Commit graph

1546 commits

Author SHA1 Message Date
Brad Davidson
10e3d40bf3 Sync datastore config defaults with kine CLI
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-05-09 15:32:53 -07:00
Richard Hansen
925726c84d flannel: Use custom type for network mode (IPv4, IPv6, dual-stack)
Move the `ipv4` and `ipv6` constants to their own constant
declaration.  This ensures that the `iota` expression for the `ipv4`
constant evaluates to 0, not some arbitrary value.  (`iota` evaluates
to N for the Nth constant in the constant declaration; see
<https://go.dev/ref/spec#Iota>.)  This is also more idiomatic, which
improves readability.

Also switch from incremental integers to bit flags, and use bitwise
operators for checking.  This is more idiomatic (the integer is
treated like a set of booleans), it avoids some code duplication, and
it is necessary to avoid ambiguity.  Consider the following:

    const (
    	ipv4 = iota
    	ipv6
    )

In the above, `ipv4` would have the value 0 and `ipv6` would have the
value 1.  This would make it impossible to distinguish an IPv6-only
stack from a dual-stack configuration because `ipv6` would equal
`ipv4 + ipv6`.  With bit flags this problem doesn't exist.

And put the integer holding the bit flags in a custom type with
convenience methods to improve readability.

Signed-off-by: Richard Hansen <rhansen@rhansen.org>
2025-05-09 12:51:48 -07:00
Vitor Savian
53de968676
Add generation for kube-scheduler and kube-controller-manager certs (#12285)
* Add generation for kube-scheduler and kube-controller-manager certs

Signed-off-by: Vitor Savian <vitor.savian@suse.com>

* Add new certs to the tests

Signed-off-by: Vitor Savian <vitor.savian@suse.com>

* Change cert-dir to tls-cert-file and tls-private-key-file

Signed-off-by: Vitor Savian <vitor.savian@suse.com>

* Address altName structure

Co-authored-by: Brad Davidson <brad@oatmail.org>
Signed-off-by: Vitor Savian <vitor.savian@suse.com>

---------

Signed-off-by: Vitor Savian <vitor.savian@suse.com>
Co-authored-by: Brad Davidson <brad@oatmail.org>
2025-05-09 16:25:44 -03:00
bo.jiang
4c1f014d27 Optimize certificate status check
Signed-off-by: bo.jiang <bo.jiang@daocloud.io>
2025-05-08 11:57:29 -07:00
Brad Davidson
67291090ca Add support for conditional image tarball imports
Normally K3s will import all tarballs in the image dir on startup, and
re-import any tarballs that change while it is running.

This change allows users to opt into only importing tarballs that have
changed since they were last imported, even across restarts.

This behavior is opted into by touching a `.cache.json` file in the
images dir. This file is used to track the size and mtime of the image
files when they are imported.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-05-07 15:06:14 -07:00
Brad Davidson
a8f0acbe52 Add CLI flag and config file for s3 bucket lookup type
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-05-07 11:50:22 -07:00
Brad Davidson
921e502918 Add anonymous-auth to flags gated on empty authorization-config value
Also warn if default flags are not set due to user provided config

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-05-07 10:59:27 -07:00
Brad Davidson
b15af84e4a Bump containerd/cri-dockerd/spegel/runc
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-05-07 10:20:40 -07:00
Vitor Savian
0b48e363b5 Update certification renew alert to 120 days
Signed-off-by: Vitor Savian <vitor.savian@suse.com>
2025-05-02 15:17:12 -03:00
Vitor Savian
dc03cb4b3f
Update k8s version to 1.33
* Update to 1.33

