Commit Graph

2631 Commits (a92f163c9d937d466cae88d3e5feeec429951b2c)

Author SHA1 Message Date
Roberto Bonafiglia abdf0c7319 Fix comments and add check in case of IPv6 only node
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2022-08-04 09:54:45 +02:00
Roberto Bonafiglia d90ba30353 Added NodeIP autodect in case of dualstack connection
Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
2022-08-04 09:54:45 +02:00
Derek Nola 82e5da35a9
Upgrade macos-10.15 to macos-12 (#5953)
Signed-off-by: Derek Nola <derek.nola@suse.com>
2022-08-03 20:11:17 -07:00
Brad Davidson 43508341c1 Bump minio to v7.0.33
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-08-03 11:28:08 -07:00
Derek Nola 1c17f05b8e
Fix secrets reencryption for 8K+ secrets (#5936)
Signed-off-by: Derek Nola <derek.nola@suse.com>
2022-08-02 14:08:06 -07:00
Derek Nola 118a68c913
Updates to CLI flag grouping + deprecated flag warnings. (#5937)
* Consolidate data dir flag
* Group cluster flags together
* Reorder and group agent flags
* Add additional info around vmodule flag
* Hide deprecated flags, and add warning about their removal

Signed-off-by: Derek Nola <derek.nola@suse.com>
2022-08-02 13:51:16 -07:00
Vladimir Kochnev 13af0b1d88 Save agent token to /var/lib/rancher/k3s/server/agent-token
Having separate tokens for server and agent nodes is a nice feature.

However, passing server's plain `K3S_AGENT_TOKEN` value
to `k3s agent --token` without CA hash is insecure when CA is
self-signed, and k3s warns about it in the logs:

```
Cluster CA certificate is not trusted by the host CA bundle, but the token does not include a CA hash.
Use the full token from the server's node-token file to enable Cluster CA validation.
```

Okay so I need CA hash but where should I get it?

This commit attempts to fix this issue by saving agent token value to
`agent-token` file with CA hash appended.

Signed-off-by: Vladimir Kochnev <hashtable@yandex.ru>
2022-08-01 14:11:50 -07:00
Derek Nola 4c0bc8c046
Update etcd error to match correct url (#5909)
Signed-off-by: Derek Nola <derek.nola@suse.com>
2022-07-29 09:40:53 -07:00
Brad Davidson db2ba7b61d Don't enable unprivileged ports and icmp on old kernels
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-28 14:33:20 -07:00
Derek Nola 90016c208d
ADR: Depreciating and Removing Old Flags (#5890)
* Update naming on old adrs
* New adr for removing deprecated flags

Signed-off-by: Derek Nola <derek.nola@suse.com>
2022-07-28 14:08:50 -07:00
Hussein Galal 24da6adfa9
Move v1.24.3+k3s1 to stable (#5889)
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
2022-07-22 21:20:31 +02:00
Brad Davidson 049004455a Bump dynamiclistener to fix issue with cert expiration
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-22 12:17:34 -07:00
Brad Davidson 5eaa0a9422 Replace getLocalhostIP with Loopback helper method
Requires tweaking existing method signature to allow specifying whether or not IPv6 addresses should be return URL-safe.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-21 16:51:57 -07:00
Brad Davidson 84fb8787f2 Add service-cluster-ip-range to controller-manager args
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-21 16:51:57 -07:00
Thomas Ferrandiz 0a232c72d5 Upgrade kube-router to v1.5.0
Use k3s-io fork of kube-router to keep the netpol dual-stack contrib

Signed-off-by: thomasferrandiz <thomas.ferrandiz@suse.com>
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-21 16:18:21 -07:00
Brad Davidson bd5fdfce33 Fix server systemd detection
* Use INVOCATION_ID to detect execution under systemd, since as of a9b5a1933f NOTIFY_SOCKET is now cleared by the server code.
* Set the unit type to notify by default for both server and agent, which is what Rancher-managed installs have done for a while.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-21 13:42:20 -07:00
Brad Davidson 1674b9d640 Raise etcd connection test timeout to 30 seconds
Addressess issue where the compact may take more than 10 seconds on slower disks. These disks probably aren't really suitable for etcd, but apparently run fine otherwise.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-21 13:23:19 -07:00
Dirk Müller 93ca992cdb update rootlesskit to 1.0.1
This avoids an issue with u-root 7.0.0 which has been retracted by the
author:

  $ go list -u -m all
  $ go list -m: github.com/u-root/u-root@v7.0.0+incompatible: retracted by module author: Published v7 too early (before migrating to go modules)

Signed-off-by: Dirk Müller <dirk@dmllr.de>
2022-07-21 13:22:19 -07:00
rancher-max ca15e0c5e5 Put terraform tests into packages and cleanup upgrade test
Signed-off-by: rancher-max <max.ross@suse.com>
2022-07-21 13:20:05 -07:00
rancher-max 989f3b34fe Update terraform package and make running locally easier
Signed-off-by: rancher-max <max.ross@suse.com>
2022-07-21 13:20:05 -07:00
Nikolai Shields 990ba0e88c
Update to v1.24.3 (#5870)
Signed-off-by: Nikolai Shields <nikolai@nikolaishields.com>
2022-07-15 02:16:41 -05:00
Brad Davidson ffe72eecc4 Address issues with etcd snapshots
* Increase the default snapshot timeout. The timeout is not currently
  configurable from Rancher, and larger clusters are frequently seeing
  uploads fail at 30 seconds.
* Enable compression for scheduled snapshots if enabled on the
  command-line. The CLI flag was not being passed into the etcd config.
* Only set the S3 content-type to application/zip if the file is zipped.
* Don't run more than one snapshot at once, to prevent misconfigured
  etcd snapshot cron schedules from stacking up.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-12 14:41:38 -07:00
Brad Davidson 167ed19d22 Fix deletion of svclb DaemonSet when Service is deleted
87e1806697 removed the OwnerReferences
field from the DaemonSet, which makes sense since the Service may now be
in a different namespace than the DaemonSet and cross-namespace owner
references are not supported.  Unfortunately, we were relying on
garbage collection to delete the DameonSet, so this started leaving
orphaned DaemonSets when Services were deleted.

We don't want to add an a Service OnRemove handler, since this will add
finalizers to all Services, not just LoadBalancers services, causing
conformance tests to fail. Instead, manage our own finalizers, and
restore the DaemonSet removal Event that was removed by the same commit.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-12 12:27:55 -07:00
Brad Davidson fc1c100ffd Remove legacy bidirectional datastore sync code
Since #4438 removed 2-way sync and treats any changed+newer files on disk as an error, we no longer need to determine if files are newer on disk/db or if there is a conflicting mix of both. Any changed+newer file is an error, unless we're doing a cluster reset in which case everything is unconditionally replaced.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-12 12:10:30 -07:00
Brad Davidson 83420ef78e Fix fatal error when reconciling bootstrap data
Properly skip restoring bootstrap data for files that don't have a path
set because the feature that would set it isn't enabled.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-12 12:10:30 -07:00
Brad Davidson 84baab59a9 Promote v1.23.8+k3s2 to stable
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-12 01:04:33 -07:00
Derek Nola 86fc940759
Replace dapper testing with regular docker (#5805)
* Replace dapper mod test with regular docker

