…gration

Add seccomp GA version skew for pods

The multi-arch container images used in tests live in quay.io which
doesn't support nesting. By making the /volume/ images repo configurable,
we are able to override them despite our current limitation.

Signed-off-by: Rafael Fonseca <r4f4rfs@gmail.com>

This implements the necessary pieced for the PodSecurityPolicy
enforcement like described in the appropriate KEP section:

https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/20190717-seccomp-ga.md#podsecuritypolicy-enforcement

Signed-off-by: Sascha Grunert <sgrunert@suse.com>

…ring

Adding new EndpointSlice Mirroring Controller

…1.7.0

[Kubeadm]:Bump CoreDNS to v1.7.0

Bump to SMD PR#166 to pick up unsetting field changes and add integration tests

update security contacts for apimachinery repos

Return err when create ContainerLogsDir failed

…ne-volumes

generic ephemeral inline volumes

Fix JSON logger verbose

…c-cert-reload

adds dynamic certificate reloading for kube aggregator

…get-preferred-allocation

Add more tests for device plugin's GetPreferredAllocation() API

Return a FitError when PreFilter fails with unschedulable status

…here_volume_datastore

fixed e2e test vsphere_volume_datastore.go

…ere_utils

Fix vsphere util method - disksAreAttached

…-v1-collection-namespaced-pod-template-test

Promote DeleteCoreV1CollectionNamespacedPodTemplate test+promote - +1 endpoint

…vcaffinity

Bypass PreFilter in ServiceAfffinity if AffinityLabels arg is not present

…-flag-to-beta

Set CSIMigrationvSphere feature gates to beta

fix: license issue in blob disk feature

Respect grace period when removing mirror pod

Refactoring: Change Inf Loop Condition (1 -> True)

log tls handshake error at trace level to avoid error flooding

…uthz tracing

In kubernetes#91342 attempting to evict a Pod with a DeletionTimestamp caused
checking of PDBs to be ignored due to the fact that a Pod scheduled for
deletion should not be factored into a disruption budget. However, PDB
eviction tests currently will sometimes select a Pod already scheduled
for deletion, expecting that attempting to evict it will conflict with
the PDB. This updates those tests to make sure a Pod with deletion
timestamp is not selected for eviction when it is intended to violate a
PDB.

Signed-off-by: hasheddan <georgedanielmangum@gmail.com>

Make sure pod tested for eviction with PDB is not scheduled for deletion

Implement PodSecurityPolicy enforcement for seccomp GA

…remove_map_nil_check

[apiextensions] Remove presence check for map before delete in PrepareForCreate

…ests

Refactor tests in snapshottable and fix kubernetes#73625

Add tags support for Azure File Driver

kube-proxy iptables min-sync-period default 1sec

Fix memory leak in endpointSliceTracker

selectorspread: access listers in plugin instantiation

Fix typo in vsphere e2e test names

Deprecated API request audit annotation

Make sure the _output folder exists before using it from module-graph.sh

iptables: don't do reverse DNS lookups

vendor: update github.com/opencontainers/runc

Move proxy features to kube_features

Fix a few places where source field is empty when creating events via events/v1

Add pdbLister as a member field of struct DefaultPreemption

Skip expensive integration tests in short run mode

…1.7.0

[kube-up]: Bump CoreDNS to v1.7.0

When combining PolicyRules, don't duplicate verbs

cloud/node-controller use InstanceMetadataByProviderID

…eadm-dkc

kubeadm: deprecate "kubeadm alpha kubelet config enable-dynamic"

Fix ListZonesInRegion() after client BasePath change

…in-azure-config

allow specifying a user agent for azure clients

…ics_grabber

e2e/metrics_grabber: unset aliases for ginkgo and gomega packages

doc: deprecate azure blob disk feature

…ification

fixes 92907 improves test error output

Setup cache dirs properly based on --cache-dir value

Include pod /etc/hosts in ephemeral storage calculation for eviction

publishing: add rules for 1.19 and remove for 1.15

Update cAdvisor to v0.37.0

…date

[client-go] Fix argument ordering for fake scale client update

Don't return proxied redirects to the client

Bump addon-resizer for metrics-server to 1.8.11

Refactor and expose common preemption functions

Add saschagrunert and alejandrox1 to sig-release-approvers

kubectl debug: support debugging nodes

Better understanding of kubectl attach description

make the hugetlb controller optional when cgroup v2 is used.

