Mirror/k3s
1
0
Fork 0
mirror of https://github.com/k3s-io/k3s.git synced 2024-06-07 19:41:36 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,781 Commits 27 Branches 785 Tags 625 MiB
c35761d169
Commit Graph

658 Commits

Author SHA1 Message Date
Chris Kim
a3f87a81bd Independently set kubelet-cgroups and runtime-cgroups, and detect if we are running under a systemd scope 
Signed-off-by: Chris Kim <oats87g@gmail.com>
 2020-12-09 11:39:33 -08:00
Brad Davidson
c5aad1b5ed Disable the ServiceAccountIssuerDiscovery feature-gate. 
We're not setting ``--service-account-issuer` to a https URL, which causes an
error message at startup when the feature gate is enabled. From the
docs on that flag:

> If this option is not a valid URI per the OpenID Discovery 1.0 spec, the
> ServiceAccountIssuerDiscovery feature will remain disabled, even if the
> feature gate is set to true. It is highly recommended that this value
> comply with the OpenID spec:
> https://openid.net/specs/openid-connect-discovery-1_0.html. In practice,
> this means that service-account-issuer must be an https URL. It is also
> highly recommended that this URL be capable of serving OpenID discovery
> documents at {service-account-issuer}/.well-known/openid-configuration.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-12-08 22:51:34 -08:00
Brad Davidson
63f2211b31 deprecate the "node-role.kubernetes.io/master" label / taint 
Related to https://github.com/kubernetes/kubernetes/pull/95382

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-12-08 22:51:34 -08:00
Brad Davidson
c6950d2cb0 Update Kubernetes to v1.20.0-k3s1 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-12-08 22:51:34 -08:00
Brad Davidson
cd27c6fcbe Bump coredns to 1.7.1 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-12-08 15:58:17 -08:00
Erik Wilson
0ae7f2d5ae
Merge pull request #2407 from erikwilson/node-passwd-cleanup 
Use secrets for node-passwd entries
 2020-12-08 16:25:13 -07:00
Chris Kim
3d1e40eaa3 Handle the case when systemd lives under /init.scope 
Signed-off-by: Chris Kim <oats87g@gmail.com>
 2020-12-08 10:26:54 -08:00
Chris Kim
e71e11fed0
Merge pull request #2642 from Oats87/issues/k3s/2548-cgroup 
Set a cgroup if containerized
 2020-12-08 10:05:21 -08:00
Chris Kim
f3de60ff31 When there is a defined cgroup for PID 1, assume we are containerized and set a root 
Signed-off-by: Chris Kim <oats87g@gmail.com>
 2020-12-07 13:15:15 -08:00
Hussein Galal
fadc5a8057
Add tombstone file to etcd and catch errc etcd channel (#2592) 
* Add tombstone file to embedded etcd

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go mod update

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fixes

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* more fixes

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* more changes

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* gofmt and goimports

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go mod update

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go lint

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go lint

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go mod tidy

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
 2020-12-07 22:30:44 +02:00
Chin-Ya Huang
3f0f2b342e Show go version when executes with --version. 
Signed-off-by: Chin-Ya Huang <chin-ya.huang@suse.com>
 2020-12-04 12:51:15 -08:00
transhapHigsn
87a43c69e1 Problem: CoreDNS getting preempted by other pods 
Solution: Set priorityClassName to system-node-critical of traefik, metrics-server, local storage and coredns deployment
Signed-off-by: transhapHigsn <fet.prashantsingh@gmail.com>
 2020-12-04 12:50:12 -08:00
Akihiro Suda
eb72d509ce pkg/agent/config: validate containerd snapshotter value 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-12-01 11:00:00 -08:00
Akihiro Suda
05f6255437 add fuse-overlayfs snapshotter (mainly for rootless mode) 
Ubuntu and Debian kernels support mounting real overlayfs inside userns,
but the vanilla kernel still does not allow it.

OTOH fuse-overlayfs can be mounted inside userns with the vanilla kernel (>= 4.18).

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-12-01 11:00:00 -08:00
Akihiro Suda
43f7eaedf8 rootless: fix "stat /run/user/1000: no such file or directory" on kubectl run 
k3s was mounting a tmpfs on `/run` by itself, so it was hiding RootlessKit's `/run`.

