09d13d2962
Lock bootstrap data with empty key to prevent conflicts
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit d95980bba3
2023-04-05 16:29:31 -07:00
e8408f3af7
Debounce kubernetes service endpoint updates
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 2992477c4b
2023-04-05 16:29:31 -07:00
ab6c64342c
Fix tests to not hide failure location in dummp assert functions
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit ece4d8e45c
2023-04-05 16:29:31 -07:00
01253a5b84
Fix issue with stale connections to removed LB server
...
Track LB connections through each server so that they can be closed when it is removed.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e54ceaa497
2023-04-05 16:29:31 -07:00
447c5aec76
go generate
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit d388b82d25
2023-04-05 16:29:31 -07:00
4864ecd4aa
Ensure that loopback is used for the advertised address when resetting
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit b010db0cff
2023-04-05 16:29:31 -07:00
c313b5b70c
Bump Local Path Provisioner version ( #7167 )
...
* chore: Bump Local Path Provisioner version
* go generate
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
(cherry picked from commit cee3ddbc4a
2023-04-05 16:29:31 -07:00
53e5d566b5
Remove deprecated nodeSelector label beta.kubernetes.io/os ( #6970 ) ( #7122 )
...
* Remove deprecated nodeSelector label beta.kubernetes.io/os
Problem:
The nodeSelector label beta.kubernetes.io/os in the CoreDNS deployment was deprecated in 1.14 and will likely be removed soon
Solution:
Change the nodeSelector to remove the beta
Signed-off-by: Dan Mills <evilhamsterman@gmail.com>
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
Co-authored-by: Daniel Mills <evilhamsterman@users.noreply.github.com>
2023-04-04 21:04:08 +02:00
7fee87d976
Adds a warning about editing to the containerd config.toml file ( #7076 )
...
* Add a warning to the config.toml file
Signed-off-by: Derek Nola <derek.nola@suse.com>
Co-authored-by: Brad Davidson <brad@oatmail.org>
2023-03-14 09:33:21 -07:00
41c24b6a88
Add support for cross-signing new certs during ca rotation
...
We need to send the full chain in order for cross-signing to work
properly during switchover to a new root.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-03-13 20:08:26 -07:00
9360022bbe
Wait for kubelet to update the Ready status before reading port
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-03-13 20:07:34 -07:00
abda53075e
Wait for kubelet port to be ready before setting
...
Signed-off-by: Daishan Peng <daishan@acorn.io>
2023-03-13 20:07:34 -07:00
cabeae0619
[Release 1.24] Update flannel and kube-router ( #7063 )
...
* Update kube-router version to fix iptables rules
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
* Update Flannel to v0.21.3
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
---------
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2023-03-10 20:32:08 -08:00
0f6e4dcee0
Add test for filterByIPFamily
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-02-21 14:14:15 -08:00
3709e8386c
Fix ServiceLB dual-stack ingress IP listing
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-02-21 14:14:15 -08:00
ecb5f5a2b5
Fix CACertPath stripping trailing path components
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-02-14 13:19:22 -08:00
8ae390ff82
Fix etcd member deletion
...
Turns out etcd-only nodes were never running **any** of the controllers,
so allowing multiple controllers didn't really fix things.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-02-14 13:19:22 -08:00
77dbe648ad
Allow for multiple sets of leader-elected controllers
...
Addresses an issue where etcd controllers did not run on etcd-only nodes
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-02-10 12:26:09 -08:00
dd71479e67
Update flannel to v0.21.1
...
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2023-02-10 20:07:50 +01:00
c87d62490f
Fix access to hostNetwork port on NodeIP when egress-selector-mode=agent
...
Signed-off-by: Paul Donohue <git@PaulSD.com>
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-02-10 09:43:58 -08:00
478dae4d3d
Ensure that node exists when using node auth
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 87f9c4ab11
2023-02-10 09:34:10 -08:00
73460e28bf
Add support for kubeadm token and client certificate auth
...
Allow bootstrapping with kubeadm bootstrap token strings or existing
Kubelet certs. This allows agents to join the cluster using kubeadm
bootstrap tokens, as created with the `k3s token create` command.
When the token expires or is deleted, agents can successfully restart by
authenticating with their kubelet certificate via node authentication.
If the token is gone and the node is deleted from the cluster, node auth
will fail and they will be prevented from rejoining the cluster until
provided with a valid token.
