49 Commits (fe465cc83253fbc9139418f8a2a6254d24af1888)

Author	SHA1	Message	Date
Brad Davidson	fe465cc832	Move etcd snapshot management CLI to request/response ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	8 months ago
Brad Davidson	60248c42de	Add supervisor cert/key to rotate list ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	8 months ago
Brad Davidson	7f659759dd	Add certificate expiry check and warnings ... * Add ADR * Add `k3s certificate check` command. * Add periodic check and events when certs are about to expire. * Add metrics for certificate validity remaining, labeled by cert subject Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	8 months ago
Brad Davidson	7a2a2d075c	Move error response generation code into util ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	8 months ago
Brad Davidson	d885162967	Add server token hash to CR and S3 ... This required pulling the token hash stuff out of the cluster package, into util. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	1 year ago
Manuel Buil	f2c7117374	Take IPFamily precedence based on order ... Signed-off-by: Manuel Buil <mbuil@suse.com>	1 year ago
Manuel Buil	8c197bdce4	Include the interface name in the error message ... Signed-off-by: Manuel Buil <mbuil@suse.com>	1 year ago
Derek Nola	51f1a5a0ab	Review comments and fixes ... Signed-off-by: Derek Nola <derek.nola@suse.com>	1 year ago
Derek Nola	b967f92785	Replace os.Write with AtomicWrite function ... Signed-off-by: Derek Nola <derek.nola@suse.com>	1 year ago
Brad Davidson	aa76942d0f	Add FilterCN function to prevent SAN Stuffing ... Wire up a node watch to collect addresses of server nodes, to prevent adding unauthorized SANs to the dynamiclistener cert. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	1 year ago
Manuel Buil	6c44b06e0a	Merge pull request #7838 from manuelbuil/ipv4ipv6tailscale ... Check if we are on ipv4, ipv6 or dualStack when doing tailscale	1 year ago
Manuel Buil	d593c83603	Remove file_windows.go ... Signed-off-by: Manuel Buil <mbuil@suse.com>	1 year ago
Manuel Buil	f21a01474d	Check if we are on ipv4, ipv6 or dualStack when doing tailscale ... Signed-off-by: Manuel Buil <mbuil@suse.com>	1 year ago
Manuel Buil	869e030bdd	VPN PoC ... Signed-off-by: Manuel Buil <mbuil@suse.com>	1 year ago
Brad Davidson	8748813a61	Use distinct clients for supervisor, deploy, and helm controllers ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Manuel Buil	437ad128c7	Migrate netutil methods into /utils/net.go ... Signed-off-by: Manuel Buil <mbuil@suse.com>	2 years ago
Derek Nola	d5f560360e	Handle multiple arguments with StringSlice flags (#7380) ... * Add helper function for multiple arguments in stringslice Signed-off-by: Derek Nola <derek.nola@suse.com> * Cleanup server setup with util function Signed-off-by: Derek Nola <derek.nola@suse.com>	2 years ago
Brad Davidson	977a85559e	Add support for cross-signing new certs during ca rotation ... We need to send the full chain in order for cross-signing to work properly during switchover to a new root. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	32d62c5786	Use default address family when adding kubernetes service address to SAN list ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	3c324335b2	Add utility functions for getting kubernetes client ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	269563e4d2	Check for RBAC before starting tunnel controllers ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Brad Davidson	f633732d80	Use structured logging instead of logrus for event recorders ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	2 years ago
Roberto Bonafiglia	abdf0c7319	Fix comments and add check in case of IPv6 only node ... Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>	2 years ago
Roberto Bonafiglia	d90ba30353	Added NodeIP autodect in case of dualstack connection ... Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>	2 years ago
Brad Davidson	d3242bea3c	Refactor egress-selector pods mode to watch pods ... Watching pods appears to be the most reliable way to ensure that the proxy routes and authorizes connections. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Brad Davidson	e763fadbba	Ensure that WaitForAPIServerReady always re-dials through the loadbalancer ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Dirk Müller	fa0fa8b1d0	Update golangci-lint to 1.45.2 ... This requires a further set of gofmt -s improvements to the code, but nothing major. golangci-lint 1.45.2 brings golang 1.18 support which might be needed in the future. Signed-off-by: Dirk Müller <dirk@dmllr.de>	3 years ago
