| Advice on how to use conditions in Kubernetes types has varied over time and is interpreted differently by different people. | |
| I'm interested in how people who chose to use conditions, and how they define condition type names. | |
| I've previously crawled github to find definitions of conditions in types.go files. Here I present 364 code | |
| snippets from various types.go files which are go `const` blocks, which match the substring `ConditionType`. | |
| The data is in YAML format (I think). `example_url` is a github url for a file that contains this code snippet. It is | |
| _not_ necessarily the canonical location for this file. The link is to the first line of the constant definition block. | |
| The `approx_popularity` is a measure of how many times I saw this block across non-identical types.go files, so a rough |
Follow Docker's activation Instructions:
Make sure you can talk to local kubernetes using kubectl before going to next steps. You should see:
| The `--anonymous-auth=` flag is new in 1.5. It is an option on `kube-apiserver`, `federations-apiserver` and `kubelet`. | |
| When it is set to `true`, users who are not authenticated using another means are authenticated as user `system:anonymous`. | |
| This flag is true by default in 1.5.0. For certain common configurations, true is safe. However, for other configurations | |
| it is not safe, and in some cases, upgrading to 1.5.0 may result in any user on your network being able to access some or all | |
| of the API. This is mentioned in the release notes. However, in version 1.5.1 we changed the default to `false`. | |
| The purpose is to allow for certain api endpoints on the apiserver to be accessible to unauthenticated | |
| users. For example, a client might need to determine the server's version by accessing the `/version` endpoint before |
| The `--anonymous-auth=` flag is new in 1.5. It is an option on `kube-apiserver`, `federations-apiserver` and `kubelet`. | |
| When it is set to `true`, users who are not authenticated using another means are authenticated as user `system:anonymous`. | |
| This flag is true by default in 1.5.0. For certain common configurations, true is safe. However, for other configurations | |
| it is not safe, and in some cases, upgrading to 1.5.0 may result in any user on your network being able to access some or all | |
| of the API. This is mentioned in the release notes. However, in version 1.5.1 we changed the default to `false`. | |
| The purpose is to allow for certain api endpoints on the apiserver to be accessible to unauthenticated | |
| users. For example, a client might need to determine the server's version by accessing the `/version` endpoint before |
| --- FAIL: TestDiscoveryAtAPIS (0.33s) | |
| Error Trace: master_test.go:288 | |
| Error: Not equal: "extensions" (expected) | |
| != "batch" (actual) | |
| Error Trace: master_test.go:289 | |
| Error: Not equal: []unversioned.GroupVersionForDiscovery{unversioned.GroupVersionForDiscovery{GroupVersion:"extensions/v1beta1", Version:"v1beta1"}} (expected) | |
| != []unversioned.GroupVersionForDiscovery{unversioned.GroupVersionForDiscovery{GroupVersion:"batch/v1", Version:"v1"}} (actual) | |
| Diff: |
| Kubernetes SIG-Auth | |
| Kubernetes Special Interest Group for Authentication and Authorization | |
| Goals for this SIG: | |
| Discuss improvements Kubernetes Authorization and Authentication, and cluster security policy. | |
| Not in scope for this SIG: | |
| To report specific vulnerabilities in Kubernetes, please report using these instructions: http://kubernetes.io/v1.1/docs/reporting-security-issues.html | |
| General discussion of Linux security, or of containers is better directed to a non-Kubernetes mailing list. | |
| Proactive or general security discussion about Kubelet should go to [email protected]. |
| Conformance test using current-context of /Users/etune/.kube/config | |
| Conformance test run date:Wed Aug 12 23:32:12 PDT 2015 | |
| Conformance test SHA:09b33467347d1afddcdaff2a722cedb6308f30cd | |
| Conformance test version tag(s): | |
| Conformance test checking conformance with Kubernetes version 1.0 | |
| Conformance test: not doing test setup. | |
| I0812 23:32:13.520763 97990 e2e_test.go:97] The --provider flag is not set. Treating as a conformance test. Some tests may not be run. | |
| >>> testContext.KubeConfig: /Users/etune/.kube/config | |
| INFO: Waiting up to 10m0s for all pods (need at least 0) in namespace 'kube-system' to be running and ready |
| Conformance test using /Users/etune/.kube/config against master at 104.154.73.106 | |
| Conformance test run date:Wed Jul 8 14:10:22 PDT 2015 | |
| Conformance test SHA:98f57a65144926a8191c3e86b203844331909782 | |
| Conformance test version tag(s): | |
| Conformance test checking conformance with Kubernetes version 1.0 | |
| Conformance test: not doing test setup. | |
| export PATH=/Users/etune/go/src/github.com/GoogleCloudPlatform/kubernetes/_output/local/bin/darwin/amd64:/Users/etune/google-cloud-sdk/bin:/usr/local/git/current/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin:/opt/X11/bin:/usr/local/go/bin:/usr/local/go/bin:/Users/etune/go/bin:/Users/etune/bin:/Users/etune/go-tools/bin:/usr/local/Cellar/node/0.12.4/libexec/npm/bin/ | |
| /Users/etune/go/src/github.com/GoogleCloudPlatform/kubernetes/_output/local/bin/darwin/amd64/ginkgo --skip=Cadvisor|MasterCerts|Density|Cluster\slevel\slogging|Etcd\sfailure|Load\sCapacity|Monitoring|Namespaces.*seconds|Pod\sdisks|Reboot|Restart|Nodes|Scale|Services.*load\sbalancer|Services.*NodePo |
| ^[[32m• [SLOW TEST:16.033 seconds]^[[0m | |
| Networking | |
| ^[[90m/go/src/github.com/GoogleCloudPlatform/kubernetes/_output/dockerized/go/src/github.com/GoogleCloudPlatform/kubernetes/test/e2e/networking.go:254^[[0m | |
| should provide Internet connection for containers | |
| ^[[90m/go/src/github.com/GoogleCloudPlatform/kubernetes/_output/dockerized/go/src/github.com/GoogleCloudPlatform/kubernetes/test/e2e/networking.go:81^[[0m | |
| ^[[90m------------------------------^[[0m | |
| ^[[0mServices^[[0m | |
| ^[[1mshould be able to change the type and nodeport settings of a service^[[0m | |
| ^[[37m/go/src/github.com/GoogleCloudPlatform/kubernetes/_output/dockerized/go/src/github.com/GoogleCloudPlatform/kubernetes/test/e2e/service.go:492^[[0m | |
| [BeforeEach] Services |
