federation: Adding namespaces API #26298

nikhiljindal · 2016-05-25T20:22:23Z

Adding namespaces API to federation-apiserver and updating the federation client to include namespaces

Original description:

This adds the namespaces API to federation-apiserver.

The first commit is #26142.

nikhiljindal · 2016-05-25T20:28:31Z

This is required if we want to support NamespaceLifecycle AdmissionControl.
Note that the default value of AdmissionControl is AlwaysAdmit and hence this is not required for the default value.

But at almost all the places, we set --admission-control=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota.

To support NamespaceLifecycle we need this change.
Similarly, to support ResourceQuota we will need to add resource quota API to federation-apiserver and similarly for others.

So I think for 1.3, we can just say that we do not support these Admission Controls. We will support them in 1.4. In that case we can just hold this PR till 1.4. Else, we can merge this PR and I can send a similar one for ResourceQuota and others.

@kubernetes/sig-cluster-federation @quinton-hoole thoughts?

nikhiljindal · 2016-05-25T20:49:59Z

Discussed this with @quinton-hoole and decided its fine to hold this till 1.4

madhusudancs · 2016-05-29T19:58:01Z

@nikhiljindal Now that #26142 is merged can we get this one merged as well for 1.3? I think we will need this to create federated services, at least if we want them namespaced.

nikhiljindal · 2016-05-31T07:57:26Z

@madhusudancs As described in #26298 (comment), this is not strictly required for creating namespaced services. This change is required only if the --admission-control flag on apiserver includes NamespaceLifecycle (default value is AlwaysAdmit).

We dont need this change if we are not supporting any other admission control than AlwaysAdmit in 1.3.

madhusudancs · 2016-05-31T13:42:44Z

@nikhiljindal Thanks for that clarification again and the patience. I didn't understand your previous comment correctly. Tried without --admission-control=NamespaceLifecycle and I am able to create services.

Automatic merge from submit-queue federation: Update the list of supported admission controls Ref kubernetes#26298 (comment) In 1.3, we are going to support only AlwaysAdmit and AlwaysDeny admission controls. Updating the documentation accordingly. @kubernetes/sig-cluster-federation

lavalamp · 2016-06-02T22:19:59Z

I don't understand how you're making services without namespaces...

On Tue, May 31, 2016 at 6:42 AM, Madhusudan.C.S notifications@github.com
wrote:

@nikhiljindal https://github.com/nikhiljindal Thanks for that
clarification again and the patience. I didn't understand your previous
comment correctly. Tried without --admission-control=NamespaceLifecycle and
I am able to create services.

—
You are receiving this because you were assigned.
Reply to this email directly, view it on GitHub
#26298 (comment),
or mute the thread
https://github.com/notifications/unsubscribe/AAngltqDlngeRP3OX4JdF2liIJyLqCfbks5qHDrggaJpZM4Im7pn
.

madhusudancs · 2016-06-03T05:02:40Z

@lavalamp We are creating the federated service shards with namespaces, i.e. the shards of the federated service that gets created in the Kubernetes clusters have a namespace. What @nikhiljindal and I are referring to here is the namespace in Ubernetes. To make it more concrete here is what is happening right now:

Host: federation-apiserver
POST /api/v1/namespaces/myns/services/mysvc

federation-apiserver accepts this, service controller watches this service (and the namespace is still associated with the service object) and does:

Host: kube-apiserver
POST /api/v1/namespaces/myns/services/mysvc

lavalamp · 2016-06-03T17:41:21Z

Yeah, I understand what you're doing. I'm saying you must have performed
some black magic on the federation-apiserver to be able to use that path
without actually having it be aware of namespace objects. This makes me
concerned about namespace handling in general in federation-apiserver; we
had a lot of bugs in that area in kube-apiserver and they are typically
critical security bugs.

