Skip to content

K
k3s
Unverified Commit 2ac863c3 authored by Derek Nola's avatar Derek Nola Committed by GitHub
Browse files
Options

Add Secrets Encryption to CriticalArgs

* Add EncryptSecrets to Critical Control Args * use deep comparison to extract differences Signed-off-by: 's avatarDerek Nola <derek.nola@suse.com>
parent 98d5013b
Hide whitespace changes
Inline Side-by-side
Showing with 39 additions and 29 deletions
go.mod
View file @ 2ac863c3
...@@ -84,6 +84,7 @@ require ( ...@@ -84,6 +84,7 @@ require (
github.com/flannel-io/flannel v0.20.1-k3s1.23 github.com/flannel-io/flannel v0.20.1-k3s1.23
github.com/go-bindata/go-bindata v3.1.2+incompatible github.com/go-bindata/go-bindata v3.1.2+incompatible
github.com/go-sql-driver/mysql v1.6.0 github.com/go-sql-driver/mysql v1.6.0
github.com/go-test/deep v1.0.7
github.com/golangplus/testing v1.0.0 // indirect github.com/golangplus/testing v1.0.0 // indirect
github.com/google/cadvisor v0.43.1 github.com/google/cadvisor v0.43.1
github.com/google/uuid v1.3.0 github.com/google/uuid v1.3.0
......
package/rpm/install.sh
View file @ 2ac863c3
...@@ -8,7 +8,7 @@ set -e ...@@ -8,7 +8,7 @@ set -e
# #
# Example: # Example:
# Installing a server without traefik: # Installing a server without traefik:
# curl ... | INSTALL_K3S_EXEC="--no-deploy=traefik" sh - # curl ... | INSTALL_K3S_EXEC="--disable=traefik" sh -
# Installing an agent to point at a server: # Installing an agent to point at a server:
# curl ... | K3S_TOKEN=xxx K3S_URL=https://server-url:6443 sh - # curl ... | K3S_TOKEN=xxx K3S_URL=https://server-url:6443 sh -
# #
...@@ -66,11 +66,11 @@ set -e ...@@ -66,11 +66,11 @@ set -e
# of EXEC and script args ($@). # of EXEC and script args ($@).
# #
# The following commands result in the same behavior: # The following commands result in the same behavior:
# curl ... | INSTALL_K3S_EXEC="--no-deploy=traefik" sh -s - # curl ... | INSTALL_K3S_EXEC="--disable=traefik" sh -s -
# curl ... | INSTALL_K3S_EXEC="server --no-deploy=traefik" sh -s - # curl ... | INSTALL_K3S_EXEC="server --disable=traefik" sh -s -
# curl ... | INSTALL_K3S_EXEC="server" sh -s - --no-deploy=traefik # curl ... | INSTALL_K3S_EXEC="server" sh -s - --disable=traefik
# curl ... | sh -s - server --no-deploy=traefik # curl ... | sh -s - server --disable=traefik
# curl ... | sh -s - --no-deploy=traefik # curl ... | sh -s - --disable=traefik
# #
# - INSTALL_K3S_NAME # - INSTALL_K3S_NAME
# Name of systemd service to create, will default from the k3s exec command # Name of systemd service to create, will default from the k3s exec command
......
pkg/cluster/bootstrap.go
View file @ 2ac863c3
...@@ -14,6 +14,7 @@ import ( ...@@ -14,6 +14,7 @@ import (
"strings" "strings"
"time" "time"
"github.com/go-test/deep"
"github.com/k3s-io/k3s/pkg/bootstrap" "github.com/k3s-io/k3s/pkg/bootstrap"
"github.com/k3s-io/k3s/pkg/clientaccess" "github.com/k3s-io/k3s/pkg/clientaccess"
"github.com/k3s-io/k3s/pkg/daemons/config" "github.com/k3s-io/k3s/pkg/daemons/config"
...@@ -475,10 +476,18 @@ func (c *Cluster) compareConfig() error { ...@@ -475,10 +476,18 @@ func (c *Cluster) compareConfig() error {
clusterControl.CriticalControlArgs.EgressSelectorMode = c.config.CriticalControlArgs.EgressSelectorMode clusterControl.CriticalControlArgs.EgressSelectorMode = c.config.CriticalControlArgs.EgressSelectorMode
} }
if !reflect.DeepEqual(clusterControl.CriticalControlArgs, c.config.CriticalControlArgs) { if diff := deep.Equal(c.config.CriticalControlArgs, clusterControl.CriticalControlArgs); diff != nil {
logrus.Debugf("This is the server CriticalControlArgs: %#v", clusterControl.CriticalControlArgs) rc := reflect.ValueOf(clusterControl.CriticalControlArgs).Type()
logrus.Debugf("This is the local CriticalControlArgs: %#v", c.config.CriticalControlArgs) for _, d := range diff {
return errors.New("critical configuration value mismatch") field := strings.Split(d, ":")[0]
v, _ := rc.FieldByName(field)
if cliTag, found := v.Tag.Lookup("cli"); found {
