4aafff0219
Wrap error stating that it is coming from netpol
...
Signed-off-by: Manuel Buil <mbuil@suse.com>
2 years ago
cedefeff24
Bump cni plugins to v1.2.0-k3s1
...
Also add bandwidth and firewall plugins. The bandwidth plugin is
automatically registered with the appropriate capability, but the
firewall plugin must be configured by the user if they want to use it.
Ref: https://www.cni.dev/plugins/current/meta/firewall/
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
f1b6a3549c
Fix stack log on panic
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
31a6386994
Improve egress selector handling on agentless servers
...
Don't set up the agent tunnel authorizer on agentless servers, and warn when agentless servers won't have a way to reach in-cluster endpoints.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
944f811dc5
v1.27.1 CLI Deprecation ( #7311 )
...
* Remove Flannel Wireguard
* Remove etcd-snapshot (implicit save)
* Convert ipsec and multiple backend to fatal
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
3e3512bdae
Updated kube-route version to move the iptables ACCEPT default rule at the end of the chain
...
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2 years ago
2992477c4b
Debounce kubernetes service endpoint updates
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
ece4d8e45c
Fix tests to not hide failure location in dummp assert functions
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
e54ceaa497
Fix issue with stale connections to removed LB server
...
Track LB connections through each server so that they can be closed when it is removed.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
15ee88964b
Added multiClusterCidr feature
...
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2 years ago
b7f90f389c
Wait for kubelet port to be ready before setting ( #7041 )
...
* Wait for kubelet port to be ready before setting
* Wait for kubelet to update the Ready status before reading port
Signed-off-by: Daishan Peng <daishan@acorn.io>
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Co-authored-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
d218068f34
Adds a warning about editing to the containerd config.toml file ( #7057 )
...
* Add a warning to the config.toml file
Signed-off-by: Derek Nola <derek.nola@suse.com>
Co-authored-by: Brad Davidson <brad@oatmail.org>
2 years ago
e098b99bfa
Update flannel and kube-router ( #7039 )
...
* Update kube-router version to fix iptables rules
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
* Update Flannel to v0.21.3
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
---------
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2 years ago
b8e69712a3
Updated flannel version to v0.21.0
...
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2 years ago
290d7e8fd1
Fix access to hostNetwork port on NodeIP when egress-selector-mode=agent
...
Signed-off-by: Paul Donohue <git@PaulSD.com>
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
992e64993d
Add support for kubeadm token and client certificate auth
...
Allow bootstrapping with kubeadm bootstrap token strings or existing
Kubelet certs. This allows agents to join the cluster using kubeadm
bootstrap tokens, as created with the `k3s token create` command.
When the token expires or is deleted, agents can successfully restart by
authenticating with their kubelet certificate via node authentication.
If the token is gone and the node is deleted from the cluster, node auth
will fail and they will be prevented from rejoining the cluster until
provided with a valid token.
Servers still must be bootstrapped with the static cluster token, as
they will need to know it to decrypt the bootstrap data.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
3c324335b2
Add utility functions for getting kubernetes client
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
0d4caf4e24
Wait for cri-dockerd socket ( #6812 )
...
* Wait for cri-dockerd socket
* Consolidate cri utility functions
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
3cb6fa5cc7
Set cri-dockerd version at build time
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
89f7062431
Add build tag to disable cri-dockerd
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
f54b5e4fa0
Fix CI tests
...
* General cleanup of test-helpers functions to address CI failures
* Install awscli in test image
* Log containerd output to file even when running with --debug
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
0c9b43746b
Preload iptable_filter/ip6table_filter
...
ServiceLB now requires this module, but it will not get autoloaded by the kubelet if the host is using nftables.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
f8b661d590
Update to v1.26.0-k3s1 ( #6370 )
...