Servers still must be bootstrapped with the static cluster token, as
they will need to know it to decrypt the bootstrap data.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 992e64993d
2023-02-10 09:34:10 -08:00
f4fc44ec4a
Add support for `k3s token` command
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 373df1c8b0
2023-02-10 09:34:10 -08:00
6ae3370e28
Add `certificate rotate-ca` to write updated CA certs to datastore
...
This command must be run on a server while the service is running. After this command completes, all the servers in the cluster should be restarted to load the new CA files.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 215fb157ff
2023-02-10 09:34:10 -08:00
b88c3b8c95
Add utility functions for getting kubernetes client
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 3c324335b2
2023-02-10 09:34:10 -08:00
631847536c
Fix CA cert hash for root certs
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 58d40327b4
2023-02-10 09:34:10 -08:00
e62b921b4f
Ensure cluster-signing CA files contain only a single CA cert
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 0919ec6755
2023-02-10 09:34:10 -08:00
ce0a03648d
go generate
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-02-10 07:27:20 -08:00
e0967ce763
Check for existing resources before creating them
...
Prevents errors when starting with fail-closed webhooks
Also, use panic instead of Fatalf so that the CloudControllerManager rescue can handle the error
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-02-10 07:27:20 -08:00
89b5466a00
Use default address family when adding kubernetes service address to SAN list
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-02-09 11:56:42 -08:00
607ccbd49d
[release-1.24] Allow ServiceLB to honor `ExternalTrafficPolicy=Local` ( #6908 )
...
* Bump wrangler version for EndpointSlice support
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 94d1a87509369b81b45e1c6fde9a52
2023-02-08 14:04:08 -08:00
c9f450b314
Ignore value conflicts when reencrypting secrets ( #6918 )
...
* Ignore conflict secrets
Signed-off-by: Derek Nola <derek.nola@suse.com>
2023-02-08 10:45:13 -08:00
1b5a3a5b2e
Wait for cri-dockerd socket ( #6854 )
...
* Wait for cri-dockerd socket
* Consolidate cri utility functions
Signed-off-by: Derek Nola <derek.nola@suse.com>
2023-02-01 09:24:09 -08:00
f0ce56a02b
Standardize flag declaration ( #6868 )
...
Signed-off-by: Derek Nola <derek.nola@suse.com>
2023-02-01 09:23:34 -08:00
564b825152
Fix cron example ( #6865 )
...
Signed-off-by: Derek Nola <derek.nola@suse.com>
2023-01-31 12:57:15 -08:00
8e36b16568
Bugfix: do not break cert-manager when pprof is enabled ( #6635 )
...
Signed-off-by: Silvio Moioli <silvio@moioli.net>
(cherry picked from commit 23c1040adb
2023-01-26 17:36:55 -08:00
be26a6e618
Set cri-dockerd version at build time
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-01-26 14:43:47 -08:00
21b1da5848
Add jitter to scheduled snapshots and retry harder on conflicts
...
Also ensure that the snapshot job does not attempt to trigger multiple concurrent runs, as this is not supported.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-01-26 14:31:25 -08:00
546a94e9ae
V1.24.10 k3s1 ( #6788 )
2023-01-19 18:39:14 -08:00
f7e375979f
Fix CI tests
...
* General cleanup of test-helpers functions to address CI failures
* Install awscli in test image
* Log containerd output to file even when running with --debug
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit f54b5e4fa0
2023-01-18 09:17:39 -08:00
0887800db8
Pass through default tls-cipher-suites
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2023-01-13 22:14:58 -08:00
01d519394f
Preload iptable_filter/ip6table_filter
...
ServiceLB now requires this module, but it will not get autoloaded by the kubelet if the host is using nftables.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-12-13 18:28:28 -08:00
d5ef9e1a12
Bump k3s-root and remove embedded strongswan support
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 2835368ecb
2022-12-02 00:20:37 -08:00
af9fac15ff
go generate
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 915c7719fe
2022-12-02 00:20:37 -08:00
6e8c10473d
go generate
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 1eeea5c81f
2022-12-02 00:20:37 -08:00
2531ef3b7b
Disable CCM metrics port when legacy CCM functionality is disabled
...
Prevents port conflicts on upgrade for users that have deployed other cloud controllers.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e08a662509
2022-12-02 00:20:37 -08:00
cfa7be05cc
Bump klipper-helm and klipper-lb versions
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit a07bb555ba
2022-12-02 00:20:37 -08:00
bec4ff182f
Add `prefer-bundled-bin` as an agent flag ( #6545 )
...
