Commit Graph

1241 Commits

Author SHA1 Message Date
Brad Davidson
1aa0eac285 Print key instead of file path in snapshot metadata log message
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-11-21 14:49:38 -08:00
Brad Davidson
0624d2a51f Don't apply s3 retention if S3 client failed to initialize
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-11-21 14:49:38 -08:00
Brad Davidson
0473839f16 Don't request metadata when listing objects
While some implementations may support it, it appears that most don't,
and some may in fact return an error if it is requested.

We already stat the object to get the metadata anyway, so this was
unnecessary if harmless on most implementations.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-11-21 14:49:38 -08:00
Brad Davidson
f270db4bbb Reorder snapshot configmap reconcile to reduce log spew during initial startup
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-11-17 10:09:38 -08:00
Manuel Buil
8cf46ed4a3 Improve dualStack log
Signed-off-by: Manuel Buil <mbuil@suse.com>
2023-11-17 09:17:32 +01:00
Vitor Savian
fd676a5a64 Handle nil pointer when runtime core is not ready in etcd
Signed-off-by: Vitor <vitor.savian@suse.com>
2023-11-16 15:46:46 -08:00
Brad Davidson
12e64c8b47 Go generate
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-11-16 09:55:41 -08:00
Brad Davidson
a7f71bb5f2 Add jitter to client config retry
Also:
* Replaces labeled for/continue RETRY loops with wait helpers for improved readability
* Pulls secrets and nodes from cache for node password verification
* Migrate nodepassword tests to wrangler mocks for better code reuse

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-11-16 09:55:41 -08:00
Harsimran Singh Maan
dd1787d026 Disable helm CRD installation for disable-helm-controller (#8702)
* Disable helm CRD installation for disable-helm-controller
    The NewContext package requires config as input which would
    require all third-party callers to update when the new go module
    is published.

    This change only affects the behaviour of installation of helm
    CRDs. Existing helm crds installed in a cluster would not be removed
    when disable-helm-controller flag is set on the server.

    Addresses #8701
* address review comments
* remove redundant check

Signed-off-by: Harsimran Singh Maan <maan.harry@gmail.com>
(cherry picked from commit abc2efdd57)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-11-16 09:55:41 -08:00
Jason Costello
7d1034ab20 Tweaked order of ingress IPs in ServiceLB (#8711)
* Tweaked order of ingress IPs in ServiceLB
    Previously, ingress IPs were only string-sorted when returned
    Sorted by IP family and string-sorted in each family as part of
    filterByIPFamily method
* Update pkg/cloudprovider/servicelb.go
* Formatting

Signed-off-by: Jason Costello <jason@hazy.com>
Co-authored-by: Brad Davidson <brad@oatmail.org>
(cherry picked from commit 07ee854914)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-11-16 09:55:41 -08:00
Brad Davidson
248a009de5 Skip initial datastore reconcile during cluster-reset
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 7ecd5874d2)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-11-16 09:55:41 -08:00
Brad Davidson
6f489f08f9 Fix issue with snapshot metadata configmap
Omit snapshot list configmap entries for snapshots without extra metadata; reduce log level of warnings about missing s3 metadata files.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 2088218c5f)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-11-16 09:55:41 -08:00
chenk008
df7b982107 add agent flag disable-apiserver-lb (#8717)
* add node flag disable-agent-lb
* add agent flag disable-apiserver-lb

Co-authored-by: Brad Davidson <brad@oatmail.org>
Signed-off-by: chenk008 <kongchen28@gmail.com>
(cherry picked from commit b47cbbfd42)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-11-16 09:55:41 -08:00
Oliver Larsson
d7c1ac7ab6 QoS-class resource configuration
Problem:
Configuring qos-class features in containerd requres a custom containerd configuration template.

Solution:
Look for configuration files in default locations and configure containerd to use them if they exist.

