galal-hussein
b65fad2d1c
Add proctitle package with linux and windows constraints
...
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com >
(cherry picked from commit 48ff3bcddbbrad.davidson@rancher.com >
2024-05-31 09:17:58 -07:00
Brad Davidson
12c6d6a5cf
Actually fix agent certificate rotation
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com >
(cherry picked from commit 4cc73b1fee
2024-04-11 10:01:23 -07:00
Brad Davidson
b8b95493af
Add certificate expiry check and warnings
...
* Add ADR
* Add `k3s certificate check` command.
* Add periodic check and events when certs are about to expire.
* Add metrics for certificate validity remaining, labeled by cert subject
Signed-off-by: Brad Davidson <brad.davidson@rancher.com >
(cherry picked from commit 7f659759dd
2024-04-11 10:01:23 -07:00
Derek Nola
46cbbab263
Consolidate CopyFile functions ( #8079 )
...
* Consolidate CopyFile function
Signed-off-by: Derek Nola <derek.nola@suse.com >
* Copy to File, not destination folder
Signed-off-by: Derek Nola <derek.nola@suse.com >
---------
Signed-off-by: Derek Nola <derek.nola@suse.com >
2023-08-01 08:55:34 -07:00
Brad Davidson
23d98cec22
Fix CACertPath stripping trailing path components
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com >
2023-02-14 09:39:41 -08:00
Brad Davidson
3d146d2f1b
Allow for multiple sets of leader-elected controllers
...
Addresses an issue where etcd controllers did not run on etcd-only nodes
Signed-off-by: Brad Davidson <brad.davidson@rancher.com >
2023-02-10 10:46:48 -08:00
Brad Davidson
992e64993d
Add support for kubeadm token and client certificate auth
...
Allow bootstrapping with kubeadm bootstrap token strings or existing
Kubelet certs. This allows agents to join the cluster using kubeadm
bootstrap tokens, as created with the `k3s token create` command.
When the token expires or is deleted, agents can successfully restart by
authenticating with their kubelet certificate via node authentication.
If the token is gone and the node is deleted from the cluster, node auth
will fail and they will be prevented from rejoining the cluster until
provided with a valid token.
Servers still must be bootstrapped with the static cluster token, as
they will need to know it to decrypt the bootstrap data.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com >
2023-02-07 14:55:04 -08:00
Brad Davidson
215fb157ff
Add certificate rotate-ca to write updated CA certs to datastore
...
This command must be run on a server while the service is running. After this command completes, all the servers in the cluster should be restarted to load the new CA files.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com >
2023-02-06 15:09:31 -08:00
Derek Nola
06d81cb936
Replace deprecated ioutil package ( #6230 )
...
* Replace ioutil package
* check integration test null pointer
* Remove rotate retries
Signed-off-by: Derek Nola <derek.nola@suse.com >
2022-10-07 17:36:57 -07:00
Luther Monson
9a849b1bb7
[master] changing package to k3s-io ( #4846 )
...
* changing package to k3s-io
Signed-off-by: Luther Monson <luther.monson@gmail.com >
Co-authored-by: Derek Nola <derek.nola@suse.com >
2022-03-02 15:47:27 -08:00
Brad Davidson
2989b8b2c5
Remove unnecessary copies of runtime struct
...
Several types contained redundant references to ControlRuntime data. Switch to consistently accessing this via config.Runtime instead.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com >
2022-02-28 12:05:16 -08:00
Hussein Galal
3985fd0e26
[master] Add validation to certificate rotation ( #4692 )
...
* Add validation to certificate rotation
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com >
* Add validation to certificate rotation
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com >
2021-12-09 18:57:13 +02:00
Hussein Galal
77fd3e99ec
Add cert rotation command ( #4495 )
...
* Add cert rotation command
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com >
* add function to check for dynamic listener file
Signed-off-by: Brian Downs <brian.downs@gmail.com >
* Add dynamiclistener cert rotation support
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com >
* fixes to the cert rotation
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com >
* fix ci tests
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com >
* fixes to certificate rotation command
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com >
* more fixes
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com >
Co-authored-by: Brian Downs <brian.downs@gmail.com >
2021-12-02 23:19:16 +02:00
