Import kubernetes updates (#210)

* Admin Can Specify in Which GCE Availability Zone(s) a PV Shall Be Created An admin wants to specify in which GCE availability zone(s) users may create persistent volumes using dynamic provisioning. That's why the admin can now configure in StorageClass object a comma separated list of zones. Dynamically created PVs for PVCs that use the StorageClass are created in one of the configured zones. * Admin Can Specify in Which AWS Availability Zone(s) a PV Shall Be Created An admin wants to specify in which AWS availability zone(s) users may create persistent volumes using dynamic provisioning. That's why the admin can now configure in StorageClass object a comma separated list of zones. Dynamically created PVs for PVCs that use the StorageClass are created in one of the configured zones. * move hardPodAffinitySymmetricWeight to scheduler policy config * Added Bind method to Scheduler Extender - only one extender can support the bind method - if an extender supports bind, scheduler delegates the pod binding to the extender * examples/podsecuritypolicy/rbac: allow to use projected volumes in restricted PSP. * fix typo * SPBM policy ID support in vsphere cloud provider * fix the invalid link * DeamonSet-DaemonSet * Update GlusterFS examples readme. Signed-off-by: Humble Chirammal <hchiramm@redhat.com> * fix some typo in example/volumes * Fix spelling in example/spark * Correct spelling in quobyte * Support custom domains in the cockroachdb example's init container This switches from using v0.1 of the peer-finder image to a version that includes kubernetes-retired/contrib#2013 While I'm here, switch the version of cockroachdb from 1.0 to 1.0.1 * Update docs/ URLs to point to proper locations * Adds --insecure to cockroachdb client command Cockroach errors out when using said command: ```shell ▶ kubectl run -it --rm cockroach-client --image=cockroachdb/cockroach --restart=Never --command -- ./cockroach sql --host cockroachdb-public Waiting for pod default/cockroach-client to be running, status is Pending, pod ready: false Waiting for pod default/cockroach-client to be running, status is Pending, pod ready: false Waiting for pod default/cockroach-client to be running, status is Pending, pod ready: false If you don't see a command prompt, try pressing enter. Error attaching, falling back to logs: unable to upgrade connection: container cockroach-client not found in pod cockroach-client_default Error: problem using security settings, did you mean to use --insecure?: problem with CA certificate: not found Failed running "sql" Waiting for pod default/cockroach-client to terminate, status is Running pod "cockroach-client" deleted ``` This PR updates the README.md to include --insecure in the client command * Add StorageOS volume plugin * examples/volumes/flexvolume/nfs: check for jq and simplify quoting. * Remove broken getvolumename and pass PV or volume name to attach call * Remove controller node plugin driver dependency for non-attachable flex volume drivers (Ex: NFS). * Add `imageFeatures` parameter for RBD volume plugin, which is used to customize RBD image format 2 features. Update RBD docs in examples/persistent-volume-provisioning/README.md. * Only `layering` RBD image format 2 feature should be supported for now. * Formatted Dockerfile to be cleaner and precise * Update docs for user-guide * Make the Quota creation optional * Remove duplicated line from ceph-secret-admin.yaml * Update CockroachDB tag to v1.0.3 * Correct the comment in PSP examples. * Update wordpress to 4.8.0 * Cassandra example, use nodetool drain in preStop * Add termination gracePeriod * Use buildozer to remove deprecated automanaged tags * Use