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-12-01 10:31:21 -08:00
Akihiro Suda
67410d2757 rootless: validate sysctl before starting up 
Fix #2420

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-12-01 09:21:39 -08:00
Jacob Blain Christen
3647654fe4
[migration k3s-io] update helm-controller dependency (#2569) 
rancher/helm-controller ➡️ k3s-io/helm-controller

Part of https://github.com/rancher/k3s/issues/2189

Signed-off-by: Jacob Blain Christen <jacob@rancher.com>
 2020-12-01 08:59:10 -07:00
Akihiro Suda
0b45e32486 Support cgroup v2 
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-11-30 22:57:37 -08:00
Jacob Blain Christen
36230daa86
[migration k3s-io] update kine dependency (#2568) 
rancher/kine ➡️ k3s-io/kine

Part of https://github.com/rancher/k3s/issues/2189

Signed-off-by: Jacob Blain Christen <jacob@rancher.com>
 2020-11-30 16:45:22 -07:00
Brad Davidson
b873d3a03b Explicitly set agent paths within --data-dir 
Removing the cfg.DataDir mutation in 3e4fd7b did not break anything, but
did change some paths in unwanted ways. Rather than mutating the
user-supplied command-line flags, explicitly specify the agent
subdirectory as needed.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-11-11 09:26:41 -08:00
Brad Davidson
58b5b21f0d Don't pass cloud-provider flag to controller-manager 
As per documentation, the cloud-provider flag should not be passed to
controller-manager when using cloud-controller. However, the legacy
cloud-related controllers still need to be explicitly disabled to
prevent errors from being logged.

Fixing this also prevents controller-manager from creating the
cloud-controller-manager service account that needed extra RBAC.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-11-09 13:55:09 -08:00
Brad Davidson
3e4fd7b41f Respect --data-dir path for crictl.yaml 
Related to rancher/rke2#474

Note that anyone who customizes the data-dir path will have to set
CRI_CONFIG_FILE to the correct path when using the wrapped binaries
(crictl, etc). This is better than dropping files in the incorrect
location.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-11-05 15:51:10 -08:00
Brad Davidson
f50e3140f9 Disable configure-cloud-routes and external service/route programming support when using k3s stub cloud controller 
Resolves warning 3 from #2471

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-11-05 15:51:10 -08:00
Brad Davidson
31575e407a Add Cluster ID support to k3s stub cloud controller 
Resolves warning 2 from #2471.

As per https://github.com/kubernetes/cloud-provider/issues/12 the
ClusterID requirement was never really followed through on, so the
flag is probably going to be removed in the future.

One side-effect of this is that the core k8s cloud-controller-manager
also wants to watch nodes, and needs RBAC to do so.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-11-05 15:51:10 -08:00
Brad Davidson
5b318d093f Fix containerd sock path warning 
Resolves warning 1 from #2471

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-11-05 15:51:10 -08:00
Brad Davidson
d1424626ac Disable containerd experimental snapshot labels 
Related to #2455 and containerd/containerd#4684

These were not meant to be enabled by default, break images with many
layers, and will be disabled by default on the next containerd release.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-11-05 15:51:10 -08:00
Erik Wilson
992ca52c31
Enable go test in ci 2020-11-05 09:48:53 -07:00
Erik Wilson
92d04355f4
Use secrets for node-passwd entries and cleanup 2020-11-05 09:48:53 -07:00
Brad Davidson
3b8ec74049 Update disables list when building with no_stage 
The --disable/--no-deploy flags actually turn off some built-in
controllers, in addition to preventing manifests from getting loaded.
Make it clear which controllers can still be disabled even when the
packaged components are ommited by the no_stage build tag.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-11-04 13:39:45 -08:00
Menna Elmasry
523ccaf3f2
Merge pull request #2448 from MonzElmasry/new_b 
Make etcd use node private ip
 2020-10-29 00:23:56 +02:00
MonzElmasry
e8436cc76b
Make etcd use node private ip 
Signed-off-by: MonzElmasry <menna.elmasry@rancher.com>
 2020-10-28 23:45:24 +02:00
Chris Kim
7b8a147a1b
Merge pull request #2408 from Oats87/rpm-install-selinux 
Add auto-install capability to install.sh for k3s-selinux
 2020-10-28 14:24:09 -04:00
Hussein Galal
fcd18d1b6e
skip node delete from removed member (#2413) 
* skip node delete from removed member

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* use grpc errors

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go imports

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* exit if node is the etcd that being removed

