[release-1.24] Backport version bumps and bugfixes #7516
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fixes an issue where CRDs were being created without schema, allowing resources with invalid content to be created, later stalling the controller ListWatch event channel when the invalid resources could not be deserialized. This also requires moving Addon GVK tracking from a status field to an annotation, as the GroupVersionKind type has special handling internal to Kubernetes that prevents it from being serialized to the CRD when schema validation is enabled. Signed-off-by: Brad Davidson <brad.davidson@rancher.com> (cherry picked from commit ad41fb8)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com> (cherry picked from commit 9539147)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com> (cherry picked from commit 0bbc6ad)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com> (cherry picked from commit 0247794)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com> (cherry picked from commit 5348b5e)
Don't set up the agent tunnel authorizer on agentless servers, and warn when agentless servers won't have a way to reach in-cluster endpoints. Signed-off-by: Brad Davidson <brad.davidson@rancher.com> (cherry picked from commit 31a6386)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com> (cherry picked from commit 1ca035a)
Several places in the code used a 5-second retry loop to wait on Runtime.Core to be set. This caused a race condition where OnChange handlers could be added after the Wrangler shared informers were already started. When this happened, the handlers were never called because the shared informers they relied upon were not started. Fix that by requiring anything that waits on Runtime.Core to run from a cluster controller startup hook that is guaranteed to be called before the shared informers are started, instead of just firing it off in a goroutine that retries until it is set. Signed-off-by: Brad Davidson <brad.davidson@rancher.com> (cherry picked from commit c44d33d)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com> (cherry picked from commit f1b6a35)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com> (cherry picked from commit 91afb38)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com> (cherry picked from commit e61fde9)
Also add bandwidth and firewall plugins. The bandwidth plugin is automatically registered with the appropriate capability, but the firewall plugin must be configured by the user if they want to use it. Ref: https://www.cni.dev/plugins/current/meta/firewall/ Signed-off-by: Brad Davidson <brad.davidson@rancher.com> (cherry picked from commit cedefef)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com> (cherry picked from commit cf9ebb3)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com> (cherry picked from commit c98137d)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com> (cherry picked from commit b32bf49)
As per golang/go#47001 even subtle.ConstantTimeCompare should never be used with variable-length inputs, as it will return 0 if the lengths do not match. Switch to consistently using constant-time comparisons of hashes for password checks to avoid any possible side-channel leaks that could be combined with other vectors to discover password lengths. Signed-off-by: Brad Davidson <brad.davidson@rancher.com> (cherry picked from commit 239021e)
briandowns
approved these changes
May 10, 2023
cwayne18
approved these changes
May 10, 2023
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Codecov ReportPatch coverage:
Additional details and impacted files@@ Coverage Diff @@
## release-1.24 #7516 +/- ##
================================================
+ Coverage 9.92% 10.09% +0.16%
================================================
Files 148 149 +1
Lines 10887 10742 -145
================================================
+ Hits 1081 1084 +3
+ Misses 9584 9435 -149
- Partials 222 223 +1
Flags with carried forward coverage won't be shown. Click here to find out more.
☔ View full report in Codecov by Sentry. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed Changes
Backport version bumps and bugfixes for the 2023-05 release:
--disable-agentand--egress-selector-mode=pod|cluster#7331Types of Changes
Backports
Verification
See linked issues
Testing
Linked Issues
--egress-selector-mode=cluster|podare broken #7491--disable-agentstill attempt to run agent tunnel authorizer #7494k3s serverexits instead of retrying when receiving "too many learners" error from etcd join #7512User-Facing Change
Further Comments