Closes: kubernetes#92933

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Replace evalSymlink() with powershell command for subPath_windows.go

…l-ca-mode-2

kubeadm alpha certs generate-csr

Add nested tracing and endpoint filter tracing to apiserver

Such nodes should not be added to backend pools. This has particular impact
for nodes which are not master nodes (such as nodes running an etcd cluster)
and are incorrectly added to the pool prior to this change.

…updater

Implement server-side apply upgrade and downgrade

kubelet, cgroupv2: make hugetlb optional

Fix failing DNS tests by removing deprecated option

Fix subPath tests for Windows

…kershim

Add seccomp least privilege for docker sandbox

…eruntime

Add seccomp least privilege for kuberuntime

The current design for Fair Queueing for Server Requests has a
problem: if the min-max fair result stays different from an even
division for a long time and no queue involved in the imbalance goes
empty then the imbalance keeps accruing in queue virtual state times.

This commit adds a test that demonstrates the problem.

It also has some other tweaks to make other tests less flaky.

Factor the big scenario-testing func into pieces, with supporting
structs.

Add Aaron to conformance-behaviour-approvers OWNERS_ALIASES

Import cloud provider from k8s.io/legacy-cloud-provider

Signed-off-by: Stephen Augustus <saugustus@vmware.com>

Includes:
- bazelbuild/bazel-toolchains@3.3.2
- bazelbuild/rules_go@v0.22.7

Signed-off-by: Stephen Augustus <saugustus@vmware.com>

Handle volume-in-use error during volume expansion

Signed-off-by: Davanum Srinivas <davanum@gmail.com>

…irness

Add test for windup problem in APF

…sfully

The IPAM and scheduler performance tests are currently causing
integration-master job to fail because of timeouts. They were not
previously running as part of integration-master, so we can disable them
without loss of test coverage. They should be re-enabled as part of fix
for kubernetes#93112.

Signed-off-by: hasheddan <georgedanielmangum@gmail.com>

Update Golang to v1.14.5

Introduce min, average, and standard deviation for the number of
executing mutating and readOnly requests.

Introduce min, max, average, and standard deviation for the number
waiting and number waiting per priority level.

Later:

Revised to use a series of windows

Use three individuals instead of array of powers

Later:

Add coarse queue count metrics, removed windowed avg and stddev

Add metrics for number of queued mutating and readOnly requests,
to complement metrics for number executing.

Later:

Removed windowed average and standard deviation because consumers can
derive such from integrals of consumer's chosen window.

Also replaced "requestKind" Prometheus label with "request_kind".

Later:

Revised to focus on sampling

Make the clock intrinsic to a TimedObserver

... so that the clock can be read while holding the observer's lock;
otherwise, forward progress is not guaranteed (and violations were
observed in testing).

Bug fixes and histogram buckets revision

SetX1 to 1 when queue length limit is zero, beause dividing by zero is nasty.

Remove obsolete argument in gen_test.go.

Add a bucket boundary at 0 for sample-and-water-mark histograms, to
distinguish zeroes from non-zeros.

This includes adding Integrator test.

Simplified test code.

More pervasively used "ctlr" instead of "ctl" as abbreviation for
"controller".

…cycle

Promote: ConfigMap Lifecycle test - +2 conformance endpoint coverage

…-v1-collection-namespaced-event-test

Promote deleteCoreV1CollectionNamespacedEvent test - +1 endpoint coverage

Skip failing scheduler integration tests until they can be run successfully

Update to version 2.5.1 of the fluent-plugin-kubernetes_metadata_filter

Make nested /volume/ repo images overridable

…-vmss-fix

Skip ensuring VMSS in pool for nodes which should be excluded from lb

…MapPointer

Signed-off-by: Gaurav Singh <gaurav1086@gmail.com>

Use local variable for the copy of iterator variable

…fsgroup

Include CSIDriver capability to indicate fsGroup support

Change-Id: I035863210e19184eb2e8861772e58d2d1de8ec5e

Change-Id: Ifabb726120c1c4f90ff3e4d71fdbba468fe74e8a

Change-Id: I1eec309c537920ba520c7a90f9a1f557ec53cf2c

…adm-cmd-test-timeout

kubeadm: increase the timeout for cmd integration tests

A missing 'return' causes the AfterEach() to try to clean up
GCE ingress objects when they haven't been created, because
the test was skipped in BeforeEach().

