Skip to content
Open
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
58 commits
Select commit Hold shift + click to select a range
dead945
UPSTREAM: 113151: Revert: Revert: Clean up CRD conversion code structure
sttts Sep 11, 2023
d157aea
README
sttts Sep 1, 2023
a0f3d68
UPSTREAM: <carry>: controlplane/apiserver: add miniaggregator
sttts Sep 27, 2023
7234f81
UPSTREAM: <carry>: clusterize controllers
sttts Sep 1, 2023
28ac217
UPSTREAM: <carry>: re-add GC worker locks
gman0 Feb 3, 2025
570c6ed
UPSTREAM: <carry>: Add kcp patchers
sttts Oct 8, 2023
c93e304
UPSTREAM: <carry>: re-generated pkg/controller/resourcequota/resource…
gman0 Jan 26, 2025
2016601
UPSTREAM: <carry>: re-generated pkg/controller/garbagecollector/garba…
gman0 Feb 11, 2025
f87a202
UPSTREAM: <carry>: storage: etcd cluster key computation
sttts Sep 27, 2023
aad4a42
UPSTREAM: <carry>: clusterize serviceaccounts
sttts Sep 1, 2023
86eb6a8
UPSTREAM: <carry>: registry/core/serviceaccount: do not crash without…
sttts Sep 27, 2023
0e41242
UPSTREAM: <carry>: kube-aggregator
sttts Sep 1, 2023
006648f
UPSTREAM: <carry>: INTERESTING: clusterize admission
sttts Sep 1, 2023
ba55bcf
UPSTREAM: <carry>: Clusterize ValidatingAdmissionPolicy admission plu…
embik Jul 24, 2024
aaa0e92
UPSTREAM: <carry>: clusterize storage hash
sttts Sep 27, 2023
f2ad525
UPSTREAM: <carry>: endpoints: add Cluster struct for ctx
sttts Sep 27, 2023
4ed5b98
UPSTREAM: <carry>: endpoints/patch: wire openapi for CRD strategic me…
sttts Sep 27, 2023
4739ef6
UPSTREAM: <carry>: storage/etcd3: clusterize
sttts Sep 27, 2023
ab335e9
UPSTREAM: <carry>: apiserver: partial wildcard metadata request accro…
sttts Sep 27, 2023
d868a62
UPSTREAM: <carry>: endpoints: set kcp.io/original-api-version on wild…
sttts Sep 27, 2023
7f28105
UPSTREAM: <carry>: watch(er/cache): clusterize
sttts Sep 27, 2023
e271562
UPSTREAM: <carry>: apiserver: split chain into pre and post authz
sttts Sep 27, 2023
4a2b5f9
UPSTREAM: <carry>: apiserver: clusterize listed paths
sttts Sep 27, 2023
b9669e3
UPSTREAM: <carry>: apiserver: clusterize OpenAPI v2
sttts Sep 27, 2023
b5939d8
UPSTREAM: <carry>: clusterize BuiltInAuthenticationOptions
sttts Sep 27, 2023
bf1a2a1
UPSTREAM: <carry>: storage: add UseResourceAsPrefixDefault for legacy…
sttts Sep 27, 2023
879e485
UPSTREAM: <carry>: apiextensions-apiserver
sttts Sep 27, 2023
0203da1
UPSTREAM: <carry>: cache-server: wire shard name into storage
sttts Sep 27, 2023
db825b7
UPSTREAM: <carry>: add client and informer hacks
sttts Sep 27, 2023
1159daa
UPSTREAM: <carry>: controlplane: wire informers and clients
sttts Sep 11, 2023
4c9c3df
UPSTREAM: <carry>: generic cleanup
mjudeikis Sep 3, 2024
ab917a9
UPSTREAM: <carry>: controlplane/apiserver: disable protobuf for loopback
