51f1a5a0ab
Review comments and fixes
...
Signed-off-by: Derek Nola <derek.nola@suse.com>
1 year ago
42c2ac95e2
CLI + Backend for Secrets Encryption v3
...
Signed-off-by: Derek Nola <derek.nola@suse.com>
1 year ago
ced330c66a
[v1.28] CLI Removal for v1.28.0 ( #8203 )
...
* Remove deprecated flannel ipsec
Signed-off-by: Derek Nola <derek.nola@suse.com>
* Remove multipart backend
Signed-off-by: Derek Nola <derek.nola@suse.com>
* Fix secrets-encryption integration test flakiness
Signed-off-by: Derek Nola <derek.nola@suse.com>
---------
Signed-off-by: Derek Nola <derek.nola@suse.com>
1 year ago
af50e1b096
Update to v1.28.0-k3s1 ( #8199 )
...
* Update to v1.28.0
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* Update golang to v1.20.7
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* more changes
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* update wrangler
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* update wrangler
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* fix nodepassword test
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* fix nodepassword test
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* disable CGO before running golangci-lint
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* execlude CGO Enabled checks
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* Ignore reapply change error with logging
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
* Update google api client
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
---------
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
1 year ago
c97211866a
Fix for cluster-reset backup from s3 when etcd snapshots are disabled ( #8155 )
...
* Fixed when the user disable the etcd snapshots, but want to backup from s3
Signed-off-by: Vitor <vitor.savian@suse.com>
1 year ago
8c38d1169d
Merge pull request #8077 from manuelbuil/fixTailscale
...
Fix tailscale bug with ip modes
1 year ago
46cbbab263
Consolidate CopyFile functions ( #8079 )
...
* Consolidate CopyFile function
Signed-off-by: Derek Nola <derek.nola@suse.com>
* Copy to File, not destination folder
Signed-off-by: Derek Nola <derek.nola@suse.com>
---------
Signed-off-by: Derek Nola <derek.nola@suse.com>
1 year ago
59eec78c62
Fix tailscale bug with ip modes
...
Signed-off-by: Manuel Buil <mbuil@suse.com>
1 year ago
0b18a65d4f
Revert "Warn that v1.28 will deprecate reencrypt/prepare ( #7848 )"
...
This reverts commit 4ab01f3941
1 year ago
b9a2bf11ee
Support setting control server URL for Tailscale.
...
This change enables the use of Headscale - open source implementation of the Tailscale control server.
Signed-off-by: Denys Smirnov <dennwc@pm.me>
1 year ago
4ab01f3941
Warn that v1.28 will deprecate reencrypt/prepare ( #7848 )
...
* Warn that v1.28 will deprecate reencrypt/prepare
Signed-off-by: Derek Nola <derek.nola@suse.com>
1 year ago
6c44b06e0a
Merge pull request #7838 from manuelbuil/ipv4ipv6tailscale
...
Check if we are on ipv4, ipv6 or dualStack when doing tailscale
1 year ago
72d50b1f7c
Add `--data-dir` to the `k3s certificate rotate-ca` cli ( #7791 )
...
Need to add a cli flag for this. Also, should probably have config file loading support for the certificate commands.
Signed-off-by: leilei.zhai <leilei.zhai@qingteng.cn>
1 year ago
f21a01474d
Check if we are on ipv4, ipv6 or dualStack when doing tailscale
...
Signed-off-by: Manuel Buil <mbuil@suse.com>
1 year ago
0809187cff
Adding cli to custom klipper helm image ( #7682 )
...
Adding cli to custom klipper helm image
Signed-off-by: Vitor Savian <vitor.savian@suse.com>
1 year ago
869e030bdd
VPN PoC
...
Signed-off-by: Manuel Buil <mbuil@suse.com>
1 year ago
b0188f5a13
Test Coverage Reports for E2E tests ( #7526 )
...
* Move coverage writer into agent and server
* Add coverage report to E2E PR tests
* Add codecov upload to drone
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
64a5f58f1e
Create new kubeconfig for supervisor use
...
Only actual admin actions should use the admin kubeconfig; everything done by the supervisor/deploy/helm controllers will now use a distinct account for audit purposes.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
437ad128c7
Migrate netutil methods into /utils/net.go
...
Signed-off-by: Manuel Buil <mbuil@suse.com>
2 years ago
d5f560360e
Handle multiple arguments with StringSlice flags ( #7380 )
...
* Add helper function for multiple arguments in stringslice
Signed-off-by: Derek Nola <derek.nola@suse.com>
* Cleanup server setup with util function
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
31a6386994
Improve egress selector handling on agentless servers
...