On Thu, Jun 2, 2016 at 10:02 PM, Madhusudan.C.S notifications@github.com
wrote:

@lavalamp https://github.com/lavalamp We are creating the federated
service shards with namespaces, i.e. the shards of the federated service
that gets created in the Kubernetes clusters have a namespace. What
@nikhiljindal https://github.com/nikhiljindal and I are referring to
here is the namespace in Ubernetes. To make it more concrete here is what
is happening right now:

Host: federation-apiserver
POST /api/v1/namespaces/myns/services/mysvc

federation-apiserver accepts this, service controller watches this service
(and the namespace is still associated with the service object) and does:

Host: kube-apiserver
POST /api/v1/namespaces/myns/services/mysvc

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#26298 (comment),
or mute the thread
https://github.com/notifications/unsubscribe/AAnglpC-3HxJyJjV4x6WoB_FEcxq8s4Aks5qH7V6gaJpZM4Im7pn
.

derekwaynecarr · 2016-06-06T17:44:18Z

@lavalamp - if admission control is not running on that server for NamespaceLifecycle then they could have been doing anything they wanted ;-)

nikhiljindal · 2016-06-06T17:52:58Z

@derekwaynecarr Sorry I did not understand you. Who are "they"?

I discussed this with @lavalamp. We are not doing any black magic in federation-apiserver to be able to use that path. /api/v1/namespaces/myns/services/mysvc just works. /api/v1/namespaces/myns/ returns 404.

Also note that while federation-apiserver will only support AlwaysAdmit admission control, the underlying k8s clusters still have the standard admission control.

derekwaynecarr · 2016-06-08T17:22:50Z

I have not tracked federation-server closely as of late, but I thought we were planning on supporting a unified namespace? If so, would you not need the namespace lifecycle handler? I suspect I need to get up to spped more on the federation-server, been too heads down looking at other issues.

colhom · 2016-06-15T23:25:07Z

@nikhiljindal when this lands, we should modify the e2e framework:

before hook to ensure existence of a pre-defined namespace in federation apiserver
change existing federation cleanup hook to delete everything in a pre-defined namespace, instead of just nuking the entire clusters collection as it does now.

nikhiljindal · 2016-07-18T10:43:10Z

Rebased

nikhiljindal · 2016-07-18T13:56:51Z

Fixed boilerplate and moved client changes to 1.4 clientset from 1.3 clientset.

nikhiljindal · 2016-07-18T18:30:50Z

All tests pass!
This is now ready to be merged, once LGTM'd

ghost · 2016-07-18T20:43:23Z

@nikhiljindal Have you confirmed that the federation e2e tests still pass? See comment from @colhom above. I don't see any e2e test updates in this PR?

ghost · 2016-07-18T20:46:49Z

federation/cmd/federation-apiserver/app/core.go

-		"services/status": serviceStatusStorage,
+		"services":          serviceStore,
+		"services/status":   serviceStatusStorage,
+		"namespaces":        namespaceStorage,


nit: can we make namespaceStorage consistent with serviceStore here (or vice verse). i.e. either Store or Storage, not both.

ghost · 2016-07-18T20:48:32Z

Other than the above comment LGTM. The non-autogenerated portion of this PR is extremely small, as far as I can tell, and LGTM.

ghost · 2016-07-18T20:49:07Z

@nikhiljindal feel free to apply the label once you have addressed the nit and the e2e comments.

nikhiljindal · 2016-07-19T14:42:55Z

Thanks @quinton-hoole
Fixed the comment and verified that e2e tests are passing. Adding LGTM tag.

Can update the framework as per @colhom's suggestion in a separate PR.
Will be good to do that once namespace controller is in as well, which will ensure that namespaces are created and deleted in underlying clusters.

k8s-bot · 2016-07-19T16:19:31Z

GCE e2e build/test passed for commit 48658ad.

k8s-github-robot · 2016-07-19T16:22:11Z

Automatic merge from submit-queue

k8s-github-robot · 2016-07-19T16:36:35Z

@nikhiljindal PR needs rebase

Automatic merge from submit-queue federation: Adding namespaces API Adding namespaces API to federation-apiserver and updating the federation client to include namespaces -------------------------- Original description: This adds the namespaces API to federation-apiserver. The first commit is kubernetes#26142.

Automatic merge from submit-queue federation: Update the list of supported admission controls Ref kubernetes/kubernetes#26298 (comment) In 1.3, we are going to support only AlwaysAdmit and AlwaysDeny admission controls. Updating the documentation accordingly. @kubernetes/sig-cluster-federation

googlebot added the cla: yes label May 25, 2016

nikhiljindal added the release-note-none Denotes a PR that doesn't merit a release note. label May 25, 2016

k8s-github-robot assigned lavalamp May 25, 2016

k8s-github-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label May 25, 2016

nikhiljindal added area/cluster-federation sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. labels May 25, 2016

