1. photon
  2. Commit efda3f021b3fc2116485f7eaaa7e9f78724dbb03
Browse code

Update k8s 1.10.2 to 1.10.8 with VKE patch (7988e2)

Change-Id: Icc6fccb78af796d8ffe143a484b5e6edba7cdcc8
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/5865
Reviewed-by: Alexey Makhalov <amakhalov@vmware.com>
Tested-by: gerrit-photon <photon-checkins@vmware.com>

DheerajSShetty authored on 2018/10/05 09:34:37
Showing 2 changed files
SPECS/kubernetes/k8s-1.10-vke.patch
History View file @ efda3f0
... ... 
@@ -1,7 +1,7 @@
1 
-From 65059959f5f5ff965897e123fff1a581970d6437 Mon Sep 17 00:00:00 2001
1 
+From 532a55505f69d284f54c089a5447fa4e2f98dfaf Mon Sep 17 00:00:00 2001
2 2 
 From: DheerajSShetty <dheerajs@vmware.com>
3 
-Date: Tue, 11 Sep 2018 11:43:21 -0700
4 
-Subject: [PATCH] VKE patch for k8s 1.10 (8033c471)
3 
+Date: Thu, 4 Oct 2018 17:16:50 -0700
4 
+Subject: [PATCH]  VKE patch for k8s 1.10.8 (7988e2)
5 5
6 6 
 ---
7 7 
  api/swagger-spec/apps_v1alpha1.json                |  21 +
... ... 
@@ -17,9 +17,20 @@ Subject: [PATCH] VKE patch for k8s 1.10 (8033c471)
17 17 
  cmd/kube-controller-manager/app/plugins.go         |   4 +
18 18 
  cmd/kubelet/app/BUILD                              |   1 +
19 19 
  cmd/kubelet/app/plugins.go                         |   2 +
20 
+ pkg/apis/apps/v1/zz_generated.defaults.go          |  24 +-
21 
+ pkg/apis/apps/v1beta1/zz_generated.defaults.go     |  12 +-
22 
+ pkg/apis/apps/v1beta2/zz_generated.defaults.go     |  24 +-
23 
+ pkg/apis/batch/v1/zz_generated.defaults.go         |   6 +-
24 
+ pkg/apis/batch/v1beta1/zz_generated.defaults.go    |  12 +-
25 
+ pkg/apis/batch/v2alpha1/zz_generated.defaults.go   |  12 +-
20 26 
  pkg/apis/core/types.go                             |  14 +
27 
+ pkg/apis/core/v1/zz_generated.conversion.go        |  32 +-
28 
+ pkg/apis/core/v1/zz_generated.defaults.go          |  24 +-
21 29 
  pkg/apis/core/validation/validation.go             |  29 +-
30 
+ pkg/apis/core/zz_generated.deepcopy.go             |  34 +
22 31 
  pkg/apis/extensions/types.go                       |   1 +
32 
+ .../extensions/v1beta1/zz_generated.defaults.go    |  18 +-
33 
+ .../settings/v1alpha1/zz_generated.defaults.go     |   6 +-
23 34 
  pkg/cloudprovider/providers/BUILD                  |   2 +
24 35 
  pkg/cloudprovider/providers/cascade/BUILD          |  56 ++
25 36 
  pkg/cloudprovider/providers/cascade/OWNERS         |   3 +
... ... 
@@ -27,7 +38,7 @@ Subject: [PATCH] VKE patch for k8s 1.10 (8033c471)
27 27 
  pkg/cloudprovider/providers/cascade/auth.go        | 145 ++++
28 28 
  pkg/cloudprovider/providers/cascade/cascade.go     | 215 +++++
29 29 
  .../providers/cascade/cascade_disks.go             | 228 +++++
30 
- .../providers/cascade/cascade_instances.go         |  92 ++
30 
+ .../providers/cascade/cascade_instances.go         | 125 +++
31 31 
  .../providers/cascade/cascade_instances_test.go    |  44 +
32 32 
  .../providers/cascade/cascade_loadbalancer.go      | 285 ++++++
33 33 
  pkg/cloudprovider/providers/cascade/client.go      | 399 +++++++++
... ... 
@@ -48,15 +59,16 @@ Subject: [PATCH] VKE patch for k8s 1.10 (8033c471)
48 48 
  pkg/volume/cascade_disk/cascade_util.go            | 162 ++++
49 49 
  .../admission/persistentvolume/label/admission.go  |  54 ++
50 50 
  plugin/pkg/admission/vke/BUILD                     |  61 ++
51 
- plugin/pkg/admission/vke/admission.go              | 587 +++++++++++++
52 
- plugin/pkg/admission/vke/admission_test.go         | 952 +++++++++++++++++++++
51 
+ plugin/pkg/admission/vke/admission.go              | 618 +++++++++++++
52 
+ plugin/pkg/admission/vke/admission_test.go         | 960 +++++++++++++++++++++
53 53 
  plugin/pkg/auth/authorizer/vke/BUILD               |  40 +
54 54 
  plugin/pkg/auth/authorizer/vke/OWNERS              |   2 +
55 55 
  plugin/pkg/auth/authorizer/vke/vke_authorizer.go   | 123 +++
56 56 
  .../pkg/auth/authorizer/vke/vke_authorizer_test.go | 230 +++++
57 57 
  staging/src/k8s.io/api/core/v1/generated.pb.go     | 310 ++++++-
58 58 
  staging/src/k8s.io/api/core/v1/types.go            |  24 +-
59 
- 52 files changed, 5779 insertions(+), 31 deletions(-)
59 
+ .../k8s.io/api/core/v1/zz_generated.deepcopy.go    |  50 +-
60 
+ 64 files changed, 6026 insertions(+), 110 deletions(-)
60 61
61 62 
 diff --git a/api/swagger-spec/apps_v1alpha1.json b/api/swagger-spec/apps_v1alpha1.json
62 63 
 index 6f54662..0ce6f3f 100644
... ... 
@@ -98,7 +110,7 @@ index 6f54662..0ce6f3f 100644
98 98 
      "id": "v1.Container",
99 99 
      "description": "A single application container that you want to run within a pod.",
100 100 
 diff --git a/api/swagger-spec/apps_v1beta1.json b/api/swagger-spec/apps_v1beta1.json
101 
-index a4b090a..6fc1e0a 100644
101 
+index f2aa27c..0780075 100644
102 102 
 --- a/api/swagger-spec/apps_v1beta1.json
103 103 
 +++ b/api/swagger-spec/apps_v1beta1.json
104 104 
 @@ -4483,6 +4483,10 @@
... ... 
@@ -137,7 +149,7 @@ index a4b090a..6fc1e0a 100644
137 137 
      "id": "v1.ProjectedVolumeSource",
138 138 
      "description": "Represents a projected volume source",
139 139 
 diff --git a/api/swagger-spec/apps_v1beta2.json b/api/swagger-spec/apps_v1beta2.json
140 
-index b1fcb48..3193163 100644
140 
+index 7d92e2b..c050ee8 100644
141 141 
 --- a/api/swagger-spec/apps_v1beta2.json
142 142 
 +++ b/api/swagger-spec/apps_v1beta2.json
143 143 
 @@ -6849,6 +6849,10 @@
... ... 
@@ -176,7 +188,7 @@ index b1fcb48..3193163 100644
176 176 
      "id": "v1.ProjectedVolumeSource",
177 177 
      "description": "Represents a projected volume source",
178 178 
 diff --git a/api/swagger-spec/batch_v1.json b/api/swagger-spec/batch_v1.json
179 
-index b6d6cea..a6f3aae 100644
179 
+index e57104a..c3aa722 100644
180 180 
 --- a/api/swagger-spec/batch_v1.json
181 181 
 +++ b/api/swagger-spec/batch_v1.json
182 182 
 @@ -1823,6 +1823,10 @@
... ... 
@@ -215,7 +227,7 @@ index b6d6cea..a6f3aae 100644
215 215 
      "id": "v1.ProjectedVolumeSource",
216 216 
      "description": "Represents a projected volume source",
217 217 
 diff --git a/api/swagger-spec/batch_v1beta1.json b/api/swagger-spec/batch_v1beta1.json
218 
-index 32cdfc0..9aa9744 100644
218 
+index 67b49f7..11f30a5 100644
219 219 
 --- a/api/swagger-spec/batch_v1beta1.json
220 220 
 +++ b/api/swagger-spec/batch_v1beta1.json
221 221 
 @@ -1878,6 +1878,10 @@
... ... 
@@ -254,7 +266,7 @@ index 32cdfc0..9aa9744 100644
254 254 
      "id": "v1.ProjectedVolumeSource",
255 255 
      "description": "Represents a projected volume source",
256 256 
 diff --git a/api/swagger-spec/batch_v2alpha1.json b/api/swagger-spec/batch_v2alpha1.json
257 
-index 57acdbb..c8a6ff3 100644
257 
+index 8616a87..2e1a8f7 100644
258 258 
 --- a/api/swagger-spec/batch_v2alpha1.json
259 259 
 +++ b/api/swagger-spec/batch_v2alpha1.json
260 260 
 @@ -1893,6 +1893,10 @@
... ... 
@@ -293,7 +305,7 @@ index 57acdbb..c8a6ff3 100644
293 293 
      "id": "v1.Container",
294 294 
      "description": "A single application container that you want to run within a pod.",
295 295 
 diff --git a/api/swagger-spec/extensions_v1beta1.json b/api/swagger-spec/extensions_v1beta1.json
296 
-index 6d2e049..66b6632 100644
296 
+index 76e3253..b79ca7a 100644
297 297 
 --- a/api/swagger-spec/extensions_v1beta1.json
298 298 
 +++ b/api/swagger-spec/extensions_v1beta1.json
299 299 
 @@ -7506,6 +7506,10 @@
... ... 
@@ -332,7 +344,7 @@ index 6d2e049..66b6632 100644
332 332 
      "id": "v1.ProjectedVolumeSource",
333 333 
      "description": "Represents a projected volume source",
334 334 
 diff --git a/api/swagger-spec/settings.k8s.io_v1alpha1.json b/api/swagger-spec/settings.k8s.io_v1alpha1.json
335 
-index d4427ba..6ad2a97 100644
335 
+index fa66976..5108c61 100644
336 336 
 --- a/api/swagger-spec/settings.k8s.io_v1alpha1.json
337 337 
 +++ b/api/swagger-spec/settings.k8s.io_v1alpha1.json
338 338 
 @@ -1676,6 +1676,10 @@
... ... 