sttts Sep 25, 2023
e142cc7
UPSTREAM: <carry>: pass system:admin clients and informers in generic…
embik Jun 13, 2024
a71d65e
UPSTREAM: <carry>: remove REST mapper from admission plugins
embik Jun 20, 2024
68b54d6
UPSTREAM: <carry>: provide supportedMediaTypes for custom resoure han…
embik Jun 21, 2024
50c9ea5
UPSTREAM: <carry>: prevent NPE if no authorization is set
embik Jun 21, 2024
2034abe
UPSTREAM: <carry>: wrap CRD group into packagePrefix for OpenAPIV3 bu…
embik Jul 12, 2024
8a207b8
UPSTREAM: <CARRY>: clusterize validatingadmissionpolicystatus controller
embik Jul 23, 2024
7a27a28
UPSTREAM: <carry>: apiserver cleaning
mjudeikis Sep 3, 2024
5c809ee
UPSTREAM: <squash>: remove syncer custom code from apiextensions-apis…
sttts Sep 18, 2024
fe0acf7
UPSTREAM: <carry>: include cluster name in authz SubjectAccessReview …
xrstf Nov 13, 2024
d57c237
UPSTREAM: <squash>: prevent conflict with pre-existing auth annotation
xrstf Nov 14, 2024
455d854
CARRY: split auth/authz chains even more
mjudeikis Dec 10, 2024
1a37a19
UPSTREAM: <carry>: authz: add scoping to default rule resolver
sttts Aug 23, 2024
b6ac17f
UPSTREAM: <carry>: authz: add warrants to default rule resolver
sttts Aug 23, 2024
dc03406
UPSTREAM: <squash>: authz: add warrants to default rule resolver: glo…
sttts Jan 24, 2025
b06d2a8
UPSTREAM: <squash>: authz: add warrants to default rule resolver: hel…
sttts Jan 24, 2025
1b0b146
UPSTREAM: <squash>: authz: add warrants to default rule resolver: glo…
sttts Jan 25, 2025
0ced631
UPSTREAM: <squash>: authz: add warrants to default rule resolver: for…
sttts Jan 25, 2025
bffed1d
UPSTREAM: <squash>: authz: add warrants to default rule resolver: sim…
sttts Jan 25, 2025
8fd95d6
UPSTREAM: <carry>: endpoints: wire in ctx to watchListTransformer
gman0 Jan 22, 2025
8befcaf
UPSTREAM: <carry>: Clusterize MutatingAdmissionPolicy admission plugi…
gman0 Jan 23, 2025
8fc9059
UPSTREAM: <carry>: don't use --prefers-protobuf with client-gen
gman0 Feb 10, 2025
03a3c1b
UPSTREAM: <drop>: Pinned kcp dependencies
gman0 Feb 12, 2025
204c308
UPSTREAM: <drop>: Updated vendor modules
gman0 Feb 12, 2025
c6ebc59
UPSTREAM: <drop>: Re-generated client code
gman0 Feb 12, 2025
89e1549
UPSTREAM 130180: Make disable lookups of SA related artifacts working
mjudeikis Feb 14, 2025
3b193fc
Merge pull request #163 from mjudeikis/mjudeikis/cherry.sa.lookup
mjudeikis Feb 21, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 12 additions & 21 deletions pkg/controller/garbagecollector/garbagecollector_patch.go
Original file line number Diff line number Diff line change
Expand Up @@ -32,32 +32,27 @@ import (
"k8s.io/kubernetes/pkg/controller/garbagecollector/metrics"
)

