Commit Graph

2326 Commits (f4cc1b8788f25ddacf68634e8f134aac499b6c3b)

Author SHA1 Message Date
Darren Shepherd f4cc1b8788 Move all klipper-lb daemonset to common namespace for PodSecurity
The baseline PodSecurity profile will reject klipper-lb pods from running.
Since klipper-lb pods are put in the same namespace as the Service this
means users can not use PodSecurity baseline profile in combination with
the k3s servicelb.

The solution is to move all klipper-lb pods to a klipper-lb-system where
the security policy of the klipper-lb pods can be different an uniformly
managed.

Signed-off-by: Darren Shepherd <darren@acorn.io>
2022-06-14 15:48:58 -07:00
Derek Nola 12695cea15
E2E: Dualstack test (#5617)
* E2E dualstack test
* Improve testing documentation

Signed-off-by: Derek Nola <derek.nola@suse.com>
2022-06-14 08:40:29 -07:00
Manuel Buil d4522de06a
Merge pull request #5656 from manuelbuil/AddFlannelCniConfFile
Add FlannelCNIConf flag
2022-06-14 10:23:51 +02:00
Manuel Buil 443b23e22f
Merge pull request #5644 from manuelbuil/ipvs-interface
Remove kube-ipvs0 interface when cleaning up
2022-06-14 10:12:18 +02:00
Igor 2999289e68
add support for pprof server (#5527)
Signed-off-by: igor <igor@igor.io>
2022-06-13 22:06:55 -07:00
Guilherme Macedo 763a8bc8fe
Update security email contact (#5607)
Signed-off-by: Guilherme Macedo <guilherme.macedo@suse.com>
2022-06-13 14:58:06 -07:00
Derek Nola efab09bc1f
E2E Improvements and groundwork for test-pad tool (#5593)
* Add rancher install sript, taints to cp/etcd roles
* Revert back to generic/ubuntu2004, libvirt networking is unreliable on opensuse
* Added support for alpine
* Rancher deployment script
* Refactor installType into function
* Cleanup splitserver test
Signed-off-by: Derek Nola <derek.nola@suse.com>
2022-06-13 13:36:26 -07:00
Derek Nola 168b14b08e
Integration Test: Startup (#5630)
* New startup integration test
* Add testing section to PR template
* Move helper functions to direct k8s client calls

Signed-off-by: Derek Nola <derek.nola@suse.com>
2022-06-13 13:32:13 -07:00
Brad Davidson 0581808f5c Set default egress-selector-mode to agent
... until QA flakes can be addressed.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-06-10 10:14:15 -07:00
Brad Davidson b550e1183a Remove control-plane egress context and fix agent mode.
The control-plane context handles requests outside the cluster and
should not be sent to the proxy.

In agent mode, we don't watch pods and just direct-dial any request for
a non-node address, which is the original behavior.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-06-10 10:14:15 -07:00
Brad Davidson d3242bea3c Refactor egress-selector pods mode to watch pods
Watching pods appears to be the most reliable way to ensure that the
proxy routes and authorizes connections.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-06-08 09:34:53 -07:00
Manuel Buil c705d34804 Add FlannelConfCNI flag
Signed-off-by: Manuel Buil <mbuil@suse.com>
2022-06-08 11:03:17 +02:00
Brad Davidson c00f953ef9 Bump containerd and runc
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-06-07 13:11:07 -07:00
Derek Nola f491802b44
Update flaky tests for v1.24 (#5625)
* Update flaky tests for v1.24
* Consolidate flaky-test regex into file
Signed-off-by: Derek Nola <derek.nola@suse.com>
2022-06-07 09:37:13 -07:00
Manuel Buil 699ae80de0 Remove kube-ipvs0 interface when cleaning up
Signed-off-by: Manuel Buil <mbuil@suse.com>
2022-06-06 12:14:06 +02:00
Brad Davidson 491aa11e10 Revert "Give kubelet the node-ip value (#5579)"
This reverts commit aa9065749c.

Setting dual-stack node-ip does not work when --cloud-provider is set
to anything, including 'external'. Just set node-ip to the first IP, and
let the cloud provider add the other address.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-06-02 17:36:55 -07:00
Brad Davidson 29397b4e68 Re-add --cloud-provider=external kubelet arg
The cloud-provider arg is deprecated and cannot be set to anything other than external, but must still be used or node addresses are not set properly.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-06-01 14:23:53 -07:00
Hussein Galal a5a0e8fde2
Update to v1.24.1 (#5616)
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
2022-05-26 18:09:02 +02:00
Brad Davidson 1ef34728c9 Bump dynamiclistener to v0.3.3
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-05-20 14:17:26 -07:00
Jacob Blain Christen 394ac71076
remove dweomer from maintainers (#5582)
resigning from rancher
2022-05-19 10:19:57 -07:00
Brad Davidson 9d7230496d Add support for configuring the EgressSelector mode
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-05-18 13:26:10 -07:00
Manuel Buil aa9065749c
Give kubelet the node-ip value (#5579)
* Give kubelet all node-ips

Signed-off-by: Manuel Buil <mbuil@suse.com>
Co-authored-by: Brad Davidson <brad.davidson@rancher.com>
2022-05-18 13:21:15 -07:00
Euan Kemp 0224a2c48d Remove errant unversioned etcd go.mod entry
This entry wasn't of a correct format, which meant it resulted in errors
for some operations, such as:

```
$ go mod download
go mod download: github.com/k3s-io/etcd@v3.4.18-k3s1+incompatible: invalid version: module contains a go.mod file, so module path must match major version ("github.com/k3s-io/etcd/v3")
```

`go build` did not complain, so the release still worked, but some build
processes desire to fetch dependencies and then compile offline or such.