@@ -371,7 +383,7 @@ index d4427ba..6ad2a97 100644
371 371 
      "id": "v1.ProjectedVolumeSource",
372 372 
      "description": "Represents a projected volume source",
373 373 
 diff --git a/api/swagger-spec/v1.json b/api/swagger-spec/v1.json
374 
-index 3f1198e..dbd57f0 100644
374 
+index d3b6ea7..662614f 100644
375 375 
 --- a/api/swagger-spec/v1.json
376 376 
 +++ b/api/swagger-spec/v1.json
377 377 
 @@ -19310,6 +19310,10 @@
... ... 
@@ -500,8 +512,332 @@ index ef41bb8..c9806f7 100644
500 500 
  	if utilfeature.DefaultFeatureGate.Enabled(features.CSIPersistentVolume) {
501 501 
  		allPlugins = append(allPlugins, csi.ProbeVolumePlugins()...)
502 502 
  	}
503 
+diff --git a/pkg/apis/apps/v1/zz_generated.defaults.go b/pkg/apis/apps/v1/zz_generated.defaults.go
504 
+index 5029d8b..762c97f 100644
505 
+--- a/pkg/apis/apps/v1/zz_generated.defaults.go
506 
+@@ -71,9 +71,6 @@ func SetObjectDefaults_DaemonSet(in *v1.DaemonSet) {
507 
+ 		if a.VolumeSource.ConfigMap != nil {
508 
+ 			core_v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
509 
+ 		}
510 
+-		if a.VolumeSource.AzureDisk != nil {
511 
+-			core_v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
512 
+-		}
513 
+ 		if a.VolumeSource.Projected != nil {
514 
+ 			core_v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
515 
+ 			for j := range a.VolumeSource.Projected.Sources {
516 
+@@ -91,6 +88,9 @@ func SetObjectDefaults_DaemonSet(in *v1.DaemonSet) {
517 
+ 		if a.VolumeSource.ScaleIO != nil {
518 
+ 			core_v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
519 
+ 		}
520 
++		if a.VolumeSource.AzureDisk != nil {
521 
++			core_v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
522 
++		}
523 
+ 	}
524 
+ 	for i := range in.Spec.Template.Spec.InitContainers {
525 
+ 		a := &in.Spec.Template.Spec.InitContainers[i]
526 
+@@ -215,9 +215,6 @@ func SetObjectDefaults_Deployment(in *v1.Deployment) {
527 
+ 		if a.VolumeSource.ConfigMap != nil {
528 
+ 			core_v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
529 
+ 		}
530 
+-		if a.VolumeSource.AzureDisk != nil {
531 
+-			core_v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
532 
+-		}
533 
+ 		if a.VolumeSource.Projected != nil {
534 
+ 			core_v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
535 
+ 			for j := range a.VolumeSource.Projected.Sources {
536 
+@@ -235,6 +232,9 @@ func SetObjectDefaults_Deployment(in *v1.Deployment) {
537 
+ 		if a.VolumeSource.ScaleIO != nil {
538 
+ 			core_v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
539 
+ 		}
540 
++		if a.VolumeSource.AzureDisk != nil {
541 
++			core_v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
542 
++		}
543 
+ 	}
544 
+ 	for i := range in.Spec.Template.Spec.InitContainers {
545 
+ 		a := &in.Spec.Template.Spec.InitContainers[i]
546 
+@@ -359,9 +359,6 @@ func SetObjectDefaults_ReplicaSet(in *v1.ReplicaSet) {
547 
+ 		if a.VolumeSource.ConfigMap != nil {
548 
+ 			core_v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
549 
+ 		}
550 
+-		if a.VolumeSource.AzureDisk != nil {
551 
+-			core_v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
552 
+-		}
553 
+ 		if a.VolumeSource.Projected != nil {
554 
+ 			core_v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
555 
+ 			for j := range a.VolumeSource.Projected.Sources {
556 
+@@ -379,6 +376,9 @@ func SetObjectDefaults_ReplicaSet(in *v1.ReplicaSet) {
557 
+ 		if a.VolumeSource.ScaleIO != nil {
558 
+ 			core_v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
559 
+ 		}
560 
++		if a.VolumeSource.AzureDisk != nil {
561 
++			core_v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
562 
++		}
563 
+ 	}
564 
+ 	for i := range in.Spec.Template.Spec.InitContainers {
565 
+ 		a := &in.Spec.Template.Spec.InitContainers[i]
566 
+@@ -503,9 +503,6 @@ func SetObjectDefaults_StatefulSet(in *v1.StatefulSet) {
567 
+ 		if a.VolumeSource.ConfigMap != nil {
568 
+ 			core_v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
569 
+ 		}
570 
+-		if a.VolumeSource.AzureDisk != nil {
571 
+-			core_v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
572 
+-		}
573 
+ 		if a.VolumeSource.Projected != nil {
574 
+ 			core_v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
575 
+ 			for j := range a.VolumeSource.Projected.Sources {
576 
+@@ -523,6 +520,9 @@ func SetObjectDefaults_StatefulSet(in *v1.StatefulSet) {
577 
+ 		if a.VolumeSource.ScaleIO != nil {
578 
+ 			core_v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
579 
+ 		}
580 
++		if a.VolumeSource.AzureDisk != nil {
581 
++			core_v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
582 
++		}
583 
+ 	}
584 
+ 	for i := range in.Spec.Template.Spec.InitContainers {
585 
+ 		a := &in.Spec.Template.Spec.InitContainers[i]
586 
+diff --git a/pkg/apis/apps/v1beta1/zz_generated.defaults.go b/pkg/apis/apps/v1beta1/zz_generated.defaults.go
587 
+index a61212c..a25eab48 100644
588 
+--- a/pkg/apis/apps/v1beta1/zz_generated.defaults.go
589 
+@@ -67,9 +67,6 @@ func SetObjectDefaults_Deployment(in *v1beta1.Deployment) {
590 
+ 		if a.VolumeSource.ConfigMap != nil {
591 
+ 			v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
592 
+ 		}
593 
+-		if a.VolumeSource.AzureDisk != nil {
594 
+-			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
595 
+-		}
596 
+ 		if a.VolumeSource.Projected != nil {
597 
+ 			v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
598 
+ 			for j := range a.VolumeSource.Projected.Sources {
599 
+@@ -87,6 +84,9 @@ func SetObjectDefaults_Deployment(in *v1beta1.Deployment) {
600 
+ 		if a.VolumeSource.ScaleIO != nil {
601 
+ 			v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
602 
+ 		}
603 
++		if a.VolumeSource.AzureDisk != nil {
604 
++			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
605 
++		}
606 
+ 	}
607 
+ 	for i := range in.Spec.Template.Spec.InitContainers {
608 
+ 		a := &in.Spec.Template.Spec.InitContainers[i]
609 
+@@ -211,9 +211,6 @@ func SetObjectDefaults_StatefulSet(in *v1beta1.StatefulSet) {
610 
+ 		if a.VolumeSource.ConfigMap != nil {
611 
+ 			v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
612 
+ 		}
613 
+-		if a.VolumeSource.AzureDisk != nil {
614 
+-			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
615 
+-		}
616 
+ 		if a.VolumeSource.Projected != nil {
617 
+ 			v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
618 
+ 			for j := range a.VolumeSource.Projected.Sources {
619 
+@@ -231,6 +228,9 @@ func SetObjectDefaults_StatefulSet(in *v1beta1.StatefulSet) {
620 
+ 		if a.VolumeSource.ScaleIO != nil {
621 
+ 			v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
622 
+ 		}
623 
++		if a.VolumeSource.AzureDisk != nil {
624 
++			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
625 
++		}
626 
+ 	}
627 
+ 	for i := range in.Spec.Template.Spec.InitContainers {
628 
+ 		a := &in.Spec.Template.Spec.InitContainers[i]
629 
+diff --git a/pkg/apis/apps/v1beta2/zz_generated.defaults.go b/pkg/apis/apps/v1beta2/zz_generated.defaults.go
630 
+index 059718d..0a1a197 100644
631 
+--- a/pkg/apis/apps/v1beta2/zz_generated.defaults.go
632 
+@@ -71,9 +71,6 @@ func SetObjectDefaults_DaemonSet(in *v1beta2.DaemonSet) {
633 
+ 		if a.VolumeSource.ConfigMap != nil {
634 
+ 			v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
635 
+ 		}
636 
+-		if a.VolumeSource.AzureDisk != nil {
637 
+-			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
638 
+-		}
639 
+ 		if a.VolumeSource.Projected != nil {
640 
+ 			v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
641 
+ 			for j := range a.VolumeSource.Projected.Sources {
642 
+@@ -91,6 +88,9 @@ func SetObjectDefaults_DaemonSet(in *v1beta2.DaemonSet) {
643 
+ 		if a.VolumeSource.ScaleIO != nil {
644 
+ 			v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
645 
+ 		}
646 
++		if a.VolumeSource.AzureDisk != nil {
647 
++			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
648 
++		}
649 
+ 	}
650 
+ 	for i := range in.Spec.Template.Spec.InitContainers {
651 
+ 		a := &in.Spec.Template.Spec.InitContainers[i]
652 
+@@ -215,9 +215,6 @@ func SetObjectDefaults_Deployment(in *v1beta2.Deployment) {
653 
+ 		if a.VolumeSource.ConfigMap != nil {
654 
+ 			v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
655 
+ 		}
656 
+-		if a.VolumeSource.AzureDisk != nil {
657 
+-			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
658 
+-		}
659 
+ 		if a.VolumeSource.Projected != nil {
660 
+ 			v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
661 
+ 			for j := range a.VolumeSource.Projected.Sources {
662 
+@@ -235,6 +232,9 @@ func SetObjectDefaults_Deployment(in *v1beta2.Deployment) {
663 
+ 		if a.VolumeSource.ScaleIO != nil {
664 
+ 			v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
665 
+ 		}
666 
++		if a.VolumeSource.AzureDisk != nil {
667 
++			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
668 
++		}
669 
+ 	}
670 
+ 	for i := range in.Spec.Template.Spec.InitContainers {
671 
+ 		a := &in.Spec.Template.Spec.InitContainers[i]
672 
+@@ -359,9 +359,6 @@ func SetObjectDefaults_ReplicaSet(in *v1beta2.ReplicaSet) {
673 
+ 		if a.VolumeSource.ConfigMap != nil {
674 
+ 			v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