func (gc *GarbageCollector) ResyncMonitors(ctx context.Context, discoveryClient discovery.ServerResourcesInterface) {
func (gc *GarbageCollector) ResyncMonitors(ctx context.Context, discoveryClient discovery.ServerResourcesInterface) error {
oldResources := make(map[schema.GroupVersionResource]struct{})
func() {
return func() error {
logger := klog.FromContext(ctx)

// Get the current resource list from discovery.
newResources, err := GetDeletableResources(logger, discoveryClient)
if err != nil {
return err
}

if len(newResources) == 0 {
logger.V(2).Info("no resources reported by discovery, skipping garbage collector sync")
metrics.GarbageCollectorResourcesSyncError.Inc()
return
}
if groupLookupFailures, isLookupFailure := discovery.GroupDiscoveryFailedErrorGroups(err); isLookupFailure {
// In partial discovery cases, preserve existing synced informers for resources in the failed groups, so resyncMonitors will only add informers for newly seen resources
for k, v := range oldResources {
if _, failed := groupLookupFailures[k.GroupVersion()]; failed && gc.dependencyGraphBuilder.IsResourceSynced(k) {
newResources[k] = v
}
}
return nil
}

// Decide whether discovery has reported a change.
if reflect.DeepEqual(oldResources, newResources) {
logger.V(5).Info("no resource updates from discovery, skipping garbage collector sync")
return
return nil
}

// Ensure workers are paused to avoid processing events before informers
Expand All @@ -73,20 +68,14 @@ func (gc *GarbageCollector) ResyncMonitors(ctx context.Context, discoveryClient
// On a reattempt, check if available resources have changed
if attempt > 1 {
newResources, err = GetDeletableResources(logger, discoveryClient)

if err != nil {
return false, err
}
if len(newResources) == 0 {
logger.V(2).Info("no resources reported by discovery", "attempt", attempt)
metrics.GarbageCollectorResourcesSyncError.Inc()
return false, nil
}
if groupLookupFailures, isLookupFailure := discovery.GroupDiscoveryFailedErrorGroups(err); isLookupFailure {
// In partial discovery cases, preserve existing synced informers for resources in the failed groups, so resyncMonitors will only add informers for newly seen resources
for k, v := range oldResources {
if _, failed := groupLookupFailures[k.GroupVersion()]; failed && gc.dependencyGraphBuilder.IsResourceSynced(k) {
newResources[k] = v
}
}
}
}

logger.V(2).Info(
Expand Down Expand Up @@ -139,5 +128,7 @@ func (gc *GarbageCollector) ResyncMonitors(ctx context.Context, discoveryClient
// subsequent runs should stop them if their resources were removed.
oldResources = newResources
logger.V(2).Info("synced garbage collector")

return nil
}()
}
Original file line number Diff line number Diff line change
Expand Up @@ -510,7 +510,7 @@ func testHandlerConversion(t *testing.T, enableWatchCache bool) {
&noneConverterFactory{},
1,
dummyAuthorizerImpl{},
time.Minute, time.Minute, nil, 3*1024*1024)
time.Minute, time.Minute, nil, 3*1024*1024, true)
if err != nil {
t.Fatal(err)
}
Expand Down Expand Up @@ -1035,7 +1035,7 @@ func TestBuildOpenAPIModelsForApply(t *testing.T) {

for i, test := range tests {
crd.Spec.Versions[0].Schema = &test
models, err := buildOpenAPIModelsForApply(convertedDefs, &crd)
models, err := buildOpenAPIModelsForApply(convertedDefs, &crd, true)
if err != nil {
t.Fatalf("failed to convert to apply model: %v", err)
}
Expand Down
19 changes: 1 addition & 18 deletions staging/src/k8s.io/apiserver/pkg/server/options/admission.go
Original file line number Diff line number Diff line change
Expand Up @@ -19,14 +19,12 @@ package options
import (
"fmt"
"strings"
"time"

"github.com/spf13/pflag"

"k8s.io/apimachinery/pkg/runtime"
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
"k8s.io/apimachinery/pkg/util/sets"
utilwait "k8s.io/apimachinery/pkg/util/wait"
"k8s.io/apiserver/pkg/admission"
"k8s.io/apiserver/pkg/admission/initializer"
admissionmetrics "k8s.io/apiserver/pkg/admission/metrics"
Expand All @@ -39,11 +37,9 @@ import (
apiserverapiv1 "k8s.io/apiserver/pkg/apis/apiserver/v1"
apiserverapiv1alpha1 "k8s.io/apiserver/pkg/apis/apiserver/v1alpha1"
"k8s.io/apiserver/pkg/server"
cacheddiscovery "k8s.io/client-go/discovery/cached/memory"
"k8s.io/client-go/dynamic"
"k8s.io/client-go/informers"
"k8s.io/client-go/kubernetes"
"k8s.io/client-go/restmapper"
"k8s.io/component-base/featuregate"
)

