Pre-1.5 clusters
 
     if [[ "${KUBE_DELETE_NETWORK}" == "true" ]]; then

cluster/gce/win1803/common.psm1

@@ -18,6 +18,9 @@
   and scripts for configuring Windows nodes.
 #>
 
+# Disable progress bar to increase download speed.
+$ProgressPreference = 'SilentlyContinue'
+
 # REDO_STEPS affects the behavior of a node that is rebooted after initial
 # bringup. When true, on a reboot the scripts will redo steps that were
 # determined to have already been completed once (e.g. to overwrite
@@ -86,5 +89,62 @@ function Get-InstanceMetadataValue {
   }
 }
 
+function Validate-SHA1 {
+  param(
+    [parameter(Mandatory=$true)] [string]$Hash,
+    [parameter(Mandatory=$true)] [string]$Path
+  )
+  $actual = Get-FileHash -Path $Path -Algorithm SHA1
+  # Note: Powershell string comparisons are case-insensitive by default, and this
+  # is important here because Linux shell scripts produce lowercase hashes but
+  # Powershell Get-FileHash produces uppercase hashes. This must be case-insensitive
+  # to work.
+  if ($actual.Hash -ne $Hash) {
+    Log-Output "$Path corrupted, sha1 $actual doesn't match expected $Hash"
+    Throw ("$Path corrupted, sha1 $actual doesn't match expected $Hash")
+  }
+}
+
+# Attempts to download the file from URLs, trying each URL until it succeeds.
+# It will loop through the URLs list forever until it has a success.
+# If successful, it will write the file to OutFile. You can optionally provide a SHA1 Hash
+# argument, in which case it will attempt to validate the downloaded file against the hash.
+function MustDownload-File {
+  param (
+    [parameter(Mandatory=$false)] [string]$Hash,
+    [parameter(Mandatory=$true)] [string]$OutFile,
+    [parameter(Mandatory=$true)] [System.Collections.Generic.List[String]]$URLs
+  )
+
+  While($true) {
+    ForEach($url in $URLs) {
+      # Attempt to download the file
+      Try {
+        # TODO(mtaufen): When we finally get a Windows version that has Powershell 6
+        # installed we can set `-MaximumRetryCount 6 -RetryIntervalSec 10` to make this even more robust.
+        Invoke-WebRequest $url -OutFile $OutFile -TimeoutSec 300
+      } Catch {
+        $message = $_.Exception.ToString()
+        Log-Output "Failed to download file from $url. Will retry. Error: $message"
+        continue
+      }
+      # Attempt to validate the hash
+      if ($Hash) {
+        Try {
+            Validate-SHA1 -Hash $Hash -Path $OutFile
+        } Catch {
+            $message = $_.Exception.ToString()
+            Log-Output "Hash validation of $url failed. Will retry. Error: $message"
+            continue
+        }
+        Log-Output "Downloaded $url (SHA1 = $Hash)"
+        return
+      }
+      Log-Output "Downloaded $url"
+      return
+    }
+  }
+}
+
 # Export all public functions:
 Export-ModuleMember -Function *-*

cluster/gce/win1803/k8s-node-setup.psm1

@@ -254,9 +254,8 @@ function Download-HelperScripts {
   if (-not (ShouldWrite-File ${env:K8S_DIR}\hns.psm1)) {
     return
   }
-  Invoke-WebRequest `
-      https://github.com/Microsoft/SDN/raw/master/Kubernetes/windows/hns.psm1 `
-      -OutFile ${env:K8S_DIR}\hns.psm1
+  MustDownload-File -OutFile ${env:K8S_DIR}\hns.psm1 `
+    -URLs "https://github.com/Microsoft/SDN/raw/master/Kubernetes/windows/hns.psm1"
 }
 
 # Takes the Windows version string from the cluster bash scripts (e.g.
@@ -318,14 +317,13 @@ function DownloadAndInstall-KubernetesBinaries {
   $tmp_dir = 'C:\k8s_tmp'
   New-Item -Force -ItemType 'directory' $tmp_dir | Out-Null
 
