Commit Graph

388 Commits

Author SHA1 Message Date
Flavio Castelli
355f62fd7d fix: use correct wasm shims names
Fix the wasm shim detection and the containerd configuration generation.

Prior to this commit, the binary and the `RuntimeType` values were not
correct.

Signed-off-by: Flavio Castelli <fcastelli@suse.com>
(cherry picked from commit 64e4f0e6e7)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-03-07 17:25:43 -08:00
Brad Davidson
a7318dffb9 Fix additional corner cases in registries handling
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit b164d7a270)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-03-07 17:25:43 -08:00
Brad Davidson
13d28efea7 Tweak netpol node wait logs
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 513c3416e7)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-03-07 17:25:43 -08:00
Brad Davidson
fbe1ed0dc6 Fix NodeHosts on dual-stack clusters
* Add both dual-stack addresses to the node hosts file
* Add hostname to hosts file as alias for node name to ensure consistent resolution

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit be569f65a9)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-03-07 17:25:43 -08:00
Roberto Bonafiglia
be5d577d1d Adjust first node-ip based on configured clusterCIDR
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2024-03-06 11:13:28 +01:00
Brad Davidson
c7e6922aa8 Fix netpol startup when flannel is disabled
Don't break out of the poll loop if we can't get the node, RBAC might not be ready yet.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-02-26 20:58:25 -08:00
Derek Nola
1c3795d1cf Rename AgentReady to ContainerRuntimeReady for better clarity
Signed-off-by: Derek Nola <derek.nola@suse.com>
2024-02-21 14:21:18 -08:00
Derek Nola
96df99113a Restore original order of agent startup functions
Signed-off-by: Derek Nola <derek.nola@suse.com>
2024-02-21 14:21:18 -08:00
Derek Nola
c74395c1a6 [Release-1.26] Test_UnitApplyContainerdQoSClassConfigFileIfPresent (#9442)
* [Testing]: Test_UnitApplyContainerdQoSClassConfigFileIfPresent (Created) (#8945)

Problem:
Function not tested.

Solution:
Unit test added.

Signed-off-by: Oliver Larsson <larsson.e.oliver@gmail.com>
--------

Signed-off-by: Oliver Larsson <larsson.e.oliver@gmail.com>
Signed-off-by: Derek Nola <derek.nola@suse.com>
Co-authored-by: Oliver Larsson <larsson.e.oliver@gmail.com>
2024-02-12 09:34:08 -08:00
Hussein Galal
62448e1e27 Update flannel to v0.24.0 and remove multiclustercidr flag (#9075)
* update flannel to v0.24.0

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* remove multiclustercidr flag

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

---------

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
2024-02-11 17:14:47 +01:00
Harrison Affel
35e68b7fd4 allow executors to define containerd and docker behavior
Signed-off-by: Harrison Affel <harrisonaffel@gmail.com>
2024-02-09 16:05:38 -03:00
Vitor Savian
5abe46642d Runtimes refactor using exec.LookPath
Signed-off-by: Vitor Savian <vitor.savian@suse.com>
2024-02-08 04:53:23 -03:00
Brad Davidson
c190124a46 Consistently handle component exit on shutdown
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-02-07 19:58:07 -08:00
Brad Davidson
9b8c0afb76 gofmt config_test.go
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-02-01 18:52:32 -08:00
Brad Davidson
52bcba296d Fix issues with certs.d template generation
* Fix issue with bare host or IP as endpoint
* Fix issue with localhost registries not defaulting to http.
* Move the registry template prep to a separate function,
  and adds tests of that function so that we can ensure we're
  generating the correct content.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-02-01 18:52:32 -08:00
Derek Nola
f0175cc73c Move proxy dialer out of init() and fix crash (#9221)
* Fixes issue where proxy support only honored server address via K3S_URL, not CLI or config.
* Fixes crash when agent proxy is enabled, but proxy env vars do not return a proxy URL for the server address (server URL is in NO_PROXY list).
* Adds tests