nikhiljindal assigned nikhiljindal and unassigned lavalamp May 25, 2016

nikhiljindal added this to the next-candidate milestone May 25, 2016

k8s-github-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 27, 2016

nikhiljindal mentioned this pull request May 31, 2016

federation: replacing string credentials field by secretRef #26132

Merged

This was referenced Jun 1, 2016

federation: Adding federation controller manager to federation e2es #26605

Merged

federation: Update the list of supported admission controls #26676

Merged

nikhiljindal mentioned this pull request Jun 17, 2016

servicecontroller needs to create namespaces in target clusters #27565

Closed

nikhiljindal force-pushed the createFedService branch from 6de2c4f to 521e8e8 Compare June 29, 2016 21:27

nikhiljindal added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Jun 29, 2016

nikhiljindal removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 18, 2016

nikhiljindal force-pushed the createFedService branch from e3048d6 to 9479eda Compare July 18, 2016 13:42

k8s-github-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Jul 18, 2016

nikhiljindal force-pushed the createFedService branch from 9479eda to 6f9409c Compare July 18, 2016 13:55

k8s-github-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Jul 18, 2016

nikhiljindal modified the milestones: v1.4, next-candidate Jul 18, 2016

ghost reviewed Jul 18, 2016
View reviewed changes

nikhiljindal added 3 commits July 19, 2016 07:38

Adding namespaces to federation-apiserver

a0f96fc

Updating the federation clientset to include namespaces

7b664cf

Adding namespace expansion files

48658ad

nikhiljindal force-pushed the createFedService branch from 6f9409c to 48658ad Compare July 19, 2016 14:39

nikhiljindal added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 19, 2016

k8s-github-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 19, 2016

k8s-github-robot merged commit 48658ad into kubernetes:master Jul 19, 2016

nikhiljindal mentioned this pull request Jul 19, 2016

Mergebot merged a PR that had needs-rebase label kubernetes-retired/contrib#1391

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

federation: Adding namespaces API #26298

federation: Adding namespaces API #26298

nikhiljindal commented May 25, 2016 •

edited

Loading

nikhiljindal commented May 25, 2016

nikhiljindal commented May 25, 2016

madhusudancs commented May 29, 2016

nikhiljindal commented May 31, 2016

madhusudancs commented May 31, 2016

lavalamp commented Jun 2, 2016

madhusudancs commented Jun 3, 2016

lavalamp commented Jun 3, 2016

derekwaynecarr commented Jun 6, 2016

nikhiljindal commented Jun 6, 2016

derekwaynecarr commented Jun 8, 2016

colhom commented Jun 15, 2016

nikhiljindal commented Jul 18, 2016

nikhiljindal commented Jul 18, 2016

nikhiljindal commented Jul 18, 2016

ghost commented Jul 18, 2016

ghost Jul 18, 2016

nikhiljindal Jul 19, 2016

ghost commented Jul 18, 2016

ghost commented Jul 18, 2016

nikhiljindal commented Jul 19, 2016

k8s-bot commented Jul 19, 2016

k8s-github-robot commented Jul 19, 2016

k8s-github-robot commented Jul 19, 2016

federation: Adding namespaces API #26298

federation: Adding namespaces API #26298

Conversation

nikhiljindal commented May 25, 2016 • edited Loading

nikhiljindal commented May 25, 2016

nikhiljindal commented May 25, 2016

madhusudancs commented May 29, 2016

nikhiljindal commented May 31, 2016

madhusudancs commented May 31, 2016

lavalamp commented Jun 2, 2016

madhusudancs commented Jun 3, 2016

lavalamp commented Jun 3, 2016

derekwaynecarr commented Jun 6, 2016

nikhiljindal commented Jun 6, 2016

derekwaynecarr commented Jun 8, 2016

colhom commented Jun 15, 2016

nikhiljindal commented Jul 18, 2016

nikhiljindal commented Jul 18, 2016

nikhiljindal commented Jul 18, 2016

ghost commented Jul 18, 2016

ghost Jul 18, 2016

Choose a reason for hiding this comment

nikhiljindal Jul 19, 2016

Choose a reason for hiding this comment

ghost commented Jul 18, 2016

ghost commented Jul 18, 2016

nikhiljindal commented Jul 19, 2016

k8s-bot commented Jul 19, 2016

k8s-github-robot commented Jul 19, 2016

k8s-github-robot commented Jul 19, 2016

nikhiljindal commented May 25, 2016 •

edited

Loading