Kubernetes 1.10.0 #1876

nilebox · 2018-03-27T07:51:49Z

regular rebasing on the latest k8s release
also unblocks Use RecommendedOptions from apiserver, use ApplyTo and extra admission initializers #1861

As usual, review individual commits and skip "Update vendor" commits.

nilebox · 2018-04-09T15:20:11Z

All tests are passing now, but the helm chart install times out. Probably some flags were changed and we need to update a helm chart, will check.

nilebox · 2018-04-10T00:43:24Z

Had to copy-paste some code from(a *AdmissionOptions) ApplyTo since the admission initialization has changed and it was blowing up.
We should switch to RecommendedOptions as a follow-up to reduce copy-paste forked code.

nilebox · 2018-04-10T02:35:57Z

Temporarily disabled webhook admission plugins to localize the issue.

nilebox · 2018-04-10T02:58:08Z

The build succeeds now, but need to look whether disabling default admission plugins causes a regression (i.e. missing support for initializer or something).
Once there is no regression, we can fix additional admission controllers support in the follow-up PR.

nilebox · 2018-04-10T03:15:54Z

The issue with webhook admission controllers is caused by RBAC permissions:

I0410 01:46:46.875133       1 request.go:874] Response Body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"validatingwebhookconfigurations.admissionregistration.k8s.io is forbidden: User \"system:serviceaccount:catalog:service-catalog-apiserver\" cannot list validatingwebhookconfigurations.admissionregistration.k8s.io at the cluster scope","reason":"Forbidden","details":{"group":"admissionregistration.k8s.io","kind":"validatingwebhookconfigurations"},"code":403}
E0410 01:46:46.875202       1 reflector.go:205] github.com/kubernetes-incubator/service-catalog/vendor/k8s.io/client-go/informers/factory.go:87: Failed to list *v1beta1.ValidatingWebhookConfiguration: validatingwebhookconfigurations.admissionregistration.k8s.io is forbidden: User "system:serviceaccount:catalog:service-catalog-apiserver" cannot list validatingwebhookconfigurations.admissionregistration.k8s.io at the cluster scope

We need to grant additional permissions to service-catalog-apiserver.

nilebox · 2018-04-10T05:01:35Z

Travis build times out (the limit is 50 minutes). We might have to fix the problem with t.Parallel() I suppose... (see #1848 (comment))

MHBauer · 2018-04-16T16:06:43Z

I'll give it a rebase on the commit with faster clients. #1929

MHBauer · 2018-04-16T21:16:52Z

well, the rebase made it faster, but it's now 47 minutes.

n3wscott · 2018-04-16T21:36:13Z

LGTM, thanks for doing the work

MHBauer

LGTM, I think we should merge and do any other changes in follow ups, such as 1.10.1.

MHBauer · 2018-04-17T02:12:25Z

Jenkinsfile

@@ -138,6 +138,7 @@ node {
      }
    } catch (Exception e) {
      echo 'Run failed.'
+      print e


still need this?

MHBauer · 2018-04-17T02:12:39Z

charts/catalog/templates/rbac.yaml

+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch"]


MHBauer · 2018-04-17T02:14:13Z

cmd/apiserver/app/server/util.go

@@ -161,20 +164,46 @@ func buildGenericConfig(s *ServiceCatalogServerOptions) (*genericapiserver.Recom
 }

 // buildAdmission constructs the admission chain
-func buildAdmission(s *ServiceCatalogServerOptions,
+// TODO nilebox: Switch to RecommendedOptions and use method (a *AdmissionOptions) ApplyTo


follow up to solve #1851, methinks

MHBauer · 2018-04-17T02:15:08Z

cmd/apiserver/app/server/util.go

+// enabledPluginNames makes use of RecommendedPluginOrder, DefaultOffPlugins,
+// EnablePlugins, DisablePlugins fields
+// to prepare a list of ordered plugin names that are enabled.
+// TODO nilebox: remove this method once switched to RecommendedOptions


same #1861 I think

MHBauer · 2018-04-17T02:17:00Z

pkg/apiserver/default_storage_factory_builder.go

+		// methods were removed.
+		// Remove the resource loop after we make sure that we don't have
+		// overrides for resources in our config.
+		return nil, fmt.Errorf("resource overrides are not supported anymore: %v", key)


good error, no idea what any of this code is for.

MHBauer · 2018-04-17T02:19:05Z

pkg/client/clientset_generated/clientset/fake/register.go

@@ -14,6 +14,8 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

+// Code generated by client-gen. DO NOT EDIT.


not sure anyone would actually see these comments, but code gen, whatever.

MHBauer · 2018-04-17T02:19:26Z

pkg/client/clientset_generated/clientset/fake/register.go

@@ -39,7 +41,7 @@ func init() {
 //
 //   import (
 //     "k8s.io/client-go/kubernetes"
-//     clientsetscheme "k8s.io/client-go/kuberentes/scheme"
+//     clientsetscheme "k8s.io/client-go/kubernetes/scheme"


MHBauer · 2018-04-17T02:20:01Z

pkg/client/informers_generated/internalversion/servicecatalog/internalversion/serviceplan.go

@@ -14,11 +14,13 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-// This file was automatically generated by informer-gen
+// Code generated by informer-gen. DO NOT EDIT.


at least it's consistent now?

…ions.ApplyTo method invoked by RecommendedOptions) Fix RBAC for admission webhooks

MHBauer · 2018-04-19T15:03:08Z

rebased to pick up fixes in #1951

k8s-ci-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Mar 27, 2018

nilebox changed the title ~~[WIP] Kubernetes 1.10.0~~ Kubernetes 1.10.0 Apr 9, 2018

nilebox added the do-not-merge label Apr 10, 2018

nilebox removed the do-not-merge label Apr 11, 2018

n3wscott added the LGTM1 label Apr 16, 2018

MHBauer approved these changes Apr 17, 2018

View reviewed changes

MHBauer added the LGTM2 label Apr 17, 2018

Nail Islamov added 11 commits April 19, 2018 08:00

Kubernetes 1.10.0

c42fb18

Update vendor with kubernetes-1.10.0

6d20686

Update master k8s.io dependencies

8d4370c

Update vendor

04237a5

autogenerated files

ef33774

Fix server config for k8s 1.10

b15b85e

Fix enabled admission plugin list

a89c39b

Generated files

46c53ac

Fix loopback client config

6a8d823

Fix admission controller initialization (adapt code from AdmissionOpt…

95b1426

…ions.ApplyTo method invoked by RecommendedOptions) Fix RBAC for admission webhooks

Switch to Kubernetes 1.9 for Jenkins build

c61fab8

MHBauer merged commit 2c22fc1 into kubernetes-retired:master Apr 19, 2018

carolynvs added this to the 1.0.0 milestone May 21, 2018

ash2k deleted the k8s-1.10 branch January 21, 2019 03:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Kubernetes 1.10.0 #1876

Kubernetes 1.10.0 #1876

nilebox commented Mar 27, 2018 •

edited

Loading

nilebox commented Apr 9, 2018

nilebox commented Apr 10, 2018

nilebox commented Apr 10, 2018 •

edited

Loading

nilebox commented Apr 10, 2018

nilebox commented Apr 10, 2018

nilebox commented Apr 10, 2018

MHBauer commented Apr 16, 2018

MHBauer commented Apr 16, 2018

n3wscott commented Apr 16, 2018

MHBauer left a comment

MHBauer Apr 17, 2018

MHBauer Apr 17, 2018

MHBauer Apr 17, 2018

MHBauer Apr 17, 2018

MHBauer Apr 17, 2018

MHBauer Apr 17, 2018

MHBauer Apr 17, 2018

MHBauer Apr 17, 2018

MHBauer commented Apr 19, 2018

Kubernetes 1.10.0 #1876

Kubernetes 1.10.0 #1876

Conversation

nilebox commented Mar 27, 2018 • edited Loading

nilebox commented Apr 9, 2018

nilebox commented Apr 10, 2018

nilebox commented Apr 10, 2018 • edited Loading

nilebox commented Apr 10, 2018

nilebox commented Apr 10, 2018

nilebox commented Apr 10, 2018

MHBauer commented Apr 16, 2018

MHBauer commented Apr 16, 2018

n3wscott commented Apr 16, 2018

MHBauer left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

MHBauer commented Apr 19, 2018

nilebox commented Mar 27, 2018 •

edited

Loading

nilebox commented Apr 10, 2018 •

edited

Loading