24 Commits (e34fe0343f420e004340155c6efc2742907d2dfb)

Author	SHA1	Message	Date
Brad Davidson	fe465cc832	Move etcd snapshot management CLI to request/response ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	8 months ago
Derek Nola	fa11850563	Readd `k3s secrets-encrypt rotate-keys` with correct support for KMSv2 GA (#9340) ... * Reorder copy order for caching * Enable longer http timeout requests Signed-off-by: Derek Nola <derek.nola@suse.com> * Setup reencrypt controller to run on all apiserver nodes * Fix reencryption for disabling secrets encryption, reenable drone tests	10 months ago
Brad Davidson	7f50b40cfe	Fall back to basic/bearer auth when node identity auth is rejected ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	1 year ago
Brad Davidson	cf9ebb3259	Fail to validate server tokens that use bootstrap id/secret format ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	992e64993d	Add support for kubeadm token and client certificate auth ... Allow bootstrapping with kubeadm bootstrap token strings or existing Kubelet certs. This allows agents to join the cluster using kubeadm bootstrap tokens, as created with the `k3s token create` command. When the token expires or is deleted, agents can successfully restart by authenticating with their kubelet certificate via node authentication. If the token is gone and the node is deleted from the cluster, node auth will fail and they will be prevented from rejoining the cluster until provided with a valid token. Servers still must be bootstrapped with the static cluster token, as they will need to know it to decrypt the bootstrap data. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	373df1c8b0	Add support for `k3s token` command ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	215fb157ff	Add `certificate rotate-ca` to write updated CA certs to datastore ... This command must be run on a server while the service is running. After this command completes, all the servers in the cluster should be restarted to load the new CA files. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	58d40327b4	Fix CA cert hash for root certs ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Derek Nola	06d81cb936	Replace deprecated ioutil package (#6230) ... * Replace ioutil package * check integration test null pointer * Remove rotate retries Signed-off-by: Derek Nola <derek.nola@suse.com>	2 years ago
Luther Monson	9a849b1bb7	[master] changing package to k3s-io (#4846) ... * changing package to k3s-io Signed-off-by: Luther Monson <luther.monson@gmail.com> Co-authored-by: Derek Nola <derek.nola@suse.com>	3 years ago
Derek Nola	bcb662926d	Secrets-encryption rotation (#4372) ... * Regular CLI framework for encrypt commands * New secrets-encryption feature * New integration test * fixes for flaky integration test CI * Fix to bootstrap on restart of existing nodes * Consolidate event recorder Signed-off-by: Derek Nola <derek.nola@suse.com>	3 years ago
Brian Downs	ac7a8d89c6	Add ability to reconcile bootstrap data between datastore and disk (#3398)	3 years ago
Derek Nola	21c8a33647	Introduction of Integration Tests (#3695) ... * Commit of new etcd snapshot integration tests. * Updated integration github action to not run on doc changes. * Update Drone runner to only run unit tests Signed-off-by: dereknola <derek.nola@suse.com>	3 years ago
Hussein Galal	136dddca11	Fix storing bootstrap data with empty token string (#3422) ... * Fix storing bootstrap data with empty token string Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com> * delete node password secret after restoration fixes to bootstrap key vendor update Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com> * fix comment Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com> * fix typo Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com> * more fixes Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com> * fixes Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com> * fixes Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com> * typos Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com> * Removing dynamic listener file after restoration Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com> * go mod tidy Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>	3 years ago
Brad Davidson	7cdfaad6ce	Always use static ports for client load-balancers (#3026) ... * Always use static ports for the load-balancers This fixes an issue where RKE2 kube-proxy daemonset pods were failing to communicate with the apiserver when RKE2 was restarted because the load-balancer used a different port every time it started up. This also changes the apiserver load-balancer port to be 1 below the supervisor port instead of 1 above it. This makes the apiserver port consistent at 6443 across servers and agents on RKE2. Additional fixes below were required to successfully test and use this change on etcd-only nodes. * Actually add lb-server-port flag to CLI * Fix nil pointer when starting server with --disable-etcd but no --server * Don't try to use full URI as initial load-balancer endpoint * Fix etcd load-balancer pool updates * Update dynamiclistener to fix cert updates on etcd-only nodes * Handle recursive initial server URL in load balancer * Don't run the deploy controller on etcd-only nodes	4 years ago
Brad Davidson	ad5e504cf0	Allow joining clusters when the server CA is trusted by the OS CA bundle (#2743) ... * Add tests to clientaccess/token * Fix issues in clientaccess/token identified by tests * Update tests to close coverage gaps * Remove redundant check turned up by code coverage reports * Add warnings if CA hash will not be validated Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	4 years ago
Brad Davidson	360b0f1ee5	Add timeout to clientaccess http client ... The default http client does not have an overall request timeout, so connections to misbehaving or unavailable servers can stall for an excessive amount of time. At the moment, just attempting to join an unavailable cluster takes 2 minutes and 40 seconds to timeout. Resolve that by setting a reasonable request timeout. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	4 years ago
Brad Davidson	cdfc6cfa1a	Split clientaccess token/kubeconfig code ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	4 years ago
Brad Davidson	45dd4afe50	Simplify token parsing ... Improves readability, reduces round-trips to the join server to validate certs. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	4 years ago
Brad Davidson	703ba5cde7	Add a bunch of doc comments ... Also change identical error messages to clarify where problems are occurring. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	4 years ago
Darren Shepherd	2f5ee914f9	Add supervisor port ... In k3s today the kubernetes API and the /v1-k3s API are combined into one http server. In rke2 we are running unmodified, non-embedded Kubernetes and as such it is preferred to run k8s and the /v1-k3s API on different ports. The /v1-k3s API port is called the SupervisorPort in the code. To support this separation of ports a new shim was added on the client in then pkg/agent/proxy package that will launch two load balancers instead of just one load balancer. One load balancer for 6443 and the other for 9345 (which is the supervisor port).	5 years ago
Darren Shepherd	3c8e0b4157	No longer use basic auth for default admin account	5 years ago
Darren Shepherd	ba240d0611	Refactor tokens, bootstrap, and cli args	5 years ago
Darren Shepherd	c0702b0492	Port to wrangler	6 years ago