public/k3s
1
0
Fork 0
mirror of https://git.vectorsigma.ru/public/k3s.git synced 2026-08-02 11:19:50 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,516 Commits 31 Branches 949 Tags
1e2dacf7dd67bc06c9c1ab76c80feb951a19a289
Commit Graph

1066 Commits

Author SHA1 Message Date
Brad Davidson
1e2dacf7dd Fix ServiceLB dual-stack ingress IP listing 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-21 14:14:24 -08:00
Roberto Bonafiglia
bbd7fecf58 Update flannel to v0.21.1 
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
 2023-02-15 18:18:48 +01:00
Brad Davidson
beb9c727c0 Fix CACertPath stripping trailing path components 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-14 13:20:52 -08:00
Brad Davidson
2fa8a7ef43 Fix etcd member deletion 
Turns out etcd-only nodes were never running **any** of the controllers,
so allowing multiple controllers didn't really fix things.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-14 13:20:52 -08:00
Brad Davidson
0f7514e08f Allow for multiple sets of leader-elected controllers 
Addresses an issue where etcd controllers did not run on etcd-only nodes

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-10 14:04:01 -08:00
Paul Donohue
40c99b21fa Fix access to hostNetwork port on NodeIP when egress-selector-mode=agent 
Signed-off-by: Paul Donohue <git@PaulSD.com>
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-10 09:44:05 -08:00
Brad Davidson
0e210807fa Ensure that node exists when using node auth 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 87f9c4ab11)
 2023-02-10 09:34:57 -08:00
Brad Davidson
fe1be2b3dc Add support for kubeadm token and client certificate auth 
Allow bootstrapping with kubeadm bootstrap token strings or existing
Kubelet certs. This allows agents to join the cluster using kubeadm
bootstrap tokens, as created with the `k3s token create` command.

When the token expires or is deleted, agents can successfully restart by
authenticating with their kubelet certificate via node authentication.
If the token is gone and the node is deleted from the cluster, node auth
will fail and they will be prevented from rejoining the cluster until
provided with a valid token.

Servers still must be bootstrapped with the static cluster token, as
they will need to know it to decrypt the bootstrap data.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 992e64993d)
 2023-02-10 09:34:57 -08:00
Brad Davidson
0208f16b5f Add support for k3s token command 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 373df1c8b0)
 2023-02-10 09:34:57 -08:00
Brad Davidson
0b34f62e76 Add certificate rotate-ca to write updated CA certs to datastore 
This command must be run on a server while the service is running. After this command completes, all the servers in the cluster should be restarted to load the new CA files.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 215fb157ff)
 2023-02-10 09:34:57 -08:00
Brad Davidson
565f40efa6 Add utility functions for getting kubernetes client 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 3c324335b2)
 2023-02-10 09:34:57 -08:00
Brad Davidson
2b76d471f1 Fix CA cert hash for root certs 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 58d40327b4)
 2023-02-10 09:34:57 -08:00
Brad Davidson
4f312e0ab2 Ensure cluster-signing CA files contain only a single CA cert 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 0919ec6755)
 2023-02-10 09:34:57 -08:00
Brad Davidson
fa2ca3e63d go generate 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-10 07:27:44 -08:00
Brad Davidson
a9e5a49b3a Check for existing resources before creating them 
Prevents errors when starting with fail-closed webhooks

Also, use panic instead of Fatalf so that the CloudControllerManager rescue can handle the error

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-10 07:27:44 -08:00
Brad Davidson
f924827819 go generate 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 1c6fde9a52)
 2023-02-09 15:18:25 -08:00
Brad Davidson
19ed35540a Honor Service ExternalTrafficPolicy 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 369b81b45e)
 2023-02-09 15:18:25 -08:00
Brad Davidson
208486323b Use default address family when adding kubernetes service address to SAN list 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-09 11:55:27 -08:00
Derek Nola
566975533d Ignore value conflicts when reencrypting secrets (#6917) 
* Ignore conflict secrets

Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-02-08 10:44:53 -08:00
Derek Nola
88b9d29d72 Fix cron example (#6866) 
Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-01-31 13:04:41 -08:00
Silvio Moioli
05545fc017 Bugfix: do not break cert-manager when pprof is enabled (#6635) 
Signed-off-by: Silvio Moioli <silvio@moioli.net>
(cherry picked from commit 23c1040adb)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-01-26 17:37:20 -08:00
Brad Davidson
99b534a5e3 Add jitter to scheduled snapshots and retry harder on conflicts 
Also ensure that the snapshot job does not attempt to trigger multiple concurrent runs, as this is not supported.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-01-26 14:31:45 -08:00
Brooks Newberry
edc0795686 Update to v1.23.16+k3s1 (#6776) 2023-01-19 11:06:57 -08:00
Brad Davidson
d745f8558d Fix CI tests 
* General cleanup of test-helpers functions to address CI failures
* Install awscli in test image
* Log containerd output to file even when running with --debug