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
 2020-10-28 18:32:51 +02:00
Chris Kim
96fc4c4b21 Add iptable_nat to modprobe list 
Signed-off-by: Chris Kim <oats87g@gmail.com>
 2020-10-27 14:22:14 -04:00
Brad Davidson
de18528412
Make etcd voting members responsible for managing learners (#2399) 
* Set etcd timeouts using values from k8s instead of etcdctl
  Fix for one of the warnings from #2303
* Use etcd zap logger instead of deprecated capsnlog
  Fix for one of the warnings from #2303
* Remove member self-promotion code paths
* Add learner promotion tracking code
* Fix RaftAppliedIndex progress check
* Remove ErrGRPCKeyNotFound check
  This is not used by v3 API - it just returns a response with 0 KVs.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-10-27 11:06:26 -07:00
Erik Wilson
6b11d86037
Merge pull request #2377 from erikwilson/no-proxy-fix 
Use no_proxy env, add .svc and cluster domains
 2020-10-12 13:46:22 -07:00
Erik Wilson
56e077eb29
Use no_proxy env, add .svc and cluster domains 2020-10-12 11:02:07 -07:00
Erik Wilson
114b5ccad1
Merge pull request #2363 from erikwilson/netpol-informers 
Add event handlers to network policy controller
 2020-10-12 08:53:39 -07:00
Erik Wilson
e26e333b7e
Add network policy controller CacheSyncOrTimeout 2020-10-07 12:35:44 -07:00
Erik Wilson
045cd49ab5
Add event handlers to network policy controller 2020-10-07 12:10:27 -07:00
Erik Wilson
ce0da0a0f4
Add file verification for data directory 2020-10-06 10:29:27 -07:00
Erik Wilson
66d29148f7
Add Release function for flock 2020-10-06 10:29:27 -07:00
Erik Wilson
360d82d20e
Add flock from k8s.io/kubernetes/pkg/util/flock 2020-10-06 10:29:26 -07:00
Brad Davidson
c3c983198f Add temporary fix for issue with interrupted etcd promote 
This is a minimal fix for https://github.com/rancher/rke2/issues/392

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-09-30 11:45:58 -07:00
Hussein Galal
373449ec0a
Allow for multiple etcd snapshot restoration (#2307) 
* add reset tmp file

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go imports

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fix multiple lines string

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fix typo

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* use resetFile function

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
 2020-09-30 02:53:31 +02:00
Brad Davidson
8262e23169
Revert removal of EndpointName hooks (#2319) 
* Revert "Remove dead EndpointName code"
    This reverts commit 8025da5a8d.
* Fix docstrings based on proper understanding of use
 2020-09-28 18:13:55 -07:00
Brad Davidson
360b0f1ee5 Add timeout to clientaccess http client 
The default http client does not have an overall request timeout, so
connections to misbehaving or unavailable servers can stall for an
excessive amount of time. At the moment, just attempting to join
an unavailable cluster takes 2 minutes and 40 seconds to timeout.

Resolve that by setting a reasonable request timeout.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-09-27 03:26:27 -07:00
Brad Davidson
cdfc6cfa1a Split clientaccess token/kubeconfig code 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-09-27 03:26:27 -07:00
Brad Davidson
45dd4afe50 Simplify token parsing 
Improves readability, reduces round-trips to the join server to validate certs.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-09-27 03:26:24 -07:00
Brad Davidson
9074da7405 Fix misc nits and missing/unused imports 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-09-27 03:10:00 -07:00
Brad Davidson
703ba5cde7 Add a bunch of doc comments 
Also change identical error messages to clarify where problems are
occurring.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-09-27 03:10:00 -07:00
Brad Davidson
ae916c2dec Use const for kube-system namespace 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-09-27 03:10:00 -07:00
Brad Davidson
f59e8fc21b Fix etcd directory permissions 
Silences warning on startup about insecure directory permissions

