return ret } <del> // continuousEcho() uses the same connection for multiple requests, made to run as a goroutine so that // manipulations can be made to the service and backend pods while a connection is ongoing // it starts by sending a series of packets to establish conntrack entries and waits for a signal to keep // sending packts. It returns an error if the number of failed attempts is >= 5 func continuousEcho(host string, port int, timeout time.Duration, maxAttempts int, signal chan struct{}, errorChannel chan error) { defer ginkgo.GinkgoRecover() const threshold = 10 // Sanity check inputs, because it has happened.  These are the only things // that should hard fail the test - they are basically ASSERT()s. if host == "" { errorChannel <- fmt.Errorf("Got empty host for continuous echo (%s)", host) return } if port == 0 { errorChannel <- fmt.Errorf("Got port ==0 for continuous echo (%d)", port) return } hostPort := net.JoinHostPort(host, strconv.Itoa(port)) url := fmt.Sprintf("udp://%s", hostPort) ret := UDPPokeResult{} con, err := net.Dial("udp", hostPort) if err != nil { ret.Status = UDPError ret.Error = err errorChannel <- fmt.Errorf("Connection to %q failed: %v", url, err) return } numErrors := 0 bufsize := len(strconv.Itoa(maxAttempts)) + 1 var buf = make([]byte, bufsize) for i := 0; i < maxAttempts; i++ { if i == threshold { framework.Logf("Continuous echo waiting for signal to continue") <-signal if numErrors == threshold { errorChannel <- fmt.Errorf("continuous echo was not able to communicate with initial server pod") return } } time.Sleep(1 * time.Second) err = con.SetDeadline(time.Now().Add(timeout)) if err != nil { ret.Status = UDPError ret.Error = err framework.Logf("Continuous echo (%q): %v", url, err) numErrors++ continue } myRequest := fmt.Sprintf("echo %d", i) _, err = con.Write([]byte(fmt.Sprintf("%sn", myRequest))) if err != nil { ret.Error = err neterr, ok := err.(net.Error) if ok && neterr.Timeout() { ret.Status = UDPTimeout } else if strings.Contains(err.Error(), "connection refused") { ret.Status = UDPRefused } else { ret.Status = UDPError } numErrors++ framework.Logf("Continuous echo (%q): %v - %d errors seen so far", url, err, numErrors) continue } err = con.SetDeadline(time.Now().Add(timeout)) if err != nil { ret.Status = UDPError ret.Error = err numErrors++ framework.Logf("Continuous echo (%q): %v - %d errors seen so far", url, err, numErrors) continue } n, err := con.Read(buf) if err != nil { ret.Error = err neterr, ok := err.(net.Error) if ok && neterr.Timeout() { ret.Status = UDPTimeout } else if strings.Contains(err.Error(), "connection refused") { ret.Status = UDPRefused } else { ret.Status = UDPError } numErrors++ framework.Logf("Continuous echo (%q): %v - %d errors seen so far", url, err, numErrors) continue } ret.Response = buf[0:n] if string(ret.Response) != fmt.Sprintf("%d", i) { ret.Status = UDPBadResponse ret.Error = fmt.Errorf("response does not match expected string: %q", string(ret.Response)) framework.Logf("Continuous echo (%q): %v", url, ret.Error) numErrors++ continue } ret.Status = UDPSuccess framework.Logf("Continuous echo(%q): success", url) } err = nil if numErrors >= threshold { err = fmt.Errorf("Too many Errors in continuous echo") } errorChannel <- err } </del> // testReachableUDP tests that the given host serves UDP on the given port. func testReachableUDP(host string, port int, timeout time.Duration) { pollfn := func() (bool, error) {


return fmt.Errorf("waiting for kubelet timed out") } <del> func RestartApiserver(c discovery.ServerVersionInterface) error { </del> <ins> func RestartApiserver(cs clientset.Interface) error { </ins> // TODO: Make it work for all providers. if !ProviderIs("gce", "gke", "aws") { return fmt.Errorf("unsupported provider: %s", TestContext.Provider) } if ProviderIs("gce", "aws") { <del> return sshRestartMaster() </del> <ins> initialRestartCount, err := getApiserverRestartCount(cs) if err != nil { return fmt.Errorf("failed to get apiserver's restart count: %v", err) } if err := sshRestartMaster(); err != nil { return fmt.Errorf("failed to restart apiserver: %v", err) } return waitForApiserverRestarted(cs, initialRestartCount) </ins> } // GKE doesn't allow ssh access, so use a same-version master // upgrade to teardown/recreate master. <del> v, err := c.ServerVersion() </del> <ins> v, err := cs.Discovery().ServerVersion() </ins> if err != nil { return err }


return nil } <del> var redactedBytes []byte </del> <ins> var ( redactedBytes    []byte dataOmittedBytes []byte ) </ins> // Flatten redacts raw data entries from the config object for a human-readable view. func ShortenConfig(config *Config) {


// When specified, it should match one the container or initContainer // names in the pod template. // +optional <del> ContainerName *string `json:"containerName" protobuf:"bytes,1,opt,name=containerName"` </del> <ins> ContainerName *string `json:"containerName,omitempty" protobuf:"bytes,1,opt,name=containerName"` </ins> // Represents the relationship between the container exit code(s) and the // specified values. Containers completed with success (exit code 0) are


name = "go_default_test", size = "large", srcs = [ <ins> "etcd_cross_group_test.go", </ins> "etcd_storage_path_test.go", "main_test.go", ],


Expect(curHistory).NotTo(BeNil()) return curHistory } <ins> func waitFailedDaemonPodDeleted(c clientset.Interface, pod *v1.Pod) func() (bool, error) { return func() (bool, error) { if _, err := c.CoreV1().Pods(pod.Namespace).Get(pod.Name, metav1.GetOptions{}); err != nil { if errors.IsNotFound(err) { return true, nil } return false, fmt.Errorf("failed to get failed daemon pod %q: %v", pod.Name, err) } return false, nil } } </ins>


func init() { sDec, _ := base64.StdEncoding.DecodeString("REDACTED+") redactedBytes = []byte(string(sDec)) <ins> sDec, _ = base64.StdEncoding.DecodeString("DATA+OMITTED") dataOmittedBytes = []byte(string(sDec)) </ins> } // IsConfigEmpty returns true if the config is empty.


cachedService.service = service s.cache.set(namespacedName.String(), cachedService) case cache.Deleted: <del> err := s.ensureLBDeleted(service) </del> <ins> err := s.balancer.EnsureTCPLoadBalancerDeleted(s.loadBalancerName(service), s.zone.Region) </ins> if err != nil { return err, retryable }


sleep 5 <del> POD_LIST_1=$($KUBECFG '-template={{range.Items}}{{.Meta}} {{end}}' list pods) </del> <ins> POD_LIST_1=$($KUBECFG '-template={{range.Items}}{{.Name}} {{end}}' list pods) </ins> echo "Pods running: ${POD_LIST_1}" $KUBECFG stop redisSlaveController


delete(objs, namespacedName) for _, w := range t.getWatches(gvr, ns) { <del> w.Delete(obj) </del> <ins> w.Delete(obj.DeepCopyObject()) </ins> } return nil }


}) It("should write files of various sizes, verify size, validate content", func() { <del> fileSizes := []int64{1 * framework.MiB, 100 * framework.MiB} </del> <ins> fileSizes := []int64{fileSizeSmall, fileSizeMedium} </ins> err := testVolumeIO(f, cs, config, volSource, nil /*no secContext*/, testFile, fileSizes) Expect(err).NotTo(HaveOccurred()) })


<ins> /* Copyright 2016 The Kubernetes Authors All rights reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ package codeinspector import ( "fmt" "go/ast" "go/parser" "go/token" "io/ioutil" "strings" "unicode" ) // GetPublicFunctions lists all public functions (not methods) from a golang source file. func GetPublicFunctions(filePath string) ([]string, error) { var functionNames []string // Create the AST by parsing src. fset := token.NewFileSet() // positions are relative to fset f, err := parser.ParseFile(fset, filePath, nil, 0) if err != nil { return nil, fmt.Errorf("failed parse file to list functions: %v", err) } // Inspect the AST and print all identifiers and literals. ast.Inspect(f, func(n ast.Node) bool { var s string switch x := n.(type) { case *ast.FuncDecl: s = x.Name.Name // It's a function (not method), and is public, record it. if x.Recv == nil && isPublic(s) { functionNames = append(functionNames, s) } } return true }) return functionNames, nil } // isPublic checks if a given string is a public function name. func isPublic(myString string) bool { a := []rune(myString) a[0] = unicode.ToUpper(a[0]) return myString == string(a) } // GetSourceCodeFiles lists golang source code files from directory, excluding sub-directory and tests files. func GetSourceCodeFiles(dir string) ([]string, error) { files, err := ioutil.ReadDir(dir) if err != nil { return nil, err } var filenames []string for _, file := range files { if strings.HasSuffix(file.Name(), ".go") && !strings.HasSuffix(file.Name(), "_test.go") { filenames = append(filenames, file.Name()) } } return filenames, nil } </ins>


podSpec.EphemeralContainers = nil } <del> if (!utilfeature.DefaultFeatureGate.Enabled(features.VolumeSubpath) || !utilfeature.DefaultFeatureGate.Enabled(features.VolumeSubpathEnvExpansion)) && !subpathExprInUse(oldPodSpec) { // drop subpath env expansion from the pod if either of the subpath features is disabled and the old spec did not specify subpath env expansion </del> <ins> if !utilfeature.DefaultFeatureGate.Enabled(features.VolumeSubpath) && !subpathExprInUse(oldPodSpec) { // drop subpath env expansion from the pod if subpath feature is disabled and the old spec did not specify subpath env expansion </ins> VisitContainers(podSpec, AllContainers, func(c *api.Container, containerType ContainerType) bool { for i := range c.VolumeMounts { c.VolumeMounts[i].SubPathExpr = ""


}, { "ImportPath": "github.com/json-iterator/go", <del> "Rev": "f2b4162afba35581b6d4a50d3b8f34e33c144682" </del> <ins> "Rev": "ab8a2e0c74be9d3be70b3184d9acc634935ded82" </ins> }, { "ImportPath": "github.com/mailru/easyjson/buffer",


} } <ins> // estimateMaxStringLengthPerRequest estimates the maximum string length (in characters) // that has a set of enum values. // The result of the estimation is the length of the longest possible value. func estimateMaxStringEnumLength(s Schema) int64 { var maxLength int64 for _, v := range s.Enum() { if s, ok := v.(string); ok && int64(len(s)) > maxLength { maxLength = int64(len(s)) } } return maxLength } </ins> // estimateMaxArrayItemsPerRequest estimates the maximum number of array items with // the provided minimum serialized size that can fit into a single request. func estimateMaxArrayItemsFromMinSize(minSize int64) int64 {


All               bool Record            bool ChangeCause       string <del> Local             bool </del> Cmd               *cobra.Command Limits               string


w.Flush() if trackingWriter.Written == 0 && !o.IgnoreNotFound && len(allErrs) == 0 { // if we wrote no output, and had no errors, and are not ignoring NotFound, be sure we output something <del> noResourcesFoundFormat := fmt.Sprintf("No resources found in %s namespace.", o.Namespace) fmt.Fprintln(o.ErrOut, noResourcesFoundFormat) </del> <ins> if !o.AllNamespaces { fmt.Fprintln(o.ErrOut, fmt.Sprintf("No resources found in %s namespace.", o.Namespace)) } else { fmt.Fprintln(o.ErrOut, fmt.Sprintf("No resources found")) } </ins> } return utilerrors.NewAggregate(allErrs) }


podCopy := pod.DeepCopy() // NominatedNodeName is updated only if we are trying to set it, and the value is // different from the existing one. <del> if !podutil.UpdatePodCondition(&podCopy.Status, condition) && pod.Status.NominatedNodeName == nominatedNode { </del> <ins> if !podutil.UpdatePodCondition(&podCopy.Status, condition) && (len(nominatedNode) == 0 || pod.Status.NominatedNodeName == nominatedNode) { </ins> return nil } <del> podCopy.Status.NominatedNodeName = nominatedNode </del> <ins> if nominatedNode != "" { podCopy.Status.NominatedNodeName = nominatedNode } </ins> return patchPod(client, pod, podCopy) }


PLEASE NOTE: This document applies to the HEAD of the source tree
 If you are using a released version of Kubernetes, you should refer to the docs that go with that version.  The latest 1.0.x release of this document can be found [here](http://releases.k8s.io/release-1.0/docs/user-guide/kubectl-overview.md). Documentation for other releases can be found at [releases.k8s.io](http://releases.k8s.io).  --   # kubectl overview **Table of Contents** - [kubectl overview](#kubectl-overview) - [Overview](#overview) - [Common Operations](#common-operations) - [Kubectl Operations](#kubectl-operations) - [Resource Types](#resource-types) This overview is intended for anyone who wants to use `kubectl` command line tool to interact with Kubernetes cluster. Please remember that it is built for quick started with `kubectl`; for complete and detailed information, please refer to [kubectl](kubectl/kubectl.md). TODO: auto-generate this file to stay up with `kubectl` changes. Please see [#14177](https://github.com/kubernetes/kubernetes/pull/14177). ## Overview `kubectl` controls the Kubernetes cluster manager. The synopsis is: ``` kubectl [command] [TYPE] [NAME] [flags] ``` This specifies: - `command` is a certain operation performed on a given resource(s), such as `create`, `get`, `describe`, `delete` etc. - `TYPE` is the type of resource(s). Both singular and plural forms are accepted. For example, `node(s)`, `namespace(s)`, `pod(s)`, `replicationcontroller(s)`, `service(s)` etc. - `NAME` is the name of resource(s). `TYPE NAME` can be specified as `TYPE name1 name2` or `TYPE/name1 TYPE/name2`. `TYPE NAME` can also be specified by one or more file arguments: `-f file1 -f file2 ...`, [use YAML rather than JSON](config-best-practices.md) since YAML tends to be more user-friendly for config. - `flags` are used to provide more control information when running a command. For example, you can use `-s` or `--server` to specify the address and port of the Kubernetes API server. Command line flags override their corresponding default values and environment variables. [Use short flags sparingly, only for the most frequently used options](../devel/kubectl-conventions.md). Please use `kubectl help [command]` for detailed information about a command. Please refer to [kubectl](kubectl/kubectl.md) for a complete list of available commands and flags. ## Common Operations For explanation, here I gave some mostly often used `kubectl` command examples. Please replace sample names with actual values if you would like to try these commands. 1. `kubectl create` - Create a resource by filename or stdin // Create a service using the data in example-service.yaml. $ kubectl create -f example-service.yaml // Create a replication controller using the data in example-controller.yaml. $ kubectl create -f example-controller.yaml // Create objects whose definitions are in a directory. This looks for config objects in all .yaml, .yml, and .json files in <directory> and passes them to create. $ kubectl create -f <directory> 2. `kubectl get` - Display one or many resources // List all pods in ps output format. $ kubectl get pods // List all pods in ps output format with more information (such as node name). $ kubectl get pods -o wide // List a single replication controller with specified name in ps output format. You can use the alias 'rc' instead of 'replicationcontroller'. $ kubectl get replicationcontroller <rc-name> // List all replication controllers and services together in ps output format. $ kubectl get rc,services 3. `kubectl describe` - Show details of a specific resource or group of resources // Describe a node $ kubectl describe nodes <node-name> // Describe a pod $ kubectl describe pods/<pod-name> // Describe all pods managed by the replication controller <rc-name> // (rc-created pods get the name of the rc as a prefix in the pod the name). $ kubectl describe pods <rc-name> 4. `kubectl delete` - Delete resources by filenames, stdin, resources and names, or by resources and label selector // Delete a pod using the type and name specified in pod.yaml. $ kubectl delete -f pod.yaml // Delete pods and services with label name=. $ kubectl delete pods,services -l name= // Delete all pods $ kubectl delete pods --all 5. `kubectl exec` - Execute a command in a container // Get output from running 'date' from pod <pod-name>, using the first container by default. $ kubectl exec <pod-name> date // Get output from running 'date' in <container-name> from pod <pod-name>. $ kubectl exec <pod-name> -c <container-name> date // Get an interactive tty and run /bin/bash from pod <pod-name>, using the first container by default. $ kubectl exec -ti <pod-name> /bin/bash 6. `kubectl logs` - Print the logs for a container in a pod. // Returns snapshot of logs from pod <pod-name>. $ kubectl logs <pod-name> // Starts streaming of logs from pod <pod-name>, it is something like 'tail -f'. $ kubectl logs -f <pod-name> ## Kubectl Operations The following table describes all `kubectl` operations and their general synopsis: Operation       | Synopsis	|       Description -------------------- | -------------------- | -------------------- annotate	| `kubectl annotate [--overwrite] (-f FILENAME | TYPE NAME) KEY_1=VAL_1 ... KEY_N=VAL_N [--resource-version=version]` | Update the annotations on a resource api-versions	| `kubectl api-versions` | Print available API versions attach		| `kubectl attach POD -c CONTAINER` | Attach to a running container cluster-info	| `kubectl cluster-info` | Display cluster info config		| `kubectl config SUBCOMMAND` | Modifies kubeconfig files create		| `kubectl create -f FILENAME` | Create a resource by filename or stdin delete		| `kubectl delete ([-f FILENAME] | TYPE [(NAME | -l label | --all)])` | Delete resources by filenames, stdin, resources and names, or by resources and label selector describe	| `kubectl describe (-f FILENAME | TYPE [NAME_PREFIX | -l label] | TYPE/NAME)` | Show details of a specific resource or group of resources edit		| `kubectl edit (RESOURCE/NAME | -f FILENAME)` | Edit a resource on the server exec		| `kubectl exec POD [-c CONTAINER] -- COMMAND [args...]` | Execute a command in a container expose		| `kubectl expose (-f FILENAME | TYPE NAME) [--port=port] [--protocol=TCP|UDP] [--target-port=number-or-name] [--name=name] [----external-ip=external-ip-of-service] [--type=type]` | Take a replication controller, service or pod and expose it as a new Kubernetes Service get		| `kubectl get [(-o|--output=)json|yaml|wide|go-template=...|go-template-file=...|jsonpath=...|jsonpath-file=...] (TYPE [NAME | -l label] | TYPE/NAME ...) [flags]` | Display one or many resources label		| `kubectl label [--overwrite] (-f FILENAME | TYPE NAME) KEY_1=VAL_1 ... KEY_N=VAL_N [--resource-version=version]` | Update the labels on a resource logs		| `kubectl logs [-f] [-p] POD [-c CONTAINER]` | Print the logs for a container in a pod namespace	| `kubectl namespace [namespace]` | SUPERSEDED: Set and view the current Kubernetes namespace patch		| `kubectl patch (-f FILENAME | TYPE NAME) -p PATCH` | Update field(s) of a resource by stdin port-forward	| `kubectl port-forward POD [LOCAL_PORT:]REMOTE_PORT [...[LOCAL_PORT_N:]REMOTE_PORT_N]` | Forward one or more local ports to a pod proxy		| `kubectl proxy [--port=PORT] [--www=static-dir] [--www-prefix=prefix] [--api-prefix=prefix]` | Run a proxy to the Kubernetes API server replace		| `kubectl replace -f FILENAME` | Replace a resource by filename or stdin rolling-update	| `kubectl rolling-update OLD_CONTROLLER_NAME ([NEW_CONTROLLER_NAME] --image=NEW_CONTAINER_IMAGE | -f NEW_CONTROLLER_SPEC)` | Perform a rolling update of the given ReplicationController run		| `kubectl run NAME --image=image [--env="key=value"] [--port=port] [--replicas=replicas] [--dry-run=bool] [--overrides=inline-json]` | Run a particular image on the cluster scale		| `kubectl scale [--resource-version=version] [--current-replicas=count] --replicas=COUNT (-f FILENAME | TYPE NAME)` | Set a new size for a Replication Controller stop		| `kubectl stop (-f FILENAME | TYPE (NAME | -l label | --all))` | Deprecated: Gracefully shut down a resource by name or filename version		| `kubectl version` | Print the client and server version information ## Resource Types The `kubectl` supports the following resource types, and their abbreviated aliases: Resource Type	| Abbreviated Alias -------------------- | -------------------- componentstatuses	|	cs events	|	ev endpoints	|	ep horizontalpodautoscalers	|	hpa limitranges	|	limits nodes	|	no namespaces	|	ns pods	|	po persistentvolumes	|	pv persistentvolumeclaims	|	pvc resourcequotas	|	quota replicationcontrollers	|	rc daemonsets	|	ds services	|	svc  [![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/docs/user-guide/kubectl-overview.md?pixel)]()


memoryUsage, err := strconv.ParseFloat(lines[0], 64) framework.ExpectNoError(err) <ins> var rssToken, inactiveFileToken string if isCgroupV2 { // Use Anon memory for RSS as cAdvisor on cgroupv2 // see https://github.com/google/cadvisor/blob/a9858972e75642c2b1914c8d5428e33e6392c08a/container/libcontainer/handler.go#L799 rssToken = "anon" inactiveFileToken = "inactive_file" } else { rssToken = "total_rss" inactiveFileToken = "total_inactive_file" } </ins> var totalInactiveFile float64 for _, line := range lines[1:] { tokens := strings.Split(line, " ") <del> if tokens[0] == "total_rss" { </del> <ins> if tokens[0] == rssToken { </ins> rss, err = strconv.ParseFloat(tokens[1], 64) framework.ExpectNoError(err) } <del> if tokens[0] == "total_inactive_file" { </del> <ins> if tokens[0] == inactiveFileToken { </ins> totalInactiveFile, err = strconv.ParseFloat(tokens[1], 64) framework.ExpectNoError(err) }


