Commit graph

10 commits

Author SHA1 Message Date
Sebastien Tardif
ae1d51f4f4 fix: trim comment and include feature-gates value in warning
Apply reviewer suggestion: reduce verbose comment to a single line
and include the feature-gates value in the warning message.

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
2026-06-29 15:05:20 -07:00
Sebastien Tardif
43c121791c fix: pre-apply feature gates before embedded API server starts
In the embedded executor, all Kubernetes components share a single
global utilfeature.DefaultFeatureGate. Feature gate flag parsing
normally occurs inside command.ExecuteContext(), but the API server's
REST storage registration can read the global gate before flags are
parsed, seeing alpha-default values instead of user-configured ones.

This causes an intermittent race condition where alpha feature gates
(e.g. InPlacePodVerticalScaling on K8s v1.32) are ignored even when
correctly configured via the k3s config file. The race depends on
goroutine scheduling: REST storage registration may complete before
the feature gate flag is parsed, causing the API server to not
register the corresponding subresources (e.g. pods/resize).

Fix: extract the feature-gates value from the API server args and
apply it to DefaultMutableFeatureGate before creating the API server
command and starting its goroutine. This ensures the global gate
reflects user configuration before any component reads it. The
subsequent flag parsing in ExecuteContext() will set the same values
again (idempotent).

Ref k3s-io/k3s#14286

AI-assisted: This change was developed with AI assistance.
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
2026-06-29 15:05:20 -07:00
Brad Davidson
f06dc108f4 Replace PreparingExecutor with explicit executor init
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2026-04-28 11:00:50 -07:00
Brad Davidson
f891548e32 Fix embedded excutor VPN config injection
Some checks are pending
Scorecard supply-chain security / Scorecard analysis (push) Waiting to run
Allow the executor to modify node config before certs are generated, and use this to add VPN node IPs to kubelet serving cert
2026-04-14 09:03:05 -07:00
Brad Davidson
3acf8db8f2 Update packages to remove dep on archived github.com/pkg/errors
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2026-03-09 16:09:01 -07:00
zijiren
084c7aafc4
Fix VPN node IP not being applied to kubelet (#13457)
Signed-off-by: zijiren233 <pyh1670605849@gmail.com>
2026-02-04 10:16:09 -08:00
Brad Davidson
e44a77d475 lint: nested-structs
Some checks failed
Scorecard supply-chain security / Scorecard analysis (push) Waiting to run
govulncheck / govulncheck (push) Has been cancelled
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-12-18 11:20:07 -08:00
Brad Davidson
f279a979b3 lint: exported
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-12-18 11:20:07 -08:00
Brad Davidson
316464975e lint: redundant-build-tag
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-12-18 11:20:07 -08:00
Brad Davidson
c3ca02aa75 Move embed into separate package from executor
Better isolates the K3s implementation from the interface, and aligns
the package path with other projects executors. This should also remove
the indirect flannel dep from other projects that don't use the embedded
executor.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
2025-12-08 12:53:10 -08:00