Commit Graph

1513 Commits

Author SHA1 Message Date
Menna Elmasry
f8a4547bec Merge pull request #2448 from MonzElmasry/new_b
Make etcd use node private ip
v1.19.3-rc1+k3s2 v1.19.3+k3s2
2020-10-28 16:40:15 -07:00
Ranjib Dey
18e8184252 remove duplicate systemd directives
Signed-off-by: Ranjib Dey ranjib@linux.com
2020-10-28 16:40:15 -07:00
Chris Kim
4e9f0e4275 Remove RPM publishing from .drone.yml
Signed-off-by: Chris Kim <oats87g@gmail.com>
2020-10-28 16:40:15 -07:00
Brad Davidson
8cdaf52980 Update kine to v0.5.0
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2020-10-28 16:40:15 -07:00
Chris Kim
68339ae00c Add iptable_nat to modprobe list
Signed-off-by: Chris Kim <oats87g@gmail.com>
2020-10-28 16:40:15 -07:00
Chris Kim
098966971a Add auto-install capability to install.sh for k3s-selinux
Signed-off-by: Chris Kim <oats87g@gmail.com>
2020-10-28 16:40:15 -07:00
Hussein Galal
701e45f42b skip node delete from removed member (#2413)
* skip node delete from removed member

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* use grpc errors

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go imports

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* exit if node is the etcd that being removed

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
2020-10-28 16:40:15 -07:00
Brad Davidson
085a3b2920 Make etcd voting members responsible for managing learners (#2399)
* Set etcd timeouts using values from k8s instead of etcdctl
  Fix for one of the warnings from #2303
* Use etcd zap logger instead of deprecated capsnlog
  Fix for one of the warnings from #2303
* Remove member self-promotion code paths
* Add learner promotion tracking code
* Fix RaftAppliedIndex progress check
* Remove ErrGRPCKeyNotFound check
  This is not used by v3 API - it just returns a response with 0 KVs.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2020-10-28 16:40:15 -07:00
Jeremy Katz
ffb02676bc Add information on reporting security issues
Signed-off-by: Jeremy Katz <jeremy@tidelift.com>
2020-10-28 16:40:15 -07:00
Brian Downs
fd9dfba283 run go mod tidy
Signed-off-by: Brian Downs <brian.downs@gmail.com>
2020-10-28 16:40:15 -07:00
Brian Downs
be95bfe1b9 update kine to v0.4.1
Signed-off-by: Brian Downs <brian.downs@gmail.com>
2020-10-28 16:40:15 -07:00
Erik Wilson
c1002f0fc9 Use no_proxy env, add .svc and cluster domains 2020-10-28 16:40:15 -07:00
Erik Wilson
e3eaba37c2 Add network policy controller CacheSyncOrTimeout 2020-10-28 16:40:15 -07:00
Erik Wilson
ec015c9b3e Add event handlers to network policy controller 2020-10-28 16:40:15 -07:00
Erik Wilson
884ba6bb7b check-config: Remove NF_NAT_IPV4 and NF_NAT_NEEDED from kernel check 2020-10-28 16:40:15 -07:00
Erik Wilson
f4c4d8c08d Add locking and verification for data directory extraction 2020-10-28 16:40:15 -07:00
Erik Wilson
9ad1786b3d Add file verification for data directory 2020-10-28 16:40:15 -07:00
Erik Wilson
1be79b461e Add Release function for flock 2020-10-28 16:40:15 -07:00
Erik Wilson
d0c9d9bd5f Add flock from k8s.io/kubernetes/pkg/util/flock 2020-10-28 16:40:15 -07:00
Brad Davidson
879150d155 Add temporary fix for issue with interrupted etcd promote
This is a minimal fix for https://github.com/rancher/rke2/issues/392

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2020-10-28 16:40:15 -07:00
Hussein Galal
64bfc7c8bc Allow for multiple etcd snapshot restoration (#2307)
* add reset tmp file

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go imports

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fix multiple lines string

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fix typo

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* use resetFile function

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
2020-10-28 16:40:15 -07:00
Brad Davidson
4a3f0e4928 Revert removal of EndpointName hooks (#2319)
* Revert "Remove dead EndpointName code"
    This reverts commit 8025da5a8d.
* Fix docstrings based on proper understanding of use
2020-10-28 16:40:15 -07:00
Brad Davidson
22f57cd84e Add timeout to clientaccess http client
The default http client does not have an overall request timeout, so
connections to misbehaving or unavailable servers can stall for an
excessive amount of time. At the moment, just attempting to join
an unavailable cluster takes 2 minutes and 40 seconds to timeout.

Resolve that by setting a reasonable request timeout.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2020-10-28 16:40:15 -07:00
Brad Davidson
ad981265c2 Split clientaccess token/kubeconfig code
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2020-10-28 16:40:15 -07:00
Brad Davidson
e3431ffbf3 Simplify token parsing
Improves readability, reduces round-trips to the join server to validate certs.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2020-10-28 16:40:15 -07:00
Brad Davidson
3d8118b4a3 Fix misc nits and missing/unused imports
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2020-10-28 16:40:15 -07:00
Brad Davidson
dfe88df824 Add a bunch of doc comments
Also change identical error messages to clarify where problems are
occurring.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2020-10-28 16:40:15 -07:00
Brad Davidson
491d1003ef Use const for kube-system namespace
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2020-10-28 16:40:15 -07:00
Brad Davidson
5e4edcb524 Fix etcd directory permissions
Silences warning on startup about insecure directory permissions

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2020-10-28 16:40:15 -07:00
Brad Davidson
61dd185422 Rename etcd directory helpers to reduce confusion about which datadir we're talking about
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2020-10-28 16:40:15 -07:00
Brad Davidson
d852d34aa3 Remove dead EndpointName code
According to @galal-hussein this is dead code that was probably brought
over from Kine. I certainly couldn't figure out what it is supposed to
be doing.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2020-10-28 16:40:15 -07:00
Brad Davidson
6998709610 Remove unnecessary listener arg from managed DB setup
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2020-10-28 16:40:15 -07:00
Brad Davidson
1acb25d884 Fix managed etcd cold startup deadlock issue #2249
We should ignore --token and --server if the managed database is initialized,
just like we ignore --cluster-init. If the user wants to join a new
cluster, or rejoin a cluster after --cluster-reset, they need to delete
the database. This a cleaner way to prevent deadlocking on quorum loss,
and removes the requirement that the target of the --server argument
must be online before already joined nodes can start.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2020-10-28 16:40:15 -07:00
Kevin Messer
1bfa269ae1 feat(install): replace rpm by yum for setup_selinux (#1829)
It's a bad practice to install packages via rpm directly. It's better to install all packages with Yum/Dnf. It's also possible to install packages directly via an URL, which is the purpose of this PR.
2020-10-28 16:40:15 -07:00
Adam Farden
f58f89d327 [systemd] really wait for network to come online (#1665)
Wants= is required to actually set the dependency on network-online.service
After= is required or k3s.service will be started at the same time as network-online.service

In network environments with slow DHCP, both are required to ensure valid network configuration for k3s

Signed-off-by: Adam Farden <adam@farden.cz>
2020-10-28 16:40:15 -07:00
Matthew Clive
052d283a37 Add network dependency to installed service file (#2210)
Adds the line `After=network-online.target` to the k3s systemd service
file. This applies the fix mentioned in
[this GH comment](https://github.com/rancher/k3s/issues/1626#issuecomment-642253812)
which I can confirm makes k3s networking survive reboot in Raspbian
Buster.

[It appears, in some docs I found](https://www.digitalocean.com/community/tutorials/understanding-systemd-units-and-unit-files)
that this is a recommended and usual way of specifying that we need the
target to be _completed_ before starting k3s. Using just the `Wants=`
directive doesn't work for this task, you have to add both directives
at once to do this. Quote:

> `Wants=`: This directive is similar to `Requires=`, but less strict.
> `Systemd` will attempt to start any units listed here when this unit
> is activated. If these units are not found or fail to start, the
> current unit will continue to function. This is the recommended way to
> configure most dependency relationships. **Again, this implies a
> parallel activation unless modified by other directives**

> [...]

> `After=`: The units listed in this directive will be started before
> starting the current unit. This does not imply a dependency
> relationship and **one must be established through the above
> directives if this is required.**

- _(Emphasis mine)_

Signed-off-by: Matthew Clive <arcticlight@arcticlight.me>
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2020-10-28 16:40:15 -07:00
MonzElmasry
6c2151ad83 Mark k3s 1.18.9+k3s1 as stable
Signed-off-by: MonzElmasry <menna.elmasry@rancher.com>
2020-10-28 16:40:15 -07:00
Brad Davidson
fb527e91ab Skip etcd snapshots if the local endpoint is still a learner (#2295)
* Don't take snapshots if the local endpoint is still a learner
* Configure timeouts for etcd client dialer
2020-10-28 16:40:15 -07:00
Brad Davidson
445fbd932f Add trivy cache volume to build
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2020-10-28 16:40:15 -07:00
Brian Downs
b6c64761ab Initial Logging Output Update (#2246)
This attempts to update logging statements to make them consistent
through out the code base. It also adds additional context to messages
where possible, simplifies messages, and updates level where necessary.
2020-10-28 16:40:15 -07:00
Hussein Galal
379defa2c2 reset etcd name on cluster reset (#2284)
* reset etcd name on cluster reset

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* gofmt

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
2020-10-28 16:40:15 -07:00
Craig Jellick
3008a04804 Update ROADMAP.md 2020-10-28 16:40:15 -07:00
Brian Downs
20bdf54f1b use latest trivy version
Signed-off-by: Brian Downs <brian.downs@gmail.com>
2020-10-28 16:40:15 -07:00
Brian Downs
6897a7e16a remove use of docker image for arch purposes
Signed-off-by: Brian Downs <brian.downs@gmail.com>
2020-10-28 16:40:15 -07:00
Brian Downs
3ac831e3f9 update shell if syntax
Signed-off-by: Brian Downs <brian.downs@gmail.com>
2020-10-28 16:40:15 -07:00
Brian Downs
d422493d45 add support for arm
Signed-off-by: Brian Downs <brian.downs@gmail.com>
2020-10-28 16:40:15 -07:00
Brian Downs
e58c4d0c86 update error message
Signed-off-by: Brian Downs <brian.downs@gmail.com>
2020-10-28 16:40:15 -07:00
Brian Downs
000f289f60 add trivy scans for built images
Signed-off-by: Brian Downs <brian.downs@gmail.com>
2020-10-28 16:40:15 -07:00
Brad Davidson
974ad30be7 Update Kubernetes to v1.19.3-k3s1
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
v1.19.3+k3s1 v1.19.3-rc1+k3s1
2020-10-14 16:28:06 -07:00
Brad Davidson
d38505b124 Backport #2273 to release-1.19
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
v1.19.2-rc2+k3s1 v1.19.2+k3s1
2020-09-18 09:50:19 -07:00