// How long to wait for a log pod to be displayed const podLogTimeout = 45 * time.Second <del> // utility function for gomega Eventually func getPodLogs(c *client.Client, namespace, podName, containerName string) (string, error) { logs, err := c.Get().Resource("pods").Namespace(namespace).Name(podName).SubResource("log").Param("container", containerName).Do().Raw() if err != nil { return "", err } if err == nil && strings.Contains(string(logs), "Internal Error") { return "", fmt.Errorf("Internal Error") } return string(logs), err } </del> var _ = Describe("Downward API volume", func() { f := NewFramework("downward-api") It("should provide podname only [Conformance]", func() {


], library = ":go_default_library", deps = [ <ins> "//federation/apis/federation:go_default_library", </ins> "//federation/apis/federation/v1beta1:go_default_library", "//federation/client/clientset_generated/federation_clientset/fake:go_default_library", "//pkg/api:go_default_library",


glog.Infof("Running tests for APIVersion: %s", apiVersion) <del> manifestURL := ServeCachedManifestFile() apiServerURL, configFilePath := startComponents(manifestURL, apiVersion) </del> <ins> firstManifestURL := ServeCachedManifestFile(testPodSpecFile) secondManifestURL := ServeCachedManifestFile(testManifestFile) apiServerURL, configFilePath := startComponents(firstManifestURL, secondManifestURL, apiVersion) </ins> // Ok. we're good to go. glog.Infof("API Server started on %s", apiServerURL)


// buildELBSecurityGroupList returns list of SecurityGroups which should be // attached to ELB created by a service. List always consist of at least <del> // 1 member which is an SG created for this service. Extra groups can be </del> <ins> // 1 member which is an SG created for this service or a SG from the Global config. Extra groups can be </ins> // specified via annotation func (c *Cloud) buildELBSecurityGroupList(serviceName types.NamespacedName, loadBalancerName, annotation string) ([]string, error) { var err error


if !apierrors.IsBadRequest(err) { t.Errorf("expected HTTP status: BadRequest, got: %#v", apierrors.ReasonForError(err)) } <del> if err.Error() != expectedError { </del> <ins> if !strings.Contains(err.Error(), expectedError) { </ins> t.Errorf("expected %#v, got %#v", expectedError, err.Error()) } }


func mountToRootfs(m *configs.Mount, c *mountConfig) error { rootfs := c.root <del> mountLabel := c.label mountFd := c.fd dest, err := securejoin.SecureJoin(rootfs, m.Destination) if err != nil { return err } </del> <ins> // procfs and sysfs are special because we need to ensure they are actually // mounted on a specific path in a container without any funny business. </ins> switch m.Device { case "proc", "sysfs": // If the destination already exists and is not a directory, we bail <del> // out This is to avoid mounting through a symlink or similar -- which </del> <ins> // out. This is to avoid mounting through a symlink or similar -- which </ins> // has been a "fun" attack scenario in the past. // TODO: This won't be necessary once we switch to libpathrs and we can //       stop all of these symlink-exchange attacks. <ins> dest := filepath.Clean(m.Destination) if !strings.HasPrefix(dest, rootfs) { // Do not use securejoin as it resolves symlinks. dest = filepath.Join(rootfs, dest) } </ins> if fi, err := os.Lstat(dest); err != nil { if !os.IsNotExist(err) { return err } <del> } else if fi.Mode()&os.ModeDir == 0 { </del> <ins> } else if !fi.IsDir() { </ins> return fmt.Errorf("filesystem %q must be mounted on ordinary directory", m.Device) } if err := os.MkdirAll(dest, 0o755); err != nil { return err } <del> // Selinux kernels do not support labeling of /proc or /sys </del> <ins> // Selinux kernels do not support labeling of /proc or /sys. </ins> return mountPropagate(m, rootfs, "", nil) <ins> } mountLabel := c.label mountFd := c.fd dest, err := securejoin.SecureJoin(rootfs, m.Destination) if err != nil { return err } switch m.Device { </ins> case "mqueue": if err := os.MkdirAll(dest, 0o755); err != nil { return err


} } <ins> type buffer struct { b  bytes.Buffer rw sync.RWMutex } func (b *buffer) String() string { b.rw.RLock() defer b.rw.RUnlock() return b.b.String() } func (b *buffer) Write(p []byte) (n int, err error) { b.rw.Lock() defer b.rw.Unlock() return b.b.Write(p) } </ins> func TestSecretUpdated(t *testing.T) { datacenter := "0.0.0.0" secretName := "vccreds"


// stopKubelet will kill the running kubelet, and returns a func that will restart the process again func stopKubelet() func() { kubeletServiceName := findRunningKubletServiceName() <del> stdout, err := exec.Command("sudo", "systemctl", "kill", kubeletServiceName).CombinedOutput() </del> <ins> // reset the kubelet service start-limit-hit stdout, err := exec.Command("sudo", "systemctl", "reset-failed", kubeletServiceName).CombinedOutput() framework.ExpectNoError(err, "Failed to reset kubelet start-limit-hit with systemctl: %v, %v", err, stdout) stdout, err = exec.Command("sudo", "systemctl", "kill", kubeletServiceName).CombinedOutput() </ins> framework.ExpectNoError(err, "Failed to stop kubelet with systemctl: %v, %v", err, stdout) return func() { stdout, err := exec.Command("sudo", "systemctl", "start", kubeletServiceName).CombinedOutput() framework.ExpectNoError(err, "Failed to restart kubelet with systemctl: %v, %v", err, stdout) } } <ins> func kubeletHealthCheck(url string) bool { insecureTransport := http.DefaultTransport.(*http.Transport).Clone() insecureTransport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} insecureHTTPClient := &http.Client{ Transport: insecureTransport, } req, err := http.NewRequest("HEAD", url, nil) if err != nil { return false } req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", framework.TestContext.BearerToken)) resp, err := insecureHTTPClient.Do(req) if err != nil { klog.Warningf("Health check on %q failed, error=%v", url, err) } else if resp.StatusCode != http.StatusOK { klog.Warningf("Health check on %q failed, status=%d", url, resp.StatusCode) } return err == nil && resp.StatusCode == http.StatusOK } </ins> func toCgroupFsName(cgroupName cm.CgroupName) string { if framework.TestContext.KubeletConfig.CgroupDriver == "systemd" { return cgroupName.ToSystemd()


handler = genericfilters.WithCORS(handler, c.CorsAllowedOriginList, nil, nil, nil, "true") <ins> // WithWarningRecorder must be wrapped by the timeout handler // to make the addition of warning headers threadsafe handler = genericapifilters.WithWarningRecorder(handler) </ins> // WithTimeoutForNonLongRunningRequests will call the rest of the request handling in a go-routine with the // context with deadline. The go-routine can keep running, while the timeout logic will return a timeout to the client. handler = genericfilters.WithTimeoutForNonLongRunningRequests(handler, c.LongRunningFunc)


testRootDir := makeTempDirOrDie("kubelet_integ_1.", "") configFilePath := makeTempDirOrDie("config", testRootDir) glog.Infof("Using %s as root dir for kubelet #1", testRootDir) <del> kcfg := kubeletapp.SimpleKubelet(cl, &fakeDocker1, machineList[0], testRootDir, manifestURL, "127.0.0.1", 10250, api.NamespaceDefault, empty_dir.ProbeVolumePlugins(), nil, cadvisorInterface, configFilePath) </del> <ins> kcfg := kubeletapp.SimpleKubelet(cl, &fakeDocker1, machineList[0], testRootDir, firstManifestURL, "127.0.0.1", 10250, api.NamespaceDefault, empty_dir.ProbeVolumePlugins(), nil, cadvisorInterface, configFilePath) </ins> kcfg.PodStatusUpdateFrequency = 1 * time.Second kubeletapp.RunKubelet(kcfg) // Kubelet (machine)


"regexp" "strings" "syscall" <ins> "github.com/golang/glog" </ins> ) const MOUNT_MS_BIND = syscall.MS_BIND


{ cfg: &kubeadmapi.MasterConfiguration{}, expected: api.Volume{ <del> Name: "pki", </del> <ins> Name: "k8s", </ins> VolumeSource: api.VolumeSource{ HostPath: &api.HostPathVolumeSource{ Path: kubeadmapi.GlobalEnvParams.KubernetesDir},


go_test( name = "go_default_test", srcs = [ <ins> "labels_test.go", </ins> "pod_update_test.go", "types_test.go", ],


// corresponding requests. func newCacheRoundTripper(cacheDir string, rt http.RoundTripper) http.RoundTripper { d := diskv.New(diskv.Options{ <ins> PathPerm: os.FileMode(0750), FilePerm: os.FileMode(0660), </ins> BasePath: cacheDir, TempDir:  filepath.Join(cacheDir, ".diskv-temp"), })


// Create a usage object that is based on the quota resource version that will handle updates // by default, we preserve the past usage observation, and set hard to the current spec <del> usage := v1.ResourceQuota{ ObjectMeta: metav1.ObjectMeta{ Name:            resourceQuota.Name, Namespace:       resourceQuota.Namespace, ResourceVersion: resourceQuota.ResourceVersion, Labels:          resourceQuota.Labels, Annotations:     resourceQuota.Annotations}, Status: v1.ResourceQuotaStatus{ Hard: hardLimits, Used: used, }, </del> <ins> usage := resourceQuota.DeepCopy() usage.Status = v1.ResourceQuotaStatus{ Hard: hardLimits, Used: used, </ins> } dirty = dirty || !quota.Equals(usage.Status.Used, resourceQuota.Status.Used) // there was a change observed by this controller that requires we update quota if dirty { <del> _, err = rq.rqClient.ResourceQuotas(usage.Namespace).UpdateStatus(&usage) </del> <ins> _, err = rq.rqClient.ResourceQuotas(usage.Namespace).UpdateStatus(usage) </ins> return err } return nil


attachdetachMutex.LockKey(string(nodeName)) defer attachdetachMutex.UnlockKey(string(nodeName)) <del> if err := detacher.vsphereVolumes.DetachDisk(volPath, nodeName); err != nil { </del> <ins> if err := detacher.vsphereVolumes.DetachDisk(newVolumePath, nodeName); err != nil { </ins> klog.Errorf("Error detaching volume %q: %v", volPath, err) return err }


registerMetrics.Do(func() { legacyregistry.MustRegister(etcdRequestLatency) legacyregistry.MustRegister(objectCounts) <ins> legacyregistry.MustRegister(etcdObjectCounts) </ins> legacyregistry.MustRegister(dbTotalSize) legacyregistry.MustRegister(etcdBookmarkCounts) legacyregistry.MustRegister(etcdLeaseObjectCounts) }) } <del> // UpdateObjectCount sets the etcd_object_counts metric. </del> <ins> // UpdateObjectCount sets the apiserver_storage_object_counts and etcd_object_counts (deprecated) metric. </ins> func UpdateObjectCount(resourcePrefix string, count int64) { objectCounts.WithLabelValues(resourcePrefix).Set(float64(count)) <ins> etcdObjectCounts.WithLabelValues(resourcePrefix).Set(float64(count)) </ins> } // RecordEtcdRequestLatency sets the etcd_request_duration_seconds metrics.