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-09-27 03:10:00 -07:00
Brad Davidson
ee99660a96 Rename etcd directory helpers to reduce confusion about which datadir we're talking about 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-09-27 03:10:00 -07:00
Brad Davidson
8025da5a8d Remove dead EndpointName code 
According to @galal-hussein this is dead code that was probably brought
over from Kine. I certainly couldn't figure out what it is supposed to
be doing.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-09-27 03:10:00 -07:00
Brad Davidson
97eb28a01a Remove unnecessary listener arg from managed DB setup 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-09-27 03:09:45 -07:00
Brad Davidson
a3bbd58f37 Fix managed etcd cold startup deadlock issue #2249 
We should ignore --token and --server if the managed database is initialized,
just like we ignore --cluster-init. If the user wants to join a new
cluster, or rejoin a cluster after --cluster-reset, they need to delete
the database. This a cleaner way to prevent deadlocking on quorum loss,
and removes the requirement that the target of the --server argument
must be online before already joined nodes can start.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-09-27 02:44:49 -07:00
Brad Davidson
42bba04651
Skip etcd snapshots if the local endpoint is still a learner (#2295) 
* Don't take snapshots if the local endpoint is still a learner
* Configure timeouts for etcd client dialer
 2020-09-21 20:23:18 -07:00
Brian Downs
ba70c41cce
Initial Logging Output Update (#2246) 
This attempts to update logging statements to make them consistent
through out the code base. It also adds additional context to messages
where possible, simplifies messages, and updates level where necessary.
 2020-09-21 09:56:03 -07:00
Hussein Galal
46fe57d7e9
reset etcd name on cluster reset (#2284) 
* reset etcd name on cluster reset

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* gofmt

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
 2020-09-19 03:09:36 +02:00
Brad Davidson
8c6d3567fe Rename k3s-controller based on the build-time program name 
Since we're replacing the k3s rolebindings.yaml in rke2, we should allow
renaming this so that we can use the white-labeled name downstream.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-09-16 10:53:07 -07:00
Brad Davidson
ae5519c047
Use rancher-mirrored busybox for local-path-provisioner (#2257) 
Related to #1908

Will be fixed upstream by
https://github.com/rancher/local-path-provisioner/pull/135/ but we're
not going to update the LPP image right now since it's undergoing some
changes that we don't want to pick up at the moment.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-09-15 18:02:51 -07:00
Erik Wilson
a08e998bc5 Import containerd images with all platforms 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-09-14 20:44:58 -07:00
Brad Davidson
fcaeebaa18 Add support for disabling all staged content 
This reduces the binary footprint for downstream users that won't use
these files anyway.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-09-14 14:21:37 -07:00
Menna Elmasry
edb3e5b7a7
Add error logger to http server (#2242) 
* add error logger to http server

Signed-off-by: MonzElmasry <menna.elmasry@rancher.com>
 2020-09-14 23:14:30 +02:00
Brian Downs
15d7b61939 Merge remote-tracking branch 'upstream/master' into issue-112 2020-09-04 14:41:42 -07:00
Brian Downs
4c3ec907ab
remove k8s daemon config from setup hook in favor of specific fields from the config (#2206) 
Signed-off-by: Brian Downs <brian.downs@gmail.com>
 2020-09-04 09:30:36 -07:00
Brian Downs
bb8e5374ea conform to repo conventions 
Signed-off-by: Brian Downs <brian.downs@gmail.com>
 2020-09-03 18:48:30 -07:00
Brian Downs
898cbeb9b6 Merge remote-tracking branch 'upstream/master' into issue-112 2020-09-03 17:26:48 -07:00
Darren Shepherd
289ba8df6a All arguments should be of the form --k=v so that bool flags will work 
Previously a bool flag would be rendered as --flag false for `flag: false`
which is invalid and results in the opposite of what you'd expect.

Signed-off-by: Darren Shepherd <darren@rancher.com>
 2020-09-03 16:25:35 -07:00
Darren Shepherd
64ae6affc5 Missing registering debug/config flags on server subcommand 
Signed-off-by: Darren Shepherd <darren@rancher.com>
 2020-09-03 13:19:25 -07:00
Brian Downs
00831f9bc8 use version.Program 
Signed-off-by: Brian Downs <brian.downs@gmail.com>
 2020-09-03 08:51:17 -07:00
Brian Downs
301fb73952 add node ip to the request header for cert gen 
Signed-off-by: Brian Downs <brian.downs@gmail.com>
 2020-09-02 19:15:09 -07:00
Craig Jellick
53b3d0fc56
Merge pull request #2180 from ibuildthecloud/configfile 
Go back to urfave v1
 2020-09-02 11:05:19 -07:00
Brad Davidson
a3e9d31e6c
Merge pull request #2097 from iwilltry42/registry-insecure-skip-verify 
Feature: add insecure_skip_verify field to registry config template
 2020-09-01 15:58:26 -07:00
Darren Shepherd
551a1842ad
Update pkg/cli/cmds/config.go 
Co-authored-by: Jacob Blain Christen <dweomer5@gmail.com>
 2020-09-01 10:43:28 -07:00
Darren Shepherd
7657ed2e13
Update pkg/cli/server/server.go 
Co-authored-by: Jacob Blain Christen <dweomer5@gmail.com>
 2020-09-01 10:43:19 -07:00
Darren Shepherd
21d21ddd4d Add config file support independent of CLI framework 
Signed-off-by: Darren Shepherd <darren@rancher.com>
 2020-08-29 21:44:13 -07:00
Darren Shepherd
ae5c585050 Revert "Add config file support" 
This reverts commit e1dc3451bc.

