Backoff starts at 1s and doubles, up to max of 32 seconds
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 79b2e9ee84)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Replaces helm-job-image flag, and allows setting other new helm-controller options (job-resources and job-tolerations)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 9b575c4e56)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Add deprecation message in the flag description
Signed-off-by: Manuel Buil <mbuil@suse.com>
(cherry picked from commit 7595fe7b83)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
In the embedded executor, all Kubernetes components share a single
global utilfeature.DefaultFeatureGate. Feature gate flag parsing
normally occurs inside command.ExecuteContext(), but the API server's
REST storage registration can read the global gate before flags are
parsed, seeing alpha-default values instead of user-configured ones.
This causes an intermittent race condition where alpha feature gates
(e.g. InPlacePodVerticalScaling on K8s v1.32) are ignored even when
correctly configured via the k3s config file. The race depends on
goroutine scheduling: REST storage registration may complete before
the feature gate flag is parsed, causing the API server to not
register the corresponding subresources (e.g. pods/resize).
Fix: extract the feature-gates value from the API server args and
apply it to DefaultMutableFeatureGate before creating the API server
command and starting its goroutine. This ensures the global gate
reflects user configuration before any component reads it. The
subsequent flag parsing in ExecuteContext() will set the same values
again (idempotent).
Ref k3s-io/k3s#14286
AI-assisted: This change was developed with AI assistance.
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
(cherry picked from commit 43c121791c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
fix: trim comment and include feature-gates value in warning
Apply reviewer suggestion: reduce verbose comment to a single line
and include the feature-gates value in the warning message.
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
(cherry picked from commit ae1d51f4f4)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
I am not sure if cre was used there on purpose, but it seems that the image service endpoint is the correct variable that should be used there.
Signed-off-by: Neil <khair_talap@outlook.com>
Signed-off-by: neiltalap <khair_talap@outlook.com>
(cherry picked from commit f6d226eaf3)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Image names are used to re-add the pinned label when importing is
skipped due to the image being skipped due to cache checks. This is done
once on startup, same as pinned label clearing.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit aed887dafb)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
* Expand unit tests for cridockerd and flannel packages
* Cover utility functions in loadbalancer package
* Add unit tests for encrypt/decrypt helper functions
* Add unit tests for isolated methods/functions
Signed-off-by: Derek Nola <derek.nola@suse.com>
T4 reuses datastore TLS config and etcd S3 flags, but needs to not
listen when bootstrapping TLS to avoid trying to connect to the peer
without certs.
T4 only uses TLS between peers when --kine-tls is enabled.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 7c0c335d68)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
LookupExtInterface() constructs a backend.ExternalInterface but never
sets the IfaceName field, leaving it as an empty string. When the VXLAN
device (flannel.1) is deleted — e.g. because the parent interface
specified via --flannel-iface transiently disappears — the recreation
code in vxlan_network.go:165 calls net.InterfaceByName(""), which
always fails. This puts flannel into an unrecoverable retry loop:
external interface not found, retrying in 30s
The fix adds IfaceName: iface.Name to the struct literal. The iface
variable already holds the correct *net.Interface; its Name field just
needs to be copied into the IfaceName string that the VXLAN recreation
path reads.
This is a one-line change that enables the VXLAN device recreation
logic added in flannel PR #2272 (v0.27.4+) to actually work when
flannel is embedded in K3s.
Affects any deployment using --flannel-iface with an overlay network
(Tailscale, Nebula, ZeroTier) where the parent interface can
transiently restart.
Ref: https://github.com/k3s-io/k3s/issues/12436
Ref: https://github.com/flannel-io/flannel/issues/2247
Signed-off-by: Jay Kubo <6161465+jkubo@users.noreply.github.com>
(cherry picked from commit 68ce5c2747)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Upstream has enabled QUIC in the default transport config, but we
continue to only support HTTPS (TCP) as we do not want to add a
separate QUIC UDP listener on the registry port.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 0e575f3a03)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Prepare uses the SANs list, so all modifications to that need to be done before preparing
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit eaddca726c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Allow the executor to modify node config before certs are generated, and use this to add VPN node IPs to kubelet serving cert
(cherry picked from commit f891548e32)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Fixes issue where RKE2 event recorder events were not logged to console due to lack of logging context.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit a666b7905c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Found a typo while working, quick fix.
It should display "This server is not a member of the etcd cluster" instead of "this server is a not a member of the etcd cluster"
Kind regards,
Signed-off-by: DT1mote <74531281+DT1mote@users.noreply.github.com>
(cherry picked from commit cc1c20fdc0)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Compression creates a zipfile with the same path as the snapshot file
containing only the snapshot. Decompression can be a bit simpler by also
extracting to the same path, and erroring if there are unexpected
contents.
In retrospect we probably should have just gzip'd the snapshot file, but
I think there was some intention to observe the same behavior as RKE1,
which used zip files.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
mux is replaced with a simple wrapper around http.ServeMux with middleware chain support
Unfortunately github.com/rootless-containers/rootlesskit/pkg/parent
still uses it so we can't drop the indirect dep yet.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 3f5eec4c4e)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
etcd.setName was being called during managed driver creation, even if the managed driver (etcd) is not in use. Let etcd.Register handle calling setName.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 8908d5fcde)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Add support for the "nix" snapshotter, which enables running container
images built with nix2container. Nix images reference store paths
directly, avoiding layer tarballs and enabling deduplication through
the nix store.
Changes:
- Register nix-snapshotter as a builtin containerd plugin
- Add NixSupported() validation (checks nix-store is in PATH)
- Configure nix-snapshotter image service proxy in V2/V3 templates
with containerd_address for CRI image operations
- Add Transfer service unpack_config with differ=walking for
multi-arch support
- Use containerd state dir for socket path (rootless compatible)
- Disable NRI in rootless mode to prevent bind failures
Usage: k3s server --snapshotter nix
Signed-off-by: Ada <ada@6bit.com>
Co-Authored-By: Joshua Perry <josh@6bit.com>
Signed-off-by: Ada <ada@6bit.com>
(cherry picked from commit de59b6327c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Add imports to the generated containerd config so containerd loads
drop-in TOML files: config.toml.d for v2, config-v3.toml.d for v3
(e.g. /var/lib/rancher/k3s/agent/etc/containerd/config.toml.d and
/var/lib/rancher/k3s/agent/etc/containerd/config-v3.toml.d).
Also fix the v3 header comment to say config-v3.toml.tmpl instead
of config.toml.tmpl.
Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
(cherry picked from commit b51167a996)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
* Add store tests with fixtures
* Try connecting to local etcd first, if it is available
* Handle panics from etcd backend code
* Don't try to read WAL and restore v3 snapshots as they almost never exist
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit d300004f29)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Removing the initial node from the cluster would previously cause etcd to panic on startup. Fixes to etcd reconcile have stopped that from happening, but now the node will successfully come up and start a new cluster - which is not right either. Require either manual removal of DB files to create a new cluster, or setting server address to join an existing cluster.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