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Co-authored-by: Brad Davidson <brad.davidson@rancher.com>
2024-01-12 08:15:26 -08:00
Brad Davidson
e49ed4dbf4 Enable network policy controller metrics
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit ab8d2f55b9)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-01-11 19:10:42 -08:00
Brad Davidson
d6355d7bea Add embedded registry implementation
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 37e9b87f62)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-01-11 19:10:42 -08:00
Brad Davidson
d15bd074f4 Add server CLI flag and config fields for embedded registry
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit ef90da5c6e)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-01-11 19:10:42 -08:00
Brad Davidson
693809e937 Propagate errors up from config.Get
Fixes crash when killing agent while waiting for config from server

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 77846d63c1)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-01-11 19:10:42 -08:00
Brad Davidson
999bba5b67 Move registries.yaml load into agent config
Moving it into config.Agent so that we can use or modify it outside the context of containerd setup

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 16d29398ad)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-01-11 19:10:42 -08:00
Brad Davidson
aa76c77b30 Pin images instead of locking layers with lease
Layer leases never did what we wanted anyways, and this is the new approved interface for ensuring that images do not get GCd

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 5c99bdd9bd)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-01-11 19:10:42 -08:00
Lex Rivera
080ec8148d Add more paths to crun runtime detection (#9086)
* add usr/local paths for crun detection

Signed-off-by: Lex Rivera <me@lex.io>
(cherry picked from commit 5fe074b540)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-01-11 19:10:42 -08:00
Brad Davidson
0831de59e9 Add support for containerd cri registry config_path
Render cri registry mirrors.x.endpoints and configs.x.tls into config_path; keep
using mirrors.x.rewrites and configs.x.auth those do not yet have an
equivalent in the new format.

The new config file format allows disabling containerd's fallback to the
default endpoint when using mirror endpoints; a new CLI flag is added to
control that behavior.

This also re-shares some code that was unnecessarily split into parallel
implementations for linux/windows versions. There is probably more work
to be done on this front but it's a good start.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit c45524e662)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-01-11 19:10:42 -08:00
Brad Davidson
c51aa9eb09 Handle logging flags when parsing kube-proxy args
Also adds a test to ensure this continues to work.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit db7091b3f6)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2024-01-11 19:10:42 -08:00
Manuel Buil
e7f9175fe7 Wait for taint to be gone in the node before starting the netpol controller
Signed-off-by: Manuel Buil <mbuil@suse.com>
2024-01-09 09:59:33 +01:00
Derek Nola
140345869d Added support for env *_PROXY variables for agent loadbalancer (#9116)
Signed-off-by: Yodo <pierre@azmed.co>
Signed-off-by: Derek Nola <derek.nola@suse.com>
Co-authored-by: Pierre <129078893+pierre-az@users.noreply.github.com>
2024-01-06 19:58:34 -07:00
Flavio Castelli
a8cd920cf1 Added runtimes for wasm/crun/nvidia
Create a generic helper function that finds extra containerd runtimes.
The code was originally inside of the nvidia container discovery file.

Signed-off-by: Flavio Castelli <fcastelli@suse.com>

Discover the containerd shims based on runwasi that are already
available on the node.

The runtimes could have been installed either by a package manager or by
the kwasm operator.

Signed-off-by: Flavio Castelli <fcastelli@suse.com>

The containerd configuration on a Linux system now handles the nvidia
and the WebAssembly runtimes.

Signed-off-by: Flavio Castelli <fcastelli@suse.com>

Added runtime classes for crun/wasm/nvidia

Signed-off-by: Vitor Savian <vitor.savian@suse.com>

Added default runtime flag

Signed-off-by: Vitor Savian <vitor.savian@suse.com>
2023-12-08 15:49:52 -03:00
Manuel Buil
280a0ee8b1 Improve dualStack log
Signed-off-by: Manuel Buil <mbuil@suse.com>
2023-11-17 09:17:52 +01:00
Brad Davidson
dba56d046c Add jitter to client config retry
Also:
* Replaces labeled for/continue RETRY loops with wait helpers for improved readability
* Pulls secrets and nodes from cache for node password verification
* Migrate nodepassword tests to wrangler mocks for better code reuse

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-11-16 09:56:05 -08:00
Oliver Larsson
67c0ab6aed QoS-class resource configuration
Problem:
Configuring qos-class features in containerd requres a custom containerd configuration template.

Solution:
Look for configuration files in default locations and configure containerd to use them if they exist.