675 
+ 		}
676 
+-		if a.VolumeSource.AzureDisk != nil {
677 
+-			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
678 
+-		}
679 
+ 		if a.VolumeSource.Projected != nil {
680 
+ 			v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
681 
+ 			for j := range a.VolumeSource.Projected.Sources {
682 
+@@ -379,6 +376,9 @@ func SetObjectDefaults_ReplicaSet(in *v1beta2.ReplicaSet) {
683 
+ 		if a.VolumeSource.ScaleIO != nil {
684 
+ 			v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
685 
+ 		}
686 
++		if a.VolumeSource.AzureDisk != nil {
687 
++			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
688 
++		}
689 
+ 	}
690 
+ 	for i := range in.Spec.Template.Spec.InitContainers {
691 
+ 		a := &in.Spec.Template.Spec.InitContainers[i]
692 
+@@ -503,9 +503,6 @@ func SetObjectDefaults_StatefulSet(in *v1beta2.StatefulSet) {
693 
+ 		if a.VolumeSource.ConfigMap != nil {
694 
+ 			v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
695 
+ 		}
696 
+-		if a.VolumeSource.AzureDisk != nil {
697 
+-			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
698 
+-		}
699 
+ 		if a.VolumeSource.Projected != nil {
700 
+ 			v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
701 
+ 			for j := range a.VolumeSource.Projected.Sources {
702 
+@@ -523,6 +520,9 @@ func SetObjectDefaults_StatefulSet(in *v1beta2.StatefulSet) {
703 
+ 		if a.VolumeSource.ScaleIO != nil {
704 
+ 			v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
705 
+ 		}
706 
++		if a.VolumeSource.AzureDisk != nil {
707 
++			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
708 
++		}
709 
+ 	}
710 
+ 	for i := range in.Spec.Template.Spec.InitContainers {
711 
+ 		a := &in.Spec.Template.Spec.InitContainers[i]
712 
+diff --git a/pkg/apis/batch/v1/zz_generated.defaults.go b/pkg/apis/batch/v1/zz_generated.defaults.go
713 
+index 9b02de3..7b88dcf 100644
714 
+--- a/pkg/apis/batch/v1/zz_generated.defaults.go
715 
+@@ -65,9 +65,6 @@ func SetObjectDefaults_Job(in *v1.Job) {
716 
+ 		if a.VolumeSource.ConfigMap != nil {
717 
+ 			core_v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
718 
+ 		}
719 
+-		if a.VolumeSource.AzureDisk != nil {
720 
+-			core_v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
721 
+-		}
722 
+ 		if a.VolumeSource.Projected != nil {
723 
+ 			core_v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
724 
+ 			for j := range a.VolumeSource.Projected.Sources {
725 
+@@ -85,6 +82,9 @@ func SetObjectDefaults_Job(in *v1.Job) {
726 
+ 		if a.VolumeSource.ScaleIO != nil {
727 
+ 			core_v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
728 
+ 		}
729 
++		if a.VolumeSource.AzureDisk != nil {
730 
++			core_v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
731 
++		}
732 
+ 	}
733 
+ 	for i := range in.Spec.Template.Spec.InitContainers {
734 
+ 		a := &in.Spec.Template.Spec.InitContainers[i]
735 
+diff --git a/pkg/apis/batch/v1beta1/zz_generated.defaults.go b/pkg/apis/batch/v1beta1/zz_generated.defaults.go
736 
+index 1d05468..1b17b0b 100644
737 
+--- a/pkg/apis/batch/v1beta1/zz_generated.defaults.go
738 
+@@ -66,9 +66,6 @@ func SetObjectDefaults_CronJob(in *v1beta1.CronJob) {
739 
+ 		if a.VolumeSource.ConfigMap != nil {
740 
+ 			v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
741 
+ 		}
742 
+-		if a.VolumeSource.AzureDisk != nil {
743 
+-			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
744 
+-		}
745 
+ 		if a.VolumeSource.Projected != nil {
746 
+ 			v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
747 
+ 			for j := range a.VolumeSource.Projected.Sources {
748 
+@@ -86,6 +83,9 @@ func SetObjectDefaults_CronJob(in *v1beta1.CronJob) {
749 
+ 		if a.VolumeSource.ScaleIO != nil {
750 
+ 			v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
751 
+ 		}
752 
++		if a.VolumeSource.AzureDisk != nil {
753 
++			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
754 
++		}
755 
+ 	}
756 
+ 	for i := range in.Spec.JobTemplate.Spec.Template.Spec.InitContainers {
757 
+ 		a := &in.Spec.JobTemplate.Spec.Template.Spec.InitContainers[i]
758 
+@@ -209,9 +209,6 @@ func SetObjectDefaults_JobTemplate(in *v1beta1.JobTemplate) {
759 
+ 		if a.VolumeSource.ConfigMap != nil {
760 
+ 			v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
761 
+ 		}
762 
+-		if a.VolumeSource.AzureDisk != nil {
763 
+-			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
764 
+-		}
765 
+ 		if a.VolumeSource.Projected != nil {
766 
+ 			v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
767 
+ 			for j := range a.VolumeSource.Projected.Sources {
768 
+@@ -229,6 +226,9 @@ func SetObjectDefaults_JobTemplate(in *v1beta1.JobTemplate) {
769 
+ 		if a.VolumeSource.ScaleIO != nil {
770 
+ 			v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
771 
+ 		}
772 
++		if a.VolumeSource.AzureDisk != nil {
773 
++			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
774 
++		}
775 
+ 	}
776 
+ 	for i := range in.Template.Spec.Template.Spec.InitContainers {
777 
+ 		a := &in.Template.Spec.Template.Spec.InitContainers[i]
778 
+diff --git a/pkg/apis/batch/v2alpha1/zz_generated.defaults.go b/pkg/apis/batch/v2alpha1/zz_generated.defaults.go
779 
+index eec4cfb..12ddc74 100644
780 
+--- a/pkg/apis/batch/v2alpha1/zz_generated.defaults.go
781 
+@@ -66,9 +66,6 @@ func SetObjectDefaults_CronJob(in *v2alpha1.CronJob) {
782 
+ 		if a.VolumeSource.ConfigMap != nil {
783 
+ 			v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
784 
+ 		}
785 
+-		if a.VolumeSource.AzureDisk != nil {
786 
+-			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
787 
+-		}
788 
+ 		if a.VolumeSource.Projected != nil {
789 
+ 			v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
790 
+ 			for j := range a.VolumeSource.Projected.Sources {
791 
+@@ -86,6 +83,9 @@ func SetObjectDefaults_CronJob(in *v2alpha1.CronJob) {
792 
+ 		if a.VolumeSource.ScaleIO != nil {
793 
+ 			v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
794 
+ 		}
795 
++		if a.VolumeSource.AzureDisk != nil {
796 
++			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
797 
++		}
798 
+ 	}
799 
+ 	for i := range in.Spec.JobTemplate.Spec.Template.Spec.InitContainers {
800 
+ 		a := &in.Spec.JobTemplate.Spec.Template.Spec.InitContainers[i]
801 
+@@ -209,9 +209,6 @@ func SetObjectDefaults_JobTemplate(in *v2alpha1.JobTemplate) {
802 
+ 		if a.VolumeSource.ConfigMap != nil {
803 
+ 			v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
804 
+ 		}
805 
+-		if a.VolumeSource.AzureDisk != nil {
806 
+-			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
807 
+-		}
808 
+ 		if a.VolumeSource.Projected != nil {
809 
+ 			v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
810 
+ 			for j := range a.VolumeSource.Projected.Sources {
811 
+@@ -229,6 +226,9 @@ func SetObjectDefaults_JobTemplate(in *v2alpha1.JobTemplate) {
812 
+ 		if a.VolumeSource.ScaleIO != nil {
813 
+ 			v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
814 
+ 		}
815 
++		if a.VolumeSource.AzureDisk != nil {
816 
++			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
817 
++		}
818 
+ 	}
819 
+ 	for i := range in.Template.Spec.Template.Spec.InitContainers {
820 
+ 		a := &in.Template.Spec.Template.Spec.InitContainers[i]
503 821 
 diff --git a/pkg/apis/core/types.go b/pkg/apis/core/types.go
504 
-index 8b183de..cfe4c85 100644
822 
+index 7f37e3d..fc792ee 100644
505 823 
 --- a/pkg/apis/core/types.go
506 824 
 +++ b/pkg/apis/core/types.go
507 825 
 @@ -316,6 +316,8 @@ type VolumeSource struct {
... ... 
@@ -539,8 +875,177 @@ index 8b183de..cfe4c85 100644
539 539 
  // Adapts a ConfigMap into a volume.
540 540 
  //
541 541 
  // The contents of the target ConfigMap's Data field will be presented in a
542 
+diff --git a/pkg/apis/core/v1/zz_generated.conversion.go b/pkg/apis/core/v1/zz_generated.conversion.go
543 
+index cd8ae52..8c9f46e 100644
544 
+--- a/pkg/apis/core/v1/zz_generated.conversion.go
545 
+@@ -60,6 +60,8 @@ func RegisterConversions(scheme *runtime.Scheme) error {
546 
+ 		Convert_core_CSIPersistentVolumeSource_To_v1_CSIPersistentVolumeSource,
547 
+ 		Convert_v1_Capabilities_To_core_Capabilities,
548 
+ 		Convert_core_Capabilities_To_v1_Capabilities,
549 
++		Convert_v1_CascadeDiskVolumeSource_To_core_CascadeDiskVolumeSource,
550 
++		Convert_core_CascadeDiskVolumeSource_To_v1_CascadeDiskVolumeSource,
551 
+ 		Convert_v1_CephFSPersistentVolumeSource_To_core_CephFSPersistentVolumeSource,
552 
+ 		Convert_core_CephFSPersistentVolumeSource_To_v1_CephFSPersistentVolumeSource,
553 
+ 		Convert_v1_CephFSVolumeSource_To_core_CephFSVolumeSource,
554 
+@@ -673,6 +675,28 @@ func Convert_core_Capabilities_To_v1_Capabilities(in *core.Capabilities, out *v1
555 
+ 	return autoConvert_core_Capabilities_To_v1_Capabilities(in, out, s)
556 
+ }
557 
+
558 
++func autoConvert_v1_CascadeDiskVolumeSource_To_core_CascadeDiskVolumeSource(in *v1.CascadeDiskVolumeSource, out *core.CascadeDiskVolumeSource, s conversion.Scope) error {
559 
++	out.DiskID = in.DiskID
560 
++	out.FSType = in.FSType
561 
++	return nil
562 
++}
563 
++
564 
++// Convert_v1_CascadeDiskVolumeSource_To_core_CascadeDiskVolumeSource is an autogenerated conversion function.