buildozer to delete licenses() rules except under third_party/ * NR Infrastructure agent example daemonset Copy of previous newrelic example, then modified to use the new agent "newrelic-infra" instead of "nrsysmond". Also maps all of host node's root fs into /host in the container (ro, but still exposes underlying node info into a container). Updates to README * Reduce one time url direction Reduce one time url direction * update to rbac v1 in yaml file * Replicate the persistent volume label admission plugin in a controller in the cloud-controller-manager * update related files * Paramaterize stickyMaxAgeMinutes for service in API * Update example to CockroachDB v1.0.5 * Remove storage-class annotations in examples * PodSecurityPolicy.allowedCapabilities: add support for using * to allow to request any capabilities. Also modify "privileged" PSP to use it and allow privileged users to use any capabilities. * Add examples pods to demonstrate CPU manager. * Tag broken examples test as manual * bazel: use autogenerated all-srcs rules instead of manually-curated sources rules * Update CockroachDB tag to v1.1.0 * update BUILD files * pkg/api/legacyscheme: fixup imports * Update bazel * [examples.storage/minio] update deploy config version * Volunteer to help review examples I would like to do some code review for examples about how to run real applications with Kubernetes * examples/podsecuritypolicy/rbac: fix names in comments and sync with examples repository. * Update storageclass version to v1 in examples * pkg/apis/core: mechanical import fixes in dependencies * Use k8s.gcr.io vanity domain for container images * Update generated files * gcloud docker now auths k8s.gcr.io by default * -Add scheduler optimization options, short circuit all predicates if one predicate fails * Revert k8s.gcr.io vanity domain This reverts commit eba5b6092afcae27a7c925afea76b85d903e87a9. Fixes kubernetes/kubernetes#57526 * Autogenerate BUILD files * Move scheduler code out of plugin directory. This moves plugin/pkg/scheduler to pkg/scheduler and plugin/cmd/kube-scheduler to cmd/kube-scheduler. Bulk of the work was done with gomvpkg, except for kube-scheduler main package. * Fix scheduler refs in BUILD files. Update references to moved scheduler code. * Switch to k8s.gcr.io vanity domain This is the 2nd attempt. The previous was reverted while we figured out the regional mirrors (oops). New plan: k8s.gcr.io is a read-only facade that auto-detects your source region (us, eu, or asia for now) and pulls from the closest. To publish an image, push k8s-staging.gcr.io and it will be synced to the regionals automatically (similar to today). For now the staging is an alias to gcr.io/google_containers (the legacy URL). When we move off of google-owned projects (working on it), then we just do a one-time sync, and change the google-internal config, and nobody outside should notice. We can, in parallel, change the auto-sync into a manual sync - send a PR to "promote" something from staging, and a bot activates it. Nice and visible, easy to keep track of. * Remove apiVersion from scheduler extender example configuration * Update examples to use PSPs from the policy API group. * fix all the typos across the project * Autogenerated: hack/update-bazel.sh * Modify PodSecurityPolicy admission plugin to additionally allow authorizing via "use" verb in policy API group. * fix todo: add validate method for &schedulerapi.Policy * examples/podsecuritypolicy: add owners. * Adding dummy and dummy-attachable example Flexvolume drivers; adding DaemonSet deployment example * Fix relative links in README
kubernetes · Mar 14, 2018 · e4cc298 · e4cc298
1 parent dfc12dd
commit e4cc298
Show file tree

