public/k3s
1
0
Fork 0
mirror of https://git.vectorsigma.ru/public/k3s.git synced 2026-08-04 04:20:14 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,559 Commits 31 Branches 949 Tags
82a0c4e1f4b34e11afe3bb0aed1ee627fcb47dfe
Commit Graph

1082 Commits

Author SHA1 Message Date
Brad Davidson
478dae4d3d Ensure that node exists when using node auth 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 87f9c4ab11)
 2023-02-10 09:34:10 -08:00
Brad Davidson
73460e28bf Add support for kubeadm token and client certificate auth 
Allow bootstrapping with kubeadm bootstrap token strings or existing
Kubelet certs. This allows agents to join the cluster using kubeadm
bootstrap tokens, as created with the `k3s token create` command.

When the token expires or is deleted, agents can successfully restart by
authenticating with their kubelet certificate via node authentication.
If the token is gone and the node is deleted from the cluster, node auth
will fail and they will be prevented from rejoining the cluster until
provided with a valid token.

Servers still must be bootstrapped with the static cluster token, as
they will need to know it to decrypt the bootstrap data.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 992e64993d)
 2023-02-10 09:34:10 -08:00
Brad Davidson
f4fc44ec4a Add support for k3s token command 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 373df1c8b0)
 2023-02-10 09:34:10 -08:00
Brad Davidson
6ae3370e28 Add certificate rotate-ca to write updated CA certs to datastore 
This command must be run on a server while the service is running. After this command completes, all the servers in the cluster should be restarted to load the new CA files.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 215fb157ff)
 2023-02-10 09:34:10 -08:00
Brad Davidson
b88c3b8c95 Add utility functions for getting kubernetes client 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 3c324335b2)
 2023-02-10 09:34:10 -08:00
Brad Davidson
631847536c Fix CA cert hash for root certs 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 58d40327b4)
 2023-02-10 09:34:10 -08:00
Brad Davidson
e62b921b4f Ensure cluster-signing CA files contain only a single CA cert 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 0919ec6755)
 2023-02-10 09:34:10 -08:00
Brad Davidson
ce0a03648d go generate 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-10 07:27:20 -08:00
Brad Davidson
e0967ce763 Check for existing resources before creating them 
Prevents errors when starting with fail-closed webhooks

Also, use panic instead of Fatalf so that the CloudControllerManager rescue can handle the error

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-10 07:27:20 -08:00
Brad Davidson
89b5466a00 Use default address family when adding kubernetes service address to SAN list 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-02-09 11:56:42 -08:00
Brad Davidson
607ccbd49d [release-1.24] Allow ServiceLB to honor ExternalTrafficPolicy=Local (#6908) 
* Bump wrangler version for EndpointSlice support

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 94d1a87509)

* Honor Service ExternalTrafficPolicy

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 369b81b45e)

* go generate

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 1c6fde9a52)
 2023-02-08 14:04:08 -08:00
Derek Nola
c9f450b314 Ignore value conflicts when reencrypting secrets (#6918) 
* Ignore conflict secrets

Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-02-08 10:45:13 -08:00
Derek Nola
1b5a3a5b2e Wait for cri-dockerd socket (#6854) 
* Wait for cri-dockerd socket
* Consolidate cri utility functions

Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-02-01 09:24:09 -08:00
Derek Nola
f0ce56a02b Standardize flag declaration (#6868) 
Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-02-01 09:23:34 -08:00
Derek Nola
564b825152 Fix cron example (#6865) 
Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-01-31 12:57:15 -08:00
Silvio Moioli
8e36b16568 Bugfix: do not break cert-manager when pprof is enabled (#6635) 
Signed-off-by: Silvio Moioli <silvio@moioli.net>
(cherry picked from commit 23c1040adb)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-01-26 17:36:55 -08:00
Brad Davidson
be26a6e618 Set cri-dockerd version at build time 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-01-26 14:43:47 -08:00
Brad Davidson
21b1da5848 Add jitter to scheduled snapshots and retry harder on conflicts 
Also ensure that the snapshot job does not attempt to trigger multiple concurrent runs, as this is not supported.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-01-26 14:31:25 -08:00
Brooks Newberry
546a94e9ae V1.24.10 k3s1 (#6788) 2023-01-19 18:39:14 -08:00
Brad Davidson
f7e375979f Fix CI tests 
* General cleanup of test-helpers functions to address CI failures
* Install awscli in test image
* Log containerd output to file even when running with --debug

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit f54b5e4fa0)
 2023-01-18 09:17:39 -08:00
Brad Davidson
0887800db8 Pass through default tls-cipher-suites 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-01-13 22:14:58 -08:00
Brad Davidson
01d519394f Preload iptable_filter/ip6table_filter 
ServiceLB now requires this module, but it will not get autoloaded by the kubelet if the host is using nftables.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-13 18:28:28 -08:00
Brad Davidson
d5ef9e1a12 Bump k3s-root and remove embedded strongswan support 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 2835368ecb)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:20:37 -08:00
Brad Davidson
af9fac15ff go generate 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 915c7719fe)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:20:37 -08:00
Brad Davidson
6e8c10473d go generate 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 1eeea5c81f)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:20:37 -08:00
Brad Davidson
2531ef3b7b Disable CCM metrics port when legacy CCM functionality is disabled 
Prevents port conflicts on upgrade for users that have deployed other cloud controllers.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e08a662509)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:20:37 -08:00
Brad Davidson
cfa7be05cc Bump klipper-helm and klipper-lb versions 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit a07bb555ba)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:20:37 -08:00
Derek Nola
bec4ff182f Add prefer-bundled-bin as an agent flag (#6545) 
* Add prefer-bundled-bin as an agent flag
* Add E2E test for prefer-bundled-bin