Signed-off-by: Oliver Larsson <larsson.e.oliver@gmail.com>
(cherry picked from commit 30c8ad926d)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-11-16 09:56:05 -08:00
Derek Nola
ab100ad17a Fix SystemdCgroup in templates_linux.go (#8766)
Signed-off-by: Derek Nola <derek.nola@suse.com>
2023-11-02 13:41:34 -07:00
Edgar Lee
4e77f40d59 Add --image-service-endpoint flag (#8279)
* Add --image-service-endpoint flag

Problem:
External container runtime can be set but image service endpoint is unchanged
and also is not exposed as a flag. This is useful for using containerd
snapshotters outside of the ones that have built-in support like
stargz-snapshotter.

Solution:
Add a flag --image-service-endpoint and also default image service endpoint to
container runtime endpoint if set.

Signed-off-by: Edgar Lee <edgarhinshunlee@gmail.com>
(cherry picked from commit fe18b1fce9)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-17 10:44:52 -07:00
Sean Yen
727071c6e8 Windows support
Signed-off-by: Sean Yen <seanyen@microsoft.com>
2023-10-16 23:15:28 +02:00
Brad Davidson
c239d687ba Pass SystemdCgroup setting through to nvidia runtime options
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 0e5c760625)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-10-13 10:23:51 -07:00
Roberto Bonafiglia
27e3d95a4c Use IPv6 in case is the first configured IP with dualstack
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2023-10-13 10:25:18 +02:00
Roberto Bonafiglia
cfb2ef5e3a Fixed tailscale node IP dualstack mode in case of IPv4 only node
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2023-10-10 10:37:54 +02:00
Manuel Buil
8869aab229 Take IPFamily precedence based on order
Signed-off-by: Manuel Buil <mbuil@suse.com>
2023-10-02 18:40:30 +02:00
Manuel Buil
f8f888f4b6 Include the interface name in the error message
Signed-off-by: Manuel Buil <mbuil@suse.com>
2023-09-26 11:07:44 +02:00
Manuel Buil
2fc9a40f65 Merge pull request #8420 from manuelbuil/flannelErrors126
[Release 1.26] Add context to flannel errors
2023-09-25 16:33:11 +02:00
Manuel Buil
6c4c157352 Add context to flannel errors
Signed-off-by: Manuel Buil <mbuil@suse.com>
2023-09-25 08:28:22 +02:00
Manuel Buil
23c9208c84 Fix error reporting
Signed-off-by: Manuel Buil <mbuil@suse.com>
2023-09-22 19:04:56 +02:00
Simon Kirsten
dc12bf1a1f Add support for {{ template "base" . }} in etc/containerd/config.toml.tmpl (#7991)
Signed-off-by: Simon Kirsten <simonkirsten24@gmail.com>
(cherry picked from commit 546dc247a0)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-08-04 16:09:40 -07:00
Derek Nola
60bd5c5b3f [Release-1.26] August Test Backports (#8126)
* Unit test for MustFindString (#8013)
* Consolidate CopyFile functions (#8079)
* Remove unnecessary E2E envs
* Cleanup unnecessary "sudo" in commands
* Add additonal s3 coverage clause

Signed-off-by: Derek Nola <derek.nola@suse.com>
2023-08-04 11:39:01 -07:00
Manuel Buil
a1ff4612e8 Fix tailscale bug with ip modes
Signed-off-by: Manuel Buil <mbuil@suse.com>
2023-08-02 11:43:08 +02:00
Brad Davidson
49b549e270 Fall back to basic/bearer auth when node identity auth is rejected
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 7f50b40cfe)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-07-07 13:18:45 -07:00
Denys Smirnov
729ce73fca Support setting control server URL for Tailscale.
This change enables the use of Headscale - open source implementation of the Tailscale control server.

Signed-off-by: Denys Smirnov <dennwc@pm.me>
2023-07-07 12:30:43 +02:00
Manuel Buil
3ee5c0c39d Check if we are on ipv4, ipv6 or dualStack when doing tailscale
Signed-off-by: Manuel Buil <mbuil@suse.com>
2023-07-06 11:12:30 +02:00
Manuel Buil
d4b1768457 Fix code spell check
Signed-off-by: Manuel Buil <mbuil@suse.com>
2023-07-04 15:53:03 +02:00
Manuel Buil
ab07b36ccd VPN PoC
Signed-off-by: Manuel Buil <mbuil@suse.com>
2023-06-09 19:11:36 +02:00