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit f54b5e4fa0)
 2023-01-17 18:15:42 -08:00
Brad Davidson
27f8fe7d02 Pass through default tls-cipher-suites 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-01-13 22:15:11 -08:00
Brad Davidson
e41a76520c Preload iptable_filter/ip6table_filter 
ServiceLB now requires this module, but it will not get autoloaded by the kubelet if the host is using nftables.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-13 19:18:44 -08:00
Brad Davidson
c58062591c Bump k3s-root and remove embedded strongswan support 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 2835368ecb)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:21:01 -08:00
Brad Davidson
f2fdf7eb36 go generate 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 915c7719fe)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:21:01 -08:00
Brad Davidson
f36904d033 go generate 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 1eeea5c81f)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:21:01 -08:00
Brad Davidson
c2944e8def Disable CCM metrics port when legacy CCM functionality is disabled 
Prevents port conflicts on upgrade for users that have deployed other cloud controllers.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e08a662509)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:21:01 -08:00
Brad Davidson
836907568f Bump klipper-helm and klipper-lb versions 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit a07bb555ba)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:21:01 -08:00
Derek Nola
91120595b2 Add prefer-bundled-bin as an agent flag (#6545) 
* Add prefer-bundled-bin as an agent flag
* Add E2E test for prefer-bundled-bin

Signed-off-by: Derek Nola <derek.nola@suse.com>
(cherry picked from commit 614da78e43)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:21:01 -08:00
Manuel Buil
3e157ed907 Remove stuff which belongs in the windows executor implementation 
Signed-off-by: Manuel Buil <mbuil@suse.com>
(cherry picked from commit 483e29e783)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:21:01 -08:00
Brad Davidson
05ba667415 Address nits from self-review 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 9ff0943d56)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:21:01 -08:00
Brad Davidson
de0c68f298 Allow agent to run rootless 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 56bf7d6ad3)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:21:01 -08:00
Brad Davidson
2d9d277a1d Add rootless IPv6 support 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 6f2b21c5cd)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:21:01 -08:00
Brad Davidson
8b77684522 Make rootless settings configurable 
Add enivironment variables for port-driver, cidr, mtu, and disable-host-loopback settings. Since rootless is still experimental, I don't think they deserve full CLI flag status.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit c02dceb7ad)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:21:01 -08:00
Brad Davidson
683271f6d0 go generate 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 73171ff20a)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:21:01 -08:00
Derek Nola
8784eab7a6 Add new prefer-bundled-bin experimental flag (#6420) 
* initial prefer-bundled-bin ci change
* Add startup testlet
* Convert parsing to pflag library
* Fix code validation
* go mod tidy

Signed-off-by: Derek Nola <derek.nola@suse.com>
(cherry picked from commit 0f52088cd3)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:21:01 -08:00
Derek Nola
a64dd933d6 Change secrets-encryption to GA (#6592) 
Signed-off-by: Derek Nola <derek.nola@suse.com>
 2022-12-01 12:40:29 -08:00
Manuel Buil
30903ccb5b Fix log for flannelExternalIP use case 
Signed-off-by: Manuel Buil <mbuil@suse.com>
 2022-11-22 16:56:20 +01:00
Manuel Buil
07dc375c82 Remove stuff which belongs in the windows executor implementation 
Signed-off-by: Manuel Buil <mbuil@suse.com>
 2022-11-18 09:46:35 +01:00
Brad Davidson
96bfe8b397 Bump traefik chart to 19.0.4 to fix kubernetes version check 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-11-14 14:52:08 -08:00
Derek Nola
2ac863c36b Add Secrets Encryption to CriticalArgs 
* Add EncryptSecrets to Critical Control Args
* use deep comparison to extract differences

Signed-off-by: Derek Nola <derek.nola@suse.com>
 2022-11-04 14:22:52 -07:00
Manuel Buil
98d5013b09 Merge pull request #6435 from manuelbuil/addrTypes123 
[Release 1.23] Change the priority of address types depending on flannel-external-ip
 2022-11-04 16:43:17 +01:00
thomasferrandiz
f927bc0c1b Merge pull request #6438 from thomasferrandiz/log-kube-router-1.23 
[Release 1.23] log kube-router version when starting netpol controller
 2022-11-04 15:21:35 +01:00
Thomas Ferrandiz
441311ed43 log kube-router version when starting netpol controller 
Signed-off-by: Thomas Ferrandiz <thomas.ferrandiz@suse.com>
 2022-11-04 11:02:05 +01:00
Manuel Buil
1401b35b96 Change the priority of address types depending on flannel-external-ip 
Signed-off-by: Manuel Buil <mbuil@suse.com>
 2022-11-04 09:10:52 +01:00
Manuel Buil
90800f16a4 Add some helping logs to avoid wrong configs 
Signed-off-by: Manuel Buil <mbuil@suse.com>
 2022-11-04 09:06:55 +01:00
Brad Davidson
8d95fad453 go generate 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-11-03 20:56:30 -07:00