565 
++func Convert_v1_CascadeDiskVolumeSource_To_core_CascadeDiskVolumeSource(in *v1.CascadeDiskVolumeSource, out *core.CascadeDiskVolumeSource, s conversion.Scope) error {
566 
++	return autoConvert_v1_CascadeDiskVolumeSource_To_core_CascadeDiskVolumeSource(in, out, s)
567 
++}
568 
++
569 
++func autoConvert_core_CascadeDiskVolumeSource_To_v1_CascadeDiskVolumeSource(in *core.CascadeDiskVolumeSource, out *v1.CascadeDiskVolumeSource, s conversion.Scope) error {
570 
++	out.DiskID = in.DiskID
571 
++	out.FSType = in.FSType
572 
++	return nil
573 
++}
574 
++
575 
++// Convert_core_CascadeDiskVolumeSource_To_v1_CascadeDiskVolumeSource is an autogenerated conversion function.
576 
++func Convert_core_CascadeDiskVolumeSource_To_v1_CascadeDiskVolumeSource(in *core.CascadeDiskVolumeSource, out *v1.CascadeDiskVolumeSource, s conversion.Scope) error {
577 
++	return autoConvert_core_CascadeDiskVolumeSource_To_v1_CascadeDiskVolumeSource(in, out, s)
578 
++}
579 
++
580 
+ func autoConvert_v1_CephFSPersistentVolumeSource_To_core_CephFSPersistentVolumeSource(in *v1.CephFSPersistentVolumeSource, out *core.CephFSPersistentVolumeSource, s conversion.Scope) error {
581 
+ 	out.Monitors = *(*[]string)(unsafe.Pointer(&in.Monitors))
582 
+ 	out.Path = in.Path
583 
+@@ -3299,13 +3323,14 @@ func autoConvert_v1_PersistentVolumeSource_To_core_PersistentVolumeSource(in *v1
584 
+ 	out.AzureFile = (*core.AzureFilePersistentVolumeSource)(unsafe.Pointer(in.AzureFile))
585 
+ 	out.VsphereVolume = (*core.VsphereVirtualDiskVolumeSource)(unsafe.Pointer(in.VsphereVolume))
586 
+ 	out.Quobyte = (*core.QuobyteVolumeSource)(unsafe.Pointer(in.Quobyte))
587 
+-	out.AzureDisk = (*core.AzureDiskVolumeSource)(unsafe.Pointer(in.AzureDisk))
588 
++	out.CascadeDisk = (*core.CascadeDiskVolumeSource)(unsafe.Pointer(in.CascadeDisk))
589 
+ 	out.PhotonPersistentDisk = (*core.PhotonPersistentDiskVolumeSource)(unsafe.Pointer(in.PhotonPersistentDisk))
590 
+ 	out.PortworxVolume = (*core.PortworxVolumeSource)(unsafe.Pointer(in.PortworxVolume))
591 
+ 	out.ScaleIO = (*core.ScaleIOPersistentVolumeSource)(unsafe.Pointer(in.ScaleIO))
592 
+ 	out.Local = (*core.LocalVolumeSource)(unsafe.Pointer(in.Local))
593 
+ 	out.StorageOS = (*core.StorageOSPersistentVolumeSource)(unsafe.Pointer(in.StorageOS))
594 
+ 	out.CSI = (*core.CSIPersistentVolumeSource)(unsafe.Pointer(in.CSI))
595 
++	out.AzureDisk = (*core.AzureDiskVolumeSource)(unsafe.Pointer(in.AzureDisk))
596 
+ 	return nil
597 
+ }
598 
+
599 
+@@ -3337,6 +3362,7 @@ func autoConvert_core_PersistentVolumeSource_To_v1_PersistentVolumeSource(in *co
600 
+ 	out.Local = (*v1.LocalVolumeSource)(unsafe.Pointer(in.Local))
601 
+ 	out.StorageOS = (*v1.StorageOSPersistentVolumeSource)(unsafe.Pointer(in.StorageOS))
602 
+ 	out.CSI = (*v1.CSIPersistentVolumeSource)(unsafe.Pointer(in.CSI))
603 
++	out.CascadeDisk = (*v1.CascadeDiskVolumeSource)(unsafe.Pointer(in.CascadeDisk))
604 
+ 	return nil
605 
+ }
606 
+
607 
+@@ -5587,12 +5613,13 @@ func autoConvert_v1_VolumeSource_To_core_VolumeSource(in *v1.VolumeSource, out *
608 
+ 	out.ConfigMap = (*core.ConfigMapVolumeSource)(unsafe.Pointer(in.ConfigMap))
609 
+ 	out.VsphereVolume = (*core.VsphereVirtualDiskVolumeSource)(unsafe.Pointer(in.VsphereVolume))
610 
+ 	out.Quobyte = (*core.QuobyteVolumeSource)(unsafe.Pointer(in.Quobyte))
611 
+-	out.AzureDisk = (*core.AzureDiskVolumeSource)(unsafe.Pointer(in.AzureDisk))
612 
++	out.CascadeDisk = (*core.CascadeDiskVolumeSource)(unsafe.Pointer(in.CascadeDisk))
613 
+ 	out.PhotonPersistentDisk = (*core.PhotonPersistentDiskVolumeSource)(unsafe.Pointer(in.PhotonPersistentDisk))
614 
+ 	out.Projected = (*core.ProjectedVolumeSource)(unsafe.Pointer(in.Projected))
615 
+ 	out.PortworxVolume = (*core.PortworxVolumeSource)(unsafe.Pointer(in.PortworxVolume))
616 
+ 	out.ScaleIO = (*core.ScaleIOVolumeSource)(unsafe.Pointer(in.ScaleIO))
617 
+ 	out.StorageOS = (*core.StorageOSVolumeSource)(unsafe.Pointer(in.StorageOS))
618 
++	out.AzureDisk = (*core.AzureDiskVolumeSource)(unsafe.Pointer(in.AzureDisk))
619 
+ 	return nil
620 
+ }
621 
+
622 
+@@ -5629,6 +5656,7 @@ func autoConvert_core_VolumeSource_To_v1_VolumeSource(in *core.VolumeSource, out
623 
+ 	out.PortworxVolume = (*v1.PortworxVolumeSource)(unsafe.Pointer(in.PortworxVolume))
624 
+ 	out.ScaleIO = (*v1.ScaleIOVolumeSource)(unsafe.Pointer(in.ScaleIO))
625 
+ 	out.StorageOS = (*v1.StorageOSVolumeSource)(unsafe.Pointer(in.StorageOS))
626 
++	out.CascadeDisk = (*v1.CascadeDiskVolumeSource)(unsafe.Pointer(in.CascadeDisk))
627 
+ 	return nil
628 
+ }
629 
+
630 
+diff --git a/pkg/apis/core/v1/zz_generated.defaults.go b/pkg/apis/core/v1/zz_generated.defaults.go
631 
+index 084c951..baeaa01 100644
632 
+--- a/pkg/apis/core/v1/zz_generated.defaults.go
633 
+@@ -140,12 +140,12 @@ func SetObjectDefaults_PersistentVolume(in *v1.PersistentVolume) {
634 
+ 	if in.Spec.PersistentVolumeSource.ISCSI != nil {
635 
+ 		SetDefaults_ISCSIPersistentVolumeSource(in.Spec.PersistentVolumeSource.ISCSI)
636 
+ 	}
637 
+-	if in.Spec.PersistentVolumeSource.AzureDisk != nil {
638 
+-		SetDefaults_AzureDiskVolumeSource(in.Spec.PersistentVolumeSource.AzureDisk)
639 
+-	}
640 
+ 	if in.Spec.PersistentVolumeSource.ScaleIO != nil {
641 
+ 		SetDefaults_ScaleIOPersistentVolumeSource(in.Spec.PersistentVolumeSource.ScaleIO)
642 
+ 	}
643 
++	if in.Spec.PersistentVolumeSource.AzureDisk != nil {
644 
++		SetDefaults_AzureDiskVolumeSource(in.Spec.PersistentVolumeSource.AzureDisk)
645 
++	}
646 
+ }
647 
+
648 
+ func SetObjectDefaults_PersistentVolumeClaim(in *v1.PersistentVolumeClaim) {
649 
+@@ -199,9 +199,6 @@ func SetObjectDefaults_Pod(in *v1.Pod) {
650 
+ 		if a.VolumeSource.ConfigMap != nil {
651 
+ 			SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
652 
+ 		}
653 
+-		if a.VolumeSource.AzureDisk != nil {
654 
+-			SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
655 
+-		}
656 
+ 		if a.VolumeSource.Projected != nil {
657 
+ 			SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
658 
+ 			for j := range a.VolumeSource.Projected.Sources {
659 
+@@ -219,6 +216,9 @@ func SetObjectDefaults_Pod(in *v1.Pod) {
660 
+ 		if a.VolumeSource.ScaleIO != nil {
661 
+ 			SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
662 
+ 		}
663 
++		if a.VolumeSource.AzureDisk != nil {
664 
++			SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
665 
++		}
666 
+ 	}
667 
+ 	for i := range in.Spec.InitContainers {
668 
+ 		a := &in.Spec.InitContainers[i]
669 
+@@ -342,9 +342,6 @@ func SetObjectDefaults_PodTemplate(in *v1.PodTemplate) {
670 
+ 		if a.VolumeSource.ConfigMap != nil {
671 
+ 			SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
672 
+ 		}
673 
+-		if a.VolumeSource.AzureDisk != nil {
674 
+-			SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
675 
+-		}
676 
+ 		if a.VolumeSource.Projected != nil {
677 
+ 			SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
678 
+ 			for j := range a.VolumeSource.Projected.Sources {
679 
+@@ -362,6 +359,9 @@ func SetObjectDefaults_PodTemplate(in *v1.PodTemplate) {
680 
+ 		if a.VolumeSource.ScaleIO != nil {
681 
+ 			SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
682 
+ 		}
683 
++		if a.VolumeSource.AzureDisk != nil {
684 
++			SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
685 
++		}
686 
+ 	}
687 
+ 	for i := range in.Template.Spec.InitContainers {
688 
+ 		a := &in.Template.Spec.InitContainers[i]
689 
+@@ -487,9 +487,6 @@ func SetObjectDefaults_ReplicationController(in *v1.ReplicationController) {
690 
+ 			if a.VolumeSource.ConfigMap != nil {
691 
+ 				SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
692 
+ 			}
693 
+-			if a.VolumeSource.AzureDisk != nil {
694 
+-				SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
695 
+-			}
696 
+ 			if a.VolumeSource.Projected != nil {
697 
+ 				SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
698 
+ 				for j := range a.VolumeSource.Projected.Sources {
699 
+@@ -507,6 +504,9 @@ func SetObjectDefaults_ReplicationController(in *v1.ReplicationController) {
700 
+ 			if a.VolumeSource.ScaleIO != nil {
701 
+ 				SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
702 
+ 			}
703 
++			if a.VolumeSource.AzureDisk != nil {
704 
++				SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
705 
++			}
706 
+ 		}
707 
+ 		for i := range in.Spec.Template.Spec.InitContainers {
708 
+ 			a := &in.Spec.Template.Spec.InitContainers[i]
542 709 
 diff --git a/pkg/apis/core/validation/validation.go b/pkg/apis/core/validation/validation.go
543 
-index b66fd6f..7f0e6bd 100644
710 
+index 8d12dad..2391b6b 100644
544 711 
 --- a/pkg/apis/core/validation/validation.go
545 712 
 +++ b/pkg/apis/core/validation/validation.go
546 713 
 @@ -664,6 +664,14 @@ func validateVolumeSource(source *core.VolumeSource, fldPath *field.Path, volNam
... ... 