Don't set up the agent tunnel authorizer on agentless servers, and warn when agentless servers won't have a way to reach in-cluster endpoints.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
bc5b42c279
Cleanup help messages ( #7369 )
...
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
944f811dc5
v1.27.1 CLI Deprecation ( #7311 )
...
* Remove Flannel Wireguard
* Remove etcd-snapshot (implicit save)
* Convert ipsec and multiple backend to fatal
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
15ee88964b
Added multiClusterCidr feature
...
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2 years ago
23d98cec22
Fix CACertPath stripping trailing path components
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
3d146d2f1b
Allow for multiple sets of leader-elected controllers
...
Addresses an issue where etcd controllers did not run on etcd-only nodes
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
32d62c5786
Use default address family when adding kubernetes service address to SAN list
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
a92f163c9d
Add NATS to the list of supported data stores ( #6876 )
...
Signed-off-by: Byron Ruth <byron@nats.io>
2 years ago
992e64993d
Add support for kubeadm token and client certificate auth
...
Allow bootstrapping with kubeadm bootstrap token strings or existing
Kubelet certs. This allows agents to join the cluster using kubeadm
bootstrap tokens, as created with the `k3s token create` command.
When the token expires or is deleted, agents can successfully restart by
authenticating with their kubelet certificate via node authentication.
If the token is gone and the node is deleted from the cluster, node auth
will fail and they will be prevented from rejoining the cluster until
provided with a valid token.
Servers still must be bootstrapped with the static cluster token, as
they will need to know it to decrypt the bootstrap data.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
373df1c8b0
Add support for `k3s token` command
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
215fb157ff
Add `certificate rotate-ca` to write updated CA certs to datastore
...
This command must be run on a server while the service is running. After this command completes, all the servers in the cluster should be restarted to load the new CA files.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
32086717fc
Ensure flag type consistency ( #6852 )
...
* Convert all flags to pointers for consistency
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
9fcc7c0db8
Fix cronjob example ( #6707 )
...
Related PR:
https://github.com/rancher/rke2-docs/pull/38
Signed-off-by: Akos Elek <akose73@tazerve.hu>
2 years ago
8340b54309
Pass through default tls-cipher-suites
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
b5d39df929
Deprecation of `etcd-snapshot` command in v1.26 ( #6575 )
...
* Consolidate etcd snapshot commands
* Consolidate secrets encryption commands
* Move etcd-snapshot to fatal error stage.
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
d723775792
Remove deprecated flags in v1.26 ( #6574 )
...
* Remove NoFlannel
* Remove cluster-secret
* Remove no-deploy
* Remove disable-selinux
* Convert wireguard to fatal error
* Remove reference to no-op K3S_CLUSTER_SECRET
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
2835368ecb
Bump k3s-root and remove embedded strongswan support
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
af8f101bdc
Mark secrets-encryption flag as GA ( #6582 )
...
* Mark secrets-encrypt flag as GA
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
614da78e43
Add `prefer-bundled-bin` as an agent flag ( #6545 )
...
* Add prefer-bundled-bin as an agent flag
* Add E2E test for prefer-bundled-bin
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
56bf7d6ad3
Allow agent to run rootless
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
6f2b21c5cd
Add rootless IPv6 support
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
0f52088cd3
Add new `prefer-bundled-bin` experimental flag ( #6420 )
...
* initial prefer-bundled-bin ci change
* Add startup testlet
* Convert parsing to pflag library
* Fix code validation
* go mod tidy
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
f2585c1671
Add --flannel-external-ip flag
...
Using the node external IP address for all CNI traffic is a breaking change from previous versions; we should make it an opt-in for distributed clusters instead of default behavior.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
06d81cb936
Replace deprecated ioutil package ( #6230 )
...
* Replace ioutil package
* check integration test null pointer
* Remove rotate retries
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
d963cb2f70
Disable cloud-node and cloud-node-lifecycle if CCM is disabled
...
If CCM and ServiceLB are both disabled, don't run the cloud-controller-manager at all;
this should provide the same CLI flag behavior as previous releases, and not create
problems when users disable the CCM but still want ServiceLB.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
a15e7e8b68
Move DisableServiceLB/Rootless/ServiceLBNamespace into config.Control
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
1d46841d80
Fix deprecation message
...
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
cd49101fc8
Convert deprecated flags to fatal errors for v1.25 ( #6069 )
...
* Replace warning with fatal errors.
* Group system-default-registry under (agent/runtime)
Signed-off-by: Derek Nola <derek.nola@suse.com>
2 years ago
ba62c79f9b
Update to v1.25.0-k3s1 ( #6040 )
...
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
2 years ago
4aca21a1f1
Add cri-dockerd support as backend for --docker flag
...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2 years ago
Derek Nola