mirror of
https://github.com/kubernetes/kubernetes.git
synced 2026-05-19 08:32:56 -04:00
99e9db5815
Automatic merge from submit-queue (batch tested with PRs 63881, 64046, 63409, 63402, 63221). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Disable the public cadvisor port by default **What this PR does / why we need it**: Quoting @tallclair in #56523: > We should add the deprecation warning in 1.10 along with a release note, but not change the default. The notes should warn that the default will change in 1.11. We disable the flag by default in 1.11, and remove it entirely in 1.12 or 1.13. > If you currently depend on the UI or the API, speak up! Going forward, the recommended way of taking advantage of those features will be to run cAdvisor as a DaemonSet. Disabling the publicly-available cAdvisor port is beneficial for security, as you might not want to expose the UI with lots of information about what your system is doing. We already did this for all kubeadm deployments in v1.7, and haven't recieved any issues for that. This should be okay to do at this stage, as this flag was deprecated in v1.10. Given we need to support this flag for one more release (v1.11), it makes perfect sense to instead switch it off in preparation for v1.12 when we can delete it (see the [deprecation policy](https://kubernetes.io/docs/reference/deprecation-policy/#deprecating-a-flag-or-cli)) **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Part of #56523 **Special notes for your reviewer**: I removed the e2e test that expects cAdvisor to be running, as we don't expect it to be anymore. **Release note**: ```release-note [action required] The formerly publicly-available cAdvisor web UI that the kubelet ran on port 4194 by default is now turned off by default. The flag configuring what port to run this UI on `--cadvisor-port` was deprecated in v1.10. Now the default is `--cadvisor-port=0`, in other words, to not run the web server. The recommended way to run cAdvisor if you still need it, is via a DaemonSet. The `--cadvisor-port` will be removed in v1.12 ``` cc @kubernetes/sig-cluster-lifecycle-pr-reviews @kubernetes/sig-auth-pr-reviews @kubernetes/sig-node-pr-reviews |
||
|---|---|---|
| .. | ||
| scale | ||
| BUILD | ||
| dns.go | ||
| dns_common.go | ||
| dns_configmap.go | ||
| doc.go | ||
| example_cluster_dns.go | ||
| firewall.go | ||
| framework.go | ||
| ingress.go | ||
| ingress_scale.go | ||
| kube_proxy.go | ||
| network_policy.go | ||
| network_tiers.go | ||
| networking.go | ||
| networking_perf.go | ||
| no_snat.go | ||
| OWNERS | ||
| proxy.go | ||
| service.go | ||
| service_latency.go | ||
| serviceloadbalancers.go | ||
| util_iperf.go | ||