return len(c1map) == 0 } <ins> func shouldIgnoreNodeUpdate(oldNode, curNode v1.Node) bool { if !nodeInSameCondition(oldNode.Status.Conditions, curNode.Status.Conditions) { return false } oldNode.ResourceVersion = curNode.ResourceVersion oldNode.Status.Conditions = curNode.Status.Conditions return apiequality.Semantic.DeepEqual(oldNode, curNode) } </ins> func (dsc *DaemonSetsController) updateNode(old, cur interface{}) { oldNode := old.(*v1.Node) curNode := cur.(*v1.Node) <del> if reflect.DeepEqual(oldNode.Labels, curNode.Labels) && reflect.DeepEqual(oldNode.Spec.Taints, curNode.Spec.Taints) && nodeInSameCondition(oldNode.Status.Conditions, curNode.Status.Conditions) { // If node labels, taints and condition didn't change, we can ignore this update. </del> <ins> if shouldIgnoreNodeUpdate(*oldNode, *curNode) { </ins> return }


timeout := time.Duration(3 * time.Second) ctx, cancel := context.WithTimeout(context.Background(), timeout) defer cancel() <del> scheme := runtime.NewScheme() </del> <ins> scheme := fake.NewTestScheme() </ins> metav1.AddMetaToScheme(scheme) informerReciveObjectCh := make(chan *metav1.PartialObjectMetadata, 1) objs := []runtime.Object{}


} apiGroupList, resourcesByGV, failedGVs = SplitGroupsAndResources(aggregatedDiscovery) default: <del> return nil, nil, nil, fmt.Errorf("Unknown discovery response content-type: %s", responseContentType) </del> <ins> // Default is unaggregated discovery v1. err = json.Unmarshal(body, apiGroupList) if err != nil { return nil, nil, nil, err } </ins> } return apiGroupList, resourcesByGV, failedGVs, nil } <ins> // isV2Beta1ContentType checks of the content-type string is both // "application/json" and contains the v2beta1 content-type params. // NOTE: This function is resilient to the ordering of the // content-type parameters, as well as parameters added by // intermediaries such as proxies or gateways. Examples: // //	"application/json; g=apidiscovery.k8s.io;v=v2beta1;as=APIGroupDiscoveryList" = true //	"application/json; as=APIGroupDiscoveryList;v=v2beta1;g=apidiscovery.k8s.io" = true //	"application/json; as=APIGroupDiscoveryList;v=v2beta1;g=apidiscovery.k8s.io;charset=utf-8" = true //	"application/json" = false //	"application/json; charset=UTF-8" = false func isV2Beta1ContentType(contentType string) bool { base, params, err := mime.ParseMediaType(contentType) if err != nil { return false } return runtime.ContentTypeJSON == base && params["g"] == "apidiscovery.k8s.io" && params["v"] == "v2beta1" && params["as"] == "APIGroupDiscoveryList" } </ins> // ServerGroups returns the supported groups, with information like supported versions and the // preferred version. func (d *DiscoveryClient) ServerGroups() (*metav1.APIGroupList, error) {


return machine, exists, err } <ins> // VirtualMachineClientGetWithRetry invokes az.VirtualMachinesClient.Get with exponential backoff retry func (az *Cloud) VirtualMachineClientGetWithRetry(resourceGroup, vmName string, types compute.InstanceViewTypes) (compute.VirtualMachine, error) { var machine compute.VirtualMachine err := wait.ExponentialBackoff(az.resourceRequestBackoff, func() (bool, error) { var retryErr error machine, retryErr = az.VirtualMachinesClient.Get(resourceGroup, vmName, types) if retryErr != nil { glog.Errorf("backoff: failure, will retry,err=%v", retryErr) return false, nil } glog.V(2).Infof("backoff: success") return true, nil }) return machine, err } // GetIPForMachineWithRetry invokes az.getIPForMachine with exponential backoff retry func (az *Cloud) GetIPForMachineWithRetry(name types.NodeName) (string, error) { var ip string err := wait.ExponentialBackoff(az.resourceRequestBackoff, func() (bool, error) { var retryErr error ip, retryErr = az.getIPForMachine(name) if retryErr != nil { glog.Errorf("backoff: failure, will retry,err=%v", retryErr) return false, nil } glog.V(2).Infof("backoff: success") return true, nil }) return ip, err } </ins> // CreateOrUpdateSGWithRetry invokes az.SecurityGroupsClient.CreateOrUpdate with exponential backoff retry func (az *Cloud) CreateOrUpdateSGWithRetry(sg network.SecurityGroup) error { return wait.ExponentialBackoff(az.resourceRequestBackoff, func() (bool, error) {


<ins> # 3.1 * The pause container gains a signal handler to clean up orphaned zombie processes. ([#36853](https://prs.k8s.io/36853), [@verb](https://github.com/verb)) * `pause -v` will return build information for the pause binary. ([#56762](https://prs.k8s.io/56762), [@verb](https://github.com/verb)) # 3.0 * The pause container was rewritten entirely in C. ([#23009](https://prs.k8s.io/23009), [@uluyol](https://github.com/uluyol)) </ins>


Spec: api.ServiceSpec{ Ports: []api.ServicePort{ { <del> Name:     "default", Protocol: api.Protocol("UDP"), Port:     14, </del> <ins> Name:       "default", Protocol:   api.Protocol("UDP"), Port:       14, TargetPort: util.NewIntOrStringFromInt(14), </ins> }, }, Selector: map[string]string{"func": "stream"}, Type:     api.ServiceTypeLoadBalancer, }, }, <del> expected: "you will also need to explicitly open a firewall", status:   200, </del> <ins> status: 200, </ins> }, }


func TestSecretForDockerRegistryGenerate(t *testing.T) { username, password, email, server := "test-user", "test-password", "test-user@example.org", "https://index.docker.io/v1/" <del> secretData, err := handleDockercfgContent(username, password, email, server) </del> <ins> secretData, err := handleDockerCfgJsonContent(username, password, email, server) </ins> if err != nil { t.Errorf("unexpected error: %v", err) } <del> secretDataNoEmail, err := handleDockercfgContent(username, password, "", server) </del> <ins> secretDataNoEmail, err := handleDockerCfgJsonContent(username, password, "", server) </ins> if err != nil { t.Errorf("unexpected error: %v", err) }


} require.NoError(t, registerAPIService(ctx, client, groupVersion, service)) <del> defer func() { require.NoError(t, unregisterAPIService(ctx, client, groupVersion)) }() </del> <ins> groupVersions = append(groupVersions, groupVersion) </ins> } // Keep repeatedly fetching document from aggregator. // Check to see if it contains our service within a reasonable amount of time require.NoError(t, WaitForGroups(ctx, client, basicTestGroupWithFixup)) <ins> require.NoError(t, WaitForRootPaths(t, ctx, client, sets.New("/apis/"+basicTestGroup.Name), nil)) // Unregister and ensure the group gets dropped from root paths for _, groupVersion := range groupVersions { require.NoError(t, unregisterAPIService(ctx, client, groupVersion)) } require.NoError(t, WaitForRootPaths(t, ctx, client, nil, sets.New("/apis/"+basicTestGroup.Name))) </ins> } func runTestCases(t *testing.T, cases []testCase) {