2020-07-15T17:21:10.3690332Z [BeforeEach] GCE [Slow] [Feature:kubemci]
2020-07-15T17:21:10.3690715Z   /home/runner/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/test/e2e/network/ingress.go:592
2020-07-15T17:21:10.3690970Z Jul 15 17:21:10.368: INFO: Only supported for providers [gce gke] (not )
2020-07-15T17:21:10.3694003Z [AfterEach] GCE [Slow] [Feature:kubemci]
2020-07-15T17:21:10.3696927Z   /home/runner/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/test/e2e/network/ingress.go:614
2020-07-15T17:21:10.3697845Z [1mSTEP[0m: No ingress created, no cleanup necessary
2020-07-15T17:21:10.3698213Z [1mSTEP[0m: Cleaning up cloud resources
2020-07-15T17:21:15.3709789Z E0715 17:21:15.370134   78875 runtime.go:78] Observed a panic: "invalid memory address or nil pointer dereference" (runtime error: invalid memory address or nil pointer dereference)
2020-07-15T17:21:15.3710883Z goroutine 63 [running]:
2020-07-15T17:21:15.3711892Z [AfterEach] [sig-network] Loadbalancing: L7
2020-07-15T17:21:15.3712802Z k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/runtime.logPanic(0x40215e0, 0x7b71700)
2020-07-15T17:21:15.3713654Z   /home/runner/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/test/e2e/framework/framework.go:179
2020-07-15T17:21:15.3714871Z 	/home/runner/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/runtime/runtime.go:74 +0xa3
2020-07-15T17:21:15.3715130Z Jul 15 17:21:15.370: INFO: Waiting up to 3m0s for all (but 0) nodes to be ready
2020-07-15T17:21:15.3715703Z k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/runtime.HandleCrash(0x0, 0x0, 0x0)
2020-07-15T17:21:15.3716215Z 	/home/runner/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/runtime/runtime.go:48 +0x82
2020-07-15T17:21:15.3716610Z panic(0x40215e0, 0x7b71700)
2020-07-15T17:21:15.3717184Z 	/opt/hostedtoolcache/go/1.13.4/x64/src/runtime/panic.go:679 +0x1b2
2020-07-15T17:21:15.3717803Z k8s.io/kubernetes/test/e2e/framework/providers/gce.(*IngressController).deleteForwardingRule(0x0, 0x0, 0xc0034cce04, 0x2)
2020-07-15T17:21:15.3718372Z 	/home/runner/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/test/e2e/framework/providers/gce/ingress.go:158 +0x20b
2020-07-15T17:21:15.3718859Z k8s.io/kubernetes/test/e2e/framework/providers/gce.(*IngressController).Cleanup(0x0, 0x0, 0x1, 0xc0034ccd68)
2020-07-15T17:21:15.3719369Z 	/home/runner/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/test/e2e/framework/providers/gce/ingress.go:724 +0x38
2020-07-15T17:21:15.3719947Z k8s.io/kubernetes/test/e2e/framework/providers/gce.(*IngressController).CleanupIngressControllerWithTimeout.func1(0xc0034ccd78, 0xc00315e8a0, 0xc0002acf88)
2020-07-15T17:21:15.3720474Z 	/home/runner/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/test/e2e/framework/providers/gce/ingress.go:88 +0x33
2020-07-15T17:21:15.3720968Z k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/wait.runConditionWithCrashProtection(0xc0034ccfa0, 0xc0034cce00, 0x0, 0x0)
2020-07-15T17:21:15.3721508Z 	/home/runner/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:211 +0x6f
2020-07-15T17:21:15.3722020Z k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/wait.WaitFor(0xc003393120, 0xc0034ccfa0, 0xc00341ae40, 0x0, 0x0)
2020-07-15T17:21:15.3722542Z 	/home/runner/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:528 +0x159
2020-07-15T17:21:15.3723233Z k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/wait.pollInternal(0xc003393120, 0xc0034ccfa0, 0x0, 0x0)
2020-07-15T17:21:15.3723771Z 	/home/runner/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:414 +0x9f
2020-07-15T17:21:15.3724305Z k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/wait.Poll(0x12a05f200, 0xd18c2e2800, 0xc0034ccfa0, 0xc0000a4940, 0xc0034ccfb0)
2020-07-15T17:21:15.3724872Z 	/home/runner/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:408 +0x4d
2020-07-15T17:21:15.3725377Z k8s.io/kubernetes/test/e2e/framework/providers/gce.(*IngressController).CleanupIngressControllerWithTimeout(0x0, 0xd18c2e2800, 0x0, 0x0)
2020-07-15T17:21:15.3726709Z 	/home/runner/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/test/e2e/framework/providers/gce/ingress.go:87 +0x69
2020-07-15T17:21:15.3743725Z k8s.io/kubernetes/test/e2e/framework/providers/gce.(*IngressController).CleanupIngressController(...)
2020-07-15T17:21:15.3744385Z 	/home/runner/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/test/e2e/framework/providers/gce/ingress.go:81
2020-07-15T17:21:15.3744822Z k8s.io/kubernetes/test/e2e/network.glob..func10.4.2()
2020-07-15T17:21:15.3745340Z 	/home/runner/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/test/e2e/network/ingress.go:626 +0x12a
2020-07-15T17:21:15.3745868Z k8s.io/kubernetes/vendor/github.com/onsi/ginkgo/internal/leafnodes.(*runner).runSync(0xc000e17740, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
2020-07-15T17:21:15.3746756Z 	/home/runner/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/vendor/github.com/onsi/ginkgo/internal/leafnodes/runner.go:113 +0xb8