logrus.Warnf("critical configuration mismatched: %s", cliTag)
} else {
logrus.Warnf("critical configuration mismatched: %s", field)
}
}
return errors.New("critical configuration value mismatch between servers")
} }
return nil return nil
} }
......
pkg/daemons/config/types.go
View file @ 2ac863c3
...@@ -120,23 +120,24 @@ type Agent struct { ...@@ -120,23 +120,24 @@ type Agent struct {
} }
// CriticalControlArgs contains parameters that all control plane nodes in HA must share // CriticalControlArgs contains parameters that all control plane nodes in HA must share
// The cli tag is used to provide better error information to the user on mismatch
type CriticalControlArgs struct { type CriticalControlArgs struct {
ClusterDNSs []net.IP ClusterDNSs []net.IP `cli:"cluster-dns"`
ClusterIPRanges []*net.IPNet ClusterIPRanges []*net.IPNet `cli:"cluster-cidr"`
ClusterDNS net.IP ClusterDNS net.IP `cli:"cluster-dns"`
ClusterDomain string ClusterDomain string `cli:"cluster-domain"`
ClusterIPRange *net.IPNet ClusterIPRange *net.IPNet `cli:"cluster-cidr"`
DisableCCM bool DisableCCM bool `cli:"disable-cloud-controller"`
DisableHelmController bool DisableHelmController bool `cli:"disable-helm-controller"`
DisableNPC bool DisableNPC bool `cli:"disable-network-policy"`
DisableServiceLB bool DisableServiceLB bool `cli:"disable-service-lb"`
FlannelBackend string EncryptSecrets bool `cli:"secrets-encryption"`
FlannelIPv6Masq bool FlannelBackend string `cli:"flannel-backend"`
FlannelExternalIP bool FlannelIPv6Masq bool `cli:"flannel-ipv6-masq"`
EgressSelectorMode string FlannelExternalIP bool `cli:"flannel-external-ip"`
NoCoreDNS bool EgressSelectorMode string `cli:"egress-selector-mode"`
ServiceIPRange *net.IPNet ServiceIPRange *net.IPNet `cli:"service-cidr"`
ServiceIPRanges []*net.IPNet ServiceIPRanges []*net.IPNet `cli:"service-cidr"`
} }
type Control struct { type Control struct {
...@@ -181,7 +182,6 @@ type Control struct { ...@@ -181,7 +182,6 @@ type Control struct {
ClusterInit bool ClusterInit bool
ClusterReset bool ClusterReset bool
ClusterResetRestorePath string ClusterResetRestorePath string
EncryptSecrets bool
EncryptForce bool EncryptForce bool
EncryptSkip bool EncryptSkip bool
TLSMinVersion uint16 TLSMinVersion uint16
......
tests/perf/server/files/server_userdata.tmpl
View file @ 2ac863c3
...@@ -28,11 +28,11 @@ write_files: ...@@ -28,11 +28,11 @@ write_files:
if [ ${db_engine} == "embedded-etcd" ]; then if [ ${db_engine} == "embedded-etcd" ]; then
curl -sfL https://get.k3s.io | K3S_CLUSTER_SECRET="${k3s_cluster_secret}" \ curl -sfL https://get.k3s.io | K3S_CLUSTER_SECRET="${k3s_cluster_secret}" \
INSTALL_K3S_VERSION="${install_k3s_version}" \ INSTALL_K3S_VERSION="${install_k3s_version}" \
INSTALL_K3S_EXEC="${k3s_server_args} --cluster-cidr=10.0.0.0/8 --no-deploy traefik --no-deploy servicelb --tls-san ${lb_address} %{ if master_index != 0 } --server https://${lb_address}:6443 %{ else } --cluster-init %{ endif }" sh - INSTALL_K3S_EXEC="${k3s_server_args} --cluster-cidr=10.0.0.0/8 --disable traefik --disable servicelb --tls-san ${lb_address} %{ if master_index != 0 } --server https://${lb_address}:6443 %{ else } --cluster-init %{ endif }" sh -
else else
curl -sfL https://get.k3s.io | K3S_CLUSTER_SECRET="${k3s_cluster_secret}" \ curl -sfL https://get.k3s.io | K3S_CLUSTER_SECRET="${k3s_cluster_secret}" \
INSTALL_K3S_VERSION="${install_k3s_version}" \ INSTALL_K3S_VERSION="${install_k3s_version}" \
INSTALL_K3S_EXEC="${k3s_server_args} --cluster-cidr=10.0.0.0/8 --no-deploy traefik --no-deploy servicelb --tls-san ${lb_address} %{ if use_ha == "true" } --datastore-endpoint=$STORAGE_ENDPOINT %{ endif }" sh - INSTALL_K3S_EXEC="${k3s_server_args} --cluster-cidr=10.0.0.0/8 --disable traefik --disable servicelb --tls-san ${lb_address} %{ if use_ha == "true" } --datastore-endpoint=$STORAGE_ENDPOINT %{ endif }" sh -
fi fi
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
break break
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment