{"push_id":2690524431,"size":1000,"distinct_size":13560,"ref":"refs/heads/master","head":"d5803e596fc8aba17aa8c74a96aff9c73bb0f1da","before":"877ee91930ccf980c7a396f956173bc55cad27c8","commits":[{"sha":"d2495b83293676622885433cb57d8a8a7fb70de5","author":{"name":"Kubernetes Submit Queue","email":"5239ff46b5e3e621e3f6a652ec59210ae096c8ec@users.noreply.github.com"},"message":"Merge pull request #63143 from jsafrane/containerized-subpath\n\nAutomatic merge from submit-queue (batch tested with PRs 63348, 63839, 63143, 64447, 64567). If you want to cherry-pick this change to another branch, please follow the instructions <a href=\"https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md\">here</a>.\n\nContainerized subpath\n\n**What this PR does / why we need it**:\r\nContainerized kubelet needs a different implementation of `PrepareSafeSubpath` than kubelet running directly on the host.\r\n\r\nOn the host we safely open the subpath and then bind-mount `/proc/<pidof kubelet>/fd/<descriptor of opened subpath>`.\r\n\r\nWith kubelet running in a container, `/proc/xxx/fd/yy` on the host contains path that works only inside the container, i.e. `/rootfs/path/to/subpath` and thus any bind-mount on the host fails.\r\n\r\nSolution:\r\n- safely open the subpath and gets its device ID and inode number\r\n- blindly bind-mount the subpath to `/var/lib/kubelet/pods/<uid>/volume-subpaths/<name of container>/<id of mount>`. This is potentially unsafe, because user can change the subpath source to a link to a bad place (say `/run/docker.sock`) just before the bind-mount.\r\n- get device ID and inode number of the destination. Typical users can't modify this file, as it lies on /var/lib/kubelet on the host.\r\n- compare these device IDs and inode numbers.\r\n\r\n**Which issue(s) this PR fixes**\r\nFixes #61456\r\n\r\n**Special notes for your reviewer**:\r\n\r\nThe PR contains some refactoring of `doBindSubPath` to extract the common code. New `doNsEnterBindSubPath` is added for the nsenter related parts.\r\n\r\n**Release note**:\r\n\r\n```release-note\r\nNONE\r\n```","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/d2495b83293676622885433cb57d8a8a7fb70de5"},{"sha":"38d2dc7068b7a5b1aff3a9ef3ee0297ea162b170","author":{"name":"Kubernetes Submit Queue","email":"5239ff46b5e3e621e3f6a652ec59210ae096c8ec@users.noreply.github.com"},"message":"Merge pull request #64447 from jsafrane/block-provision\n\nAutomatic merge from submit-queue (batch tested with PRs 63348, 63839, 63143, 64447, 64567). If you want to cherry-pick this change to another branch, please follow the instructions <a href=\"https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md\">here</a>.\n\nAdd block volume support to internal provisioners.\n\n**What this PR does / why we need it**:\r\nInternal provisioners now create filesystem PVs when block PVs are requested. This leads to unbindable PVCs.\r\n\r\nIn this PR, volume plugins that support block volumes provision block PVs when block is requested. All the other provisioners return clear error in `kubectl describe pvc`:\r\n\r\n```\r\nEvents:\r\n  Type     Reason              Age               From                         Message\r\n  ----     ------              ----              ----                         -------\r\n  Warning  ProvisioningFailed  7s (x2 over 18s)  persistentvolume-controller  Failed to provision volume with StorageClass \"standard\": kubernetes.io/cinder does not support block volume provisioning\r\n\r\n```\r\n\r\n```release-note\r\nNONE\r\n```\r\n\r\ncc @kubernetes/vmware for vsphere changes\r\ncc @andyzhangx for Azure changes\r\n\r\n/assign @copejon @mtanino","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/38d2dc7068b7a5b1aff3a9ef3ee0297ea162b170"},{"sha":"bbf5625630d59b36147a6a8c4be2c134c47ae8b2","author":{"name":"Kubernetes Submit Queue","email":"5239ff46b5e3e621e3f6a652ec59210ae096c8ec@users.noreply.github.com"},"message":"Merge pull request #64567 from ncdc/code-generator-run-from-anywhere\n\nAutomatic merge from submit-queue (batch tested with PRs 63348, 63839, 63143, 64447, 64567). If you want to cherry-pick this change to another branch, please follow the instructions <a href=\"https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md\">here</a>.