Hide file tree

Showing 85 changed files with 1,640 additions and 120 deletions.
diff --git a/staging/cloud-controller-manager/persistent-volume-label-initializer-config.yaml b/staging/cloud-controller-manager/persistent-volume-label-initializer-config.yaml
@@ -0,0 +1,13 @@
+kind: InitializerConfiguration
+apiVersion: admissionregistration.k8s.io/v1alpha1
+metadata:
+  name: pvlabel.kubernetes.io
+initializers:
+  - name: pvlabel.kubernetes.io
+    rules:
+    - apiGroups:
+      - ""
+      apiVersions:
+      - "*"
+      resources:
+      - persistentvolumes
diff --git a/staging/cockroachdb/README.md b/staging/cockroachdb/README.md
@@ -57,7 +57,7 @@ Start up a client pod and open up an interactive, (mostly) Postgres-flavor
 SQL shell using:
 
 ```console
-$ kubectl run -it --rm cockroach-client --image=cockroachdb/cockroach --restart=Never --command -- ./cockroach sql --host cockroachdb-public
+$ kubectl run -it --rm cockroach-client --image=cockroachdb/cockroach --restart=Never --command -- ./cockroach sql --host cockroachdb-public --insecure
 ```
 
 You can see example SQL statements for inserting and querying data in the

diff --git a/staging/cockroachdb/cockroachdb-statefulset.yaml b/staging/cockroachdb/cockroachdb-statefulset.yaml
@@ -93,9 +93,12 @@ spec:
       # has to decide what command-line flags to use when starting CockroachDB.
       # This only matters when a pod's persistent volume is empty - if it has
       # data from a previous execution, that data will always be used.
+      #
+      # If your Kubernetes cluster uses a custom DNS domain, you will have
+      # to add an additional arg to this pod: "-domain=<your-custom-domain>"
       initContainers:
       - name: bootstrap
-        image: cockroachdb/cockroach-k8s-init:0.1
+        image: cockroachdb/cockroach-k8s-init:0.2
         imagePullPolicy: IfNotPresent
         args:
         - "-on-start=/on-start.sh"
@@ -122,7 +125,7 @@ spec:
               topologyKey: kubernetes.io/hostname
       containers:
       - name: cockroachdb
-        image: cockroachdb/cockroach:v1.0
+        image: cockroachdb/cockroach:v1.1.0
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 26257
@@ -165,8 +168,6 @@ spec:
   volumeClaimTemplates:
   - metadata:
       name: datadir
-      annotations:
-        volume.alpha.kubernetes.io/storage-class: anything
     spec:
       accessModes:
         - "ReadWriteOnce"

diff --git a/staging/cockroachdb/demo.sh b/staging/cockroachdb/demo.sh
@@ -21,6 +21,7 @@ function sql() {
   # output?
   kubectl exec "cockroachdb-${1}" -- /cockroach/cockroach sql \
       --host "cockroachdb-${1}.cockroachdb" \
+      --insecure \
       -e "$(cat /dev/stdin)"
 }
 