@@ -558,7 +1063,7 @@ index b66fd6f..7f0e6bd 100644
558 558
559 559 
  	if numVolumes == 0 {
560 560 
  		allErrs = append(allErrs, field.Required(fldPath, "must specify a volume type"))
561 
-@@ -1494,6 +1502,14 @@ func validateCSIPersistentVolumeSource(csi *core.CSIPersistentVolumeSource, fldP
561 
+@@ -1491,6 +1499,14 @@ func validateCSIPersistentVolumeSource(csi *core.CSIPersistentVolumeSource, fldP
562 562 
  	return allErrs
563 563 
  }
564 564
... ... 
@@ -573,7 +1078,7 @@ index b66fd6f..7f0e6bd 100644
573 573 
  // ValidatePersistentVolumeName checks that a name is appropriate for a
574 574 
  // PersistentVolumeName object.
575 575 
  var ValidatePersistentVolumeName = NameIsDNSSubdomain
576 
-@@ -1737,6 +1753,15 @@ func ValidatePersistentVolume(pv *core.PersistentVolume) field.ErrorList {
576 
+@@ -1734,6 +1750,15 @@ func ValidatePersistentVolume(pv *core.PersistentVolume) field.ErrorList {
577 577 
  		}
578 578 
  	}
579 579
... ... 
@@ -589,7 +1094,7 @@ index b66fd6f..7f0e6bd 100644
589 589 
  	if numVolumes == 0 {
590 590 
  		allErrs = append(allErrs, field.Required(specPath, "must specify a volume type"))
591 591 
  	}
592 
-@@ -4370,7 +4395,7 @@ func ValidateSecret(secret *core.Secret) field.ErrorList {
592 
+@@ -4367,7 +4392,7 @@ func ValidateSecret(secret *core.Secret) field.ErrorList {
593 593 
  			allErrs = append(allErrs, field.Required(field.NewPath("metadata", "annotations").Key(core.ServiceAccountNameKey), ""))
594 594 
  		}
595 595 
  	case core.SecretTypeOpaque, "":
... ... 
@@ -598,7 +1103,7 @@ index b66fd6f..7f0e6bd 100644
598 598 
  	case core.SecretTypeDockercfg:
599 599 
  		dockercfgBytes, exists := secret.Data[core.DockerConfigKey]
600 600 
  		if !exists {
601 
-@@ -4416,7 +4441,7 @@ func ValidateSecret(secret *core.Secret) field.ErrorList {
601 
+@@ -4413,7 +4438,7 @@ func ValidateSecret(secret *core.Secret) field.ErrorList {
602 602 
  		if _, exists := secret.Data[core.TLSPrivateKeyKey]; !exists {
603 603 
  			allErrs = append(allErrs, field.Required(dataPath.Key(core.TLSPrivateKeyKey), ""))
604 604 
  		}
... ... 
@@ -607,6 +1112,65 @@ index b66fd6f..7f0e6bd 100644
607 607 
  	default:
608 608 
  		// no-op
609 609 
  	}
610 
+diff --git a/pkg/apis/core/zz_generated.deepcopy.go b/pkg/apis/core/zz_generated.deepcopy.go
611 
+index 3522575..3706048 100644
612 
+--- a/pkg/apis/core/zz_generated.deepcopy.go
613 
+@@ -321,6 +321,22 @@ func (in *Capabilities) DeepCopy() *Capabilities {
614 
+ }
615 
+
616 
+ // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
617 
++func (in *CascadeDiskVolumeSource) DeepCopyInto(out *CascadeDiskVolumeSource) {
618 
++	*out = *in
619 
++	return
620 
++}
621 
++
622 
++// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CascadeDiskVolumeSource.
623 
++func (in *CascadeDiskVolumeSource) DeepCopy() *CascadeDiskVolumeSource {
624 
++	if in == nil {
625 
++		return nil
626 
++	}
627 
++	out := new(CascadeDiskVolumeSource)
628 
++	in.DeepCopyInto(out)
629 
++	return out
630 
++}
631 
++
632 
++// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
633 
+ func (in *CephFSPersistentVolumeSource) DeepCopyInto(out *CephFSPersistentVolumeSource) {
634 
+ 	*out = *in
635 
+ 	if in.Monitors != nil {
636 
+@@ -3324,6 +3340,15 @@ func (in *PersistentVolumeSource) DeepCopyInto(out *PersistentVolumeSource) {
637 
+ 			(*in).DeepCopyInto(*out)
638 
+ 		}
639 
+ 	}
640 
++	if in.CascadeDisk != nil {
641 
++		in, out := &in.CascadeDisk, &out.CascadeDisk
642 
++		if *in == nil {
643 
++			*out = nil
644 
++		} else {
645 
++			*out = new(CascadeDiskVolumeSource)
646 
++			**out = **in
647 
++		}
648 
++	}
649 
+ 	return
650 
+ }
651 
+
652 
+@@ -5923,6 +5948,15 @@ func (in *VolumeSource) DeepCopyInto(out *VolumeSource) {
653 
+ 			(*in).DeepCopyInto(*out)
654 
+ 		}
655 
+ 	}
656 
++	if in.CascadeDisk != nil {
657 
++		in, out := &in.CascadeDisk, &out.CascadeDisk
658 
++		if *in == nil {
659 
++			*out = nil
660 
++		} else {
661 
++			*out = new(CascadeDiskVolumeSource)
662 
++			**out = **in
663 
++		}
664 
++	}
665 
+ 	return
666 
+ }
667 
+
610 668 
 diff --git a/pkg/apis/extensions/types.go b/pkg/apis/extensions/types.go
611 669 
 index e369728..a5406ab 100644
612 670 
 --- a/pkg/apis/extensions/types.go
... ... 
@@ -619,6 +1183,94 @@ index e369728..a5406ab 100644
619 619 
  	All                   FSType = "*"
620 620 
  )
621 621
622 
+diff --git a/pkg/apis/extensions/v1beta1/zz_generated.defaults.go b/pkg/apis/extensions/v1beta1/zz_generated.defaults.go
623 
+index 3b009be..261b3d4 100644
624 
+--- a/pkg/apis/extensions/v1beta1/zz_generated.defaults.go
625 
+@@ -73,9 +73,6 @@ func SetObjectDefaults_DaemonSet(in *v1beta1.DaemonSet) {
626 
+ 		if a.VolumeSource.ConfigMap != nil {
627 
+ 			v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
628 
+ 		}
629 
+-		if a.VolumeSource.AzureDisk != nil {
630 
+-			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
631 
+-		}
632 
+ 		if a.VolumeSource.Projected != nil {
633 
+ 			v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
634 
+ 			for j := range a.VolumeSource.Projected.Sources {
635 
+@@ -93,6 +90,9 @@ func SetObjectDefaults_DaemonSet(in *v1beta1.DaemonSet) {
636 
+ 		if a.VolumeSource.ScaleIO != nil {
637 
+ 			v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
638 
+ 		}
639 
++		if a.VolumeSource.AzureDisk != nil {
640 
++			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
641 
++		}
642 
+ 	}
643 
+ 	for i := range in.Spec.Template.Spec.InitContainers {
644 
+ 		a := &in.Spec.Template.Spec.InitContainers[i]
645 
+@@ -217,9 +217,6 @@ func SetObjectDefaults_Deployment(in *v1beta1.Deployment) {
646 
+ 		if a.VolumeSource.ConfigMap != nil {
647 
+ 			v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
648 
+ 		}
649 
+-		if a.VolumeSource.AzureDisk != nil {
650 
+-			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
651 
+-		}
652 
+ 		if a.VolumeSource.Projected != nil {
653 
+ 			v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
654 
+ 			for j := range a.VolumeSource.Projected.Sources {
655 
+@@ -237,6 +234,9 @@ func SetObjectDefaults_Deployment(in *v1beta1.Deployment) {
656 
+ 		if a.VolumeSource.ScaleIO != nil {
657 
+ 			v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
658 
+ 		}
659 
++		if a.VolumeSource.AzureDisk != nil {
660 
++			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
661 
++		}
662 
+ 	}
663 
+ 	for i := range in.Spec.Template.Spec.InitContainers {
664 
+ 		a := &in.Spec.Template.Spec.InitContainers[i]
665 
+@@ -383,9 +383,6 @@ func SetObjectDefaults_ReplicaSet(in *v1beta1.ReplicaSet) {
666 
+ 		if a.VolumeSource.ConfigMap != nil {
667 
+ 			v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
668 
+ 		}
669 
+-		if a.VolumeSource.AzureDisk != nil {
670 
+-			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
671 
+-		}
672 
+ 		if a.VolumeSource.Projected != nil {
673 
+ 			v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
674 
+ 			for j := range a.VolumeSource.Projected.Sources {
675 
+@@ -403,6 +400,9 @@ func SetObjectDefaults_ReplicaSet(in *v1beta1.ReplicaSet) {
676 
+ 		if a.VolumeSource.ScaleIO != nil {
677 
+ 			v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
678 
+ 		}
679 
++		if a.VolumeSource.AzureDisk != nil {
680 
++			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
681 
++		}
682 
+ 	}
683 
+ 	for i := range in.Spec.Template.Spec.InitContainers {
684 
+ 		a := &in.Spec.Template.Spec.InitContainers[i]
685 
+diff --git a/pkg/apis/settings/v1alpha1/zz_generated.defaults.go b/pkg/apis/settings/v1alpha1/zz_generated.defaults.go
686 
+index f7604a4..d9cf7e8 100644
687 
+--- a/pkg/apis/settings/v1alpha1/zz_generated.defaults.go
688 
+@@ -71,9 +71,6 @@ func SetObjectDefaults_PodPreset(in *v1alpha1.PodPreset) {
689 
+ 		if a.VolumeSource.ConfigMap != nil {
690 
+ 			v1.SetDefaults_ConfigMapVolumeSource(a.VolumeSource.ConfigMap)
691 
+ 		}
692 
+-		if a.VolumeSource.AzureDisk != nil {
693 
+-			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
694 
+-		}
695 
+ 		if a.VolumeSource.Projected != nil {
696 
+ 			v1.SetDefaults_ProjectedVolumeSource(a.VolumeSource.Projected)
697 
+ 			for j := range a.VolumeSource.Projected.Sources {
698 
+@@ -91,6 +88,9 @@ func SetObjectDefaults_PodPreset(in *v1alpha1.PodPreset) {
699 
+ 		if a.VolumeSource.ScaleIO != nil {
700 
+ 			v1.SetDefaults_ScaleIOVolumeSource(a.VolumeSource.ScaleIO)
701 
+ 		}
702 
++		if a.VolumeSource.AzureDisk != nil {
703 
++			v1.SetDefaults_AzureDiskVolumeSource(a.VolumeSource.AzureDisk)
704 
++		}
705 
+ 	}
706 
+ }
707 
+
622 708 
 diff --git a/pkg/cloudprovider/providers/BUILD b/pkg/cloudprovider/providers/BUILD
623 709 
 index aeccfa1..4313576 100644
624 710 
 --- a/pkg/cloudprovider/providers/BUILD
... ... 