* Add prefer-bundled-bin as an agent flag
* Add E2E test for prefer-bundled-bin
Signed-off-by: Derek Nola <derek.nola@suse.com>
(cherry picked from commit 614da78e43
2022-12-02 00:20:37 -08:00
15d35cad28
Remove stuff which belongs in the windows executor implementation
...
Signed-off-by: Manuel Buil <mbuil@suse.com>
(cherry picked from commit 483e29e783
2022-12-02 00:20:37 -08:00
b5a3126757
Address nits from self-review
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 9ff0943d56
2022-12-02 00:20:37 -08:00
78917e1de6
Allow agent to run rootless
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 56bf7d6ad3
2022-12-02 00:20:37 -08:00
fd7db23961
Add rootless IPv6 support
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 6f2b21c5cd
2022-12-02 00:20:37 -08:00
f4a2be5108
Make rootless settings configurable
...
Add enivironment variables for port-driver, cidr, mtu, and disable-host-loopback settings. Since rootless is still experimental, I don't think they deserve full CLI flag status.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit c02dceb7ad
2022-12-02 00:20:37 -08:00
e7b6ad399a
go generate
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 73171ff20a
2022-12-02 00:20:37 -08:00
f457794d8e
Add new `prefer-bundled-bin` experimental flag ( #6420 )
...
* initial prefer-bundled-bin ci change
* Add startup testlet
* Convert parsing to pflag library
* Fix code validation
* go mod tidy
Signed-off-by: Derek Nola <derek.nola@suse.com>
(cherry picked from commit 0f52088cd3
2022-12-02 00:20:37 -08:00
a10c4fa6c3
Change secrets-encryption flag to GA
...
Signed-off-by: Derek Nola <derek.nola@suse.com>
2022-12-01 12:38:30 -08:00
a3297cc76a
Fix log for flannelExternalIP use case
...
Signed-off-by: Manuel Buil <mbuil@suse.com>
2022-11-22 16:55:51 +01:00
7eafff5548
Remove stuff which belongs in the windows executor implementation
...
Signed-off-by: Manuel Buil <mbuil@suse.com>
2022-11-18 09:46:19 +01:00
4a36c68bb5
Bump traefik chart to 19.0.4 to fix kubernetes version check
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-11-14 13:42:56 -08:00
c113444dac
Add Secrets Encryption to CriticalArgs ( #6409 ) ( #6446 )
...
* Add EncryptSecrets to Critical Control Args
* use deep comparison to extract differences
Signed-off-by: Derek Nola <derek.nola@suse.com>
2022-11-04 13:38:06 -07:00
8eb4bc589b
Merge pull request #6439 from thomasferrandiz/log-kube-router-1.24
...
[Release 1.24] log kube-router version when starting netpol controller
2022-11-04 15:41:57 +01:00
4b1660f1af
Merge pull request #6434 from manuelbuil/addrTypes124
...
[Release 1.24] Change the priority of address types depending on flannel-external-ip
2022-11-04 15:21:57 +01:00
4a7cbdb338
log kube-router version when starting netpol controller
...
Signed-off-by: Thomas Ferrandiz <thomas.ferrandiz@suse.com>
2022-11-04 11:00:48 +01:00
c955c78afb
Change the priority of address types depending on flannel-external-ip
...
Signed-off-by: Manuel Buil <mbuil@suse.com>
2022-11-04 09:10:03 +01:00
26083e884c
Add some helping logs to avoid wrong configs
...
Signed-off-by: Manuel Buil <mbuil@suse.com>
2022-11-04 09:04:17 +01:00
62948829ce
go generate
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-11-03 20:54:07 -07:00
b1c613738c
Fix incorrect defer usage
...
Problem:
Using defer inside a loop can lead to resource leaks
Solution:
Judge newer file in the separate function
Signed-off-by: iyear <ljyngup@gmail.com>
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-11-03 20:54:07 -07:00
71abdec649
Bump traefik to v2.9.4 / chart v18.3.0
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-11-03 20:54:07 -07:00
e07917cb70
Convert containerd config.toml.tmpl Linux template to v2 syntax
...
Signed-off-by: Petri Kivikangas <36138+Kitanotori@users.noreply.github.com>
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-11-03 20:54:07 -07:00
b1dfd884e2
Set default kubeletPort
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-11-03 20:54:07 -07:00
4e4b631b2e
Check for RBAC before starting tunnel controllers
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-11-03 20:54:07 -07:00
0e0d283d08
Add GVK lookup to deploy controller
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-11-03 20:54:07 -07:00
de32ce1776
Update helm-controller to pull in refactor
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-11-03 20:54:07 -07:00
8620d5033f
Bump Traefik helm chart to v18.0.0
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-11-03 20:54:07 -07:00
c557e421dd
Update flannel to 0.20.1
...