diff --git a/staging/cpu-manager/OWNERS b/staging/cpu-manager/OWNERS
@@ -0,0 +1,6 @@
+approvers:
+- derekwaynecarr
+- vishh
+- ConnorDoyle
+- sjenning
+- balajismaniam
diff --git a/staging/cpu-manager/README.md b/staging/cpu-manager/README.md
@@ -0,0 +1,62 @@
+# CPU Manager Example
+
+This example flow uses a pre-built docker image based on
+[cpuset-visualizer](https://github.com/ConnorDoyle/cpuset-visualizer).
+Each container run here hosts an endpoint serving an up-to-the-second
+system representation generated by
+[`lstopo`](https://www.open-mpi.org/projects/hwloc).
+
+## Setup
+
+1. Start a local cluster with the static CPU manager policy enabled :
+
+   ```
+   sudo PATH=$PATH \
+     KUBELET_FLAGS="\
+     --feature-gates=CPUManager=true \
+     --cpu-manager-policy=static \
+     --cpu-manager-reconcile-period=5s \
+     --kube-reserved=cpu=500m" \
+     ./hack/local-up-cluster.sh
+   ```
+
+## Run pods
+
+The example pods are in the `/examples/cpu-manager` directory of the
+Kubernetes source tree. Your ability to run all of the example pods
+simultaneously depends on how many CPUs are available on the test system.
+
+The required CPUs for each example pod are listed below:
+
+```
+ POD              | CPUs
+------------------|---------
+ be.yaml          | >= 1 CPU
+ shared.yaml      | >= 1 CPU
+ exclusive-1.yaml | >= 2 CPU
+ exclusive-2.yaml | >= 3 CPU
+ exclusive-3.yaml | >= 4 CPU
+ exclusive-4.yaml | >= 5 CPU
+```
+
+### Example
+
+Run a pod with a single container in the shared pool, and another pod
+with a single container in an exclusive cpuset with one CPU.
+
+```
+$ kubectl create -f examples/cpu-manager/shared.yaml
+$ kubectl create -f examples/cpu-manager/exclusive-1.yaml
+```
+
+To list IP addresses of the pods running in the local cluster, do:
+
+```
+$ watch ./examples/cpu-manager/pod-ips
+exclusive-1 http://172.17.0.4
+shared http://172.17.0.3
+```
+
+#### Sample cpuset-visualizer output
+
+![Sample cpuset-visualizer output](https://user-images.githubusercontent.com/379372/28648573-974693ce-7223-11e7-84ed-17cce11910ff.png)
diff --git a/staging/cpu-manager/be.yaml b/staging/cpu-manager/be.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: be
+spec:
+  containers:
+  - image: quay.io/connordoyle/cpuset-visualizer
+    name: be
diff --git a/staging/cpu-manager/exclusive-1.yaml b/staging/cpu-manager/exclusive-1.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: exclusive-1
+spec:
+  containers:
+  - image: quay.io/connordoyle/cpuset-visualizer
+    name: exclusive-1
+    resources:
+      requests:
+        cpu: 1
+        memory: "256M"
+      limits:
+        cpu: 1
+        memory: "256M"
diff --git a/staging/cpu-manager/exclusive-2.yaml b/staging/cpu-manager/exclusive-2.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: exclusive-2
+spec:
+  containers:
+  - image: quay.io/connordoyle/cpuset-visualizer
+    name: exclusive-2
+    resources:
+      requests:
+        cpu: 2
+        memory: "256M"
+      limits:
+        cpu: 2
+        memory: "256M"
diff --git a/staging/cpu-manager/exclusive-3.yaml b/staging/cpu-manager/exclusive-3.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: exclusive-3
+spec:
+  containers:
+  - image: quay.io/connordoyle/cpuset-visualizer
+    name: exclusive-3
+    resources:
+      requests:
+        cpu: 3
+        memory: "256M"
+      limits:
+        cpu: 3
+        memory: "256M"
diff --git a/staging/cpu-manager/exclusive-4.yaml b/staging/cpu-manager/exclusive-4.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: exclusive-4
+spec:
+  containers:
+  - image: quay.io/connordoyle/cpuset-visualizer
+    name: exclusive-4
+    resources:
+      requests:
+        cpu: 4
+        memory: "256M"
+      limits:
+        cpu: 4
+        memory: "256M"
diff --git a/staging/cpu-manager/pod-ips b/staging/cpu-manager/pod-ips
@@ -0,0 +1,26 @@
+#!/bin/bash
+
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Requires `jq`. See https://stedolan.github.io/jq/download
+
+set -o nounset -o pipefail -o errexit
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+KUBECTL="$DIR/../../cluster/kubectl.sh"
+export KUBECONFIG="${KUBECONFIG:-/var/run/kubernetes/admin.kubeconfig}"
+
+$KUBECTL get pods -o json | \
+  jq -r '.items[] | "\(.metadata.name) http://\(.status.podIP)"'
diff --git a/staging/cpu-manager/shared.yaml b/staging/cpu-manager/shared.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: shared
+spec:
+  containers:
+  - image: quay.io/connordoyle/cpuset-visualizer
+    name: shared
+    resources:
+      requests:
+        cpu: 100m
diff --git a/staging/examples_test.go b/staging/examples_test.go
@@ -32,18 +32,19 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/validation/field"
 	"k8s.io/apimachinery/pkg/util/yaml"
-	"k8s.io/kubernetes/pkg/api"
 	"k8s.io/kubernetes/pkg/api/testapi"
-	"k8s.io/kubernetes/pkg/api/validation"
 	"k8s.io/kubernetes/pkg/apis/apps"
 	appsvalidation "k8s.io/kubernetes/pkg/apis/apps/validation"
 	"k8s.io/kubernetes/pkg/apis/batch"
+	api "k8s.io/kubernetes/pkg/apis/core"
+	"k8s.io/kubernetes/pkg/apis/core/validation"
 	"k8s.io/kubernetes/pkg/apis/extensions"
 	expvalidation "k8s.io/kubernetes/pkg/apis/extensions/validation"
 	"k8s.io/kubernetes/pkg/capabilities"
 	"k8s.io/kubernetes/pkg/registry/batch/job"
 	schedulerapi "k8s.io/kubernetes/pkg/scheduler/api"
 	schedulerapilatest "k8s.io/kubernetes/pkg/scheduler/api/latest"
+	schedulerapivalidation "k8s.io/kubernetes/pkg/scheduler/api/validation"
 )
 
 func validateObject(obj runtime.Object) (errors field.ErrorList) {
@@ -144,6 +145,15 @@ func validateObject(obj runtime.Object) (errors field.ErrorList) {
 	return errors
 }
 