@@ -1555,18 +2207,22 @@ index 0000000..a2e8ded
1555 1555 
 +}
1556 1556 
 diff --git a/pkg/cloudprovider/providers/cascade/cascade_instances.go b/pkg/cloudprovider/providers/cascade/cascade_instances.go
1557 1557 
 new file mode 100644
1558 
-index 0000000..ee02e23
1558 
+index 0000000..957378b
1559 1559 
 --- /dev/null
1560 1560 
 +++ b/pkg/cloudprovider/providers/cascade/cascade_instances.go
1561 
-@@ -0,0 +1,92 @@
1561 
+@@ -0,0 +1,125 @@
1562 1562 
 +package cascade
1563 1563 
 +
1564 1564 
 +import (
1565 1565 
 +	"context"
1566 1566 
 +	"errors"
1567 
++	"github.com/golang/glog"
1568 
++	"os"
1569 
++	"strings"
1570 
++
1567 1571 
 +	"k8s.io/api/core/v1"
1568 1572 
 +	k8stypes "k8s.io/apimachinery/pkg/types"
1569 
-+	"strings"
1573 
++	"k8s.io/kubernetes/pkg/cloudprovider"
1570 1574 
 +)
1571 1575 
 +
1572 1576 
 +// NodeAddresses is an implementation of Instances.NodeAddresses. In the future, private IP address, external IP, etc.
... ... 
@@ -1611,12 +2267,11 @@ index 0000000..ee02e23
1611 1611 
 +}
1612 1612 
 +
1613 1613 
 +// ExternalID returns the cloud provider ID of the specified instance (deprecated).
1614 
-+// Note: We do not call Cascade Controller here to check if the instance is alive or not because that requires the
1615 
-+// worker nodes to also login to Cascade Controller. That check is used by Kubernetes to proactively remove nodes that
1616 
-+// the cloud provider believes is no longer available. Even otherwise, Kubernetes will remove those nodes eventually.
1617 
-+// So we are not losing much by not doing that check.
1614 
++// Note: We call Cascade Controller here to check if the instance is alive or not. That check is used by Kubernetes
1615 
++// to proactively remove nodes that the cloud provider believes is no longer available. Even otherwise, Kubernetes
1616 
++// will remove those nodes eventually.
1618 1617 
 +func (cc *CascadeCloud) ExternalID(ctx context.Context, nodeName k8stypes.NodeName) (string, error) {
1619 
-+	return getInstanceIDFromNodeName(nodeName)
1618 
++	return getInstanceIDAndLivelinessFromNodeName(cc, nodeName)
1620 1619 
 +}
1621 1620 
 +
1622 1621 
 +// InstanceExistsByProviderID returns true if the instance with the given provider id still exists and is running.
... ... 
@@ -1641,6 +2296,36 @@ index 0000000..ee02e23
1641 1641 
 +	return nodeParts[1], nil
1642 1642 
 +}
1643 1643 
 +
1644 
++// This gets the Cascade VM ID and its liveliness from the Kubernetes node name.
1645 
++func getInstanceIDAndLivelinessFromNodeName(cc *CascadeCloud, nodeName k8stypes.NodeName) (string, error) {
1646 
++	instanceID, err := getInstanceIDFromNodeName(nodeName)
1647 
++	if err != nil {
1648 
++		return "", err
1649 
++	}
1650 
++	// Get local hostname. We need to do this check to make sure we call VKE controller only from master nodes
1651 
++	// because worker nodes cannot login to VKE controller.
1652 
++	hostname, err := os.Hostname()
1653 
++	if err != nil {
1654 
++		glog.Errorf("Cascade Cloud Provider: get hostname failed. Error[%v]", err)
1655 
++		return "", err
1656 
++	}
1657 
++	// Note: Kubelet running on the worker node do not need to call VKE.
1658 
++	if strings.HasPrefix(hostname, MasterPrefix) {
1659 
++		_, err := cc.apiClient.GetVM(instanceID)
1660 
++		if err != nil {
1661 
++			switch err.(type) {
1662 
++			case APIError:
1663 
++				if err.(APIError).ErrorCode == VMNotFoundError {
1664 
++					// If instance no longer exists, we will return instance not found error
1665 
++					glog.Warningf("Cascade Cloud Provider: VM %s does not exist", instanceID)
1666 
++					return "", cloudprovider.InstanceNotFound
1667 
++				}
1668 
++			}
1669 
++		}
1670 
++	}
1671 
++	return instanceID, nil
1672 
++}
1673 
++
1644 1674 
 +// InstanceTypeByProviderID returns the cloudprovider instance type of the node with the specified unique providerID
1645 1675 
 +// This method will not be called from the node that is requesting this ID. i.e. metadata service
1646 1676 
 +// and other local methods cannot be used here
... ... 
@@ -4198,10 +4883,10 @@ index 0000000..97c0856
4198 4198 
 \ No newline at end of file
4199 4199 
 diff --git a/plugin/pkg/admission/vke/admission.go b/plugin/pkg/admission/vke/admission.go
4200 4200 
 new file mode 100644
4201 
-index 0000000..37f82d9
4201 
+index 0000000..f850e26
4202 4202 
 --- /dev/null
4203 4203 
 +++ b/plugin/pkg/admission/vke/admission.go
4204 
-@@ -0,0 +1,587 @@
4204 
+@@ -0,0 +1,618 @@
4205 4205 
 +package vke
4206 4206 
 +
4207 4207 
 +import (
... ... 
@@ -4229,8 +4914,9 @@ index 0000000..37f82d9
4229 4229 
 +	// PluginName indicates name of admission plugin.
4230 4230 
 +	PluginName = "VMwareAdmissionController"
4231 4231 
 +
4232 
-+	systemUnsecuredUser      = "system:unsecured"
4233 4232 
 +	systemNodesGroup         = "system:nodes"
4233 
++	systemMastersGroup       = "system:masters"
4234 
++	systemWorkerGroup        = "system:worker"
4234 4235 
 +	privilegedNamespace      = "vke-system"
4235 4236 
 +	privilegedServiceAccount = "system:serviceaccount:" + privilegedNamespace + ":"
4236 4237 
 +	reservedPrefix           = "vke"
... ... 
@@ -4282,12 +4968,12 @@ index 0000000..37f82d9
4282 4282 
 +		return nil
4283 4283 
 +	}
4284 4284 
 +
4285 
-+	if isSystemUnsecuredUser(a) {
4286 
-+		return validateSystemUnsecuredUser(vac, a)
4285 
++	if isCertificateFromMaster(a) {
4286 
++		return validateCertificateFromMaster(vac, a)
4287 4287 
 +	}
4288 4288 
 +
4289 
-+	if isCertificateFromNode(a) {
4290 
-+		return validateCertificateFromNode(a)
4289 
++	if isCertificateFromWorker(a) {
4290 
++		return validateCertificateFromWorker(a)
4291 4291 
 +	}
4292 4292 
 +
4293 4293 
 +	if isPrivilegedServiceAccount(a) {
... ... 
@@ -4441,17 +5127,19 @@ index 0000000..37f82d9
4441 4441 
 +	return false
4442 4442 
 +}
4443 4443 
 +
4444 
-+func isSystemUnsecuredUser(a admission.Attributes) bool {
4445 
-+	return a.GetUserInfo().GetName() == systemUnsecuredUser
4444 
++func isCertificateFromMaster(a admission.Attributes) bool {
4445 
++	groups := a.GetUserInfo().GetGroups()
4446 
++	for _, group := range groups {
4447 
++		if group == systemMastersGroup {
4448 
++			return true
4449 
++		}
4450 
++	}
4451 
++	return false
4446 4452 
 +}
4447 4453 
 +
4448 
-+func validateSystemUnsecuredUser(vac *vmwareAdmissionController, a admission.Attributes) (err error) {
4449 
-+	// Currently the insecure port 8080 is exposed to only localhost inside the Kubernetes master VMs. So it can be used
4450 
-+	// only by kube-controller-manager, kube-scheduler and cloud-init script which creates our pods and other resources.
