public/k3s
1
0
Fork 0
mirror of https://git.vectorsigma.ru/public/k3s.git synced 2026-07-29 17:59:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

[release-1.20] - Backport K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token (#3516)

Browse Source 
* Fix storing bootstrap data with empty token string (#3422)

* Fix storing bootstrap data with empty token string

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* delete node password secret after restoration

fixes to bootstrap key

vendor update

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fix comment

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fix typo

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* more fixes

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fixes

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fixes

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* typos

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* Removing dynamic listener file after restoration

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go mod tidy

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go mod vendor

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fix a runtime core panic

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* update kine

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* revert the helm controller update

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* Fix calling delete in kine

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
This commit is contained in:
Hussein Galal
2021-07-13 22:58:58 +02:00
committed by GitHub
parent 5b791c1387
commit cd6e3ccd31
52 changed files with 3195 additions and 200 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
pkg/cluster/https.go
View File

@@ -6,6 +6,7 @@ import (
"log"
"net"
"net/http"
"os"
"path/filepath"
"github.com/rancher/dynamiclistener"
@@ -14,6 +15,7 @@ import (
"github.com/rancher/dynamiclistener/storage/kubernetes"
"github.com/rancher/dynamiclistener/storage/memory"
"github.com/rancher/k3s/pkg/daemons/config"
"github.com/rancher/k3s/pkg/etcd"
"github.com/rancher/k3s/pkg/version"
"github.com/rancher/wrangler-api/pkg/generated/controllers/core"
"github.com/sirupsen/logrus"
@@ -24,16 +26,21 @@ import (
// dynamiclistener will use the cluster's Server CA to sign the dynamically generate certificate,
// and will sync the certs into the Kubernetes datastore, with a local disk cache.
func (c *Cluster) newListener(ctx context.Context) (net.Listener, http.Handler, error) {
if c.managedDB != nil {
if _, err := os.Stat(etcd.ResetFile(c.config)); err == nil {
// delete the dynamic listener file if it exists after restoration to fix restoration
// on fresh nodes
os.Remove(filepath.Join(c.config.DataDir, "tls/dynamic-cert.json"))
}
}
tcp, err := dynamiclistener.NewTCPListener(c.config.BindAddress, c.config.SupervisorPort)
if err != nil {
return nil, nil, err
}
cert, key, err := factory.LoadCerts(c.runtime.ServerCA, c.runtime.ServerCAKey)
if err != nil {
return nil, nil, err
}
storage := tlsStorage(ctx, c.config.DataDir, c.runtime)
return dynamiclistener.NewListener(tcp, storage, cert, key, dynamiclistener.Config{
ExpirationDaysCheck: config.CertificateRenewDays,