+func validateschedulerpolicy(obj runtime.Object) error {
+	switch t := obj.(type) {
+	case *schedulerapi.Policy:
+		return schedulerapivalidation.ValidatePolicy(*t)
+	default:
+		return fmt.Errorf("obj type is not schedulerapi.Policy")
+	}
+}
+
 func walkJSONFiles(inDir string, fn func(name, path string, data []byte)) error {
 	return filepath.Walk(inDir, func(path string, info os.FileInfo, err error) error {
 		if err != nil {
@@ -357,7 +367,10 @@ func TestExampleObjectSchemas(t *testing.T) {
 					t.Errorf("%s did not decode correctly: %v\n%s", path, err, string(data))
 					return
 				}
-				//TODO: Add validate method for &schedulerapi.Policy
+				if err := validateschedulerpolicy(expectedType); err != nil {
+					t.Errorf("%s did not validate correctly: %v\n%s", path, err, string(data))
+					return
+				}
 			} else {
 				codec, err := testapi.GetCodecForObject(expectedType)
 				if err != nil {

diff --git a/staging/https-nginx/README.md b/staging/https-nginx/README.md
@@ -14,7 +14,7 @@ $ make keys KEY=/tmp/nginx.key CERT=/tmp/nginx.crt
 
 ### Create a https nginx application running in a kubernetes cluster
 
-You need a [running kubernetes cluster](https://kubernetes.io/docs/setup/) for this to work.
+You need a [running kubernetes cluster](https://kubernetes.io/docs/setup/pick-right-solution/) for this to work.
 
 Create a secret and a configmap.
 
@@ -122,7 +122,7 @@ $ curl https://104.198.1.26:30028 -k
 ...
 ```
 
-For more information on how to run this in a kubernetes cluster, please see the [user-guide](https://kubernetes.io/docs/concepts/services-networking/service/).
+For more information on how to run this in a kubernetes cluster, please see the [user-guide](https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/).
 
 <!-- BEGIN MUNGE: GENERATED_ANALYTICS -->
 [![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/examples/https-nginx/README.md?pixel)]()

diff --git a/staging/https-nginx/make_secret.go b/staging/https-nginx/make_secret.go
@@ -0,0 +1,71 @@
+/*
+Copyright 2015 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// A small script that converts the given open ssl public/private keys to
+// a secret that it writes to stdout as json. Most common use case is to
+// create a secret from self signed certificates used to authenticate with
+// a devserver. Usage: go run make_secret.go -crt ca.crt -key priv.key > secret.json
+package main
+
+import (
+	"flag"
+	"fmt"
+	"io/ioutil"
+	"log"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/kubernetes/pkg/api/legacyscheme"
+	api "k8s.io/kubernetes/pkg/apis/core"
+
+	// This installs the legacy v1 API
+	_ "k8s.io/kubernetes/pkg/apis/core/install"
+)
+
+// TODO:
+// Add a -o flag that writes to the specified destination file.
+// Teach the script to create crt and key if -crt and -key aren't specified.
+var (
+	crt = flag.String("crt", "", "path to nginx certificates.")
+	key = flag.String("key", "", "path to nginx private key.")
+)
+
+func read(file string) []byte {
+	b, err := ioutil.ReadFile(file)
+	if err != nil {
+		log.Fatalf("Cannot read file %v, %v", file, err)
+	}
+	return b
+}
+
+func main() {
+	flag.Parse()
+	if *crt == "" || *key == "" {
+		log.Fatalf("Need to specify -crt -key and -template")
+	}
+	nginxCrt := read(*crt)
+	nginxKey := read(*key)
+	secret := &api.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "nginxsecret",
+		},
+		Data: map[string][]byte{
+			"nginx.crt": nginxCrt,
+			"nginx.key": nginxKey,
+		},
+	}
+	fmt.Printf(runtime.EncodeOrDie(legacyscheme.Codecs.LegacyCodec(legacyscheme.Registry.EnabledVersions()...), secret))
+}