-  $uri = ${kube_env}['NODE_BINARY_TAR_URL']
-  $filename = Split-Path -leaf $uri
-
-  # Disable progress bar to increase download speed.
-  $ProgressPreference = 'SilentlyContinue'
-  Invoke-WebRequest $uri -OutFile ${tmp_dir}\${filename}
-
-  # TODO(yujuhong): Verify hash of the tarball.
+  $urls = ${kube_env}['NODE_BINARY_TAR_URL'].Split(",")
+  $filename = Split-Path -leaf $urls[0]
+  $hash = $null
+  if ($kube_env.ContainsKey('NODE_BINARY_TAR_HASH')) {
+    $hash = ${kube_env}['NODE_BINARY_TAR_HASH']
+  }
+  MustDownload-File -Hash $hash -OutFile ${tmp_dir}\${filename} -URLs $urls
 
   # Change the directory to the parent directory of ${env:K8S_DIR} and untar.
   # This (over-)writes ${dest_dir}/kubernetes/node/bin/*.exe files.
@@ -791,9 +789,8 @@ function Configure-HostNetworkingService {
 function Configure-CniNetworking {
   if ((ShouldWrite-File ${env:CNI_DIR}\win-bridge.exe) -or
       (ShouldWrite-File ${env:CNI_DIR}\host-local.exe)) {
-    Invoke-WebRequest `
-        https://github.com/yujuhong/gce-k8s-windows-testing/raw/master/windows-cni-plugins.zip `
-        -OutFile ${env:CNI_DIR}\windows-cni-plugins.zip
+    MustDownload-File -OutFile ${env:CNI_DIR}\windows-cni-plugins.zip `
+      -URLs "https://github.com/yujuhong/gce-k8s-windows-testing/raw/master/windows-cni-plugins.zip"
     rm ${env:CNI_DIR}\*.exe
     Expand-Archive ${env:CNI_DIR}\windows-cni-plugins.zip ${env:CNI_DIR}
     mv ${env:CNI_DIR}\bin\*.exe ${env:CNI_DIR}\

cluster/gce/win1803/smoke-test.sh

@@ -22,8 +22,7 @@
 #      pods, Windows pods, K8s services, and the Internet.
 #   4) Verifying that basic DNS resolution works in Windows pods.
 #
-# This script assumes that it is run from the root of the kubernetes repository
-# and that kubectl is present at client/bin/kubectl.
+# This script assumes that it is run from the root of the kubernetes repository.
 #
 # TODOs:
 #   - Implement the node-to-pod checks.
@@ -41,7 +40,7 @@
 # Override this to use a different kubectl binary.
 kubectl=kubectl
 linux_deployment_timeout=60
-windows_deployment_timeout=240
+windows_deployment_timeout=120
 output_file=/tmp/k8s-smoke-test.out
 
 function check_windows_nodes_are_ready {
@@ -59,6 +58,15 @@ function check_windows_nodes_are_ready {
   echo "Verified that all Windows nodes have status Ready"
 }
 
+function untaint_windows_nodes {
+  # Untaint the windows nodes to allow test workloads without tolerations to be
+  # scheduled onto them.
+  WINDOWS_NODES=$(${kubectl} get nodes -l beta.kubernetes.io/os=windows -o name)
+  for node in $WINDOWS_NODES; do
+    ${kubectl} taint node "$node" node.kubernetes.io/os:NoSchedule-
+  done
+}
+
 function check_no_system_pods_on_windows_nodes {
   windows_system_pods=$(${kubectl} get pods --namespace kube-system \
     -o wide | grep -E "Pending|windows" | wc -w)
@@ -73,6 +81,7 @@ function check_no_system_pods_on_windows_nodes {
 
 linux_webserver_deployment=linux-nginx
 linux_webserver_pod_label=nginx
+linux_webserver_replicas=1
 
 function deploy_linux_webserver_pod {
   echo "Writing example deployment to $linux_webserver_deployment.yaml"
@@ -84,7 +93,7 @@ metadata:
   labels:
     app: $linux_webserver_pod_label
 spec:
-  replicas: 1
+  replicas: $linux_webserver_replicas
   selector:
     matchLabels:
       app: $linux_webserver_pod_label
@@ -107,11 +116,11 @@ EOF
 