Fixes: 0f81362

…kubernetes#1154

one time fixup to enable branch fast forward, see issue in sig-release kubernetes#1154

fix: initial delay in mounting azure disk & file

Write readNetworkingV1NamespacedIngressStatus test - +1 endpoint coverage

Updated etcd to v3.4.10 to include this fix:
 - change protobuf field type from int to int64

This should fix increased flakyness in a lot of node e2e tests.

…test

Write checkAPIGroupPreferredVersion Test - +16 Endpoint coverage

…p4p9

Update default etcd server to 3.4.9

Includes:
- bazelbuild/bazel-toolchains@3.4.0
- bazelbuild/rules_go@v0.22.8

Signed-off-by: Stephen Augustus <saugustus@vmware.com>

Signed-off-by: Stephen Augustus <saugustus@vmware.com>

The endpoint controllers responded to Pod changes by trying to figure
out if the generated endpoint resource would change, rather than just
checking if the Pod had changed, but since the set of Pod fields that
need to be checked depend on the Service and Node as well, the code
ended up only checking for a subset of the changes it should have.

In particular, EndpointSliceController ended up only looking at IPv4
Pod IPs when processing Pod update events, so when a Pod went from
having no IP to having only an IPv6 IP, EndpointSliceController would
think it hadn't changed.

Rewrite some of the test helpers to better support single-stack IPv4
vs single-stack IPv6 vs dual-stack IPv4 primary vs dual-stack IPv6
primary, and update TestPodToEndpointAddressForService to test some
more cases.

…-stack

EndpointController was accidentally requiring all headless services to
be IPv4-only in clusters with IPv6DualStack enabled.

This still leaves "legacy" (ie, IPFamily-less) headless services as
always IPv4-only because the controller doesn't currently have easy
access to the information that would allow it to fix that.
(EndpointSliceController had the same problem already, and still
does.) This can be fixed, if needed, by manually setting IPFamily,
and the proposed API for 1.20 will handle this situation better.

fix: determine the correct ip config based on ip family

Port deviceManager to windows container manager to enable GPU access

…flags-02

allow setting different certificates for kube-controller-managed CSR signers

Promote Check Server Version e2e test to conformance - 1 Endpoint Coverage

go.mod: update etcd to fix e2e tests

test/e2e/ingress: add missing return to fix panics on !GCE

Updates sig-scheduling e2e Nvidia GPU tests to install drivers using
local manifest by default. Currently the DaemonSet is fetched from the
GoogleCloudPlatform/container-enginer-accelerators repo by default.
Using a local manifest allows for manually specifying the image
cos-gpu-installer image rather than always using latest. A remote
manifest can still be fetched by setting
NVIDIA_DRIVER_INSTALLER_DAEMONSET env var.

Signed-off-by: hasheddan <georgedanielmangum@gmail.com>

…cy-details

Introduce more metrics on concurrency

…rsion

Deflake PreferredVersion e2e test

kube-up: limit critical pods to kube-system by default

…-for-test

Adding dims as reviewer for test/

Update Golang to v1.14.6

Add reset handler to the instrumentation metric library and expose Reset on the metric registries

…inter_fix_range_iterator_issue

[staging/azure] azure_utils: fix range iterator issue in convertMaptoMapPointer

…mance

Promote Event CRUD tests to conformance

clamp the max cpu.shares to the maximum value allowed by the kernel.

It is not an issue when using cgroupfs, as the kernel will
anyway make sure the value is not out of range and automatically clamp
it, systemd has an additional check that prevents the cgroup creation.

Closes: kubernetes#92855

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

…c's type was changed from Gauge to Histogram, renaming it should make it easier to providers to migrate

Use local daemonset manifest for installing Nvidia drivers