Mirror/k3s
1
0
Fork 0
mirror of https://github.com/k3s-io/k3s.git synced 2024-06-07 19:41:36 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,869 Commits 27 Branches 785 Tags 625 MiB
ced330c66a
Commit Graph

1184 Commits

Author SHA1 Message Date
Derek Nola
ced330c66a
[v1.28] CLI Removal for v1.28.0 (#8203) 
* Remove deprecated flannel ipsec

Signed-off-by: Derek Nola <derek.nola@suse.com>

* Remove multipart backend

Signed-off-by: Derek Nola <derek.nola@suse.com>

* Fix secrets-encryption integration test flakiness

Signed-off-by: Derek Nola <derek.nola@suse.com>

---------

Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-08-24 22:09:13 -07:00
Hussein Galal
af50e1b096
Update to v1.28.0-k3s1 (#8199) 
* Update to v1.28.0

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* Update golang to v1.20.7

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* more changes

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* update wrangler

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* update wrangler

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fix nodepassword test

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fix nodepassword test

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* disable CGO before running golangci-lint

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* execlude CGO Enabled checks

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* Ignore reapply change error with logging

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* Update google api client

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

---------

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
 2023-08-23 00:09:31 +03:00
Brad Davidson
66bae3e326 Bump dynamiclistener for init deadlock fix 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-08-15 16:36:12 -07:00
Vitor Savian
e83b1ba4aa
Fixed the etcd retention to delete orphaned snapshots based on the date (#8177) 
* Fix retention using name instead of date

Signed-off-by: Vitor <vitor.savian@suse.com>
 2023-08-14 18:48:59 -03:00
Vitor Savian
c97211866a
Fix for cluster-reset backup from s3 when etcd snapshots are disabled (#8155) 
* Fixed when the user disable the etcd snapshots, but want to backup from s3

Signed-off-by: Vitor <vitor.savian@suse.com>
 2023-08-10 12:23:10 -03:00
Ian Cardoso
e551308db8
fix for etcd-snapshot delete with --etcd-s3 flag (#8110) 
k3s etcd-snapshot save --etcd-s3 ... is creating a local snapshot and uploading it to s3 while k3s etcd-snapshot delete --etcd-s3 ... was deleting the snapshot only on s3 buckets, this commit change the behavior of delete to do it locally and on s3

Signed-off-by: Ian Cardoso <osodracnai@gmail.com>
 2023-08-04 14:26:32 -03:00
Vitor Savian
ca7aeed090
Etcd snapshots retention when node name changes (#8099) 
Fixed the etcd retention to delete orphaned snapshots

Signed-off-by: Vitor <vitor.savian@suse.com>
 2023-08-03 10:54:40 -03:00
Brad Davidson
aa76942d0f Add FilterCN function to prevent SAN Stuffing 
Wire up a node watch to collect addresses of server nodes, to prevent adding unauthorized SANs to the dynamiclistener cert.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-08-02 11:15:39 -07:00
Manuel Buil
8c38d1169d
Merge pull request #8077 from manuelbuil/fixTailscale 
Fix tailscale bug with ip modes
 2023-08-02 11:42:20 +02:00
Derek Nola
46cbbab263
Consolidate CopyFile functions (#8079) 
* Consolidate CopyFile function

Signed-off-by: Derek Nola <derek.nola@suse.com>

* Copy to File, not destination folder

Signed-off-by: Derek Nola <derek.nola@suse.com>

---------

Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-08-01 08:55:34 -07:00
Manuel Buil
59eec78c62 Fix tailscale bug with ip modes 
Signed-off-by: Manuel Buil <mbuil@suse.com>
 2023-08-01 09:43:25 +02:00
Brad Davidson
f21ae1d949 Make apiserver egress args conditional on egress-selector-mode 
Only configure enable-aggregator-routing and egress-selector-config-file
if required by egress-selector-mode.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-07-31 13:59:41 -07:00
Simon Kirsten
546dc247a0
Add support for {{ template "base" . }} in etc/containerd/config.toml.tmpl (#7991) 
Signed-off-by: Simon Kirsten <simonkirsten24@gmail.com>
 2023-07-31 16:36:23 -04:00
Derek Nola
6d360e6473
Unit test for MustFindString (#8013) 
Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-07-31 10:22:34 -07:00
Derek Nola
be44243353
Adjust default kubeconfig file permissions (#7978) 
* Adjust default kubeconfig permissions

Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-07-14 15:00:27 -07:00
Derek Nola
0b18a65d4f
Revert "Warn that v1.28 will deprecate reencrypt/prepare (#7848)" 
This reverts commit 4ab01f3941.

Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-07-14 12:38:33 -07:00
Bartosz Lenart
34617390d0
Generation of certificates and keys for etcd gated if etcd is disabled. (#6998) 
Problem:
When support for etcd was added in 3957142, generation of certificates and keys for etcd was not gated behind use of managed etcd.
Keys are generated and distributed across servers even if managed etcd is not enabled.

Solution:
Allow generation of certificates and keys only if managed etc is enabled. Check config.DisableETCD flag.

Signed-off-by: Bartossh <lenartconsulting@gmail.com>
 2023-07-11 10:24:35 -07:00
Derek Nola
8405813c12
Fix rootless node password (#7887) 
Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-07-07 09:14:49 -07:00
Denys Smirnov
b9a2bf11ee Support setting control server URL for Tailscale. 
This change enables the use of Headscale - open source implementation of the Tailscale control server.

Signed-off-by: Denys Smirnov <dennwc@pm.me>
 2023-07-07 10:49:01 +03:00
Derek Nola
4ab01f3941
Warn that v1.28 will deprecate reencrypt/prepare (#7848) 
* Warn that v1.28 will deprecate reencrypt/prepare

Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-07-06 12:34:51 -07:00
Manuel Buil
6c44b06e0a
Merge pull request #7838 from manuelbuil/ipv4ipv6tailscale 
Check if we are on ipv4, ipv6 or dualStack when doing tailscale
 2023-07-06 11:11:26 +02:00
Manuel Buil
bca0adbca8 Fix code spell check 
Signed-off-by: Manuel Buil <mbuil@suse.com>
 2023-07-04 13:02:06 +02:00
Manuel Buil
9c48d10eba
Merge pull request #7845 from manuelbuil/removeWinFile 
Remove file_windows.go
 2023-07-04 12:43:09 +02:00
Brad Davidson
7f50b40cfe Fall back to basic/bearer auth when node identity auth is rejected 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-07-03 16:20:50 -07:00
Daishan Peng
ce3443ddf6 Allow k3s to customize apiServerPort on helm-controller 
Signed-off-by: Daishan Peng <daishan@acorn.io>
 2023-07-03 11:09:49 -07:00
LeiLei
72d50b1f7c
Add --data-dir to the k3s certificate rotate-ca cli (#7791) 
Need to add a cli flag for this. Also, should probably have config file loading support for the certificate commands.

Signed-off-by: leilei.zhai <leilei.zhai@qingteng.cn>
 2023-07-03 09:30:04 -07:00
Manuel Buil
d593c83603 Remove file_windows.go 
Signed-off-by: Manuel Buil <mbuil@suse.com>
 2023-07-03 16:08:39 +02:00
Manuel Buil
f21a01474d Check if we are on ipv4, ipv6 or dualStack when doing tailscale 
Signed-off-by: Manuel Buil <mbuil@suse.com>
 2023-07-03 10:48:59 +02:00
Vitor Savian
0809187cff
Adding cli to custom klipper helm image (#7682) 
Adding cli to custom klipper helm image

Signed-off-by: Vitor Savian <vitor.savian@suse.com>
 2023-06-28 15:31:58 +00:00
guoguangwu
2215870d5d chore: pkg imported more than once 
Signed-off-by: guoguangwu <guoguangwu@magic-shield.com>
 2023-06-26 16:58:11 -07:00
Manuel Buil
43611bb5ad Fix the error report 
Signed-off-by: Manuel Buil <mbuil@suse.com>
 2023-06-14 18:26:59 +02:00
Manuel Buil
268c9a7684
Merge pull request #7352 from manuelbuil/vpnintegrations-afterparental 
Integrate tailscale into k3s
 2023-06-09 19:02:46 +02:00
Manuel Buil
869e030bdd VPN PoC 
Signed-off-by: Manuel Buil <mbuil@suse.com>
 2023-06-09 12:39:33 +02:00
Derek Nola
dc6c569b98
Shortcircuit commands with version or help flags (#7683) 
* Shortcircuit search with help and version flag

