1. 23 Feb, 2018 9 commits
    • Pavithra Ramesh's avatar
      Remove conntrack entry on udp rule add. · 098a4467
      Pavithra Ramesh authored
      Moved conntrack util outside of proxy pkg
      Added warning message if conntrack binary is not found
      Addressed review comments.
      ran gofmt
      098a4467
    • Kubernetes Submit Queue's avatar
      Merge pull request #60214 from sttts/sttts-mac-nsenter · fa5c815c
      Kubernetes Submit Queue authored
      Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
      
      Fix compilation of nsenter code on Mac
      fa5c815c
    • Kubernetes Submit Queue's avatar
      Merge pull request #59793 from nikhita/staging-repos-boilerplate · 1a1643bb
      Kubernetes Submit Queue authored
      Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
      
      staging: add boilerplate header
      
      Follow up of https://github.com/kubernetes/kubernetes/pull/57656.
      
      Adds boilerplate in the relevant staging repos so that they don't need to depend on code-generator's boilerplate.
      
      **Release note**:
      
      ```release-note
      NONE
      ```
      
      /cc sttts fisherxu
      1a1643bb
    • Kubernetes Submit Queue's avatar
      Merge pull request #57962 from xiangpengzhao/proxy-feature-gates · da564ef4
      Kubernetes Submit Queue authored
      Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
      
       Migrate FeatureGates type of kube-proxy from string to map[string]bool
      
      **What this PR does / why we need it**:
      Migration of FeatureGates type. This is a follow-up of #53025.
      
      **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
      ref: #53025
      https://github.com/kubernetes/kubernetes/pull/57754#discussion_r160023416
      
      **Special notes for your reviewer**:
      /cc @luxas @mtaufen @ncdc 
      
      **Release note**:
      
      ```release-note
      action required: kube-proxy: feature gates are now specified as a map when provided via a JSON or YAML KubeProxyConfiguration, rather than as a string of key-value pairs.
      ```
      da564ef4
    • Kubernetes Submit Queue's avatar
      Merge pull request #56164 from danwinship/proxier-chain-split · f0ca9962
      Kubernetes Submit Queue authored
      Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
      
      Split KUBE-SERVICES chain to re-shrink the INPUT chain
      
      **What this PR does / why we need it**:
      #43972 added an iptables rule "`-A INPUT -j KUBE-SERVICES`" to make NodePort ICMP rejection work. (Previously the KUBE-SERVICES chain was only run from OUTPUT, not INPUT.) #44547 extended that patch for ExternalIP rejection as well.
      
      However, the KUBE-SERVICES chain may potentially have a very large number of ICMP reject rules for plain ClusterIP services (the ones that get run from OUTPUT), and it seems that for some reason the kernel is much more sensitive to the length of the INPUT chain than it is to the length of the OUTPUT chain. So a node that worked fine with kube 1.6 (when KUBE-SERVICES was only run from OUTPUT) might fall over with kube 1.7 (with KUBE-SERVICES being run from both INPUT and OUTPUT).
      
      (Specifically, a node with about 5000 ClusterIP reject rules that ran fine with OpenShift 3.6 [kube 1.6] slowed almost to a complete halt with OpenShift 3.7 [kube 1.7].)
      
      This PR fixes things by splitting out the "new" part of KUBE-SERVICES (NodePort and ExternalIP reject rules) into a separate KUBE-EXTERNAL-SERVICES chain run from INPUT, and moves KUBE-SERVICES back to being only run from OUTPUT. (So, yes, this assumes that you don't have 5000 NodePort/ExternalIP services, but, if you do, there's not much we can do, since those rules *have* to be run on the INPUT side.)
      
      Oh, and I left in the code to clean up the "`-A INPUT -j KUBE-SERVICES`" rule even though we don't generate it any more, so it gets fixed on upgrade.
      
      **Release note**:
      ```release-note
      Reorganized iptables rules to fix a performance regression on clusters with thousands of services.
      ```
      
      @kubernetes/sig-network-bugs @kubernetes/rh-networking
      f0ca9962
    • Kubernetes Submit Queue's avatar
      Merge pull request #58816 from croomes/storageos_containerized_kubelet · 9a75b4d7
      Kubernetes Submit Queue authored
      Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
      
      StorageOS configurable device directory and mount options
      
      **What this PR does / why we need it**:
      This allows StorageOS volumes to be mounted when the kubelet is running in a container and we are unable to use the default device location (/var/lib/storageos/volumes).  With this PR, the node's device location is requested via the StorageOS api, falling back to the current behaviour if not configured.  The node's device location can be supplied as an environment variable (DEVICE_DIR) to the StorageOS container.  This is backwards-compatible and no changes are needed to existing deployments.
      
      The PR also allows Mount options to be set for StorageOS volumes in the same way they're enabled for other volume plugins.
      
      The StorageOS API dependency was updated to the latest version, but no functionality changes besides adding the DeviceDir property to the Controller object.
      
      There is also a small refactor of the loopback device handling code in storageos_utils.go to capture stderr output.
      
      **Release note**:
      ```release-note
      StorageOS volume plugin updated to support mount options and environments where the kubelet runs in a container and the device location should be specified.
      ```
      
      Not sure why godep changed the comments of unrelated packages in Godeps.json...
      
      /sig storage
      9a75b4d7
    • Kubernetes Submit Queue's avatar
      Merge pull request #60149 from aveshagarwal/master-kubectl-priority-issue · 948f28a7
      Kubernetes Submit Queue authored
      Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
      
      Fix kubectl describe output for priority class objects.
      
      **What this PR does / why we need it**:
      
      Fixes `kubectl describe priorityclass`  (try https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#example-priorityclass)  
      
      ```
      Name:           high-priority
      Value:          %!s(int32=1000000)
      GlobalDefault:  %!s(bool=false)
      Description:    This priority class should be used for XYZ service pods only.
      Annotations:    <none>
      Events:         <none>
      
      ```
      
      **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:
      Fixes #
      
      **Special notes for your reviewer**:
      
      **Release note**:
      
      ```release-note
      None
      ```
      
      @bsalamat @kubernetes/sig-scheduling-bugs  @kubernetes/sig-cli-bugs 
      /king bug
      /sig scheduling
      /sig cli
      948f28a7
    • Kubernetes Submit Queue's avatar
      Merge pull request #60226 from php-coder/psp_examples_owners · 4ebaddb6
      Kubernetes Submit Queue authored
      Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
      
      examples/podsecuritypolicy: add owners
      
      When we modify something PSP-related, we need to update examples as well but unfortunately they wasn't belong to us.
      4ebaddb6
    • Kubernetes Submit Queue's avatar
      Merge pull request #59973 from kawych/e2e · 6c533678
      Kubernetes Submit Queue authored
      Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.
      
      Introduce e2e test for Stackdriver Metadata Agent
      
      **What this PR does / why we need it**:
      Introduce e2e test for Stackdriver Metadata Agent
      
      **Release note**:
      ```release-note
      None
      ```
      6c533678
  2. 22 Feb, 2018 31 commits