18 Commits (b0ad6d846ddb4ed4ccfc6a1f9d6d2f539ab5e085)

Author	SHA1	Message	Date
Brad Davidson	eb8bd15889	Ensure remotedialer kubelet connections use kubelet bind address ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	5 months ago
Brad Davidson	f8e0648304	Convert remaining http handlers over to use util.SendError ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	6 months ago
Brad Davidson	7a2a2d075c	Move error response generation code into util ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	8 months ago
Johnatas	6330a5b49c	Update to v1.28.2 and go v1.20.8 (#8364) ... * Update to v1.28.2 Signed-off-by: Johnatas <johnatasr@hotmail.com> * Bump containerd and stargz versions Signed-off-by: Brad Davidson <brad.davidson@rancher.com> * Print message on upgrade fail Signed-off-by: Brad Davidson <brad.davidson@rancher.com> * Send Bad Gateway instead of Service Unavailable when tunnel dial fails Works around new handling for Service Unavailable by apiserver aggregation added in kubernetes/kubernetes#119870 Signed-off-by: Brad Davidson <brad.davidson@rancher.com> * Add 60 seconds to server upgrade wait to account for delays in apiserver readiness Also change cleanup helper to ensure upgrade test doesn't pollute the images for the rest of the tests. Signed-off-by: Brad Davidson <brad.davidson@rancher.com> --------- Signed-off-by: Johnatas <johnatasr@hotmail.com> Signed-off-by: Brad Davidson <brad.davidson@rancher.com> Co-authored-by: Brad Davidson <brad.davidson@rancher.com>	1 year ago
Brad Davidson	c44d33d29b	Fix race condition in tunnel server startup ... Several places in the code used a 5-second retry loop to wait on Runtime.Core to be set. This caused a race condition where OnChange handlers could be added after the Wrangler shared informers were already started. When this happened, the handlers were never called because the shared informers they relied upon were not started. Fix that by requiring anything that waits on Runtime.Core to run from a cluster controller startup hook that is guaranteed to be called before the shared informers are started, instead of just firing it off in a goroutine that retries until it is set. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	b411864be5	Handle custom kubelet port in agent tunnel ... The kubelet port can be overridden by users; we shouldn't assume its always 10250 Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	11072e2516	Fix occasional "TLS handshake error" in apiserver network proxy. ... We should be reading from the hijacked bufio.ReaderWriter instead of directly from the net.Conn. There is a race condition where the underlying http handler may consume bytes from the hijacked request stream, if it comes in the same packet as the CONNECT header. These bytes are left in the buffered reader, which we were not using. This was causing us to occasionally drop a few bytes from the start of the tunneled connection's client data stream. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	5eaa0a9422	Replace getLocalhostIP with Loopback helper method ... Requires tweaking existing method signature to allow specifying whether or not IPv6 addresses should be return URL-safe. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	afee83dda2	Bump remotedialer ... Includes fix for recently identified memory leak. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	b550e1183a	Remove control-plane egress context and fix agent mode. ... The control-plane context handles requests outside the cluster and should not be sent to the proxy. In agent mode, we don't watch pods and just direct-dial any request for a non-node address, which is the original behavior. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	d3242bea3c	Refactor egress-selector pods mode to watch pods ... Watching pods appears to be the most reliable way to ensure that the proxy routes and authorizes connections. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Brad Davidson	9d7230496d	Add support for configuring the EgressSelector mode ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Brad Davidson	ce5b9347c9	Replace DefaultProxyDialerFn dialer injection with EgressSelector support ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Brad Davidson	af0b496ef3	Add client certificate authentication support to core Authenticator ... This is required to make the websocket tunnel server functional on etcd-only nodes, and will save some code on the RKE2 side once pulled through. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Darren Shepherd	3396a7b099	If tunnel session does not exist fallback to default dialer	5 years ago
Darren Shepherd	ba240d0611	Refactor tokens, bootstrap, and cli args	5 years ago
Darren Shepherd	c0702b0492	Port to wrangler	6 years ago
Darren Shepherd	9bb7c27c62	Initial Commit	6 years ago