   timeout=$linux_deployment_timeout
   while [[ $timeout -gt 0 ]]; do
-    echo "Waiting for Linux $linux_webserver_pod_label pods to become Ready"
+    echo "Waiting for $linux_webserver_replicas Linux $linux_webserver_pod_label pods to become Ready"
     statuses=$(${kubectl} get pods -l app=$linux_webserver_pod_label \
       -o jsonpath='{.items[*].status.conditions[?(@.type=="Ready")].status}' \
-      | grep "False" | wc -w)
-    if [[ $statuses -eq 0 ]]; then
+      | grep "True" | wc -w)
+    if [[ $statuses -eq $linux_webserver_replicas ]]; then
       break
     else
       sleep 10
@@ -148,6 +157,7 @@ function undeploy_linux_webserver_pod {
 
 linux_command_deployment=linux-ubuntu
 linux_command_pod_label=ubuntu
+linux_command_replicas=1
 
 function deploy_linux_command_pod {
   echo "Writing example deployment to $linux_command_deployment.yaml"
@@ -159,7 +169,7 @@ metadata:
   labels:
     app: $linux_command_pod_label
 spec:
-  replicas: 1
+  replicas: $linux_command_replicas
   selector:
     matchLabels:
       app: $linux_command_pod_label
@@ -183,11 +193,11 @@ EOF
 
   timeout=$linux_deployment_timeout
   while [[ $timeout -gt 0 ]]; do
-    echo "Waiting for Linux $linux_command_pod_label pods to become Ready"
+    echo "Waiting for $linux_command_replicas Linux $linux_command_pod_label pods to become Ready"
     statuses=$(${kubectl} get pods -l app=$linux_command_pod_label \
       -o jsonpath='{.items[*].status.conditions[?(@.type=="Ready")].status}' \
-      | grep "False" | wc -w)
-    if [[ $statuses -eq 0 ]]; then
+      | grep "True" | wc -w)
+    if [[ $statuses -eq $linux_command_replicas ]]; then
       break
     else
       sleep 10
@@ -237,6 +247,7 @@ function undeploy_linux_command_pod {
 
 windows_webserver_deployment=windows-nettest
 windows_webserver_pod_label=nettest
+windows_webserver_replicas=1
 
 function deploy_windows_webserver_pod {
   echo "Writing example deployment to $windows_webserver_deployment.yaml"
@@ -252,7 +263,7 @@ metadata:
   labels:
     app: $windows_webserver_pod_label
 spec:
-  replicas: 1
+  replicas: $windows_webserver_replicas
   selector:
     matchLabels:
       app: $windows_webserver_pod_label
@@ -280,11 +291,11 @@ EOF
 
   timeout=$windows_deployment_timeout
   while [[ $timeout -gt 0 ]]; do
-    echo "Waiting for Windows $windows_webserver_pod_label pods to become Ready"
+    echo "Waiting for $windows_webserver_replicas Windows $windows_webserver_pod_label pods to become Ready"
     statuses=$(${kubectl} get pods -l app=$windows_webserver_pod_label \
       -o jsonpath='{.items[*].status.conditions[?(@.type=="Ready")].status}' \
-      | grep "False" | wc -w)
-    if [[ $statuses -eq 0 ]]; then
+      | grep "True" | wc -w)
+    if [[ $statuses -eq $windows_webserver_replicas ]]; then
       break
     else
       sleep 10
@@ -319,6 +330,7 @@ function undeploy_windows_webserver_pod {
 
 windows_command_deployment=windows-powershell
 windows_command_pod_label=powershell
+windows_command_replicas=1
 
 function deploy_windows_command_pod {
   echo "Writing example deployment to $windows_command_deployment.yaml"
@@ -330,7 +342,7 @@ metadata:
   labels:
     app: $windows_command_pod_label
 spec:
-  replicas: 1
+  replicas: $windows_command_replicas
   selector:
     matchLabels:
       app: $windows_command_pod_label
@@ -358,11 +370,11 @@ EOF
 
   timeout=$windows_deployment_timeout
   while [[ $timeout -gt 0 ]]; do
-    echo "Waiting for Windows $windows_command_pod_label pods to become Ready"
+    echo "Waiting for $windows_command_replicas Windows $windows_command_pod_label pods to become Ready"
     statuses=$(${kubectl} get pods -l app=$windows_command_pod_label \
       -o jsonpath='{.items[*].status.conditions[?(@.type=="Ready")].status}' \
-      | grep "False" | wc -w)
-    if [[ $statuses -eq 0 ]]; then
+      | grep "True" | wc -w)
+    if [[ $statuses -eq $windows_command_replicas ]]; then
       break
     else
       sleep 10
@@ -640,6 +652,7 @@ function cleanup_deployments {
 }
 
