Previously we errored out of the entire join if retrieval
of either LB IP or control plane public IP failed. This resulted
in the entire "use either IP" logic not working as intended. This now
makes it log a warning only if the IP retrievals fail, and only errors
out of the join if no IP can be found at all.
* deps: update Go dependencies
* bazel: force Gazelle generation for xDS
xDS has an upstream set of build files that makes Gazelle consider their project a whole new Bazel project, which makes Gazelle not generate any build files, even though the upstream ones aren't valid.
See https://github.com/cncf/xds/issues/104.
* go: update cel.dev/expr for Bazel fixes
cel.dev/expr had some upstream Bazel fixes in v0.16.2 without which Gazelle doesn't work.
* chore: generate
* e2e: remove references to kubeProxyVersion
kubeProxyVersion is deprecated as of KEP-4004. It was never being set to an accurate value before, and we only used it in the e2e test, so removing the additional check should not hurt here.
See https://github.com/kubernetes/enhancements/tree/master/keps/sig-network/4004-deprecate-kube-proxy-version
* constellation-node-operator: use typed rate-limiter
The untyped rate-limiter was deprecated in favor of a generic one that can just be instantiated to `any` to achieve the previous behaviour.
* Advertise ALPN settings in NextProtos required by gRPC
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
* atls: add nextProtos
nextProtos (for ALPN) is now required by gRPC, so add it.
* go: add cri-client replace
* deps: tidy all modules
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
Co-authored-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: edgelessci <edgelessci@users.noreply.github.com>
* Upgrade Go dependencies
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
* Group Go dependency upgrades
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
* Remove usage of deprecated docker types
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
* Fix usage of invalid validation tags
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
* Regenerate bazel files
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
* Keep github.com/bazelbuild/buildtools at old version to not break other dependencies
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
* Let JoinClient return fatal errors
* Mark disk for wiping if JoinClient or InitServer return errors
* Reboot system if bootstrapper detects an error
* Refactor joinClient start/stop implementation
* Fix joining nodes retrying kubeadm 3 times in all cases
* Write non-recoverable failures to syslog before rebooting
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
There used to be three definitions of a Component type, and conversion
routines between the three. Since the use case is always the same, and
the Component semantics are defined by versions.go and the installer, it
seems appropriate to define the Component type there and import it in
the necessary places.
This is the first step in our migration off of
konnectivity. Before node-to-node encryption
we used konnectivity to route some KubeAPI
to kubelet traffic over the pod network which then
would be encrypted.
Since we enabled node-to-node encryption this has no
security upsides anymore. Note that we still deploy
the konnectivity agents via helm and still have the
load balancer for konnectivity.
In the following releases we will remove both.
The token given out by control-planes contains the node IP
as an endpoint. Since during this stage the joining node is
not connected to the WireGuard network, we cannot
communicate node-to-node. Therefore, we need to hop over the
load balancer again to have a src IP outside of the strict
range.
In unit tests, NewCollector may be called on systems that do not have
"journalctl" in $PATH.
We can defer checking if the command can work by not checking cmd.Err in
the constructor.
* Fix incorrect use of masterSecret salt for clusterID generation
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
---------
Signed-off-by: Daniel Weiße <dw@edgeless.systems>
Co-authored-by: Leonard Cohnen <lc@edgeless.systems>