func TestCheckVolumeFSResize(t *testing.T) { mode := v1.PersistentVolumeFilesystem <del> pv := &v1.PersistentVolume{ ObjectMeta: metav1.ObjectMeta{ Name: "dswp-test-volume-name", </del> <ins> setCapacity := func(pv *v1.PersistentVolume, pvc *v1.PersistentVolumeClaim, capacity int) { pv.Spec.Capacity = volumeCapacity(capacity) pvc.Spec.Resources.Requests = volumeCapacity(capacity) } testcases := []struct { resize       func(*testing.T, *v1.PersistentVolume, *v1.PersistentVolumeClaim, *desiredStateOfWorldPopulator) verify       func(*testing.T, []v1.UniqueVolumeName, v1.UniqueVolumeName) enableResize bool readOnlyVol  bool }{ { // No resize request for volume, volumes in ASW shouldn't be marked as fsResizeRequired resize: func(*testing.T, *v1.PersistentVolume, *v1.PersistentVolumeClaim, *desiredStateOfWorldPopulator) { }, verify: func(t *testing.T, vols []v1.UniqueVolumeName, _ v1.UniqueVolumeName) { if len(vols) > 0 { t.Errorf("No resize request for any volumes, but found resize required volumes in ASW: %v", vols) } }, enableResize: true, </ins> }, <del> Spec: v1.PersistentVolumeSpec{ PersistentVolumeSource: v1.PersistentVolumeSource{RBD: &v1.RBDPersistentVolumeSource{}}, Capacity:               volumeCapacity(1), ClaimRef:               &v1.ObjectReference{Namespace: "ns", Name: "file-bound"}, VolumeMode:             &mode, </del> <ins> { // Disable the feature gate, so volume shouldn't be marked as fsResizeRequired resize: func(_ *testing.T, pv *v1.PersistentVolume, pvc *v1.PersistentVolumeClaim, _ *desiredStateOfWorldPopulator) { setCapacity(pv, pvc, 2) }, verify: func(t *testing.T, vols []v1.UniqueVolumeName, _ v1.UniqueVolumeName) { if len(vols) > 0 { t.Errorf("Feature gate disabled, but found resize required volumes in ASW: %v", vols) } }, enableResize: false, </ins> }, <del> } pvc := &v1.PersistentVolumeClaim{ Spec: v1.PersistentVolumeClaimSpec{ VolumeName: "dswp-test-volume-name", Resources: v1.ResourceRequirements{ Requests: volumeCapacity(1), </del> <ins> { // Make volume used as ReadOnly, so volume shouldn't be marked as fsResizeRequired resize: func(_ *testing.T, pv *v1.PersistentVolume, pvc *v1.PersistentVolumeClaim, _ *desiredStateOfWorldPopulator) { setCapacity(pv, pvc, 2) </ins> }, <ins> verify: func(t *testing.T, vols []v1.UniqueVolumeName, _ v1.UniqueVolumeName) { if len(vols) > 0 { t.Errorf("volume mounted as ReadOnly, but found resize required volumes in ASW: %v", vols) } }, readOnlyVol:  true, enableResize: true, </ins> }, <del> Status: v1.PersistentVolumeClaimStatus{ Phase:    v1.ClaimBound, Capacity: volumeCapacity(1), </del> <ins> { // Clear ASW, so volume shouldn't be marked as fsResizeRequired because they are not mounted resize: func(_ *testing.T, pv *v1.PersistentVolume, pvc *v1.PersistentVolumeClaim, dswp *desiredStateOfWorldPopulator) { setCapacity(pv, pvc, 2) clearASW(dswp.actualStateOfWorld, dswp.desiredStateOfWorld, t) }, verify: func(t *testing.T, vols []v1.UniqueVolumeName, _ v1.UniqueVolumeName) { if len(vols) > 0 { t.Errorf("volume hasn't been mounted, but found resize required volumes in ASW: %v", vols) } }, enableResize: true, </ins> }, <del> } dswp, fakePodManager, fakeDSW := createDswpWithVolume(t, pv, pvc) fakeASW := dswp.actualStateOfWorld // create pod containers := []v1.Container{ </del> { <del> VolumeMounts: []v1.VolumeMount{ { Name:      "dswp-test-volume-name", MountPath: "/mnt", }, </del> <ins> // volume in ASW should be marked as fsResizeRequired resize: func(_ *testing.T, pv *v1.PersistentVolume, pvc *v1.PersistentVolumeClaim, _ *desiredStateOfWorldPopulator) { setCapacity(pv, pvc, 2) }, verify: func(t *testing.T, vols []v1.UniqueVolumeName, volName v1.UniqueVolumeName) { if len(vols) == 0 { t.Fatalf("Request resize for volume, but volume in ASW hasn't been marked as fsResizeRequired") } if len(vols) != 1 { t.Errorf("Some unexpected volumes are marked as fsResizeRequired: %v", vols) } if vols[0] != volName { t.Fatalf("Mark wrong volume as fsResizeRequired: %s", vols[0]) } </ins> }, <ins> enableResize: true, </ins> }, } <del> pod := createPodWithVolume("dswp-test-pod", "dswp-test-volume-name", "file-bound", containers) uniquePodName := types.UniquePodName(pod.UID) uniqueVolumeName := v1.UniqueVolumeName("fake-plugin/" + pod.Spec.Volumes[0].Name) fakePodManager.AddPod(pod) // Fill the dsw to contains volumes and pods. dswp.findAndAddNewPods() reconcileASW(fakeASW, fakeDSW, t) </del> <ins> for _, tc := range testcases { pv := &v1.PersistentVolume{ ObjectMeta: metav1.ObjectMeta{ Name: "dswp-test-volume-name", }, Spec: v1.PersistentVolumeSpec{ PersistentVolumeSource: v1.PersistentVolumeSource{RBD: &v1.RBDPersistentVolumeSource{}}, Capacity:               volumeCapacity(1), ClaimRef:               &v1.ObjectReference{Namespace: "ns", Name: "file-bound"}, VolumeMode:             &mode, }, } pvc := &v1.PersistentVolumeClaim{ Spec: v1.PersistentVolumeClaimSpec{ VolumeName: pv.Name, Resources: v1.ResourceRequirements{ Requests: pv.Spec.Capacity, }, }, Status: v1.PersistentVolumeClaimStatus{ Phase:    v1.ClaimBound, Capacity: pv.Spec.Capacity, }, } </ins> <del> // No resize request for volume, volumes in ASW shouldn't be marked as fsResizeRequired. defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.ExpandInUsePersistentVolumes, true)() resizeRequiredVolumes := reprocess(dswp, uniquePodName, fakeDSW, fakeASW) if len(resizeRequiredVolumes) > 0 { t.Fatalf("No resize request for any volumes, but found resize required volumes in ASW: %v", resizeRequiredVolumes) } </del> <ins> dswp, fakePodManager, fakeDSW := createDswpWithVolume(t, pv, pvc) fakeASW := dswp.actualStateOfWorld // create pod containers := []v1.Container{ { VolumeMounts: []v1.VolumeMount{ { Name:      pv.Name, MountPath: "/mnt", ReadOnly:  tc.readOnlyVol, }, }, }, } pod := createPodWithVolume("dswp-test-pod", "dswp-test-volume-name", "file-bound", containers) uniquePodName := types.UniquePodName(pod.UID) uniqueVolumeName := v1.UniqueVolumeName("fake-plugin/" + pod.Spec.Volumes[0].Name) </ins> <del> // Add a resize request to volume. pv.Spec.Capacity = volumeCapacity(2) pvc.Spec.Resources.Requests = volumeCapacity(2) </del> <ins> fakePodManager.AddPod(pod) // Fill the dsw to contains volumes and pods. dswp.findAndAddNewPods() reconcileASW(fakeASW, fakeDSW, t) </ins> <del> // Disable the feature gate, so volume shouldn't be marked as fsResizeRequired. defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.ExpandInUsePersistentVolumes, false)() resizeRequiredVolumes = reprocess(dswp, uniquePodName, fakeDSW, fakeASW) if len(resizeRequiredVolumes) > 0 { t.Fatalf("Feature gate disabled, but found resize required volumes in ASW: %v", resizeRequiredVolumes) } </del> <ins> func() { defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.ExpandInUsePersistentVolumes, tc.enableResize)() </ins> <del> // Make volume used as ReadOnly, so volume shouldn't be marked as fsResizeRequired. defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.ExpandInUsePersistentVolumes, true)() pod.Spec.Containers[0].VolumeMounts[0].ReadOnly = true resizeRequiredVolumes = reprocess(dswp, uniquePodName, fakeDSW, fakeASW) if len(resizeRequiredVolumes) > 0 { t.Fatalf("volume mounted as ReadOnly, but found resize required volumes in ASW: %v", resizeRequiredVolumes) } </del> <ins> tc.resize(t, pv, pvc, dswp) </ins> <del> // Clear ASW, so volume shouldn't be marked as fsResizeRequired because they are not mounted. pod.Spec.Containers[0].VolumeMounts[0].ReadOnly = false clearASW(fakeASW, fakeDSW, t) resizeRequiredVolumes = reprocess(dswp, uniquePodName, fakeDSW, fakeASW) if len(resizeRequiredVolumes) > 0 { t.Fatalf("volume hasn't been mounted, but found resize required volumes in ASW: %v", resizeRequiredVolumes) } </del> <ins> resizeRequiredVolumes := reprocess(dswp, uniquePodName, fakeDSW, fakeASW) </ins> <del> // volume in ASW should be marked as fsResizeRequired. reconcileASW(fakeASW, fakeDSW, t) resizeRequiredVolumes = reprocess(dswp, uniquePodName, fakeDSW, fakeASW) if len(resizeRequiredVolumes) == 0 { t.Fatalf("Request resize for volume, but volume in ASW hasn't been marked as fsResizeRequired") } if len(resizeRequiredVolumes) != 1 { t.Fatalf("Some unexpected volumes are marked as fsResizeRequired: %v", resizeRequiredVolumes) } if resizeRequiredVolumes[0] != uniqueVolumeName { t.Fatalf("Mark wrong volume as fsResizeRequired: %s", resizeRequiredVolumes[0]) </del> <ins> tc.verify(t, resizeRequiredVolumes, uniqueVolumeName) }() </ins> } }


MINION_TAG="${INSTANCE_PREFIX}-minion" MINION_NAMES=($(eval echo ${INSTANCE_PREFIX}-minion-{1..${NUM_MINIONS}})) MINION_IP_RANGES=($(eval echo "10.245.{1..${NUM_MINIONS}}.0/24")) <del> MINION_SCOPES="" </del> <ins> MINION_SCOPES="storage-ro,compute-rw" </ins> # Increase the sleep interval value if concerned about API rate limits. 3, in seconds, is the default. POLL_SLEEP_INTERVAL=3 PORTAL_NET="10.0.0.0/16"


) // ValidateLoadBalancerStatus validates required fields on a LoadBalancerStatus <del> func ValidateLoadBalancerStatus(status *core.LoadBalancerStatus, fldPath *field.Path) field.ErrorList { </del> <ins> func ValidateLoadBalancerStatus(status *core.LoadBalancerStatus, fldPath *field.Path, spec *core.ServiceSpec) field.ErrorList { </ins> allErrs := field.ErrorList{} <del> for i, ingress := range status.Ingress { idxPath := fldPath.Child("ingress").Index(i) if len(ingress.IP) > 0 { if isIP := (netutils.ParseIPSloppy(ingress.IP) != nil); !isIP { allErrs = append(allErrs, field.Invalid(idxPath.Child("ip"), ingress.IP, "must be a valid IP address")) } } if utilfeature.DefaultFeatureGate.Enabled(features.LoadBalancerIPMode) && ingress.IPMode == nil { </del> <ins> ingrPath := fldPath.Child("ingress") if !utilfeature.DefaultFeatureGate.Enabled(features.AllowServiceLBStatusOnNonLB) && spec.Type != core.ServiceTypeLoadBalancer && len(status.Ingress) != 0 { allErrs = append(allErrs, field.Forbidden(ingrPath, "may only be used when `spec.type` is 'LoadBalancer'")) } else { for i, ingress := range status.Ingress { idxPath := ingrPath.Index(i) </ins> if len(ingress.IP) > 0 { <del> allErrs = append(allErrs, field.Required(idxPath.Child("ipMode"), "must be specified when `ip` is set")) </del> <ins> if isIP := (netutils.ParseIPSloppy(ingress.IP) != nil); !isIP { allErrs = append(allErrs, field.Invalid(idxPath.Child("ip"), ingress.IP, "must be a valid IP address")) } </ins> } <del> } else if ingress.IPMode != nil && len(ingress.IP) == 0 { allErrs = append(allErrs, field.Forbidden(idxPath.Child("ipMode"), "may not be specified when `ip` is not set")) } else if ingress.IPMode != nil && !supportedLoadBalancerIPMode.Has(string(*ingress.IPMode)) { allErrs = append(allErrs, field.NotSupported(idxPath.Child("ipMode"), ingress.IPMode, supportedLoadBalancerIPMode.List())) } if len(ingress.Hostname) > 0 { for _, msg := range validation.IsDNS1123Subdomain(ingress.Hostname) { allErrs = append(allErrs, field.Invalid(idxPath.Child("hostname"), ingress.Hostname, msg)) </del> <ins> if utilfeature.DefaultFeatureGate.Enabled(features.LoadBalancerIPMode) && ingress.IPMode == nil { if len(ingress.IP) > 0 { allErrs = append(allErrs, field.Required(idxPath.Child("ipMode"), "must be specified when `ip` is set")) } } else if ingress.IPMode != nil && len(ingress.IP) == 0 { allErrs = append(allErrs, field.Forbidden(idxPath.Child("ipMode"), "may not be specified when `ip` is not set")) } else if ingress.IPMode != nil && !supportedLoadBalancerIPMode.Has(string(*ingress.IPMode)) { allErrs = append(allErrs, field.NotSupported(idxPath.Child("ipMode"), ingress.IPMode, supportedLoadBalancerIPMode.List())) </ins> } <del> if isIP := (netutils.ParseIPSloppy(ingress.Hostname) != nil); isIP { allErrs = append(allErrs, field.Invalid(idxPath.Child("hostname"), ingress.Hostname, "must be a DNS name, not an IP address")) </del> <ins> if len(ingress.Hostname) > 0 { for _, msg := range validation.IsDNS1123Subdomain(ingress.Hostname) { allErrs = append(allErrs, field.Invalid(idxPath.Child("hostname"), ingress.Hostname, msg)) } if isIP := (netutils.ParseIPSloppy(ingress.Hostname) != nil); isIP { allErrs = append(allErrs, field.Invalid(idxPath.Child("hostname"), ingress.Hostname, "must be a DNS name, not an IP address")) } </ins> } } }