\n\ncode-gen: support running from anywhere\n\n**What this PR does / why we need it**:\r\nSupport running generate-groups.sh from any directory, so users can run\r\nit from their own projects, instead of forcing them to run it from here.\r\nThis allows the generators to find and use go source code from a\r\nproject's vendor directory, for example.\r\n\r\n**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:\r\nFixes #64566\r\n\r\n**Special notes for your reviewer**:\r\n\r\n**Release note**:\r\n\r\n```release-note\r\nNONE\r\n```","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/bbf5625630d59b36147a6a8c4be2c134c47ae8b2"},{"sha":"d5e05ca2ce587489b51f8141346ab1177720d7e1","author":{"name":"Tim Allclair","email":"2125713a184129867c2009b68c5a7fe6fb4f766a@google.com"},"message":"Validate git args are not flags prior to mounting","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/d5e05ca2ce587489b51f8141346ab1177720d7e1"},{"sha":"ce730d96b7cea1e825e42ef791451e57cd7b9d47","author":{"name":"Tim Allclair","email":"2125713a184129867c2009b68c5a7fe6fb4f766a@google.com"},"message":"GitRepo command hardening","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/ce730d96b7cea1e825e42ef791451e57cd7b9d47"},{"sha":"5da925ad4fd070e687dc5255c177d5e7d542edd7","author":{"name":"Kubernetes Submit Queue","email":"5239ff46b5e3e621e3f6a652ec59210ae096c8ec@users.noreply.github.com"},"message":"Merge pull request #64262 from jessfraz/SECURITY_CONTACTS\n\nAutomatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href=\"https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md\">here</a>.\n\nadd PST to main SECURITY_CONTACTS as formality\n\nAdd the Product Security Team as the security contacts for the main\r\nrepository and they can use the OWNERS files in each subsystem/dir to find\r\nthe correct owners.\r\n\r\ncc @liggitt @cjcullen @tallclair @philips \r\n\r\n```release-note\r\nNONE\r\n```\r\n\r\ncloses #64265\r\n\r\n\r\nSigned-off-by: Jess Frazelle <acidburn@microsoft.com>","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/5da925ad4fd070e687dc5255c177d5e7d542edd7"},{"sha":"8952b8f7c99b75a9dc1aa47eb50770d218b2a8bf","author":{"name":"Eric Chiang","email":"95151dc52632bee1d0c31c4c1c292c3fff113dd1@gmail.com"},"message":"clientauthentication: add v1beta1 API version","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/8952b8f7c99b75a9dc1aa47eb50770d218b2a8bf"},{"sha":"0a9164e73aedd898a535a64fcc992d3e50002d61","author":{"name":"Eric Chiang","email":"95151dc52632bee1d0c31c4c1c292c3fff113dd1@gmail.com"},"message":"client-go: promote exec plugin support to beta","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/0a9164e73aedd898a535a64fcc992d3e50002d61"},{"sha":"206982723909944a2e68c3ffa9382f6b332e767a","author":{"name":"Eric Chiang","email":"95151dc52632bee1d0c31c4c1c292c3fff113dd1@gmail.com"},"message":"generated:\n\n\t./hack/update-bazel.sh\n\t./hack/update-codegen.sh\n\t./hack/update-staging-godeps.sh","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/206982723909944a2e68c3ffa9382f6b332e767a"},{"sha":"d96fd39651a4182ceb016c879a17c6a237c87f53","author":{"name":"Eric Chiang","email":"95151dc52632bee1d0c31c4c1c292c3fff113dd1@gmail.com"},"message":"client-go: make exec auth and auth provider mutually exclusive","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/d96fd39651a4182ceb016c879a17c6a237c87f53"},{"sha":"ff6f4803d9b10ec0a1bfed5420eb354e8a71c59f","author":{"name":"Dr. Stefan Schimanski","email":"c7eb7e27d720073802570910730f1cd8b821f3fc@gmail.com"},"message":"apimachinery: adapt ObjectConvertor invariant\n\nWe avoid deepcopies in the codec/conversion stack by re-using data structures.