Signed-off-by: Derek Nola <derek.nola@suse.com>
(cherry picked from commit 614da78e43)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:20:37 -08:00
Manuel Buil
15d35cad28 Remove stuff which belongs in the windows executor implementation 
Signed-off-by: Manuel Buil <mbuil@suse.com>
(cherry picked from commit 483e29e783)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:20:37 -08:00
Brad Davidson
b5a3126757 Address nits from self-review 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 9ff0943d56)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:20:37 -08:00
Brad Davidson
78917e1de6 Allow agent to run rootless 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 56bf7d6ad3)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:20:37 -08:00
Brad Davidson
fd7db23961 Add rootless IPv6 support 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 6f2b21c5cd)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:20:37 -08:00
Brad Davidson
f4a2be5108 Make rootless settings configurable 
Add enivironment variables for port-driver, cidr, mtu, and disable-host-loopback settings. Since rootless is still experimental, I don't think they deserve full CLI flag status.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit c02dceb7ad)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:20:37 -08:00
Brad Davidson
e7b6ad399a go generate 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 73171ff20a)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:20:37 -08:00
Derek Nola
f457794d8e Add new prefer-bundled-bin experimental flag (#6420) 
* initial prefer-bundled-bin ci change
* Add startup testlet
* Convert parsing to pflag library
* Fix code validation
* go mod tidy

Signed-off-by: Derek Nola <derek.nola@suse.com>
(cherry picked from commit 0f52088cd3)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-12-02 00:20:37 -08:00
Derek Nola
a10c4fa6c3 Change secrets-encryption flag to GA 
Signed-off-by: Derek Nola <derek.nola@suse.com>
 2022-12-01 12:38:30 -08:00
Manuel Buil
a3297cc76a Fix log for flannelExternalIP use case 
Signed-off-by: Manuel Buil <mbuil@suse.com>
 2022-11-22 16:55:51 +01:00
Manuel Buil
7eafff5548 Remove stuff which belongs in the windows executor implementation 
Signed-off-by: Manuel Buil <mbuil@suse.com>
 2022-11-18 09:46:19 +01:00
Brad Davidson
4a36c68bb5 Bump traefik chart to 19.0.4 to fix kubernetes version check 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-11-14 13:42:56 -08:00
Derek Nola
c113444dac Add Secrets Encryption to CriticalArgs (#6409) (#6446) 
* Add EncryptSecrets to Critical Control Args
* use deep comparison to extract differences

Signed-off-by: Derek Nola <derek.nola@suse.com>
 2022-11-04 13:38:06 -07:00
thomasferrandiz
8eb4bc589b Merge pull request #6439 from thomasferrandiz/log-kube-router-1.24 
[Release 1.24] log kube-router version when starting netpol controller
 2022-11-04 15:41:57 +01:00
Manuel Buil
4b1660f1af Merge pull request #6434 from manuelbuil/addrTypes124 
[Release 1.24] Change the priority of address types depending on flannel-external-ip
 2022-11-04 15:21:57 +01:00
Thomas Ferrandiz
4a7cbdb338 log kube-router version when starting netpol controller 
Signed-off-by: Thomas Ferrandiz <thomas.ferrandiz@suse.com>
 2022-11-04 11:00:48 +01:00
Manuel Buil
c955c78afb Change the priority of address types depending on flannel-external-ip 
Signed-off-by: Manuel Buil <mbuil@suse.com>
 2022-11-04 09:10:03 +01:00
Manuel Buil
26083e884c Add some helping logs to avoid wrong configs 
Signed-off-by: Manuel Buil <mbuil@suse.com>
 2022-11-04 09:04:17 +01:00
Brad Davidson
62948829ce go generate 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-11-03 20:54:07 -07:00
iyear
b1c613738c Fix incorrect defer usage 
Problem:
Using defer inside a loop can lead to resource leaks

Solution:
Judge newer file in the separate function

Signed-off-by: iyear <ljyngup@gmail.com>
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-11-03 20:54:07 -07:00
Brad Davidson
71abdec649 Bump traefik to v2.9.4 / chart v18.3.0 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-11-03 20:54:07 -07:00
Petri Kivikangas
e07917cb70 Convert containerd config.toml.tmpl Linux template to v2 syntax 
Signed-off-by: Petri Kivikangas <36138+Kitanotori@users.noreply.github.com>
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-11-03 20:54:07 -07:00
Brad Davidson
b1dfd884e2 Set default kubeletPort 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2022-11-03 20:54:07 -07:00