} } <ins> func printStatusAndLogsForNotReadyPods(c *client.Client, oldPods, newPods []*api.Pod) { printFn := func(id, log string, err error, previous bool) { prefix := "Retrieving log for container" if previous { prefix = "Retrieving log for the last terminated container" } if err != nil { Logf("%s %s, err: %v:n%sn", prefix, id, log) } else { Logf("%s %s:n%sn", prefix, id, log) } } for _, oldPod := range oldPods { for _, p := range newPods { if p.Namespace != oldPod.Namespace || p.Name != oldPod.Name { continue } if ok, _ := podRunningReady(p); !ok { Logf("Status for not ready pod %s/%s: %+v", p.Namespace, p.Name, p.Status) // Print the log of the containers if pod is not running and ready. for _, container := range p.Status.ContainerStatuses { cIdentifer := fmt.Sprintf("%s/%s/%s", p.Namespace, p.Name, container.Name) log, err := getPodLogs(c, p.Namespace, p.Name, container.Name) printFn(cIdentifer, log, err, false) // Get log from the previous container. if container.RestartCount > 0 { printFn(cIdentifer, log, err, true) } } } break } } } </ins> // rebootNode takes node name on provider through the following steps using c: //  - ensures the node is ready //  - ensures all pods on the node are running and ready


// parameters, you'll run out of stack space before anything useful happens. Convert(src, dest interface{}, flags FieldMatchingFlags) error <ins> // DefaultConvert performs the default conversion, without calling a conversion func // on the current stack frame. This makes it safe to call from a conversion func. DefaultConvert(src, dest interface{}, flags FieldMatchingFlags) error </ins> // SrcTags and DestTags contain the struct tags that src and dest had, respectively. // If the enclosing object was not a struct, then these will contain no tags, of course. SrcTag() reflect.StructTag


return utilfile.FileExists(pathname) } <ins> // EvalHostSymlinks returns the path name after evaluating symlinks func (mounter *Mounter) EvalHostSymlinks(pathname string) (string, error) { return filepath.EvalSymlinks(pathname) } </ins> // check whether hostPath is within volume path // this func will lock all intermediate subpath directories, need to close handle outside of this func after container started func lockAndCheckSubPath(volumePath, hostPath string) ([]uintptr, error) {


endpointSlicesEnabled := utilfeature.DefaultFeatureGate.Enabled(features.EndpointSliceProxying) <ins> var incorrectAddresses []string nodePortAddresses, incorrectAddresses = utilproxy.FilterIncorrectCIDRVersion(nodePortAddresses, isIPv6) if len(incorrectAddresses) > 0 { klog.Warning("NodePortAddresses of wrong family; ", incorrectAddresses) } </ins> proxier := &Proxier{ portsMap:              make(map[utilproxy.LocalPort]utilproxy.Closeable), serviceMap:            make(proxy.ServiceMap),


fi local -r src_dir="${KUBE_HOME}/kube-manifests/kubernetes/gci-trusty" <del> if [[ -n "${KUBE_USER:-}" || ! -e /etc/srv/kubernetes/abac-authz-policy.jsonl ]]; then local -r abac_policy_json="${src_dir}/abac-authz-policy.jsonl" remove-salt-config-comments "${abac_policy_json}" if [[ -n "${KUBE_USER:-}" ]]; then sed -i -e "s/{{kube_user}}/${KUBE_USER}/g" "${abac_policy_json}" else sed -i -e "/{{kube_user}}/d" "${abac_policy_json}" fi cp "${abac_policy_json}" /etc/srv/kubernetes/ fi </del> src_file="${src_dir}/kube-apiserver.manifest" remove-salt-config-comments "${src_file}" # Evaluate variables.


SecurityOpt: fmtSecurityOpts, } <del> // There is no /etc/resolv.conf in Windows, DNS and DNSSearch options would have to be passed to Docker runtime instead if runtime.GOOS == "windows" { hc.DNS = opts.DNS hc.DNSSearch = opts.DNSSearch } </del> <ins> updateHostConfig(hc) </ins> // Set sysctls if requested if container.Name == PodInfraContainerName {


} _, err := createPodPreset(f.ClientSet, f.Namespace.Name, pip) <ins> if errors.IsNotFound(err) { framework.Skipf("podpresets requires k8s.io/api/settings/v1alpha1 to be enabled") } </ins> Expect(err).NotTo(HaveOccurred()) By("creating the pod")


t.Fatalf("AddPod failed. Expected: <no error> Actual: <%v>", podAddErr) } <del> time.Sleep(1000 * time.Millisecond) </del> // Volume is added to asw, volume should be reported as attached to the node. waitForVolumeAddedToNode(t, generatedVolumeName, nodeName1, asw) verifyVolumeAttachedToNode(t, generatedVolumeName, nodeName1, cache.AttachStateAttached, asw) <del> verifyVolumeReportedAsAttachedToNode(t, logger, generatedVolumeName, nodeName1, true, asw) </del> <ins> verifyVolumeReportedAsAttachedToNode(t, logger, generatedVolumeName, nodeName1, true, asw, volumeAttachedCheckTimeout) </ins> // Delete the pod, but detach will fail dsw.DeletePod(types.UniquePodName(podName1), generatedVolumeName, nodeName1)


exit 2 fi <del> /opt/bin/etcdctl mk /coreos.com/network/config "{"Network":"${FLANNEL_NET}", "Backend": {"Type": "vxlan"}}" </del> <ins> /opt/bin/etcdctl mk /coreos.com/network/config "{"Network":"${FLANNEL_NET}", "Backend": {"Type": "vxlan"}${FLANNEL_OTHER_NET_CONFIG}}" </ins> attempt=$((attempt+1)) sleep 3 fi


rm -rf "${LOCAL_OUTPUT_BINPATH}" mkdir -p "${LOCAL_OUTPUT_BINPATH}" <del> # Remove the container if it is left over from some previous aborted run "${DOCKER[@]}" rm -f -v "${KUBE_BUILD_CONTAINER_NAME}" >/dev/null 2>&1 || true </del> <ins> kube::build::destroy_container "${KUBE_BUILD_CONTAINER_NAME}" </ins> "${docker_cmd[@]}" bash -c "cp -r ${REMOTE_OUTPUT_BINPATH} /tmp/bin;touch /tmp/finished;rm /tmp/bin/test_for_remote;/bin/sleep 600" > /dev/null 2>&1 # Wait until binaries have finished coppying


w.initialValue = results.Unknown } <del> podName := getPodLabelName(w.pod) </del> basicMetricLabels := metrics.Labels{ "probe_type": w.probeType.String(), "container":  w.container.Name, <del> "pod":        podName, </del> <ins> "pod":        w.pod.Name, </ins> "namespace":  w.pod.Namespace, "pod_uid":    string(w.pod.UID), }


