public/k3s
1
0
Fork 0
mirror of https://git.vectorsigma.ru/public/k3s.git synced 2026-08-07 06:59:53 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,607 Commits 31 Branches 949 Tags
2cb4eef4e36c8576f17beb817ed6ae1b5f9e0647
Commit Graph

1107 Commits

Author SHA1 Message Date
Manuel Buil
280e058f91 Migrate netutil methods into /utils/net.go 
Signed-off-by: Manuel Buil <mbuil@suse.com>
 2023-05-05 09:08:45 +02:00
Derek Nola
b865512ff2 [Release-1.24] CLI + Config Enhancement (#7407) 
* Handle multiple arguments with StringSlice flags (#7380)

* Add helper function for multiple arguments in stringslice
* Cleanup server setup with util function

Signed-off-by: Derek Nola <derek.nola@suse.com>

* Enable FindString to search dotD config files (#7323)

* Enable FindString to search dotD config files
* Address multiple arg cases

Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-05-02 15:09:08 -07:00
Derek Nola
8f27774e8b [Release-1.24] Add E2E testing in Drone (#7376) 
* Initial drone vagrant pipeline

Signed-off-by: Derek Nola <derek.nola@suse.com>

* Build e2e test image
* Add ci flag to secretsencryption
* Fix vagrant log on secretsencryption
* Add cron conformance pipeline
* Add string output for nodes
* Switch snapshot restore for upgrade cluster

Signed-off-by: Derek Nola <derek.nola@suse.com>

* Added IPv6 check and agent restart on e2e test utils

Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>

* Drone: Cleanup E2E VMs on test panic (#7104)

* Cleanup leftover VMs in E2E pipeline

* Clean E2E VMs before testing (#7109)

* Cleanup VMs proper

Signed-off-by: Derek Nola <derek.nola@suse.com>

* Dont run most pipelines on nightly cron
* Improve RunCmdOnNode error
* Pin upgradecluster to v1.24

Signed-off-by: Derek Nola <derek.nola@suse.com>

---------

Signed-off-by: Derek Nola <derek.nola@suse.com>
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
Co-authored-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
 2023-05-01 14:14:28 -07:00
Hussein Galal
a6bd15fb71 [release-1.24] Update klipper lb and helm-controller (#7241) 
* Update klipper lb and helm-controller

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* update klipper helm image

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

---------

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
 2023-04-06 22:43:30 +02:00
Roberto Bonafiglia
e8ec681cea Updated kube-route version to move the iptables ACCEPT default rule at the end of the chain 
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
 2023-04-06 11:10:04 +02:00
Brad Davidson
09d13d2962 Lock bootstrap data with empty key to prevent conflicts 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit d95980bba3)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-04-05 16:29:31 -07:00
Brad Davidson
e8408f3af7 Debounce kubernetes service endpoint updates 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 2992477c4b)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-04-05 16:29:31 -07:00
Brad Davidson
ab6c64342c Fix tests to not hide failure location in dummp assert functions 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit ece4d8e45c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-04-05 16:29:31 -07:00
Brad Davidson
01253a5b84 Fix issue with stale connections to removed LB server 
Track LB connections through each server so that they can be closed when it is removed.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e54ceaa497)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-04-05 16:29:31 -07:00
Brad Davidson
447c5aec76 go generate 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit d388b82d25)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-04-05 16:29:31 -07:00
Brad Davidson
4864ecd4aa Ensure that loopback is used for the advertised address when resetting 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit b010db0cff)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-04-05 16:29:31 -07:00
Brad Davidson
c313b5b70c Bump Local Path Provisioner version (#7167) 
* chore: Bump Local Path Provisioner version
* go generate

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
(cherry picked from commit cee3ddbc4a)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-04-05 16:29:31 -07:00
Hussein Galal
53e5d566b5 Remove deprecated nodeSelector label beta.kubernetes.io/os (#6970) (#7122) 
* Remove deprecated nodeSelector label beta.kubernetes.io/os

Problem:
The nodeSelector label beta.kubernetes.io/os in the CoreDNS deployment was deprecated in 1.14 and will likely be removed soon

Solution:
Change the nodeSelector to remove the beta

Signed-off-by: Dan Mills <evilhamsterman@gmail.com>
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
Co-authored-by: Daniel Mills <evilhamsterman@users.noreply.github.com>
 2023-04-04 21:04:08 +02:00
Derek Nola
7fee87d976 Adds a warning about editing to the containerd config.toml file (#7076) 
* Add a warning to the config.toml file

Signed-off-by: Derek Nola <derek.nola@suse.com>
Co-authored-by: Brad Davidson <brad@oatmail.org>
 2023-03-14 09:33:21 -07:00
Brad Davidson
41c24b6a88 Add support for cross-signing new certs during ca rotation 
We need to send the full chain in order for cross-signing to work
properly during switchover to a new root.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-03-13 20:08:26 -07:00
Brad Davidson
9360022bbe Wait for kubelet to update the Ready status before reading port 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-03-13 20:07:34 -07:00
Daishan Peng
abda53075e Wait for kubelet port to be ready before setting 
Signed-off-by: Daishan Peng <daishan@acorn.io>
 2023-03-13 20:07:34 -07:00
Roberto Bonafiglia
cabeae0619 [Release 1.24] Update flannel and kube-router (#7063) 
* Update kube-router version to fix iptables rules

Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>

* Update Flannel to v0.21.3

Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>

---------

Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
 2023-03-10 20:32:08 -08:00
Brad Davidson
0f6e4dcee0 Add test for filterByIPFamily 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-21 14:14:15 -08:00
Brad Davidson
3709e8386c Fix ServiceLB dual-stack ingress IP listing 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-21 14:14:15 -08:00
Brad Davidson
ecb5f5a2b5 Fix CACertPath stripping trailing path components 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-14 13:19:22 -08:00
Brad Davidson
8ae390ff82 Fix etcd member deletion 
Turns out etcd-only nodes were never running **any** of the controllers,
so allowing multiple controllers didn't really fix things.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-14 13:19:22 -08:00
Brad Davidson
77dbe648ad Allow for multiple sets of leader-elected controllers 
Addresses an issue where etcd controllers did not run on etcd-only nodes

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-10 12:26:09 -08:00
Roberto Bonafiglia
dd71479e67 Update flannel to v0.21.1 
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
 2023-02-10 20:07:50 +01:00
Paul Donohue
c87d62490f Fix access to hostNetwork port on NodeIP when egress-selector-mode=agent 
Signed-off-by: Paul Donohue <git@PaulSD.com>
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-10 09:43:58 -08:00
Brad Davidson
478dae4d3d Ensure that node exists when using node auth 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 87f9c4ab11)
 2023-02-10 09:34:10 -08:00
Brad Davidson
73460e28bf Add support for kubeadm token and client certificate auth 
Allow bootstrapping with kubeadm bootstrap token strings or existing
Kubelet certs. This allows agents to join the cluster using kubeadm
bootstrap tokens, as created with the `k3s token create` command.

When the token expires or is deleted, agents can successfully restart by
authenticating with their kubelet certificate via node authentication.
If the token is gone and the node is deleted from the cluster, node auth
will fail and they will be prevented from rejoining the cluster until
provided with a valid token.

Servers still must be bootstrapped with the static cluster token, as
they will need to know it to decrypt the bootstrap data.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 992e64993d)
 2023-02-10 09:34:10 -08:00
Brad Davidson
f4fc44ec4a Add support for k3s token command 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 373df1c8b0)
 2023-02-10 09:34:10 -08:00
Brad Davidson
6ae3370e28 Add certificate rotate-ca to write updated CA certs to datastore 
This command must be run on a server while the service is running. After this command completes, all the servers in the cluster should be restarted to load the new CA files.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 215fb157ff)
 2023-02-10 09:34:10 -08:00
Brad Davidson
b88c3b8c95 Add utility functions for getting kubernetes client 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 3c324335b2)
 2023-02-10 09:34:10 -08:00
Brad Davidson
631847536c Fix CA cert hash for root certs 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 58d40327b4)
 2023-02-10 09:34:10 -08:00
Brad Davidson
e62b921b4f Ensure cluster-signing CA files contain only a single CA cert 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 0919ec6755)
 2023-02-10 09:34:10 -08:00
Brad Davidson
ce0a03648d go generate 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-10 07:27:20 -08:00
Brad Davidson
e0967ce763 Check for existing resources before creating them 
Prevents errors when starting with fail-closed webhooks

Also, use panic instead of Fatalf so that the CloudControllerManager rescue can handle the error

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-10 07:27:20 -08:00
Brad Davidson
89b5466a00 Use default address family when adding kubernetes service address to SAN list 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-09 11:56:42 -08:00
Brad Davidson
607ccbd49d [release-1.24] Allow ServiceLB to honor ExternalTrafficPolicy=Local (#6908) 
* Bump wrangler version for EndpointSlice support

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 94d1a87509)

* Honor Service ExternalTrafficPolicy

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 369b81b45e)

* go generate

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 1c6fde9a52)
 2023-02-08 14:04:08 -08:00
Derek Nola
c9f450b314 Ignore value conflicts when reencrypting secrets (#6918) 
* Ignore conflict secrets

Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-02-08 10:45:13 -08:00
Derek Nola
1b5a3a5b2e Wait for cri-dockerd socket (#6854) 
* Wait for cri-dockerd socket
* Consolidate cri utility functions

Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-02-01 09:24:09 -08:00
Derek Nola
f0ce56a02b Standardize flag declaration (#6868) 
Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-02-01 09:23:34 -08:00
Derek Nola
564b825152 Fix cron example (#6865) 
Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-01-31 12:57:15 -08:00
Silvio Moioli
8e36b16568 Bugfix: do not break cert-manager when pprof is enabled (#6635) 
Signed-off-by: Silvio Moioli <silvio@moioli.net>
(cherry picked from commit 23c1040adb)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-01-26 17:36:55 -08:00
Brad Davidson
be26a6e618 Set cri-dockerd version at build time 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-01-26 14:43:47 -08:00
Brad Davidson
21b1da5848 Add jitter to scheduled snapshots and retry harder on conflicts 
Also ensure that the snapshot job does not attempt to trigger multiple concurrent runs, as this is not supported.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-01-26 14:31:25 -08:00
Brooks Newberry
546a94e9ae V1.24.10 k3s1 (#6788) 2023-01-19 18:39:14 -08:00
Brad Davidson
f7e375979f Fix CI tests 
* General cleanup of test-helpers functions to address CI failures
* Install awscli in test image
* Log containerd output to file even when running with --debug

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit f54b5e4fa0)
 2023-01-18 09:17:39 -08:00
Brad Davidson
0887800db8 Pass through default tls-cipher-suites 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-01-13 22:14:58 -08:00
Brad Davidson
01d519394f Preload iptable_filter/ip6table_filter 
ServiceLB now requires this module, but it will not get autoloaded by the kubelet if the host is using nftables.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-13 18:28:28 -08:00
Brad Davidson
d5ef9e1a12 Bump k3s-root and remove embedded strongswan support 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 2835368ecb)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:20:37 -08:00
Brad Davidson
af9fac15ff go generate 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 915c7719fe)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:20:37 -08:00
Brad Davidson
6e8c10473d go generate 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 1eeea5c81f)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:20:37 -08:00