\nThis means that the out object of a conversion must be deepcopied before mutation\nin order to not mutate the in object as well.\n\nThis guarantees that e.g. runtime.Encode (which uses conversion from internal -> versioned)\ndoes not mutate the input. This would be highly unexpected (and we do not mention possible\nmutation of the input for runtime.Encode).","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/ff6f4803d9b10ec0a1bfed5420eb354e8a71c59f"},{"sha":"268dc570e774a99f14c6c4f6eb4797cfcb35c698","author":{"name":"Jordan Liggitt","email":"aa6ef2bbe17379c3e8e7883829f55c5a7ad052b1@redhat.com"},"message":"Add wait.PollImmediateUntil","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/268dc570e774a99f14c6c4f6eb4797cfcb35c698"},{"sha":"695c3e32ad0ff144b36e4deed13a678120f5b6fb","author":{"name":"immutablet","email":"51ee0e42074c5353a9eabebe256672d3406bf12b@google.com"},"message":"Add metrics for envelop transformer:\n    transformation_operation_count\n    transformation_failures_count\n    envelope_transformation_cache_misses_count\n    data_key_generation_latencies_microseconds\n    data_key_generation_failures_count","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/695c3e32ad0ff144b36e4deed13a678120f5b6fb"},{"sha":"45fb31ec073c311eefbac9f5ed6f5e41bff83201","author":{"name":"Hemant Kumar","email":"591209db823882d21718bcf0d7e31179912f9cef@redhat.com"},"message":"Implement API changes needed for dynamic volume limits\n\ndefine alpha feature and make api changes","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/45fb31ec073c311eefbac9f5ed6f5e41bff83201"},{"sha":"a0a9ccfa87683a1414fd74e557d2abd920c1ee62","author":{"name":"Hemant Kumar","email":"591209db823882d21718bcf0d7e31179912f9cef@redhat.com"},"message":"Implement scheduler changes for volume limits","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/a0a9ccfa87683a1414fd74e557d2abd920c1ee62"},{"sha":"cf282203c3fff345e4acd044318122d16597adf2","author":{"name":"Hemant Kumar","email":"591209db823882d21718bcf0d7e31179912f9cef@redhat.com"},"message":"Implement volume plugin changes for volume limits","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/cf282203c3fff345e4acd044318122d16597adf2"},{"sha":"1f9404dfc0da20ee74529258e55f9a57f81218c3","author":{"name":"Hemant Kumar","email":"591209db823882d21718bcf0d7e31179912f9cef@redhat.com"},"message":"Implement kubelet side changes for writing volume limit to node\n\nAdd tests for checking node limits","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/1f9404dfc0da20ee74529258e55f9a57f81218c3"},{"sha":"10465ee4a7bac9430797ba35488b7a30bc075517","author":{"name":"Minhan Xia","email":"485f5f62f33078a6c00e985a765b4a384e8e2c35@google.com"},"message":"add ReadinessGates in pod spec","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/10465ee4a7bac9430797ba35488b7a30bc075517"},{"sha":"bfa9c1091e1ef0a0e7b2028cb1555423d5f709a8","author":{"name":"Minhan Xia","email":"485f5f62f33078a6c00e985a765b4a384e8e2c35@google.com"},"message":"make update","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/bfa9c1091e1ef0a0e7b2028cb1555423d5f709a8"},{"sha":"792f03b1d248eab2b7b5f90c13b4554f7b2ed7a8","author":{"name":"Minhan Xia","email":"485f5f62f33078a6c00e985a765b4a384e8e2c35@google.com"},"message":"validation and feature gate","distinct":true,"url":"https://api.github.com/repos/yanirq/kubernetes/commits/792f03b1d248eab2b7b5f90c13b4554f7b2ed7a8"}]}
{"actor":{"display_login":"yanirq"}}