Signed-off-by: Derek Nola <derek.nola@suse.com>
2022-07-08 13:01:12 -07:00
Brad Davidson d2089872bb Fix issue with containerd stats missing from cadvisor metrics
cadvisor still doesn't pull stats via CRI yet, so we have to continue to use the deprecated arg.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-08 11:03:02 -07:00
Brad Davidson 7dc78d2cee Bump runc version to v1.1.3
Includes fix for ENOSYS/EPERM issue on s390x.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-07 12:23:34 -07:00
Brad Davidson afee83dda2 Bump remotedialer
Includes fix for recently identified memory leak.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-07 12:22:37 -07:00
Brad Davidson a237260237 Bump kine to v0.9.3
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-01 00:08:15 -07:00
Brad Davidson 961c8274a9 Don't crash when service IPFamiliyPolicy is not set
Service.Spec.IPFamilyPolicy may be a nil pointer on freshly upgraded clusters.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-01 00:07:50 -07:00
Brad Davidson ff6c233e41 Fix egress selector proxy/bind-address support
Use same kubelet-preferred-address-types setting as RKE2 to improve reliability of the egress selector when using a HTTP proxy. Also, use BindAddressOrLoopback to ensure that the correct supervisor address is used when --bind-address is set.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-07-01 00:07:35 -07:00
Brad Davidson 4f4cf18fb6 Add tests for down-level etcd join
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-06-30 11:57:41 -07:00
Brad Davidson 96162c07c5 Handle egress-selector-mode change during upgrade
Properly handle unset egress-selector-mode from existing servers during cluster upgrade.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-06-30 11:57:41 -07:00
Nikolai Shields 9345bd05d1
Merge pull request #5774 from nikolaishields/june-update-channel-server
Mark v1.23.8+k3s1 to stable
2022-06-28 16:41:35 -05:00
Derek Nola 918a5dc559
Remove go-powershell dead dependency (#5777)
Signed-off-by: Derek Nola <derek.nola@suse.com>
2022-06-28 14:24:49 -07:00
Devin Buhl bf9fafc8af
add 1.24 release channel (#5742)
Signed-off-by: Devin Buhl <devin@buhl.casa>
2022-06-28 09:43:31 -07:00
Nikolai Shields 64d420a74c
Mark v1.23.8+k3s1 to stable
Signed-off-by: Nikolai Shields <nikolai@nikolaishields.com>
2022-06-28 09:33:57 -05:00
Nikolai Shields b0ed134855
Merge pull request #5749 from nikolaishields/v1.24.2-k3s1
Update to v1.24.2
2022-06-22 11:23:06 -05:00
Nikolai Shields 61b714b2dd
Update to v1.24.2
Signed-off-by: Nikolai Shields <nikolai@nikolaishields.com>
2022-06-21 15:04:30 -05:00
Brad Davidson a5414bb1fc Bump helm-controller
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-06-16 12:28:13 -07:00
Olli Janatuinen 2968a83bc0 containerd: Enable enable_unprivileged_ports and enable_unprivileged_icmp by default
Signed-off-by: Olli Janatuinen <olli.janatuinen@gmail.com>
2022-06-15 14:49:51 -07:00
Venkata Krishna Rohit Sakala 31b8224f2a Enable compact tests for k3s s390x
Signed-off-by: Venkata Krishna Rohit Sakala <rohitsakala@gmail.com>
2022-06-15 12:24:15 -07:00
Brad Davidson 6fad63583b Only listen on loopback when resetting
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-06-15 11:25:54 -07:00
Brad Davidson 3399afed83 Ensure that CONTAINERD_ variables are not shadowed by later entries
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-06-15 10:58:12 -07:00
Brad Davidson fb0a342a20 Sanitize filenames for use in configmap keys
If the user points S3 backups at a bucket containing other files, those
file names may not be valid configmap keys.

For example, RKE1 generates backup files with names like
`s3-c-zrjnb-rs-6hxpk_2022-05-05T12:05:15Z.zip`; the semicolons in the
timestamp portion of the name are not allowed for use in configmap keys.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-06-15 10:54:26 -07:00
Brad Davidson 06e40ec6e7 Disable urfave markdown/man docs generation
From https://github.com/urfave/cli/pull/1383 :
> This removes the resulting binary dependency on cpuguy83/md2man and
> russross/blackfriday (and a few more packages imported by those),
> which saves more than 400 KB (more than 300 KB
> once stripped) from the resulting binary.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-06-15 10:53:42 -07:00
Derek Nola a9b5a1933f
Delay service readiness until after startuphooks have finished (#5649)
* Move startup hooks wg into a runtime pointer, check before notifying systemd
* Switch default systemd notification to server
* Add 1 sec delay to allow etcd to write to disk
Signed-off-by: Derek Nola <derek.nola@suse.com>
2022-06-15 09:00:52 -07:00
ShylajaDevadiga 97c69546c5
add arm tests and upgrade tests (#5526)
Signed-off-by: Shylaja Devadiga <shylaja@rancher.com>
2022-06-15 08:55:05 -07:00