Signed-off-by: Derek Nola <derek.nola@suse.com>

* Keep functions seperate

Signed-off-by: Derek Nola <derek.nola@suse.com>

---------

Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-06-07 15:57:52 -07:00
Brad Davidson
e5e1a674ce Enable containerd aufs/devmapper/zfs snapshotter plugins 
These were unintentionally dropped when moving containerd back into the main multicall binary

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-06-05 15:32:30 -07:00
Brad Davidson
5170bc5a04 Improve error response logging 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-06-05 15:31:04 -07:00
Brad Davidson
45d8c1a1a2 Soft-fail on node password verification if the secret cannot be created 
Allows nodes to join the cluster during a webhook outage. This also
enhances auditability by creating Kubernetes events for the deferred
verification.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-06-05 15:31:04 -07:00
Derek Nola
b0188f5a13
Test Coverage Reports for E2E tests (#7526) 
* Move coverage writer into agent and server
* Add coverage report to E2E PR tests
* Add codecov upload to drone

Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-06-05 14:15:17 -07:00
Yuxing Deng
b64a226ebd Make LB image configurable when compiling k3s 
It is no way we can configure the lb image because it is a const value.
It would be better that we make it variable value and we can override
the value like the `helm-controller` job image when compiling k3s/rke2

Signed-off-by: Yuxing Deng <jxfa0043379@hotmail.com>
 2023-05-31 08:51:13 -07:00
Brad Davidson
64a5f58f1e Create new kubeconfig for supervisor use 
Only actual admin actions should use the admin kubeconfig; everything done by the supervisor/deploy/helm controllers will now use a distinct account for audit purposes.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-05-30 18:15:11 -07:00
Brad Davidson
8748813a61 Use distinct clients for supervisor, deploy, and helm controllers 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-05-30 18:15:11 -07:00
Brad Davidson
e9958cf070 Bump metrics-server to v0.6.3 and update tls-cipher-suites 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-05-30 17:44:06 -07:00
Brad Davidson
93279d2f59 Bump klipper-lb to v0.4.4 
Fixes issue with localhost access to ServiceLB when
ExternalTrafficPolicy=Local

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-05-30 17:38:59 -07:00
Andrew Roffey
0485a56f33 allow coredns override extensions 
Signed-off-by: Andrew Roffey <andrew@roffey.au>
 2023-05-30 17:24:00 -07:00
Manuel Buil
4aafff0219 Wrap error stating that it is coming from netpol 
Signed-off-by: Manuel Buil <mbuil@suse.com>
 2023-05-12 19:33:25 +02:00
Brad Davidson
8f450bafe1 Bump helm-controller version for repo auth/ca support 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-05-10 14:57:37 -07:00
Brad Davidson
607cbf0ad6 Bump containerd to v1.7.0 and move back into multicall binary 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-05-10 08:34:03 -07:00
thomasferrandiz
b4bc57d049
Merge pull request #7303 from thomasferrandiz/netpol-log-level 
ensure that klog verbosity is set to the same level as logrus
 2023-05-10 15:01:06 +02:00
Brad Davidson
239021e759 Consistently use constant-time comparison of password hashes 
As per https://github.com/golang/go/issues/47001 even subtle.ConstantTimeCompare should never be used with variable-length inputs, as it will return 0 if the lengths do not match. Switch to consistently using constant-time comparisons of hashes for password checks to avoid any possible side-channel leaks that could be combined with other vectors to discover password lengths.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
 2023-05-09 13:54:50 -07:00
Derek Nola
c6dc789e25
Add support for -cover + integration test code coverage (#7415) 
* Add support for -cover in k3s server
* Update codecov reporting
* Sigterm in StopK3sServer
Signed-off-by: Derek Nola <derek.nola@suse.com>
 2023-05-08 12:46:51 -07:00