The extra etcd entry appears to not be actually used, so it seems safe
to delete it.

A few other diffs in the go.sum file are from a `go mod tidy`.

Signed-off-by: Euan Kemp <euank@euank.com>
2022-05-18 11:09:15 -07:00
Donnie Adams c38a8c3b43
Remove objects when removed from manifests (#5560)
* Remove objects when removed from manifests

If a user puts a file in /var/lib/rancher/k3s/server/manifests/ then the
objects contained therein are deployed to the cluster. If the objects
are removed from that file, they are not removed from the cluster.

This change tracks the GVKs in the files and will remove objects when
there are removed from the cluster.

Signed-off-by: Donnie Adams <donnie.adams@suse.com>
2022-05-18 11:05:03 -07:00
Brad Davidson bac8cf45cb Add apparmor-parser to OpenSUSE/SLE Micro test VMs
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-05-11 14:39:07 -07:00
Brad Davidson e391bf48e7 Bump sonobuoy version and fix deprecated arg
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-05-11 14:39:07 -07:00
Brad Davidson 9e4b801a59 Build standalone containerd 1.6
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-05-11 14:39:07 -07:00
Brad Davidson 4a3d283bc1 Remove --docker/dockershim support
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-05-11 14:39:07 -07:00
Brad Davidson 360f18d1cf Always set pod-infra-container-image to protect it from image GC
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-05-11 14:39:07 -07:00
Brad Davidson 0710a7198a Remove deprecated flags from cloud-controller-manager
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-05-11 14:39:07 -07:00
Brad Davidson 703779c32f Remove deprecated flags from kube-apiserver
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-05-11 14:39:07 -07:00
Brad Davidson 551f2fa00a Remove deprecated flags from kubelet
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-05-11 14:39:07 -07:00
Brad Davidson ea3f78ac87 Update Kubernetes to v1.24
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-05-11 14:39:07 -07:00
Brad Davidson c8447dca56 Bump golang to 1.18.1
Also update all use of 'go get' => 'go install', update CI tooling for
1.18 compatibility, and gofmt everything so lint passes.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-05-11 14:39:07 -07:00
Brad Davidson e6385b2341 Update CNI version in config file
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-05-11 14:39:07 -07:00
Brad Davidson e4369ce0a8 Fix typo in image scan script
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-05-11 14:39:07 -07:00
Brad Davidson 2f22703c9e Mark v1.23.6+k3s1 stable
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-05-04 11:26:28 -07:00
Manuel Buil 9ac2648f8d
Merge pull request #5535 from manuelbuil/traefik-dualStack
Add "ipFamilyPolicy: PreferDualStack" to have dual-stack ingress support
2022-05-04 18:41:43 +02:00
Manuel Buil a3b35d21e9 Add "ipFamilyPolicy: PreferDualStack" to have dual-stack ingress support
Signed-off-by: Manuel Buil <mbuil@suse.com>
2022-05-04 17:32:34 +02:00
Brad Davidson 1d4f995edd Move auto-generated resolv.conf out of /tmp to prevent accidental cleanup
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-05-03 20:33:32 -07:00
Manuel Buil a935a42031
Merge pull request #5492 from manuelbuil/check_combination_dualStack
Check if user has a correct cluster-cidr and service-cidr config
2022-05-03 20:46:19 +02:00
Manuel Buil 314e3f56dc Check if user has a correct cluster-cidr and service-cidr config
Signed-off-by: Manuel Buil <mbuil@suse.com>
2022-05-03 11:01:30 +02:00
Brad Davidson ce5b9347c9 Replace DefaultProxyDialerFn dialer injection with EgressSelector support
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-04-29 17:54:36 -07:00
Brad Davidson e763fadbba Ensure that WaitForAPIServerReady always re-dials through the loadbalancer
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-04-29 14:47:30 -07:00
Brad Davidson d93b750326 Don't start embedded kubelet until after apiserver is up
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-04-29 14:47:30 -07:00
Derek Nola 3e5561daca
Add new `k3s completion` command for shell completion (#5461)
* Add shell completion CLI 
Signed-off-by: Derek Nola <derek.nola@suse.com>
2022-04-29 12:53:34 -07:00
Brad Davidson 13ca10664f Use ListWatch helpers instead of bare List/Watch
Reduces code complexity a bit and ensures we don't  have to handle closed watch channels on our own

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-04-29 12:24:12 -07:00
Michal Rostecki 5f2a4d4209 server: Allow to enable network policies with IPv6-only
After previous changes, network policies are working on IPv6-only
installations.

Signed-off-by: Michal Rostecki <vadorovsky@gmail.com>
2022-04-29 10:51:38 -07:00
Michal Rostecki c0045f415b agent(netpol): Explicitly enable IPv4 when necessary
Before this change, kube-router was always assuming that IPv4 is
enabled, which is not the case in IPv6-only clusters. To enable network
policies in IPv6-only, we need to explicitly let kube-router know when
to disable IPv4.

Signed-off-by: Michal Rostecki <vadorovsky@gmail.com>
2022-04-29 10:51:38 -07:00
Brad Davidson c9badb4fd7 Bump kine to v0.9.1 for nats.io support
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2022-04-29 10:50:14 -07:00