Signed-off-by: Darren Shepherd <darren@rancher.com>
 2020-08-29 21:44:07 -07:00
Erik Wilson
447097a597
Merge pull request #2098 from erikwilson/k8s-1.19 
Update to k8s 1.19
 2020-08-28 18:22:15 -07:00
Erik Wilson
c5dc09159f
Move basic authentication to k3s 2020-08-28 17:18:34 -07:00
Erik Wilson
57fc0c9c87
Fix up authenticator 2020-08-28 17:18:34 -07:00
Erik Wilson
acc42874d8
Add k8s.io/apiserver/plugins/pkg/authenticator from release-1.18 2020-08-28 17:18:34 -07:00
Erik Wilson
837a943234
Update for k8s 1.19 2020-08-28 17:18:34 -07:00
Erik Wilson
daa4beb22c
Update go.mod for k8s 1.19 2020-08-28 17:18:31 -07:00
Erik Wilson
720197b9b1
Fix linting issues 2020-08-28 17:18:29 -07:00
Brian Downs
866dc94cea
Galal hussein etcd backup restore (#2154) 
* Add etcd snapshot and restore

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fix error logs

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* goimports

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fix flag describtion

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* Add disable snapshot and retention

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* use creation time for snapshot retention

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* unexport method, update var name

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* adjust snapshot flags

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* update var name, string concat

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* revert previous change, create constants

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* update

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* updates

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* type assertion error checking

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* update

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* update

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* update

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* pr remediation

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* pr remediation

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* pr remediation

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* pr remediation

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* pr remediation

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* updates

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* updates

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* simplify logic, remove unneeded function

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* update flags

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* update flags

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* add comment

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* exit on restore completion, update flag names, move retention check

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* exit on restore completion, update flag names, move retention check

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* exit on restore completion, update flag names, move retention check

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* update disable snapshots flag and field names

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* move function

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* update field names

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* update var and field names

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* update var and field names

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* update defaultSnapshotIntervalMinutes to 12 like rke

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* update directory perms

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* update etc-snapshot-dir usage

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* update interval to 12 hours

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* fix usage typo

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* add cron

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* add cron

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* add cron

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* wire in cron

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* wire in cron

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* wire in cron

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* wire in cron

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* wire in cron

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* wire in cron

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* wire in cron

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* update deps target to work, add build/data target for creation, and generate

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* remove dead make targets

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* error handling, cluster reset functionality

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* error handling, cluster reset functionality

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* update

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* remove intermediate dapper file

Signed-off-by: Brian Downs <brian.downs@gmail.com>

Co-authored-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
 2020-08-28 16:57:40 -07:00
Frederick F. Kautz IV
cdce2b7e9a
Add support for compressed images when pre-loading images (#2165) 
* Add support for compressed images when pre-loading images

Signed-off-by: Frederick F. Kautz IV <fkautz@alumni.cmu.edu>

* attempting to fix vendor source being dirty

Signed-off-by: Frederick F. Kautz IV <fkautz@alumni.cmu.edu>

* fixing file extension for .tar.lz4

Signed-off-by: Frederick F. Kautz IV <fkautz@alumni.cmu.edu>
 2020-08-28 12:27:01 -07:00
Brad Davidson
c4ac620b8b
Merge pull request #2159 from brandond/config_file_rename 
Rename flags.conf to config.yaml
 2020-08-25 21:43:48 -07:00
Brad Davidson
b4d81a9e33 Remove lingering references to dqlite 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-08-24 17:09:19 -07:00
Brad Davidson
43fcc5ddcb Rename flags.conf => config.yaml 
Related to https://github.com/rancher/rke2/issues/150

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-08-24 14:56:30 -07:00
Brad Davidson
c980fa68a0
Update helm-controller for HelmChartConfig CRD (#2114) 
* Update helm-controller for HelmChartConfig CRD