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2022-11-03 19:05:06 +01:00
7af5b16788
Add --flannel-external-ip flag
...
Using the node external IP address for all CNI traffic is a breaking change from previous versions; we should make it an opt-in for distributed clusters instead of default behavior.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-10-24 10:14:44 -07:00
e10cfb0e37
Fix RBAC to allow removal of legacy finalizer
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-10-20 16:13:27 -07:00
e3c9d859e8
Return ProviderID in URI format
...
The InstancesV1 interface handled this for us by combining the ProviderName and InstanceID values; the new interface requires us to do it manually
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-10-17 11:02:22 -07:00
e44d22ca61
Add ServiceAccount for svclb pods
...
For 1.24 and earlier, the svclb pods need a ServiceAccount so that we can allow their sysctls in PSPs
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit f25419ca2c
2022-10-14 15:52:25 -07:00
519f13e34d
[Release-1.24] Replace deprecated ioutil package ( #6235 )
...
* Replace ioutil package
* check integration test null pointer
* Remove rotate retries
Signed-off-by: Derek Nola <derek.nola@suse.com>
2022-10-07 19:03:46 -07:00
87bfc8883b
Bump traefik to 2.9.1 / chart 12.0.0
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-10-07 16:57:30 -07:00
3a829ae860
Handle custom kubelet port in agent tunnel
...
The kubelet port can be overridden by users; we shouldn't assume its always 10250
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-10-07 16:57:30 -07:00
3f5c88e4a3
Fix occasional "TLS handshake error" in apiserver network proxy.
...
We should be reading from the hijacked bufio.ReaderWriter instead of
directly from the net.Conn. There is a race condition where the
underlying http handler may consume bytes from the hijacked request
stream, if it comes in the same packet as the CONNECT header. These
bytes are left in the buffered reader, which we were not using. This was
causing us to occasionally drop a few bytes from the start of the
tunneled connection's client data stream.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-10-07 16:57:30 -07:00
cb0f4bd49c
Use structured logging instead of logrus for event recorders
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-10-07 16:57:30 -07:00
69dd30433b
Disable cloud-node and cloud-node-lifecycle if CCM is disabled
...
If CCM and ServiceLB are both disabled, don't run the cloud-controller-manager at all;
this should provide the same CLI flag behavior as previous releases, and not create
problems when users disable the CCM but still want ServiceLB.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-10-07 16:57:30 -07:00
76f13d3558
Move servicelb into cloudprovider LoadBalancer interface
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-10-07 16:57:30 -07:00
23c302dccc
Move DisableServiceLB/Rootless/ServiceLBNamespace into config.Control
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-10-07 16:57:30 -07:00
307e45e739
Implement InstancesV2 instead of Instances
...
... and drop legacy ClusterID support.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-10-07 16:57:30 -07:00
7198eb2f74
Bump metrics-server to v0.6.1
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-10-07 16:57:30 -07:00
0be4ef9213
Add flannel-external-ip when there is a k3s node-external-ip
...
Signed-off-by: Manuel Buil <mbuil@suse.com>
2022-09-29 10:01:56 +02:00
ae7d6285b6
Fix gofmt warnings
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-09-09 17:21:24 -07:00
7d6982d1fa
Export agent.NetworkName for Windows
...
Was made private in 4aca21a1f1
2022-08-23 15:10:57 -07:00
3e394f8ec5
The Windows kubelet does not accept cadvisor flags
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-08-23 15:10:57 -07:00
035c03cfaa
Remove codespell from Drone, add to GH Actions ( #6004 )
...
Signed-off-by: Derek Nola <derek.nola@suse.com>
2022-08-18 09:21:56 -07:00
a30971efaa
Updated flannel to v0.19.1
...
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2022-08-08 09:57:56 +02:00
4aca21a1f1
Add cri-dockerd support as backend for --docker flag
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-08-05 02:39:25 -07:00
b1fa63dfb7
Revert "Remove --docker/dockershim support"
...
This reverts commit 4a3d283bc1
2022-08-05 02:39:25 -07:00
cf66559940
Print stack on panic
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-08-05 02:39:25 -07:00
abdf0c7319
Fix comments and add check in case of IPv6 only node
...
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2022-08-04 09:54:45 +02:00
d90ba30353
Added NodeIP autodect in case of dualstack connection
...
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2022-08-04 09:54:45 +02:00
Brad Davidson