Brad Davidson	965d0a08ef	Fix log spam due to servicelb event recorder namespace conflict ... Don't hardcode the event namespace when creating event recorders; some controllers want to create events in other namespaces. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Brad Davidson	714979bf6a	Ensure that apiserver ready channel checks re-dial every time ... Closing idle connections isn't guaranteed to close out a pooled connection to a loadbalancer endpoint that has been removed. Instead, ensure that requests used to wait for the apiserver to become ready aren't reused. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Roberto Bonafiglia	3fabc0703b	Merge pull request #4450 from olljanat/support-ipv6-only ... Add partial support for IPv6 only mode	3 years ago
Brad Davidson	5014c9e0e8	Fix adding etcd-only node to existing cluster ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Olli Janatuinen	966f4d6a01	Add support for IPv6 only mode ... Automatically switch to IPv6 only mode if first node-ip is IPv6 address Signed-off-by: Olli Janatuinen <olli.janatuinen@gmail.com>	3 years ago
Alexey Medvedchikov	8f389ab030	Include node-external-ip in serving-kubelet.crt SANs (#4620) ... * Include node-external-ip in serving-kubelet.crt SANs Signed-off-by: Alexey Medvedchikov <alexeymedvedchikov@improbable.io>	3 years ago
Derek Nola	bcb662926d	Secrets-encryption rotation (#4372) ... * Regular CLI framework for encrypt commands * New secrets-encryption feature * New integration test * fixes for flaky integration test CI * Fix to bootstrap on restart of existing nodes * Consolidate event recorder Signed-off-by: Derek Nola <derek.nola@suse.com>	3 years ago
Brad Davidson	5ab6d21a7d	Increase agent's apiserver ready timeout (#4454) ... Since we now start the server's agent sooner and in the background, we may need to wait longer than 30 seconds for the apiserver to become ready on downstream projects such as RKE2. Since this essentially just serves as an analogue for the server's apiReady channel, there's little danger in setting it to something relatively high. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Brad Davidson	57377d2cd4	Minor cleanup on cribbed function ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Brad Davidson	3449d5b9f9	Wait for apiserver readyz instead of healthz ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Brad Davidson	cf12a13175	Add missing node name entry to apiserver SAN list ... Also honor node-ip when adding the node address to the SAN list, instead of hardcoding the autodetected IP address. Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Manuel Buil	96dcef478a	Add functions to separate ipv4 from ipv6 functions ... Signed-off-by: Manuel Buil <mbuil@suse.com>	3 years ago
Brad Davidson	422d266da2	Disable deprecated insecure port ... Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	3 years ago
Derek Nola	4cc781b5e3	Moved testing utils into tests directory. Improved gotests template. (#3805) ... * Moved testing utils into tests directory. Improved gotests template. * Updated cgroups2 with util folder rename Signed-off-by: dereknola <derek.nola@suse.com>	3 years ago
Jamie Phillips	7704fb6ee5	Exporting the AddFeatureGate function and adding a unit test for it. (#3661)	3 years ago
Derek Nola	21c8a33647	Introduction of Integration Tests (#3695) ... * Commit of new etcd snapshot integration tests. * Updated integration github action to not run on doc changes. * Update Drone runner to only run unit tests Signed-off-by: dereknola <derek.nola@suse.com>	3 years ago
Derek Nola	c833183517	Add unit tests for pkg/etcd (#3549) ... * Created new etcd unit tests and testing support file Signed-off-by: dereknola <derek.nola@suse.com>	3 years ago
Jamie Phillips	7345ac35ae	Initial windows support for agent (#3375) ... Signed-off-by: Jamie Phillips <jamie.phillips@suse.com>	4 years ago
Brad Davidson	2705431d96	Add support for dual-stack Pod/Service CIDRs and node IP addresses (#3212) ... * Add support for dual-stack cluster/service CIDRs and node addresses Signed-off-by: Brad Davidson <brad.davidson@rancher.com>	4 years ago
Xiao Deshi	cfe7e0c734	remove duplicated func GetAddresses ... refactor tunnel.go and controller.go, remove duplicated lines. Signed-off-by: Xiao Deshi <xiaods@gmail.com>	4 years ago
Knic Knic	c2db115ec3	fix formatting	5 years ago
Knic Knic	2346ccc63f	get build on windows and get api_server to work	5 years ago