<ins> /* Copyright 2016 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ package util import ( "fmt" "reflect" "sync" "time" federation_api "k8s.io/kubernetes/federation/apis/federation/v1beta1" federation_release_1_4 "k8s.io/kubernetes/federation/client/clientset_generated/federation_release_1_4" api "k8s.io/kubernetes/pkg/api" api_v1 "k8s.io/kubernetes/pkg/api/v1" "k8s.io/kubernetes/pkg/client/cache" "k8s.io/kubernetes/pkg/client/restclient" "k8s.io/kubernetes/pkg/controller/framework" pkg_runtime "k8s.io/kubernetes/pkg/runtime" "k8s.io/kubernetes/pkg/watch" "github.com/golang/glog" ) const ( clusterSyncPeriod = 10 * time.Minute userAgentName     = "federation-service-controller" ) // FederatedReadOnlyStore is an overlay over multiple stores created in federated clusters. type FederatedReadOnlyStore interface { // Returns all items in the store. List() ([]interface{}, error) // GetByKey returns the item stored under the given key in the specified cluster (if exist). GetByKey(clusterName string, key string) (interface{}, bool, error) // Returns the items stored under the given key in all clusters. GetFromAllClusters(key string) ([]interface{}, error) // Checks whether stores for all clusters form the lists (and only these) are there and // are synced. This is only a basic check whether the data inside of the store is usable. // It is not a full synchronization/locking mechanism it only tries to ensure that out-of-sync // issues occur less often.	All users of the interface should assume // that there may be significant delays in content updates of all kinds and write their // code that it doesn't break if something is slightly out-of-sync. ClustersSynced(clusters []*federation_api.Cluster) bool } // An interface to access federation members and clients. type FederationView interface { // GetClientsetForCluster returns a clientset for the cluster, if present. GetClientsetForCluster(clusterName string) (federation_release_1_4.Interface, error) // GetReadyClusers returns all clusters for which the sub-informers are run. GetReadyClusters() ([]*federation_api.Cluster, error) // GetReadyCluster returns the cluster with the given name, if found. GetReadyCluster(name string) (*federation_api.Cluster, bool, error) // ClustersSynced returns true if the view is synced (for the first time). ClustersSynced() bool } // A structure that combines an informer running agains federated api server and listening for cluster updates // with multiple Kubernetes API informers (called target informers) running against federation members. Whenever a new // cluster is added to the federation an informer is created for it using TargetInformerFactory. Infomrers are stoped // when a cluster is either put offline of deleted. It is assumed that some controller keeps an eye on the cluster list // and thus the clusters in ETCD are up to date. type FederatedInformer interface { FederationView // Returns a store created over all stores from target informers. GetTargetStore() FederatedReadOnlyStore // Starts all the processes. Start() // Stops all the processes inside the informer. Stop() } // A function that should be used to create an informer on the target object. Store should use // framework.DeletionHandlingMetaNamespaceKeyFunc as a keying function. type TargetInformerFactory func(*federation_api.Cluster, federation_release_1_4.Interface) (cache.Store, framework.ControllerInterface) // Builds a FederatedInformer for the given federation client and factory. func NewFederatedInformer(federationClient federation_release_1_4.Interface, targetInformerFactory TargetInformerFactory) FederatedInformer { federatedInformer := &federatedInformerImpl{ targetInformerFactory: targetInformerFactory, clientFactory: func(cluster *federation_api.Cluster) (federation_release_1_4.Interface, error) { clusterConfig, err := BuildClusterConfig(cluster) if err != nil && clusterConfig != nil { clientset := federation_release_1_4.NewForConfigOrDie(restclient.AddUserAgent(clusterConfig, userAgentName)) return clientset, nil } return nil, err }, targetInformers: make(map[string]informer), } federatedInformer.clusterInformer.store, federatedInformer.clusterInformer.controller = framework.NewInformer( &cache.ListWatch{ ListFunc: func(options api.ListOptions) (pkg_runtime.Object, error) { return federationClient.Federation().Clusters().List(options) }, WatchFunc: func(options api.ListOptions) (watch.Interface, error) { return federationClient.Federation().Clusters().Watch(options) }, }, &federation_api.Cluster{}, clusterSyncPeriod, framework.ResourceEventHandlerFuncs{ DeleteFunc: func(old interface{}) { oldCluster, ok := old.(*federation_api.Cluster) if ok { federatedInformer.deleteCluster(oldCluster) } }, AddFunc: func(cur interface{}) { curCluster, ok := cur.(*federation_api.Cluster) if ok && isClusterReady(curCluster) { federatedInformer.addCluster(curCluster) } }, UpdateFunc: func(old, cur interface{}) { oldCluster, ok := old.(*federation_api.Cluster) if !ok { return } curCluster, ok := cur.(*federation_api.Cluster) if !ok { return } if isClusterReady(oldCluster) != isClusterReady(curCluster) || !reflect.DeepEqual(oldCluster.Spec, curCluster.Spec) { federatedInformer.deleteCluster(oldCluster) if isClusterReady(curCluster) { federatedInformer.addCluster(curCluster) } } }, }, ) return federatedInformer } func isClusterReady(cluster *federation_api.Cluster) bool { for _, condition := range cluster.Status.Conditions { if condition.Type == federation_api.ClusterReady { if condition.Status == api_v1.ConditionTrue { return true } } } return false } type informer struct { controller framework.ControllerInterface store      cache.Store stopChan   chan struct{} } type federatedInformerImpl struct { sync.Mutex // Informer on federated clusters. clusterInformer informer // Target informers factory targetInformerFactory TargetInformerFactory // Structures returned by targetInformerFactory targetInformers map[string]informer // A function to build clients. clientFactory func(*federation_api.Cluster) (federation_release_1_4.Interface, error) } type federatedStoreImpl struct { federatedInformer *federatedInformerImpl } func (f *federatedInformerImpl) Stop() { f.Lock() defer f.Unlock() close(f.clusterInformer.stopChan) for _, informer := range f.targetInformers { close(informer.stopChan) } } func (f *federatedInformerImpl) Start() { f.Lock() defer f.Unlock() f.clusterInformer.stopChan = make(chan struct{}) go f.clusterInformer.controller.Run(f.clusterInformer.stopChan) } // GetClientsetForCluster returns a clientset for the cluster, if present. func (f *federatedInformerImpl) GetClientsetForCluster(clusterName string) (federation_release_1_4.Interface, error) { f.Lock() defer f.Unlock() return f.getClientsetForClusterUnlocked(clusterName) } func (f *federatedInformerImpl) getClientsetForClusterUnlocked(clusterName string) (federation_release_1_4.Interface, error) { // No locking needed. Will happen in f.GetCluster. if cluster, found, err := f.getReadyClusterUnlocked(clusterName); found && err == nil { return f.clientFactory(cluster) } else { if err != nil { return nil, err } } return nil, fmt.Errorf("cluster %s not found", clusterName) } // GetReadyClusers returns all clusters for which the sub-informers are run. func (f *federatedInformerImpl) GetReadyClusters() ([]*federation_api.Cluster, error) { f.Lock() defer f.Unlock() items := f.clusterInformer.store.List() result := make([]*federation_api.Cluster, 0, len(items)) for _, item := range items { if cluster, ok := item.(*federation_api.Cluster); ok { if isClusterReady(cluster) { result = append(result, cluster) } } else { return nil, fmt.Errorf("wrong data in FederatedInformerImpl cluster store: %v", item) } } return result, nil } // GetCluster returns the cluster with the given name, if found. func (f *federatedInformerImpl) GetReadyCluster(name string) (*federation_api.Cluster, bool, error) { f.Lock() defer f.Unlock() return f.getReadyClusterUnlocked(name) } func (f *federatedInformerImpl) getReadyClusterUnlocked(name string) (*federation_api.Cluster, bool, error) { if obj, exist, err := f.clusterInformer.store.GetByKey(name); exist && err == nil { if cluster, ok := obj.(*federation_api.Cluster); ok { if isClusterReady(cluster) { return cluster, true, nil } return nil, false, nil } return nil, false, fmt.Errorf("wrong data in FederatedInformerImpl cluster store: %v", obj) } else { return nil, false, err } } // Synced returns true if the view is synced (for the first time) func (f *federatedInformerImpl) ClustersSynced() bool { f.Lock() defer f.Unlock() return f.clusterInformer.controller.HasSynced() } // Adds the given cluster to federated informer. func (f *federatedInformerImpl) addCluster(cluster *federation_api.Cluster) { f.Lock() defer f.Unlock() name := cluster.Name if client, err := f.getClientsetForClusterUnlocked(name); err == nil { store, controller := f.targetInformerFactory(cluster, client) targetInformer := informer{ controller: controller, store:      store, stopChan:   make(chan struct{}), } f.targetInformers[name] = targetInformer go targetInformer.controller.Run(targetInformer.stopChan) } else { // TODO: create also an event for cluster. glog.Errorf("Failed to create a client for cluster: %v", err) } } // Removes the cluster from federated informer. func (f *federatedInformerImpl) deleteCluster(cluster *federation_api.Cluster) { f.Lock() defer f.Unlock() name := cluster.Name if targetInformer, found := f.targetInformers[name]; found { close(targetInformer.stopChan) } delete(f.targetInformers, name) } // Returns a store created over all stores from target informers. func (f *federatedInformerImpl) GetTargetStore() FederatedReadOnlyStore { return &federatedStoreImpl{ federatedInformer: f, } } // Returns all items in the store. func (fs *federatedStoreImpl) List() ([]interface{}, error) { fs.federatedInformer.Lock() defer fs.federatedInformer.Unlock() result := make([]interface{}, 0) for _, targetInformer := range fs.federatedInformer.targetInformers { values := targetInformer.store.List() result = append(result, values...) } return result, nil } // GetByKey returns the item stored under the given key in the specified cluster (if exist). func (fs *federatedStoreImpl) GetByKey(clusterName string, key string) (interface{}, bool, error) { fs.federatedInformer.Lock() defer fs.federatedInformer.Unlock() if targetInformer, found := fs.federatedInformer.targetInformers[clusterName]; found { return targetInformer.store.GetByKey(key) } return nil, false, nil } // Returns the items stored under the given key in all clusters. func (fs *federatedStoreImpl) GetFromAllClusters(key string) ([]interface{}, error) { fs.federatedInformer.Lock() defer fs.federatedInformer.Unlock() result := make([]interface{}, 0) for _, targetInformer := range fs.federatedInformer.targetInformers { value, exist, err := targetInformer.store.GetByKey(key) if err != nil { return nil, err } if exist { result = append(result, value) } } return result, nil } // GetKey for returns the key under which the item would be put in the store. func (fs *federatedStoreImpl) GetKeyFor(item interface{}) string { // TODO: support other keying functions. key, _ := framework.DeletionHandlingMetaNamespaceKeyFunc(item) return key } // Checks whether stores for all clusters form the lists (and only these) are there and // are synced. func (fs *federatedStoreImpl) ClustersSynced(clusters []*federation_api.Cluster) bool { fs.federatedInformer.Lock() defer fs.federatedInformer.Unlock() if len(fs.federatedInformer.targetInformers) != len(clusters) { return false } for _, cluster := range clusters { if targetInformer, found := fs.federatedInformer.targetInformers[cluster.Name]; found { if !targetInformer.controller.HasSynced() { return false } } else { return false } } return true } </ins>


sched.Recorder.Eventf(victim, preemptor, v1.EventTypeNormal, "Preempted", "Preempting", "Preempted by %v/%v on node %v", preemptor.Namespace, preemptor.Name, nodeName) } <del> metrics.PreemptionVictims.Set(float64(len(victims))) </del> <ins> metrics.PreemptionVictims.Observe(float64(len(victims))) </ins> } // Clearing nominated pods should happen outside of "if node != nil". Node could // be nil when a pod with nominated node name is eligible to preempt again,


var ( // Master nodes are not added to standard load balancer by default. defaultExcludeMasterFromStandardLB = true <ins> // Outbound SNAT is enabled by default. defaultDisableOutboundSNAT = false </ins> ) // Config holds the configuration parsed from the --cloud-config flag


a.cachedCreds = newCreds // Only close all connections when TLS cert rotates. Token rotation doesn't // need the extra noise. <del> if a.onRotate != nil && oldCreds != nil && !reflect.DeepEqual(oldCreds.cert, a.cachedCreds.cert) { a.onRotate() </del> <ins> if len(a.onRotateList) > 0 && oldCreds != nil && !reflect.DeepEqual(oldCreds.cert, a.cachedCreds.cert) { for _, onRotate := range a.onRotateList { onRotate() } </ins> } return nil }


releaseHugepages() ginkgo.By("restarting kubelet to pick up pre-allocated hugepages") <del> restartKubelet() </del> <ins> // stop the kubelet and wait until the server will restart it automatically stopKubelet() </ins> waitForHugepages() })


containers: - name: fluentd-cloud-logging image: gcr.io/google_containers/fluentd-gcp:1.6 <ins> resources: limits: cpu: 100m </ins> env: - name: "FLUENTD_ARGS" value: "-qq"


// Determine if this is tagged as an Internal ELB internalELB := false internalAnnotation := apiService.Annotations[ServiceAnnotationLoadBalancerInternal] <del> if internalAnnotation != "" { </del> <ins> if internalAnnotation == "false" { internalELB = false } else if internalAnnotation != "" { </ins> internalELB = true }


for i, test := range tests { test.namespace.ObjectMeta.ResourceVersion = "1" test.oldNamespace.ObjectMeta.ResourceVersion = "1" <del> errs := ValidateNamespaceStatusUpdate(&test.oldNamespace, &test.namespace) </del> <ins> errs := ValidateNamespaceStatusUpdate(&test.namespace, &test.oldNamespace) </ins> if test.valid && len(errs) > 0 { t.Errorf("%d: Unexpected error: %v", i, errs) t.Logf("%#v vs %#v", test.oldNamespace.ObjectMeta, test.namespace.ObjectMeta)


} func TestValidateSubpathMutuallyExclusive(t *testing.T) { <del> // Enable feature VolumeSubpathEnvExpansion and VolumeSubpath defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.VolumeSubpathEnvExpansion, true)() </del> <ins> // Enable feature VolumeSubpath </ins> defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.VolumeSubpath, true)() volumes := []core.Volume{


- user: root - name: /opt/cni - makedirs: True <del> - source: https://storage.googleapis.com/kubernetes-release/network-plugins/cni-09214926.tar.gz </del> <ins> - source: https://storage.googleapis.com/kubernetes-release/network-plugins/cni-42c4cb842dad606a84e93aad5a4484ded48e3046.tar.gz </ins> - tar_options: v <del> - source_hash: md5=58f8631f912dd88be6a0920775db7274 </del> <ins> - source_hash: md5=8cee1d59f01a27e8c2c10c120dce1e7d </ins> - archive_format: tar - if_missing: /opt/cni/bin