4451 
-+	// When a call comes on insecure port 8080, Kubernetes assigns them system:unsecured user name. We need to allow
4452 
-+	// this so that our master components can be started successfully and kube-controller-manager and kube-scheduler can
4453 
-+	// work as expected.
4454 
-+	// But this needs to be allowed only inside our privileged namespace. If the request comes to any other namespace,
4454 
++func validateCertificateFromMaster(vac *vmwareAdmissionController, a admission.Attributes) (err error) {
4455 
++	// kube-controller-manager, kube-scheduler and cloud-init script which creates our pods and other resources can use
4456 
++	// the master certificate to create pods in privileged namespace. If the request comes to any other namespace,
4455 4457 
 +	// we need to make it go through our pod validation. This is needed because a user can create a deployment or
4456 4458 
 +	// replica set which has a privileged pod. Since our admission controller does not look at deployments or replica
4457 4459 
 +	// sets, we will allow it. The actual pod inside the deployment or replica set will be created by the
... ... 
@@ -4465,26 +5153,47 @@ index 0000000..37f82d9
4465 4465 
 +	return nil
4466 4466 
 +}
4467 4467 
 +
4468 
-+func isCertificateFromNode(a admission.Attributes) bool {
4469 
-+	// If the request came from a user with group = systemNodesGroup, then we assume that the request comes from a node
4470 
-+	// which uses a certificate for authentication.
4468 
++func isCertificateFromWorker(a admission.Attributes) bool {
4471 4469 
 +	groups := a.GetUserInfo().GetGroups()
4472 4470 
 +	for _, group := range groups {
4473 
-+		if group == systemNodesGroup {
4471 
++		if group == systemWorkerGroup {
4474 4472 
 +			return true
4475 4473 
 +		}
4476 4474 
 +	}
4477 4475 
 +	return false
4478 4476 
 +}
4479 4477 
 +
4480 
-+func validateCertificateFromNode(a admission.Attributes) error {
4481 
-+	// Block exec operations into pods for nodes. This is needed to block someone from using Kubelet's certificate to
4478 
++func isCreatingPodsThroughControllerManager(resource string) bool {
4479 
++	// If the resource is one of the following, it means the controller manager will create a pod for them and not the
4480 
++	// user directly. So, we need to identify these cases and block them in certain scenarios.
4481 
++	if resource == "deployments" ||
4482 
++		resource == "replicasets" ||
4483 
++		resource == "replicationcontrollers" ||
4484 
++		resource == "statefulsets" ||
4485 
++		resource == "daemonsets" ||
4486 
++		resource == "jobs" ||
4487 
++		resource == "cronjobs" {
4488 
++		return true
4489 
++	}
4490 
++	return false
4491 
++}
4492 
++
4493 
++func validateCertificateFromWorker(a admission.Attributes) error {
4494 
++	// Block exec operations into pods for workers. This is needed to block someone from using Kubelet's certificate to
4482 4495 
 +	// exec into privileged pods running on the master. Other operations with the node certificate like modifying master
4483 4496 
 +	// node, creating pods on master node, etc. are blocked by the node restriction admission controller.
4484 
-+	if a.GetResource().GroupResource() == api.Resource("pods") && a.GetOperation() == admission.Connect {
4497 
++	resource := a.GetResource().GroupResource()
4498 
++	if resource == api.Resource("pods") && a.GetOperation() == admission.Connect {
4485 4499 
 +		return admission.NewForbidden(a,
4486 4500 
 +			fmt.Errorf("%s validation failed: cannot modify pods in namespace %s", PluginName, a.GetNamespace()))
4487 4501 
 +	}
4502 
++
4503 
++	// Block creation of pods indirectly by going through the controller manager.
4504 
++	if isCreatingPodsThroughControllerManager(resource.Resource) {
4505 
++		return admission.NewForbidden(a,
4506 
++			fmt.Errorf("%s validation failed: cannot modify %s in namespace %s", PluginName, resource.Resource, a.GetNamespace()))
4507 
++	}
4508 
++
4488 4509 
 +	return nil
4489 4510 
 +}
4490 4511 
 +
... ... 
@@ -4518,7 +5227,8 @@ index 0000000..37f82d9
4518 4518 
 +	// we block it. This is needed so that we can block exec access into privileged pods running on the master. Also,
4519 4519 
 +	// privileged service account does not need to perform these operations. So, just to be extra cautious we also block
4520 4520 
 +	// off create and update pods.
4521 
-+	if a.GetResource().GroupResource() == api.Resource("pods") {
4521 
++	resource := a.GetResource().GroupResource()
4522 
++	if resource == api.Resource("pods") {
4522 4523 
 +		// Allow Delete operation on pods
4523 4524 
 +		if a.GetOperation() == admission.Delete {
4524 4525 
 +			return nil
... ... 
@@ -4536,7 +5246,7 @@ index 0000000..37f82d9
4536 4536 
 +
4537 4537 
 +	// If the privileged service account tries to update taints on the master node, we block. We need to do this so that
4538 4538 
 +	// a user cannot use a privileged service account to untaint the node and run pods on a master.
4539 
-+	if a.GetResource().GroupResource() == api.Resource("nodes") {
4539 
++	if resource == api.Resource("nodes") {
4540 4540 
 +		if a.GetOperation() == admission.Update && strings.HasPrefix(a.GetName(), masterNodePrefix) {
4541 4541 
 +			node, ok := a.GetObject().(*api.Node)
4542 4542 
 +			if !ok {
... ... 
@@ -4556,6 +5266,12 @@ index 0000000..37f82d9
4556 4556 
 +		}
4557 4557 
 +	}
4558 4558 
 +
4559 
++	// Block creation of pods indirectly by going through the controller manager.
4560 
++	if isCreatingPodsThroughControllerManager(resource.Resource) {
4561 
++		return admission.NewForbidden(a,
4562 
++			fmt.Errorf("%s validation failed: cannot modify %s in namespace %s", PluginName, resource.Resource, a.GetNamespace()))
4563 
++	}
4564 
++
4559 4565 
 +	return nil
4560 4566 
 +}
4561 4567 
 +
... ... 
@@ -4791,10 +5507,10 @@ index 0000000..37f82d9
4791 4791 
 +}
4792 4792 
 diff --git a/plugin/pkg/admission/vke/admission_test.go b/plugin/pkg/admission/vke/admission_test.go
4793 4793 
 new file mode 100644
4794 
-index 0000000..c597663
4794 
+index 0000000..684fad4
4795 4795 
 --- /dev/null
4796 4796 
 +++ b/plugin/pkg/admission/vke/admission_test.go
4797 
-@@ -0,0 +1,952 @@
4797 
+@@ -0,0 +1,960 @@
4798 4798 
 +package vke
4799 4799 
 +
4800 4800 
 +import (
... ... 
@@ -5155,16 +5871,10 @@ index 0000000..c597663
5155 5155 
 +			userInfo:           newTestUserBuilder().withGroup(testServiceAccountsGroup).build(),
5156 5156 
 +			shouldPassValidate: true,
5157 5157 
 +		},
5158 
-+		"allowed: systemUnsecuredUser creates pod in vke-system namespace": {
5159 
-+			operation:          kadmission.Create,
5160 
-+			pod:                newTestPodBuilder().withNamespace(privilegedNamespace).build(),
5161 
-+			userInfo:           newTestUserBuilder().withName(systemUnsecuredUser).build(),
5162 
-+			shouldPassValidate: true,
5163 
-+		},
5164 
-+		"allowed: kubelet group creates pod in vke-system namespace": {
5158 
++		"allowed: systemMasters group creates pod in vke-system namespace": {
5165 5159 
 +			operation:          kadmission.Create,
5166 5160 
 +			pod:                newTestPodBuilder().withNamespace(privilegedNamespace).build(),
5167 
-+			userInfo:           newTestUserBuilder().withGroup(systemNodesGroup).withName("system:node:worker").build(),
5161 
++			userInfo:           newTestUserBuilder().withGroup(systemMastersGroup).build(),
5168 5162 
 +			shouldPassValidate: true,
5169 5163 
 +		},
5170 5164 
 +		"denied: regular lightwave group does not grant privileged access": {
... ... 
@@ -5179,10 +5889,10 @@ index 0000000..c597663
5179 5179 
 +			userInfo:           newTestUserBuilder().withGroup("test1\\group1").withGroup(testServiceAccountsGroup).build(),
5180 5180 
 +			shouldPassValidate: true,
5181 5181 
 +		},
5182 
-+		"denied: kubelet exec into pod": {
5182 
++		"denied: worker kubelet exec into pod": {
5183 5183 
 +			operation:          kadmission.Connect,
5184 5184 
 +			pod:                newTestPodBuilder().build(),
5185 
-+			userInfo:           newTestUserBuilder().withGroup("system:nodes").build(),
5185 
++			userInfo:           newTestUserBuilder().withGroup("system:worker").build(),
5186 5186 
 +			shouldPassValidate: false,
5187 5187 
 +		},
5188 5188 
 +	}
... ... 
@@ -5319,12 +6029,12 @@ index 0000000..c597663
5319 5319 
 +			userInfo:           newTestUserBuilder().build(),
5320 5320 
 +			shouldPassValidate: false,
5321 5321 
 +		},
5322 
-+		"allowed: systemUnsecuredUser update clusterroles with vke: prefix": {
5322 
++		"allowed: systemMasters group update clusterroles with vke: prefix": {
5323 5323 
 +			operation:          kadmission.Update,
5324 5324 
 +			resource:           "clusterroles",
5325 5325 
 +			name:               "vke:clusterrole",
5326 5326 
 +			namespace:          "",
5327 
-+			userInfo:           newTestUserBuilder().withName(systemUnsecuredUser).build(),
5327 
++			userInfo:           newTestUserBuilder().withGroup(systemMastersGroup).build(),
5328 5328 
 +			shouldPassValidate: true,
5329 5329 
 +		},
5330 5330 
 +		"allowed: regular lightwave user create clusterrolebindings": {
... ... 