Signed-off-by: Vitor Savian <vitor.savian@suse.com>

* Fix prints that broke unit tests

Signed-off-by: Vitor Savian <vitor.savian@suse.com>

* Change binary max size to 75

Signed-off-by: Vitor Savian <vitor.savian@suse.com>

* Change containerd version to fix misspelling

Signed-off-by: Vitor Savian <vitor.savian@suse.com>

* Address binary size comment

Signed-off-by: Vitor Savian <vitor.savian@suse.com>

* Update Dependencies

Signed-off-by: Vitor Savian <vitor.savian@suse.com>

* Remove dependencie not used anymore

Signed-off-by: Vitor Savian <vitor.savian@suse.com>

---------

Signed-off-by: Vitor Savian <vitor.savian@suse.com>
2025-04-30 04:43:37 -03:00
Brad Davidson
396f1366cc Bump spegel to v0.1.1
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-04-24 16:31:24 -07:00
Brad Davidson
9604f271bc Bump traefik to v3.3.6
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-04-21 16:11:56 -07:00
Brad Davidson
b8a705d9c2 Fix handler panic when bootstrapper returned empty peer list
Panic gets rescued by the http server, and was only visible when running in debug mode, but should be handled properly.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-04-18 10:20:15 -07:00
Brad Davidson
4f17e626f3 Fix chainingBootstrapper to return the first successful address list
Avoids infinite recursion when the chain includes an agentBootstrapper with a server address that points back at this node (via join address loop or external LB)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-04-17 14:20:39 -07:00
Brad Davidson
3f7e6a30ce Move delegating auth middleware into common package and add MaxInFlight
Adds maximum in-flight request limits to agent join and p2p peer info
request request handlers.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-04-17 14:20:39 -07:00
Brad Davidson
7883918d0a Add cache to spegel p2p peerinfo handler
libp2p may make a large number of bootstrap calls during startup; serve nodes from cache to avoid excessive CPU usage.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-04-17 14:20:39 -07:00
Brad Davidson
097b63e588 Set kubelet read-only-port via CLI flag
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-04-17 14:20:27 -07:00
Brad Davidson
f90334e207 Fix etcd socket option config
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-04-11 13:39:44 -07:00
Aaron Dewes
147a3c0daf fix: Use proper key when signing kubelet certificate
I assume this was a mistake when copying and the kubelet key should have been used here.

This bug was introduced in #11471.

Signed-off-by: Aaron Dewes <aaron@nirvati.org>
2025-04-10 19:50:44 -07:00
github-actions[bot]
2fdc6fab07
Bump Klipper Helm and Helm Controller version (#12026)
* chore: Bump Klipper Helm and Helm Controller version

Made with ❤️️ by updatecli

* chore: Bump Klipper Helm and Helm Controller version

Made with ❤️️ by updatecli

* Fix build

Signed-off-by: Derek Nola <derek.nola@suse.com>

---------

Signed-off-by: Derek Nola <derek.nola@suse.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Derek Nola <derek.nola@suse.com>
2025-04-10 15:00:29 -04:00
manuelbuil
9505f7ff3b Add error in certificate check
Signed-off-by: manuelbuil <mbuil@suse.com>
2025-04-10 13:22:43 +02:00
Brad Davidson
f5b0d7884f Fix windows socket prefix
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-04-09 09:25:43 -07:00
Brad Davidson
9deef77eef Add ReusePort/ReuseAddr flags to etcd config
Addresses flakes in etcd CI due to the port still being in TIME_WAIT after the server is shut down between tests

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-04-08 15:27:19 -07:00
Brad Davidson
7cdf0fa688 Bump to traefik/v3.3.5, coredns/v1.12.1
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-04-07 12:52:27 -07:00
Derek Nola
91d76b1614 Remove double error check
Signed-off-by: Derek Nola <derek.nola@suse.com>
2025-04-07 09:08:22 -07:00
Derek Nola
fa69c45926 Align Value CLI
Signed-off-by: Derek Nola <derek.nola@suse.com>
2025-04-07 09:08:22 -07:00
Derek Nola
786efd1bff Mark rotate-keys as GA
Signed-off-by: Derek Nola <derek.nola@suse.com>
2025-04-07 09:08:22 -07:00
Derek Nola
aea3703f68 Implement secrets-encryption secretbox provider
- Add testlet for new provider switch
- Handle migration between providers
- Add exception for criticalcontrolargs
Signed-off-by: Derek Nola <derek.nola@suse.com>
2025-04-07 09:08:22 -07:00
Brad Davidson
a897f6875e Fix flakey etcd startup tests
Increase etcd shutdown delay to avoid "bind: address already in use" errors seen in CI. Also uses test TmpDir to ensure dir is cleaned up between tests.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-04-02 09:01:26 -07:00
Brad Davidson
1ba19856de Add tests for control-plane component arg generation
Use mocked executor to ensure the correct args are being passed to components