Signed-off-by: Oliver Larsson <larsson.e.oliver@gmail.com>
(cherry picked from commit 30c8ad926d)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-11-16 09:55:41 -08:00
Hussein Galal
27106c47fc Add warning for multiclustercidr flag (#8759)
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
2023-11-14 01:28:09 +02:00
Vitor Savian
3377e9d809 Added etcd status condition
* Added ADR for etcd status

Signed-off-by: Vitor <vitor.savian@suse.com>

* Added etcd status condition

Signed-off-by: Vitor <vitor.savian@suse.com>

---------

Signed-off-by: Vitor <vitor.savian@suse.com>
2023-11-13 11:05:04 -08:00
Hussein Galal
575bce7689 Update traefik to fix registry value (#8789)
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
2023-11-06 22:55:59 +02:00
Hussein Galal
1f0c784a93 [release-1.27] Update traefik chart to v25.0.0 (#8775)
* Upgrade traefik chart to v25.0.0

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go generate

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

---------

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
2023-11-03 19:10:28 +02:00
Derek Nola
40ee2725ee Fix SystemdCgroup in templates_linux.go (#8765)
Signed-off-by: Derek Nola <derek.nola@suse.com>
2023-11-02 13:41:38 -07:00
Brad Davidson
b6f23014b2 Don't try to read token hash and cluster id during cluster-reset
These fields are only necessary when saving snapshots to S3, and will block restoration if attempted

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-27 15:06:50 -07:00
Brad Davidson
0f6e77feaa Manually requeue configmap reconcile when no nodes have reconciled snapshots
Silences error message from lasso - this is a normal startup condition
when no snapshots exist so we shouldn't log nasty looking errors.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-18 15:09:39 -07:00
Brad Davidson
edc3fb2804 Re-enable etcd endpoint auto-sync
Removing this in 002e6c43ee regressed
control-plane-only nodes, as we rely on the etcd client to update its
endpoint list internally so that we can use it to sync the load-balancer
address list.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-18 15:09:39 -07:00
Edgar Lee
55e61670c3 Add --image-service-endpoint flag (#8279)
* Add --image-service-endpoint flag

Problem:
External container runtime can be set but image service endpoint is unchanged
and also is not exposed as a flag. This is useful for using containerd
snapshotters outside of the ones that have built-in support like
stargz-snapshotter.

Solution:
Add a flag --image-service-endpoint and also default image service endpoint to
container runtime endpoint if set.

Signed-off-by: Edgar Lee <edgarhinshunlee@gmail.com>
(cherry picked from commit fe18b1fce9)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-17 10:44:19 -07:00
Brad Davidson
b0fb6f343e Fix CloudDualStackNodeIPs feature-gate inconsistency
Enable the feature-gate for both kubelet and cloud-controller-manager. Enabling it on only one side breaks RKE2, where feature-gates are not shared due to running in different processes.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-17 10:43:37 -07:00
Sean Yen
dbea2e68c8 Windows support
Signed-off-by: Sean Yen <seanyen@microsoft.com>
2023-10-16 23:14:58 +02:00
Derek Nola
40f29507c7 Use version.Program not K3s in log (#8656)
Signed-off-by: Derek Nola <derek.nola@suse.com>
2023-10-16 12:26:27 -07:00
Brad Davidson
78e57bc970 Start etcd client before ensuring self removal
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-14 00:38:56 -07:00
Brad Davidson
22f8d28ba6 Bump traefik, golang.org/x/net, google.golang.org/grpc
Fixes exposure to CVE-2023-39325

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-13 11:09:28 -07:00
Brad Davidson
52c7d6c91d Add server token hash to CR and S3
This required pulling the token hash stuff out of the cluster package, into util.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit d885162967)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-13 11:09:28 -07:00
Brad Davidson
e7014cf859 Switch to managing ETCDSnapshotFile resources
Reconcile snapshot CRs instead of ConfigMap; manage ConfigMap downstream from CR list

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 550ab36ab7)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-13 11:09:28 -07:00
Brad Davidson
22c0916abd Move snapshot delete into local/s3 functions
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 5cd4f69bfa)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-13 11:09:28 -07:00
Brad Davidson
1a448d4b45 Sort snapshots by time and key in tabwriter output
Fixes snapshot list coming out in non-deterministic order