"//staging/src/k8s.io/client-go/util/testing:go_default_library", "//staging/src/k8s.io/component-base/featuregate/testing:go_default_library", "//staging/src/k8s.io/component-base/version:go_default_library", <del> "//staging/src/k8s.io/cri-api/pkg/apis/runtime/v1alpha2:go_default_library", </del> "//vendor/github.com/google/cadvisor/info/v1:go_default_library", "//vendor/github.com/google/cadvisor/info/v2:go_default_library", "//vendor/github.com/stretchr/testify/assert:go_default_library", "//vendor/github.com/stretchr/testify/require:go_default_library", "//vendor/k8s.io/utils/mount:go_default_library", <del> ], </del> <ins> ] + select({ "@io_bazel_rules_go//go/platform:android": [ "//staging/src/k8s.io/cri-api/pkg/apis/runtime/v1alpha2:go_default_library", ], "@io_bazel_rules_go//go/platform:linux": [ "//staging/src/k8s.io/cri-api/pkg/apis/runtime/v1alpha2:go_default_library", ], "//conditions:default": [], }), </ins> ) filegroup(


} return nil, err } <ins> if !matchImageTagOrSHA(resp, image) { return nil, imageNotFoundError{ID: image} } </ins> return &resp, nil }


github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= github.com/opencontainers/image-spec v1.0.2 h1:9yCKha/T5XdGtO0q9Q9a6T5NUCsTn/DrBg0D7ufOcFM= github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0= <del> github.com/opencontainers/runc v1.1.4 h1:nRCz/8sKg6K6jgYAFLDlXzPeITBZJyX28DBVhWD+5dg= </del> github.com/opencontainers/runc v1.1.4/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg= <ins> github.com/opencontainers/runc v1.1.5 h1:L44KXEpKmfWDcS02aeGm8QNTFXTo2D+8MYGDIJ/GDEs= github.com/opencontainers/runc v1.1.5/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg= </ins> github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0= github.com/opencontainers/runtime-spec v1.0.3-0.20200929063507-e6143ca7d51d/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0= github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=


<ins> /* Copyright 2023 The Kubernetes Authors. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */ package plugin import ( "testing" "github.com/stretchr/testify/assert" v1 "k8s.io/api/core/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) func getFakeNode() (*v1.Node, error) { return &v1.Node{ObjectMeta: metav1.ObjectMeta{Name: "worker"}}, nil } func TestRegistrationHandler_ValidatePlugin(t *testing.T) { newRegistrationHandler := func() *RegistrationHandler { return NewRegistrationHandler(nil, getFakeNode) } for _, test := range []struct { description string handler     func() *RegistrationHandler pluginName  string endpoint    string versions    []string shouldError bool }{ { description: "no versions provided", handler:     newRegistrationHandler, shouldError: true, }, { description: "unsupported version", handler:     newRegistrationHandler, versions:    []string{"v2.0.0"}, shouldError: true, }, { description: "plugin already registered with a higher supported version", handler: func() *RegistrationHandler { handler := newRegistrationHandler() if err := handler.RegisterPlugin("this-plugin-already-exists-and-has-a-long-name-so-it-doesnt-collide", "", []string{"v1.1.0"}, nil); err != nil { t.Fatal(err) } return handler }, pluginName:  "this-plugin-already-exists-and-has-a-long-name-so-it-doesnt-collide", versions:    []string{"v1.0.0"}, shouldError: true, }, { description: "should validate the plugin", handler:     newRegistrationHandler, pluginName:  "this-is-a-dummy-plugin-with-a-long-name-so-it-doesnt-collide", versions:    []string{"v1.3.0"}, }, } { t.Run(test.description, func(t *testing.T) { handler := test.handler() err := handler.ValidatePlugin(test.pluginName, test.endpoint, test.versions) if test.shouldError { assert.Error(t, err) } else { assert.NoError(t, err) } }) } t.Cleanup(func() { handler := newRegistrationHandler() handler.DeRegisterPlugin("this-plugin-already-exists-and-has-a-long-name-so-it-doesnt-collide") handler.DeRegisterPlugin("this-is-a-dummy-plugin-with-a-long-name-so-it-doesnt-collide") }) } </ins>


var map_EndpointPort = map[string]string{ "":         "EndpointPort represents a Port used by an EndpointSlice", <del> "name":     "The name of this port. All ports in an EndpointSlice must have a unique name. If the EndpointSlice is dervied from a Kubernetes service, this corresponds to the Service.ports[].name. Name must either be an empty string or pass IANA_SVC_NAME validation: * must be no more than 15 characters long * may contain only [-a-z0-9] * must contain at least one letter [a-z] * it must not start or end with a hyphen, nor contain adjacent hyphens Default is empty string.", </del> <ins> "name":     "The name of this port. All ports in an EndpointSlice must have a unique name. If the EndpointSlice is dervied from a Kubernetes service, this corresponds to the Service.ports[].name. Name must either be an empty string or pass DNS_LABEL validation: * must be no more than 63 characters long. * must consist of lower case alphanumeric characters or '-'. * must start and end with an alphanumeric character. Default is empty string.", </ins> "protocol": "The IP protocol for this port. Must be UDP, TCP, or SCTP. Default is TCP.", "port":     "The port number of the endpoint. If this is not specified, ports are not restricted and must be interpreted in the context of the specific consumer.", }


"github.com/GoogleCloudPlatform/kubernetes/pkg/admission" "github.com/GoogleCloudPlatform/kubernetes/pkg/api" <ins> "github.com/GoogleCloudPlatform/kubernetes/pkg/api/errors" </ins> "github.com/GoogleCloudPlatform/kubernetes/pkg/client" "github.com/GoogleCloudPlatform/kubernetes/pkg/client/cache" )


- name: config mountPath: /etc/config nodeSelector: <del> # TODO(liggitt): switch to node.kubernetes.io/masq-agent-ds-ready in 1.16 beta.kubernetes.io/masq-agent-ds-ready: "true" </del> <ins> node.kubernetes.io/masq-agent-ds-ready: "true" </ins> volumes: - name: config configMap:


// and updating Scale for any resource which implements the `scale` subresource, // as long as that subresource operates on a version of scale convertable to // autoscaling.Scale. <del> package scale </del> <ins> package scale // import "k8s.io/client-go/scale" </ins>


Reject      = "REJECT" ToDest      = "--to-destination " Recent      = "recent " <ins> MatchSet    = "--match-set " </ins> ) type Rule map[string]string


<del> apiVersion: extensions/v1beta1 </del> <ins> apiVersion: networking.k8s.io/v1beta1 </ins> kind: Ingress metadata: name: static-ip


<del> linux/amd64=alpine:3.12 linux/arm=arm32v6/alpine:3.12 linux/arm64=arm64v8/alpine:3.12 linux/ppc64le=ppc64le/alpine:3.12 linux/s390x=s390x/alpine:3.12 </del> <ins> linux/amd64=alpine:3.16 linux/arm=arm32v6/alpine:3.16 linux/arm64=arm64v8/alpine:3.16 linux/ppc64le=ppc64le/alpine:3.16 linux/s390x=s390x/alpine:3.16 </ins> windows/amd64/1809=REGISTRY/busybox:1.29-2-windows-amd64-1809 windows/amd64/ltsc2022=REGISTRY/busybox:1.29-2-windows-amd64-ltsc2022


updateMeta(&podMeta, "Pod") setMeta := set.TypeMeta updateMeta(&setMeta, "StatefulSet") <del> policy := set.Spec.PersistentVolumeClaimRetentionPolicy </del> <ins> policy := getPersistentVolumeClaimRetentionPolicy(set) </ins> const retain = apps.RetainPersistentVolumeClaimRetentionPolicyType const delete = apps.DeletePersistentVolumeClaimRetentionPolicyType switch {


if len(obj.Type) == 0 { obj.Nullable = false // because this does not roundtrip through go-openapi } <ins> if obj.XIntOrString { obj.Type = "" } </ins> }, func(obj *apiextensions.JSONSchemaPropsOrBool, c fuzz.Continue) { if c.RandBool() {


client := http.Client{} request, err := http.NewRequest("PATCH", server.URL+"/api/version/namespaces/default/simple/"+ID, bytes.NewReader([]byte(`{"labels":{"foo":"bar"}}`))) <del> request.Header.Set("Content-Type", "application/merge-patch+json") </del> <ins> request.Header.Set("Content-Type", "application/merge-patch+json; charset=UTF-8") </ins> _, err = client.Do(request) if err != nil { t.Errorf("unexpected error: %v", err)


"tagline" : "You Know, for Search" } ``` <del> Visiting the URL `http://104.154.91.224:5601` should show the Kibana viewer for the logging information stored in the Elasticsearch service running at `http://104.154.81.135:9200`. </del> <ins> Visiting the URL `https://130.211.122.180/api/v1beta3/proxy/namespaces/default/services/kibana-logging` should show the Kibana viewer for the logging information stored in the Elasticsearch service. </ins>


} // Uses the same niceness level as cadvisor.fs does when running du // Uses -B 1 to always scale to a blocksize of 1 byte <del> out, err := exec.Command("nice", "-n", "19", "du", "-s", "-B", "1", path).CombinedOutput() </del> <ins> out, err := exec.Command("nice", "-n", "19", "du", "-x", "-s", "-B", "1", path).CombinedOutput() </ins> if err != nil { <del> return nil, fmt.Errorf("failed command 'du' ($ nice -n 19 du -s -B 1) on path %s with error %v", path, err) </del> <ins> return nil, fmt.Errorf("failed command 'du' ($ nice -n 19 du -x -s -B 1) on path %s with error %v", path, err) </ins> } used, err := resource.ParseQuantity(strings.Fields(string(out))[0]) if err != nil {


} } if test.disableAttach { <del> gomega.Expect(err).To(gomega.HaveOccurred(), "Unexpected VolumeAttachment found") </del> <ins> framework.ExpectError(err, "Unexpected VolumeAttachment found") </ins> } })


action MUST be validated. release: v1.21 file: test/e2e/network/service.go <ins> - testname: Service, deletes a collection of services codename: '[sig-network] Services should delete a collection of services [Conformance]' description: Create three services with the required labels and ports. It MUST locate three services in the test namespace. It MUST succeed at deleting a collection of services via a label selector. It MUST locate only one service after deleting the service collection. release: v1.23 file: test/e2e/network/service.go </ins> - testname: Find Kubernetes Service in default Namespace codename: '[sig-network] Services should find a service from listing all namespaces [Conformance]'


allErrs = append(allErrs, metavalidation.ValidateLabels(endpoint.Topology, topologyPath)...) if endpoint.Hostname != nil { <del> for _, msg := range validation.IsDNS1123Label(*endpoint.Hostname) { allErrs = append(allErrs, field.Invalid(idxPath.Child("hostname"), *endpoint.Hostname, msg)) } </del> <ins> allErrs = append(allErrs, apivalidation.ValidateDNS1123Label(*endpoint.Hostname, idxPath.Child("hostname"))...) </ins> } }