 check_windows_nodes_are_ready
+untaint_windows_nodes
 check_no_system_pods_on_windows_nodes
 
 deploy_linux_webserver_pod

cluster/get-kube-binaries.sh

@@ -164,8 +164,8 @@ SERVER_PLATFORM="linux"
 SERVER_ARCH="${KUBERNETES_SERVER_ARCH:-amd64}"
 SERVER_TAR="kubernetes-server-${SERVER_PLATFORM}-${SERVER_ARCH}.tar.gz"
 if [[ -n "${KUBERNETES_NODE_PLATFORM-}" || -n "${KUBERNETES_NODE_ARCH-}" ]]; then
-  NODE_PLATFORM="${KUBERNETES_NODE_PLATFORM:${SERVER_PLATFORM}}"
-  NODE_ARCH="${KUBERNETES_NODE_ARCH:${SERVER_ARCH}}"
+  NODE_PLATFORM="${KUBERNETES_NODE_PLATFORM:-${SERVER_PLATFORM}}"
+  NODE_ARCH="${KUBERNETES_NODE_ARCH:-${SERVER_ARCH}}"
   NODE_TAR="kubernetes-node-${NODE_PLATFORM}-${NODE_ARCH}.tar.gz"
 fi
 

cluster/images/conformance/BUILD

@@ -47,7 +47,6 @@ container_image(
 container_bundle(
     name = "conformance",
     images = {"k8s.gcr.io/conformance-amd64:{STABLE_DOCKER_TAG}": "conformance-internal"},
-    stamp = True,
 )
 
 filegroup(

cluster/images/conformance/Makefile

@@ -25,7 +25,7 @@ KUBECTL_BIN?=$(shell pwd)/../../../$(OUT_DIR)/dockerized/bin/linux/$(ARCH)/kubec
 E2E_TEST_BIN?=$(shell pwd)/../../../$(OUT_DIR)/dockerized/bin/linux/$(ARCH)/e2e.test
 CLUSTER_DIR?=$(shell pwd)/../../../cluster/
 
-BASEIMAGE=k8s.gcr.io/debian-hyperkube-base-$(ARCH):0.12.0
+BASEIMAGE=k8s.gcr.io/debian-hyperkube-base-$(ARCH):0.12.1
 TEMP_DIR:=$(shell mktemp -d -t conformanceXXXXXX)
 
 all: build

cluster/images/conformance/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 reviewers:
   - timothysc
   - dims

cluster/images/conformance/run_e2e.sh

-#!/bin/bash
+#!/usr/bin/env bash
 # Copyright 2018 The Kubernetes Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

cluster/images/etcd-empty-dir-cleanup/etcd-empty-dir-cleanup.sh

@@ -17,14 +17,14 @@
 echo "Removing empty directories from etcd..."
 
 cleanup_empty_dirs () {
-  if [ "$(${ETCDCTL} ls $1)" ]; then
-    for SUBDIR in $(${ETCDCTL} ls -p $1 | grep "/$")
+  if [ "$("${ETCDCTL}" ls "${1}")" ]; then
+    for SUBDIR in $("${ETCDCTL}" ls -p "${1}" | grep "/$")
     do
-      cleanup_empty_dirs ${SUBDIR}
+      cleanup_empty_dirs "${SUBDIR}"
     done
   else
     echo "Removing empty key $1 ..."
-    ${ETCDCTL} rmdir $1
+    "${ETCDCTL}" rmdir "${1}"
   fi
 }
 
@@ -33,5 +33,5 @@ do
   echo "Starting cleanup..."
   cleanup_empty_dirs "/registry"
   echo "Done with cleanup."
-  sleep ${SLEEP_SECOND}
+  sleep "${SLEEP_SECOND}"
 done

cluster/images/etcd-version-monitor/etcd-version-monitor.go

@@ -19,6 +19,7 @@ package main
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	goflag "flag"
 	"fmt"
 	"net/http"
@@ -202,21 +203,21 @@ func getVersion(lastSeenBinaryVersion *string) error {
 	// Create the get request for the etcd version endpoint.
 	req, err := http.NewRequest("GET", etcdVersionScrapeURI, nil)
 	if err != nil {
-		return fmt.Errorf("Failed to create GET request for etcd version: %v", err)
+		return fmt.Errorf("failed to create GET request for etcd version: %v", err)
 	}
 