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-03-31 17:09:43 -07:00
Brad Davidson
ee036f7bc9 Fix issue caused by default authorization-mode apiserver arg
Move arg-parsing helper functions into util, and use them to see if the user has set an authorization-config flag - and do not set authorization-mode if so.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-03-31 17:09:43 -07:00
Brad Davidson
0eeac6a622 Rework mock executor using gomock for call validation
Generate the mock executor with mockgen and convert existing uses of the mock executor to set it up properly.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-03-31 17:09:43 -07:00
Brad Davidson
d45006be66 Move etcd ready channel into executor
This eliminates the final channel that was being passed around in an internal struct. The ETCD management code passes in a func that can be polled until etcd is ready; the executor is responsible for polling this after etcd is started and closing the etcd ready channel at the correct time.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-03-24 12:42:29 -07:00
Brad Davidson
72bbd676f1 Fix etcd tests to use mock executor
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-03-24 12:42:29 -07:00
Brad Davidson
a8bc412422 Move container runtime ready channel into executor
Move the container runtime ready channel into the executor interface, instead of passing it awkwardly between server and agent config structs

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-03-24 12:42:29 -07:00
Brad Davidson
529e748ac7 Move apiserver ready wait into common channel
Splits server startup into prepare/start phases. Server's agent is now
started after server is prepared, but before it is started. This allows
us to properly bootstrap the executor before starting server components,
and use the executor to provide a shared channel to wait on apiserver
readiness.

This allows us to replace four separate callers of WaitForAPIServerReady
with reads from a common ready channel.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-03-24 12:42:29 -07:00
Brad Davidson
2c133692b2 Increase log output while waiting for apiserver ready
Increases log verbosity but decreases polling frequency to avoid
spamming the console. It usually takes a couple seconds for the
apiserver to come up anyway.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-03-24 12:42:29 -07:00
Brad Davidson
c11c06cad4 Add context to agent token validation error
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-03-24 12:42:29 -07:00
Robert Rose
5e1845b7c1 Remove resources created by addon before deleting addon (#11975)
Remove the AddOn last, after any resources it created in the cluster
have been deleted and the AddOn file is removed.

Signed-off-by: Robert Rose <robert.rose@mailbox.org>
2025-03-19 14:33:20 -07:00
Derek Nola
ac38633c71
Migrate to UrfaveCLI v2 (#11831)
* Bump rootlesskit tov 1.1.1, last of the v1 line
* Migrate to urfavecli v2
* Disable StringSlice seperattion

Signed-off-by: Derek Nola <derek.nola@suse.com>
2025-03-12 09:02:45 -07:00
Brad Davidson
781640ecea Fix syncing empty list of apiserver addresses during initial startup
Also add more debug logging to the sync process.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-03-11 14:49:45 -07:00
Derek Nola
3ce7ca7544
Bump klipper-lb image (#11898)
Signed-off-by: Derek Nola <derek.nola@suse.com>
2025-03-10 09:49:17 -07:00
Brad Davidson
d694dd1db9 Add periodic background snapshot reconcile
Interval is configurable with new etcd-snapshot-reconcile-interval flag

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-03-05 12:18:19 -08:00
Brad Davidson
bed1f66880 Avoid use of github.com/pkg/errors functions that capture stack
We are not making use of the stack traces that these functions capture, so we should avoid using them as unnecessary overhead.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-03-05 00:41:38 -08:00
Brad Davidson
e7b52cd63d Fix panic when secret-encrypt status is checked before runtime core is ready
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-02-27 11:19:26 -08:00
Brad Davidson
f940368747 Use etcd proxy to bootstrap control-plane-only nodes, if possible
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-02-27 11:19:26 -08:00
Brad Davidson
244bfd0c35 Use existing server-CA and hash if available
Also wraps errors along the cluster prepare path to improve tracability.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-02-27 11:19:26 -08:00
Brad Davidson
53fcadc028 Serve HTTP bootstrap data from datastore before disk
Fixes issue where CA rotation would fail on servers with join URL set due to using old data from disk on other server

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-02-27 11:19:26 -08:00
Brad Davidson
5894af30ff Move CR APIs to k3s-io/api
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-02-24 11:17:27 -08:00
Brad Davidson
2b6225eeff Fix missing migration for containerd registry.configs plugin namespace
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-02-20 16:46:58 -08:00