* Update to v1.26.0-alpha.2
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* go generate
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* Default CURRENT_VERSION to VERSION_TAG for alpha versions
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* remove containerd package
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* Update k8s to v1.26.0-rc.0-k3s1 cri-tools cri-dockerd and cadvisor
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* replace cri-api reference to the new api
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* go mod tidy
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* Fix version script to allow rc and alphas
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* Fix version script to allow rc and alphas
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* Fix version script to allow rc and alphas
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* Update to Kubernetes 1.26.0-rc.1
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
* Undo helm-controller pin
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
* Bump containerd to -k3s2 for stargz fix
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
* DevicePlugins featuregate is locked to on
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
* Bump kine for DeleteRange fix
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
* Update to v1.26.0-k3s1
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* go mod tidy
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* Bring back snapshotter checks and update golang to 1.19.4
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* fix windows containerd snapshotter checks
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Co-authored-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
d723775792
Remove deprecated flags in v1.26 ( #6574 )
...
* Remove NoFlannel
* Remove cluster-secret
* Remove no-deploy
* Remove disable-selinux
* Convert wireguard to fatal error
* Remove reference to no-op K3S_CLUSTER_SECRET
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
2835368ecb
Bump k3s-root and remove embedded strongswan support
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
1beecb2e2d
Merge pull request #6531 from manuelbuil/fixLogs
...
Fix log for flannelExternalIP use case
2 years ago
6f2b21c5cd
Add rootless IPv6 support
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
5188443988
Fix log for flannelExternalIP use case
...
Signed-off-by: Manuel Buil <mbuil@suse.com>
2 years ago
b7d217dbf3
Merge pull request #6405 from thomasferrandiz/log-kube-router-version
...
log kube-router version when starting netpol controller
2 years ago
8aff25e192
Merge pull request #6403 from manuelbuil/logsFlannelExternalIP
...
Avoid wrong config for `flannel-external-ip` and add warning if unencrypted backend
2 years ago
1682172ac1
Add some helping logs to avoid wrong configs
...
Signed-off-by: Manuel Buil <mbuil@suse.com>
2 years ago
87c7ea81f0
Updated flannel version to 0.20.1
...
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2 years ago
68ac954489
log kube-router version when starting netpol controller
...
Signed-off-by: Thomas Ferrandiz <thomas.ferrandiz@suse.com>
2 years ago
6156059136
Convert containerd config.toml.tmpl Linux template to v2 syntax
...
Signed-off-by: Petri Kivikangas <36138+Kitanotori@users.noreply.github.com>
2 years ago
76729d813b
Set default kubeletPort
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
269563e4d2
Check for RBAC before starting tunnel controllers
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
f2585c1671
Add --flannel-external-ip flag
...
Using the node external IP address for all CNI traffic is a breaking change from previous versions; we should make it an opt-in for distributed clusters instead of default behavior.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
06d81cb936
Replace deprecated ioutil package ( #6230 )
...
* Replace ioutil package
* check integration test null pointer
* Remove rotate retries
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
b411864be5
Handle custom kubelet port in agent tunnel
...
The kubelet port can be overridden by users; we shouldn't assume its always 10250
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
5164cf5345
Add flannel-external-ip when there is a k3s node-external-ip
...
Signed-off-by: Manuel Buil <mbuil@suse.com>
2 years ago
26e9405767
Added warning message for flannel backend additional options deprecation
...
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2 years ago
cd49101fc8
Convert deprecated flags to fatal errors for v1.25 ( #6069 )
...
* Replace warning with fatal errors.
* Group system-default-registry under (agent/runtime)
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
a30971efaa
Updated flannel to v0.19.1
...
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2 years ago
4aca21a1f1
Add cri-dockerd support as backend for --docker flag
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
b1fa63dfb7
Revert "Remove --docker/dockershim support"
...
This reverts commit 4a3d283bc1
2 years ago
d90ba30353
Added NodeIP autodect in case of dualstack connection
...
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2 years ago
118a68c913
Updates to CLI flag grouping + deprecated flag warnings. ( #5937 )
...
* Consolidate data dir flag
* Group cluster flags together
* Reorder and group agent flags
* Add additional info around vmodule flag
* Hide deprecated flags, and add warning about their removal
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
db2ba7b61d
Don't enable unprivileged ports and icmp on old kernels
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
bd5fdfce33
Fix server systemd detection
...
* Use INVOCATION_ID to detect execution under systemd, since as of a9b5a1933f
2 years ago
afee83dda2
Bump remotedialer
...
Includes fix for recently identified memory leak.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
Manuel Buil