 	// Send the get request and receive a response.
 	client := &http.Client{}
 	resp, err := client.Do(req)
 	if err != nil {
-		return fmt.Errorf("Failed to receive GET response for etcd version: %v", err)
+		return fmt.Errorf("failed to receive GET response for etcd version: %v", err)
 	}
 	defer resp.Body.Close()
 
 	// Obtain EtcdVersion from the JSON response.
 	var version EtcdVersion
 	if err := json.NewDecoder(resp.Body).Decode(&version); err != nil {
-		return fmt.Errorf("Failed to decode etcd version JSON: %v", err)
+		return fmt.Errorf("failed to decode etcd version JSON: %v", err)
 	}
 
 	// Return without updating the version if it stayed the same since last time.
@@ -228,7 +229,7 @@ func getVersion(lastSeenBinaryVersion *string) error {
 	if *lastSeenBinaryVersion != "" {
 		deleted := etcdVersion.Delete(prometheus.Labels{"binary_version": *lastSeenBinaryVersion})
 		if !deleted {
-			return fmt.Errorf("Failed to delete previous version's metric")
+			return errors.New("failed to delete previous version's metric")
 		}
 	}
 
@@ -259,14 +260,14 @@ func getVersionPeriodically(stopCh <-chan struct{}) {
 func scrapeMetrics() (map[string]*dto.MetricFamily, error) {
 	req, err := http.NewRequest("GET", etcdMetricsScrapeURI, nil)
 	if err != nil {
-		return nil, fmt.Errorf("Failed to create GET request for etcd metrics: %v", err)
+		return nil, fmt.Errorf("failed to create GET request for etcd metrics: %v", err)
 	}
 
 	// Send the get request and receive a response.
 	client := &http.Client{}
 	resp, err := client.Do(req)
 	if err != nil {
-		return nil, fmt.Errorf("Failed to receive GET response for etcd metrics: %v", err)
+		return nil, fmt.Errorf("failed to receive GET response for etcd metrics: %v", err)
 	}
 	defer resp.Body.Close()
 

cluster/images/etcd/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 reviewers:
   - jpbetz
   - wenjiaswe

cluster/images/hyperkube/BUILD

@@ -12,7 +12,6 @@ container_image(
 container_bundle(
     name = "hyperkube",
     images = {"k8s.gcr.io/hyperkube-amd64:{STABLE_DOCKER_TAG}": "hyperkube-internal"},
-    stamp = True,
 )
 
 filegroup(

cluster/images/hyperkube/Makefile

@@ -22,7 +22,7 @@ ARCH?=amd64
 OUT_DIR?=_output
 HYPERKUBE_BIN?=$(shell pwd)/../../../$(OUT_DIR)/dockerized/bin/linux/$(ARCH)/hyperkube
 
-BASEIMAGE=k8s.gcr.io/debian-hyperkube-base-$(ARCH):0.12.0
+BASEIMAGE=k8s.gcr.io/debian-hyperkube-base-$(ARCH):0.12.1
 TEMP_DIR:=$(shell mktemp -d -t hyperkubeXXXXXX)
 
 all: build

cluster/images/hyperkube/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 reviewers:
   - ixdy
   - luxas

cluster/images/kubemark/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 reviewers:
   - gmarek
   - shyamjvs

cluster/juju/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 approvers:
 - Cynerva
 - ktsakalozos

cluster/juju/bundles/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 reviewers:
 - jlowdermilk

cluster/juju/layers/kubernetes-e2e/README.md

@@ -83,13 +83,13 @@ To see the different types of tests the Kubernetes end-to-end charm has access
 to, we encourage you to see the upstream documentation on the different types
 of tests, and to strongly understand what subsets of the tests you are running.
 
-[Kinds of tests](https://github.com/kubernetes/community/blob/master/contributors/devel/e2e-tests.md#kinds-of-tests)
+[Kinds of tests](https://git.k8s.io/community/contributors/devel/sig-testing/e2e-tests.md#kinds-of-tests)
 
 ### More information on end-to-end testing
 
 Along with the above descriptions, end-to-end testing is a much larger subject
 than this readme can encapsulate. There is far more information in the
-[end-to-end testing guide](https://github.com/kubernetes/community/blob/master/contributors/devel/e2e-tests.md).
+[end-to-end testing guide](https://git.k8s.io/community/contributors/devel/sig-testing/e2e-tests.md).
 