Expand Down Expand Up @@ -151,24 +147,11 @@ func (a *AdmissionOptions) ApplyTo(
return fmt.Errorf("failed to read plugin config: %v", err)
}

discoveryClient := cacheddiscovery.NewMemCacheClient(kubeClient.Discovery())
discoveryRESTMapper := restmapper.NewDeferredDiscoveryRESTMapper(discoveryClient)
genericInitializer := initializer.New(kubeClient, dynamicClient, informers, c.Authorization.Authorizer, features,
c.DrainedNotify(), discoveryRESTMapper)
c.DrainedNotify(), nil)
initializersChain := admission.PluginInitializers{genericInitializer}
initializersChain = append(initializersChain, pluginInitializers...)

admissionPostStartHook := func(hookContext server.PostStartHookContext) error {
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would be good to add comment this this is removed. I think history is bit lost.

Copy link

@gman0 gman0 Feb 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are there some docs I could link to? Originally removed in 3211e1f , but without details.

discoveryRESTMapper.Reset()
go utilwait.Until(discoveryRESTMapper.Reset, 30*time.Second, hookContext.Done())
return nil
}

err = c.AddPostStartHook("start-apiserver-admission-initializer", admissionPostStartHook)
if err != nil {
return fmt.Errorf("failed to add post start hook for policy admission: %w", err)
}

admissionChain, err := a.Plugins.NewFromPlugins(pluginNames, pluginsConfigProvider, initializersChain, a.Decorators)
if err != nil {
return err
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ func TestCreateClusterAwareContext(t *testing.T) {
{
name: "scoped, built-in type",
existingObject: makePod("pod1", "root:org:abc", "default"),
expectedCluster: genericapirequest.Cluster{Name: logicalcluster.New("root:org:abc")},
expectedCluster: genericapirequest.Cluster{Name: logicalcluster.Name("root:org:abc")},
},
{
name: "cluster wide, built-in type",
Expand All @@ -46,28 +46,28 @@ func TestCreateClusterAwareContext(t *testing.T) {
p.Namespace = ""
return p
}(),
expectedCluster: genericapirequest.Cluster{Name: logicalcluster.New("root:org:abc")},
expectedCluster: genericapirequest.Cluster{Name: logicalcluster.Name("root:org:abc")},
},
{
name: "scoped, identity, built-in type",
existingObject: makePod("pod1", "root:org:abc", "default"),
expectedCluster: genericapirequest.Cluster{Name: logicalcluster.New("root:org:abc")},
expectedCluster: genericapirequest.Cluster{Name: logicalcluster.Name("root:org:abc")},
},

{
name: "scoped, unstructured type",
existingObject: makeUnstructured("root:org:abc", "default"),
expectedCluster: genericapirequest.Cluster{Name: logicalcluster.New("root:org:abc")},
expectedCluster: genericapirequest.Cluster{Name: logicalcluster.Name("root:org:abc")},
},
{
name: "cluster wide, unstructured type",
existingObject: makeUnstructured("root:org:abc", ""),
expectedCluster: genericapirequest.Cluster{Name: logicalcluster.New("root:org:abc")},
expectedCluster: genericapirequest.Cluster{Name: logicalcluster.Name("root:org:abc")},
},
{
name: "scoped, identity, unstructured type",
existingObject: makeUnstructured("root:org:abc", "default"),
expectedCluster: genericapirequest.Cluster{Name: logicalcluster.New("root:org:abc")},
expectedCluster: genericapirequest.Cluster{Name: logicalcluster.Name("root:org:abc")},
},
}

Expand Down