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-08-20 14:23:50 -07:00
Brian Downs
324bb55986 add ctx to hook, handle hook errors 
Signed-off-by: Brian Downs <brian.downs@gmail.com>
 2020-08-19 16:54:58 -07:00
Brian Downs
fa2c1422b3 change name of variable 
Signed-off-by: Brian Downs <brian.downs@gmail.com>
 2020-08-19 14:30:53 -07:00
Brian Downs
a4b2953017 add setup hook capabilities for rke2 
Signed-off-by: Brian Downs <brian.downs@gmail.com>
 2020-08-19 13:42:45 -07:00
Brad Davidson
79c499f0e0 Fix handling of TLS configuration args 
Also fixes an unrelated error formatting issue turned up while testing.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-08-18 16:44:10 -07:00
Brad Davidson
b1d017f892 Update dynamiclistener 
Second round of fixes for #1621

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-08-18 10:38:47 -07:00
Jacob Blain Christen
e2089bea18
cli: add --selinux flag to agent/server sub-cmds (#2111) 
* cli: add --selinux flag to agent/server sub-cmds

Introduces --selinux flag to affirmatively enable SELinux in containerd.
Deprecates --disable-selinux flag which now defaults to true which
auto-detection of SELinux configuration for containerd is no longer
supported.  Specifying both --selinux and --disable-selinux will result
in an error message encouraging you to pick a side.

* Update pkg/agent/containerd/containerd.go

update log warning message about enabled selinux host but disabled runtime

Co-authored-by: Brad Davidson <brad@oatmail.org>
Signed-off-by: Jacob Blain Christen <jacob@rancher.com>
 2020-08-11 16:17:32 -07:00
Jacob Blain Christen
97ff5affab
Merge pull request #2065 from dweomer/containerd/v1.3.6-selinux 
updated containerd/cri selinux support
 2020-08-07 11:09:28 -07:00
Thorsten Klein
cf8c101b70
registry template: add insecure_skip_verify field 
Signed-off-by: Thorsten Klein <iwilltry42@gmail.com>
 2020-08-06 08:02:08 +02:00
Brad Davidson
3f2551ec05
Merge pull request #1848 from euank/insecure-on-lo 
Listen insecurely on localhost only
 2020-08-05 10:55:09 -07:00
Euan Kemp
4808c4e7d5 Listen insecurely on localhost only 
Before this change, k3s configured the scheduler and controller's
insecure ports to listen on 0.0.0.0. Those ports include pprof, which
provides a DoS vector at the very least.

These ports are only enabled for componentstatus checks in the first
place, and componentstatus is hardcoded to only do the check on
localhost anyway (see
https://github.com/kubernetes/kubernetes/blob/v1.18.2/pkg/registry/core/rest/storage_core.go#L341-L344),
so there shouldn't be any downside to switching them to listen only on
localhost.
 2020-08-05 10:28:11 -07:00
Akihiro Suda
a70cdac356
update rootlesskit to v0.10.0 
Fix intermittent "Connection reset by peer" error during port forwarding

https://github.com/rootless-containers/rootlesskit/issues/153

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
 2020-08-05 18:22:05 +09:00
Brad Davidson
3e8141dc65 Update dynamiclistener 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-08-04 13:05:37 -07:00
Hussein Galal
169ee63907
Add etcd members as learners (#2066) 
* Add etcd members as learners

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* Ignore errors in promote member

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
 2020-07-29 22:52:49 +02:00
Brad Davidson
1eec7348a5 Call setproctitle to conceal node args in ps output 
This is related to #2014.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-07-28 15:49:49 -07:00
Jacob Blain Christen
371bee82f9 containerd: bump to v1.3.6 
Remove $NOTIFY_SOCKET, if present, from env when invoking containerd to
prevent gratuitous notifications sent to systemd.

Signed-off-by: Jacob Blain Christen <jacob@rancher.com>
 2020-07-27 14:41:52 -07:00
Brad Davidson
dfd0f9d1a6 Correctly report and propagate kubeconfig write failures 
As seen in issues such as #15 #155 #518 #570 there are situations where
k3s will fail to write the kubeconfig file, but reports that it wrote it
anyway as the success message is printed unconditionally. Also, secondary
actions like setting file mode and creating a symlink are also attempted
even if the file was not created.