 ### Evaluating end-to-end results
 

cluster/juju/prereqs/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 reviewers:
 - eparis
 - david-mcmahon

cluster/kube-down.sh

@@ -20,7 +20,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
 if [ -f "${KUBE_ROOT}/cluster/env.sh" ]; then
     source "${KUBE_ROOT}/cluster/env.sh"

cluster/kubeadm.sh

@@ -18,7 +18,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-KUBE_ROOT=${KUBE_ROOT:-$(dirname "${BASH_SOURCE}")/..}
+KUBE_ROOT=${KUBE_ROOT:-$(dirname "${BASH_SOURCE[0]}")/..}
 source "${KUBE_ROOT}/cluster/clientbin.sh"
 
 # If KUBEADM_PATH isn't set, gather up the list of likely places and use ls

cluster/kubemark/OWNERS

+# See the OWNERS docs at https://go.k8s.io/owners
+
 reviewers:
   - gmarek
   - shyamjvs

cluster/kubemark/gce/config-default.sh

@@ -25,6 +25,7 @@ GCLOUD=gcloud
 ZONE=${KUBE_GCE_ZONE:-us-central1-b}
 REGION=${ZONE%-*}
 NUM_NODES=${KUBEMARK_NUM_NODES:-10}
+NUM_WINDOWS_NODES=${KUBEMARK_NUM_WINDOWS_NODES:-0}
 MASTER_SIZE=${KUBEMARK_MASTER_SIZE:-n1-standard-$(get-master-size)}
 MASTER_DISK_TYPE=pd-ssd
 MASTER_DISK_SIZE=${MASTER_DISK_SIZE:-$(get-master-disk-size)}

cluster/log-dump/log-dump.sh

@@ -329,8 +329,13 @@ function find_non_logexported_nodes() {
 }
 
 function dump_nodes_with_logexporter() {
-  echo "Detecting nodes in the cluster"
-  detect-node-names &> /dev/null
+  if [[ -n "${use_custom_instance_list}" ]]; then
+    echo "Dumping logs for nodes provided by log_dump_custom_get_instances() function"
+    NODE_NAMES=( $(log_dump_custom_get_instances node) )
+  else
+    echo "Detecting nodes in the cluster"
+    detect-node-names &> /dev/null
+  fi
 
   if [[ -z "${NODE_NAMES:-}" ]]; then
     echo "No nodes found!"
@@ -349,6 +354,7 @@ function dump_nodes_with_logexporter() {
   sed -i'' -e "s@{{.CloudProvider}}@${cloud_provider}@g" "${KUBE_ROOT}/cluster/log-dump/logexporter-daemonset.yaml"
   sed -i'' -e "s@{{.GCSPath}}@${gcs_artifacts_dir}@g" "${KUBE_ROOT}/cluster/log-dump/logexporter-daemonset.yaml"
   sed -i'' -e "s@{{.EnableHollowNodeLogs}}@${enable_hollow_node_logs}@g" "${KUBE_ROOT}/cluster/log-dump/logexporter-daemonset.yaml"
+  sed -i'' -e "s@{{.DumpSystemdJournal}}@${dump_systemd_journal}@g" "${KUBE_ROOT}/cluster/log-dump/logexporter-daemonset.yaml"
 
   # Create the logexporter namespace, service-account secret and the logexporter daemonset within that namespace.
   KUBECTL="${KUBE_ROOT}/cluster/kubectl.sh"

cluster/log-dump/logexporter-daemonset.yaml

@@ -36,7 +36,7 @@ spec:
     spec:
       containers:
       - name: logexporter-test
-        image: gcr.io/k8s-testimages/logexporter:v0.1.3
+        image: gcr.io/k8s-testimages/logexporter:v0.1.5
         env:
         - name: NODE_NAME
           valueFrom:
@@ -49,6 +49,7 @@ spec:
         - --gcs-path={{.GCSPath}}
         - --gcloud-auth-file-path=/etc/service-account/service-account.json
         - --enable-hollow-node-logs={{.EnableHollowNodeLogs}}
+        - --dump-systemd-journal={{.DumpSystemdJournal}}
         - --sleep-duration=24h
         - --alsologtostderr
         volumeMounts: