Kubernetes 1.10.0 (#1876)

* Kubernetes 1.10.0

* Update vendor with kubernetes-1.10.0

* Update master k8s.io dependencies

* Update vendor

* autogenerated files

* Fix server config for k8s 1.10

* Fix enabled admission plugin list

* Generated files

* Fix loopback client config

* Fix admission controller initialization (adapt code from AdmissionOptions.ApplyTo method invoked by RecommendedOptions)
Fix RBAC for admission webhooks

* Switch to Kubernetes 1.9 for Jenkins build

Author: nilebox

Gopkg.lock

@@ -51,23 +51,23 @@ required = [
 
 [[constraint]]
   name = "k8s.io/api"
-  version = "kubernetes-1.9.1"
+  version = "kubernetes-1.10.0"
 
 [[constraint]]
   name = "k8s.io/apimachinery"
-  version = "kubernetes-1.9.1"
+  version = "kubernetes-1.10.0"
 
 [[constraint]]
   name = "k8s.io/apiserver"
-  version = "kubernetes-1.9.1"
+  version = "kubernetes-1.10.0"
 
 [[constraint]]
   name = "k8s.io/client-go"
-  version = "kubernetes-1.9.1"
+  version = "kubernetes-1.10.0"
 
 [[constraint]]
   name = "k8s.io/code-generator"
-  version = "kubernetes-1.9.1"
+  version = "kubernetes-1.10.0"
 
 [[constraint]]
   name = "github.com/pmorie/go-open-service-broker-client"

Gopkg.toml

@@ -138,6 +138,7 @@ node {
       }
     } catch (Exception e) {
       echo 'Run failed.'
+      print e
       currentBuild.result = 'FAILURE'
     } finally {
       archiveArtifacts artifacts: 'walkthrough*.txt', fingerprint: true

Jenkinsfile

@@ -39,7 +39,7 @@ spec:
         - --audit-log-path
         - {{ .Values.apiserver.audit.logPath }}
         {{- end}}
-        - --admission-control
+        - --enable-admission-plugins
         - "KubernetesNamespaceLifecycle,DefaultServicePlan,ServiceBindingsLifecycle,ServicePlanChangeValidator,BrokerAuthSarCheck"
         - --secure-port
         - "8443"

charts/catalog/templates/apiserver-deployment.yaml

@@ -17,6 +17,12 @@ items:
   - apiGroups: [""]
     resources: ["namespaces"]
     verbs:     ["get", "list", "watch"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["mutatingwebhookconfigurations"]
+    verbs: ["get", "list", "watch"]
 # API-server service-account gets its own role
 - apiVersion: {{template "rbacApiVersion" . }}
   kind: ClusterRoleBinding

charts/catalog/templates/rbac.yaml

@@ -44,7 +44,7 @@ type ServiceCatalogServerOptions struct {
 	// the admission options
 	AdmissionOptions *genericserveroptions.AdmissionOptions
 	// the https configuration. certs, etc
-	SecureServingOptions *genericserveroptions.SecureServingOptions
+	SecureServingOptions *genericserveroptions.SecureServingOptionsWithLoopback
 	// authn for the API
 	AuthenticationOptions *genericserveroptions.DelegatingAuthenticationOptions
 	// authz for the API
@@ -67,7 +67,7 @@ func NewServiceCatalogServerOptions() *ServiceCatalogServerOptions {
 	opts := &ServiceCatalogServerOptions{
 		GenericServerRunOptions: genericserveroptions.NewServerRunOptions(),
 		AdmissionOptions:        genericserveroptions.NewAdmissionOptions(),
-		SecureServingOptions:    genericserveroptions.NewSecureServingOptions(),
+		SecureServingOptions:    genericserveroptions.WithLoopback(genericserveroptions.NewSecureServingOptions()),
 		AuthenticationOptions:   genericserveroptions.NewDelegatingAuthenticationOptions(),
 		AuthorizationOptions:    genericserveroptions.NewDelegatingAuthorizationOptions(),
 		AuditOptions:            genericserveroptions.NewAuditOptions(),