This change skips attempting additional actions, and propagates the
failure back upwards.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-07-24 12:07:32 -07:00
Brad Davidson
9da8dc4f61 Update coredns version to 1.6.9 for master 
Needed for #1844

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2020-07-21 11:06:44 -07:00
Brian Downs
5a81fdbdc5 update cis flag implementation to propogate the rest of the way through to kubelet 
Signed-off-by: Brian Downs <brian.downs@gmail.com>
 2020-07-20 16:31:56 -07:00
Jason
e3f8789114
Add containerd snapshotter flag (#1991) 
* Add containerd snapshotter flag

Signed-off-by: Jason-ZW <zhenyang@rancher.com>

* Fix CamelCase nit and option description

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Signed-off-by: Jason-ZW <zhenyang@rancher.com>

Co-authored-by: Brad Davidson <brad@oatmail.org>
 2020-07-18 01:16:23 +02:00
Brian Downs
abb2d9aad1 add flag usage 
Signed-off-by: Brian Downs <brian.downs@gmail.com>
 2020-07-14 15:55:18 -07:00
Brian Downs
57a6319fac add protect-kernel-defaults to kubelet 
Signed-off-by: Brian Downs <brian.downs@gmail.com>
 2020-07-14 15:46:10 -07:00
Erik Wilson
66a8c2ad7f
Merge pull request #1899 from erikwilson/config-file 
Add config file support
 2020-07-14 08:41:45 -07:00
Brian Downs
ebac755da1 add profiling flag with default value of false 
Signed-off-by: Brian Downs <brian.downs@gmail.com>
 2020-07-10 13:08:04 -07:00
Erik Wilson
e1dc3451bc
Add config file support 2020-07-10 10:34:00 -07:00
Brian Downs
99a8bca522 remove hard coded value 
Signed-off-by: Brian Downs <brian.downs@gmail.com>
 2020-07-09 11:20:06 -07:00
Brandon Davidson
538842ffdc
Merge pull request #1768 from brandond/fix_1764 
Configure default signer implementation to use ClientCA instead of ServerCA
 2020-07-07 16:52:14 -07:00
Erik Wilson
0d6a2bfb0b
Merge pull request #1974 from mschneider82/patch-1 
fixed panic in network_policy_controller
 2020-07-01 09:48:00 -07:00
Erik Wilson
42f0b95ac5
Merge pull request #1800 from niusmallnan/dev 
Add retry backoff for starting network-policy controller
 2020-07-01 09:47:21 -07:00
niusmallnan
d713683614 Add retry backoff for starting network-policy controller 
Signed-off-by: niusmallnan <niusmallnan@gmail.com>
 2020-06-30 09:25:09 +08:00
Matthias Schneider
56a083c812 fixed panic in network_policy_controller 
I have rebooted a newly created k3s etcd cluster and this panic was triggered:

    ```
    k3s[948]: [signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x45f2945]
    k3s[948]: goroutine 1 [running]:
    k3s[948]: github.com/rancher/k3s/pkg/agent/netpol.NewNetworkPolicyController(0xc00159e180, 0x61b4a60, 0xc006294000, 0xdf8475800, 0xc011d9a360, 0xc, 0x0, 0xc00bf545b8, 0x2b2edbc)
    k3s[948]:         /home/x/git/k3s/pkg/agent/netpol/network_policy_controller.go:1698 +0x275
    ```