@@ -5351,12 +6061,12 @@ index 0000000..c597663
5351 5351 
 +			userInfo:           newTestUserBuilder().build(),
5352 5352 
 +			shouldPassValidate: false,
5353 5353 
 +		},
5354 
-+		"allowed: systemUnsecuredUser update clusterrolebindings with vke: prefix": {
5354 
++		"allowed: systemMastersGroup update clusterrolebindings with vke: prefix": {
5355 5355 
 +			operation:          kadmission.Update,
5356 5356 
 +			resource:           "clusterrolebindings",
5357 5357 
 +			name:               "vke:clusterrolebinding",
5358 5358 
 +			namespace:          "",
5359 
-+			userInfo:           newTestUserBuilder().withName(systemUnsecuredUser).build(),
5359 
++			userInfo:           newTestUserBuilder().withGroup(systemMastersGroup).build(),
5360 5360 
 +			shouldPassValidate: true,
5361 5361 
 +		},
5362 5362 
 +		"allowed: regular lightwave user update worker nodes": {
... ... 
@@ -5445,11 +6155,11 @@ index 0000000..c597663
5445 5445 
 +			userInfo:           newTestUserBuilder().build(),
5446 5446 
 +			shouldPassValidate: false,
5447 5447 
 +		},
5448 
-+		"allowed: systemUnsecuredUser update nodes": {
5448 
++		"allowed: systemMasters group update nodes": {
5449 5449 
 +			operation:          kadmission.Update,
5450 5450 
 +			resource:           "nodes",
5451 5451 
 +			namespace:          "",
5452 
-+			userInfo:           newTestUserBuilder().withName(systemUnsecuredUser).build(),
5452 
++			userInfo:           newTestUserBuilder().withGroup(systemMastersGroup).build(),
5453 5453 
 +			shouldPassValidate: true,
5454 5454 
 +		},
5455 5455 
 +		"allowed: kubelet update node": {
... ... 
@@ -5479,6 +6189,20 @@ index 0000000..c597663
5479 5479 
 +			userInfo:           newTestUserBuilder().withName(privilegedServiceAccount + "default").build(),
5480 5480 
 +			shouldPassValidate: false,
5481 5481 
 +		},
5482 
++		"denied: privileged service account create a deployment": {
5483 
++			operation:          kadmission.Create,
5484 
++			resource:           "deployments",
5485 
++			namespace:          "vke-system",
5486 
++			userInfo:           newTestUserBuilder().withName(privilegedServiceAccount + "default").build(),
5487 
++			shouldPassValidate: false,
5488 
++		},
5489 
++		"denied: worker kubelet create a deployment": {
5490 
++			operation:          kadmission.Create,
5491 
++			resource:           "deployments",
5492 
++			namespace:          "vke-system",
5493 
++			userInfo:           newTestUserBuilder().withGroup(systemWorkerGroup).build(),
5494 
++			shouldPassValidate: false,
5495 
++		},
5482 5496 
 +	}
5483 5497 
 +	for k, v := range tests {
5484 5498 
 +		testResourceValidation(k, v.operation, v.resource, v.subresource, v.name, v.namespace, v.userInfo, v.object,
... ... 
@@ -6670,7 +7394,7 @@ index 85c7b63..b97b2f1 100644
6670 6670 
  			iNdEx = preIndex
6671 6671 
  			skippy, err := skipGenerated(dAtA[iNdEx:])
6672 6672 
 diff --git a/staging/src/k8s.io/api/core/v1/types.go b/staging/src/k8s.io/api/core/v1/types.go
6673 
-index 08ef419..6fb4d80 100644
6673 
+index 36f4567..7b280cd 100644
6674 6674 
 --- a/staging/src/k8s.io/api/core/v1/types.go
6675 6675 
 +++ b/staging/src/k8s.io/api/core/v1/types.go
6676 6676 
 @@ -333,9 +333,9 @@ type VolumeSource struct {
... ... 
@@ -6734,6 +7458,101 @@ index 08ef419..6fb4d80 100644
6734 6734 
  // Adapts a ConfigMap into a volume.
6735 6735 
  //
6736 6736 
  // The contents of the target ConfigMap's Data field will be presented in a
6737 
+diff --git a/staging/src/k8s.io/api/core/v1/zz_generated.deepcopy.go b/staging/src/k8s.io/api/core/v1/zz_generated.deepcopy.go
6738 
+index ebdcb89..a04787f 100644
6739 
+--- a/staging/src/k8s.io/api/core/v1/zz_generated.deepcopy.go
6740 
+@@ -321,6 +321,22 @@ func (in *Capabilities) DeepCopy() *Capabilities {
6741 
+ }
6742 
+
6743 
+ // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
6744 
++func (in *CascadeDiskVolumeSource) DeepCopyInto(out *CascadeDiskVolumeSource) {
6745 
++	*out = *in
6746 
++	return
6747 
++}
6748 
++
6749 
++// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CascadeDiskVolumeSource.
6750 
++func (in *CascadeDiskVolumeSource) DeepCopy() *CascadeDiskVolumeSource {
6751 
++	if in == nil {
6752 
++		return nil
6753 
++	}
6754 
++	out := new(CascadeDiskVolumeSource)
6755 
++	in.DeepCopyInto(out)
6756 
++	return out
6757 
++}
6758 
++
6759 
++// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
6760 
+ func (in *CephFSPersistentVolumeSource) DeepCopyInto(out *CephFSPersistentVolumeSource) {
6761 
+ 	*out = *in
6762 
+ 	if in.Monitors != nil {
6763 
+@@ -3247,13 +3263,13 @@ func (in *PersistentVolumeSource) DeepCopyInto(out *PersistentVolumeSource) {
6764 
+ 			**out = **in
6765 
+ 		}
6766 
+ 	}
6767 
+-	if in.AzureDisk != nil {
6768 
+-		in, out := &in.AzureDisk, &out.AzureDisk
6769 
++	if in.CascadeDisk != nil {
6770 
++		in, out := &in.CascadeDisk, &out.CascadeDisk
6771 
+ 		if *in == nil {
6772 
+ 			*out = nil
6773 
+ 		} else {
6774 
+-			*out = new(AzureDiskVolumeSource)
6775 
+-			(*in).DeepCopyInto(*out)
6776 
++			*out = new(CascadeDiskVolumeSource)
6777 
++			**out = **in
6778 
+ 		}
6779 
+ 	}
6780 
+ 	if in.PhotonPersistentDisk != nil {
6781 
+@@ -3310,6 +3326,15 @@ func (in *PersistentVolumeSource) DeepCopyInto(out *PersistentVolumeSource) {
6782 
+ 			(*in).DeepCopyInto(*out)
6783 
+ 		}
6784 
+ 	}
6785 
++	if in.AzureDisk != nil {
6786 
++		in, out := &in.AzureDisk, &out.AzureDisk
6787 
++		if *in == nil {
6788 
++			*out = nil
6789 
++		} else {
6790 
++			*out = new(AzureDiskVolumeSource)
6791 
++			(*in).DeepCopyInto(*out)
6792 
++		}
6793 
++	}
6794 
+ 	return
6795 
+ }
6796 
+
6797 
+@@ -5871,13 +5896,13 @@ func (in *VolumeSource) DeepCopyInto(out *VolumeSource) {
6798 
+ 			**out = **in
6799 
+ 		}
6800 
+ 	}
6801 
+-	if in.AzureDisk != nil {
6802 
+-		in, out := &in.AzureDisk, &out.AzureDisk
6803 
++	if in.CascadeDisk != nil {
6804 
++		in, out := &in.CascadeDisk, &out.CascadeDisk
6805 
+ 		if *in == nil {
6806 
+ 			*out = nil
6807 
+ 		} else {
6808 
+-			*out = new(AzureDiskVolumeSource)
6809 
+-			(*in).DeepCopyInto(*out)
6810 
++			*out = new(CascadeDiskVolumeSource)
6811 
++			**out = **in
6812 
+ 		}
6813 
+ 	}
6814 
+ 	if in.PhotonPersistentDisk != nil {
6815 
+@@ -5925,6 +5950,15 @@ func (in *VolumeSource) DeepCopyInto(out *VolumeSource) {
6816 
+ 			(*in).DeepCopyInto(*out)
6817 
+ 		}
6818 
+ 	}
6819 
++	if in.AzureDisk != nil {
6820 
++		in, out := &in.AzureDisk, &out.AzureDisk
6821 
++		if *in == nil {
6822 
++			*out = nil
6823 
++		} else {
6824 
++			*out = new(AzureDiskVolumeSource)
6825 
++			(*in).DeepCopyInto(*out)
6826 
++		}
6827 
++	}
6828 
+ 	return
6829 
+ }
6830 
+
6737 6831 
 --
6738 6832 
 2.7.4
6739 6833
SPECS/kubernetes/kubernetes-1.10.spec
History View file @ efda3f0
... ... 
@@ -1,11 +1,11 @@
1 1 
 Summary:        Kubernetes cluster management
2 2 
 Name:           kubernetes
3 
-Version:        1.10.2
4 
-Release:        13%{?dist}
3 
+Version:        1.10.8
4 
+Release:        1%{?dist}
5 5 
 License:        ASL 2.0
6 6 
 URL:            https://github.com/kubernetes/kubernetes/archive/v%{version}.tar.gz
7 7 
 Source0:        kubernetes-%{version}.tar.gz
8 
-%define sha1    kubernetes-%{version}.tar.gz=e1cef85820ff16265788c96a6fd31056bfaf247c
8 
+%define sha1    kubernetes-%{version}.tar.gz=a9b944ec9f07b08e8982df4e72c1d29e05564c71
9 9 
 Source1:        https://github.com/kubernetes/contrib/archive/contrib-0.7.0.tar.gz
10 10 
 %define sha1    contrib-0.7.0=47a744da3b396f07114e518226b6313ef4b2203c
11 11 
 Patch0:         k8s-1.10-vke.patch
... ... 
@@ -207,6 +207,8 @@ fi
207 207 
 /opt/vmware/kubernetes/windows/amd64/kubectl.exe
208 208
209 209 
 %changelog
210 
+*   Thu Oct 04 2018 Dheeraj Shetty <dheerajs@vmware.com> 1.10.8-1
211 
+-   Update to k8s version 1.10.8 with VKE patch
210 212 
 *   Tue Sep 11 2018 Dheeraj Shetty <dheerajs@vmware.com> 1.10.2-13
211 213 
 -   Update vke patch (8033c471)
212 214 
 *   Mon Aug 22 2018 Dheeraj Shetty <dheerajs@vmware.com> 1.10.2-12