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit a15b804e00)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-13 11:09:28 -07:00
Brad Davidson
df0fd0de49 Store extra metadata and cluster ID for snapshots
Write the extra metadata both locally and to S3. These files are placed such that they will not be used by older versions of K3s that do not make use of them.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 7464007037)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-13 11:09:28 -07:00
Brad Davidson
7375740ed4 Move s3 snapshot list functionality to s3.go
Also, don't list ONLY s3 snapshots if S3 is enabled.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 80f909d0ca)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-13 11:09:28 -07:00
Brad Davidson
487b3948a3 Consistently set snapshotFile timestamp
Attempt to use timestamp from creation or filename instead of file/object modification times

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 8d47645312)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-13 11:09:28 -07:00
Brad Davidson
d270e97825 Tidy s3 upload functions
Consistently refer to object keys as such, simplify error handling.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit f1afe153a3)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-13 11:09:28 -07:00
Brad Davidson
7a0eecd601 Elide old snapshot data when apiserver rejects configmap with ErrRequestEntityTooLarge
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 2b0e2e8ada)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-13 11:09:28 -07:00
Brad Davidson
eed767ea74 Move etcd snapshot code into separate file
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 676b00aa0e)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-13 11:09:28 -07:00
Brad Davidson
2370a75097 Add new CRD for etcd snapshots
Also adds a hack go script to print the embedded CRDs, for developer use.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 500744bb94)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-13 11:09:28 -07:00
Brad Davidson
3237b0e0a2 Bump busybox to v1.36.1
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 9bb1ce1253)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-13 11:09:28 -07:00
Brad Davidson
b92dba32f4 Pass SystemdCgroup setting through to nvidia runtime options
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 0e5c760625)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-13 11:09:28 -07:00
Brad Davidson
9826b553c9 Disable HTTP on main etcd client port
Fixes performance issue under load, ref: https://github.com/etcd-io/etcd/issues/15402 and https://github.com/kubernetes/kubernetes/pull/118460

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 8c73fd670b)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-13 11:09:28 -07:00
Roberto Bonafiglia
9ce7972ea3 Use IPv6 in case is the first configured IP with dualstack
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2023-10-13 10:24:56 +02:00
Derek Nola
f294e2b22e [Release-1.27] Clear remove annotations on cluster reset (#8587)
* Use admin kubeconfig instead of supervisor for etcd snapshot CLI

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Skip creating CRDs and setting up event recorder for CLI controller context

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Don't export functions not needed outside the etcd package

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Reorganize Driver interface and etcd driver to avoid passing context and config into most calls

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Clear remove annotations on cluster reset; refuse to delete last member from cluster

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

---------

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Co-authored-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-11 16:17:50 -07:00
Derek Nola
d451d4f34f Server Token Rotation (#8576)
* Consolidate NewCertCommands
* Add support for user defined new token
* Add E2E testlets



* Ensure agent token also changes

Signed-off-by: Derek Nola <derek.nola@suse.com>
2023-10-10 13:03:09 -07:00
Roberto Bonafiglia
5606a23946 Fixed tailscale node IP dualstack mode in case of IPv4 only node
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2023-10-10 10:37:18 +02:00
Manuel Buil
9c70ee4091 Network defaults are duplicated, remove one
Signed-off-by: Manuel Buil <mbuil@suse.com>
2023-10-04 08:24:10 +02:00
Manuel Buil
dbb6280d70 Take IPFamily precedence based on order
Signed-off-by: Manuel Buil <mbuil@suse.com>
2023-09-29 12:38:16 +02:00
Manuel Buil
88fa074c4f ipFamilyPolicy:PreferDualStack for coredns and metrics-server
Signed-off-by: Manuel Buil <mbuil@suse.com>
2023-09-29 12:37:48 +02:00
Manuel Buil
b91ce1f05d Merge pull request #8464 from manuelbuil/vpnExtraArgs127
[Release-1.27] Add extraArgs to tailscale
2023-09-28 10:05:28 +02:00