Signed-off-by: Matthias Schneider <ms@wck.biz>
 2020-06-29 20:49:24 +02:00
Jacob Blain Christen
3197d206ce
Merge pull request #1892 from dweomer/servicelb/node-role 
servicelb: fix ineffective toleration
 2020-06-26 13:55:57 -07:00
Brian Downs
58aae57e12 set environment variable and create config for crictl 
Signed-off-by: Brian Downs <brian.downs@gmail.com>
 2020-06-24 14:26:44 -07:00
Brian Downs
63dbf806df create symlink from docker sock to where crictl in k3s is looking for the sock to use 
Signed-off-by: Brian Downs <brian.downs@gmail.com>
 2020-06-23 18:42:45 -07:00
Hussein Galal
f5ee757b86
Add cluster dns configmap (#1785) 2020-06-22 23:06:01 +02:00
Brian Downs
7f4f237575
added profile = false args to api, controllerManager, and scheduler (#1891) 2020-06-12 21:09:41 +02:00
Jacob Blain Christen
1ed12cffa0 servicelb: fix ineffective toleration 
noderole.kubernetes.io/master -> node-role.kubernetes.io/master
 2020-06-11 14:39:12 -07:00
galal-hussein
c580a8b528 Add heartbeat interval and election timeout 2020-06-06 16:39:42 -07:00
Darren Shepherd
6b5b69378f Add embedded etcd support 
This is replaces dqlite with etcd.  The each same UX of dqlite is
followed so there is no change to the CLI args for this.
 2020-06-06 16:39:41 -07:00
Darren Shepherd
39571424dd Generate etcd certificates 2020-06-06 16:39:41 -07:00
Darren Shepherd
a18d387390 Refactor clustered DB framework 2020-06-06 16:39:41 -07:00
Darren Shepherd
4317a91b96 Delete dqlite 2020-06-06 16:39:41 -07:00
Darren Shepherd
7e59c0801e Make program name a variable to be changed at compile time 2020-06-06 16:39:41 -07:00
Taeho Kim
3d59a85dae Upgrade local-path-storage to v0.0.14 2020-06-02 13:47:37 +00:00
Erik Wilson
43b9bf2e50
Merge pull request #1795 from StateFarmIns/support_for_setting_default_ssl_ciphers 
Feature Request #1741: Update to set default CipherSuites
 2020-05-15 09:41:37 -07:00
Erik Wilson
d10d6f7fb3
Merge pull request #1762 from consideRatio/coredns-readinessprobe 
coredns: readiness- and livenessProbe tweaks (~15s -> ~3s startup)
 2020-05-15 09:40:54 -07:00
Chuck Schweizer
19c34bd12d Update to set default CipherSuites 
The default CipherSuites need to be set to disable the insecure TLS 1.2 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 Cipher
 2020-05-13 08:34:45 -05:00
Chuck Schweizer
ca9c9c2e1e Adding support for TLS MinVersion and CipherSuites 
This will watch for the following kube-apiserver-arg variables and apply
them to the k3s kube-apiserver https listener.

  --kube-apiserver-arg=tls-cipher-suites=XXXXXXX
  --kube-apiserver-arg=tls-min-version=XXXXXXX
 2020-05-07 09:27:09 -05:00
Erik Sundell
27ae2fb9c8 coredns: go generate 2020-05-07 16:21:46 +02:00
Darren Shepherd
cb4b34763e
Merge pull request #1759 from ibuildthecloud/background 
Start kube-apiserver in the background
 2020-05-06 21:50:48 -07:00
Darren Shepherd
e5fe184a44
Merge pull request #1757 from ibuildthecloud/separate-port 
Add supervisor port
 2020-05-06 21:32:45 -07:00
Darren Shepherd
072396f774 Start kube-apiserver in the background 
In rke2 everything is a static pod so this causes a chicken and egg situation
in which we need the kubelet running before the kube-apiserver can be
launched.  By starting the apiserver in the background this allows us to
do this odd bootstrapping.
 2020-05-06 21:17:23 -07:00
Brad Davidson
71561ecda2 Use ClientCA for the signer controller 2020-05-06 16:51:35 -07:00
Darren Shepherd
f38082673d
Merge pull request #1753 from ibuildthecloud/prepull 
Support prepulling images on start
 2020-05-05 22:11:52 -07:00
Darren Shepherd
74bcf4da0b
Merge pull request #1756 from ibuildthecloud/less-logging 
Only echo Waiting for kubelet every 30 seconds
 2020-05-05 22:07:50 -07:00
Darren Shepherd
2f5ee914f9 Add supervisor port 
In k3s today the kubernetes API and the /v1-k3s API are combined into
one http server.  In rke2 we are running unmodified, non-embedded Kubernetes
and as such it is preferred to run k8s and the /v1-k3s API on different
ports.  The /v1-k3s API port is called the SupervisorPort in the code.

To support this separation of ports a new shim was added on the client in
then pkg/agent/proxy package that will launch two load balancers instead
of just one load balancer.  One load balancer for 6443 and the other
for 9345 (which is the supervisor port).
 2020-05-05 15:54:51 -07:00
Darren Shepherd
afd6f6d7e7 Encapsulate execution logic 
This moves all the calls to cobra root commands to one package
so that we can change the behavior of running components as embedded
or external.
 2020-05-05 15:34:32 -07:00
Darren Shepherd
61ba9171ce Only echo Waiting for kubelet every 30 seconds 
Don't print a message every second while we are waiting for the
kubelet to report Ready.
 2020-05-05 15:23:18 -07:00
Darren Shepherd
1d05e99769
Merge pull request #1752 from ibuildthecloud/disable-ccm 
Don't write ccm.yaml if --disable-cloud-controller is set
 2020-05-05 15:11:10 -07:00