Skip to content
  1. Nov 27, 2023
  3. Nov 17, 2023
    • Max Gautier's avatar
      Validate systemd unit files (#10597) · 0d4f57aa
      Max Gautier authored 
      * Validate systemd unit files

This ensure that we fail early if we have a bad systemd unit file
(syntax error, using a version not available in the local version, etc)

* Hack to check systemd version for service files validation

factory-reset.target was introduced in system 250, same version as the
aliasing feature we need for verifying systemd services with ansible.
So we only actually executes the validation if that target is present.

This is an horrible hack which should be reverted as soon as we drop
support for distributions with systemd<250.
      0d4f57aa
  5. Nov 08, 2023
    • Max Gautier's avatar
      Move control plane certs renewal "spread out" into the systemd timer (#10596) · b3f6d051
      Max Gautier authored 
      * Use RandomizedDelaySec to spread out control certificates renewal plane

If the number of control plane node is superior to 6, using (index * 10
minutes) will fail (03:60:00 is not a valid timestamp).

Compared to just fixing the jinja expression (to use a modulo for
example), this should avoid having two control planes certificates
update node being triggered at the same time.

* Make k8s-certs-renew.timer Persistent

If the control plane happens to be offline during the scheduled
certificates renewal (node failure or anything like that), we still want
the renewal to happen.
      b3f6d051
    • Max Gautier's avatar
      Refactor "multi" handlers to use listen (#10542) · 8ebeb88e
      Max Gautier authored 
      * containerd: refactor handlers to use 'listen'

* cri-dockerd: refactor handlers to use 'listen'

* cri-o: refactor handlers to use 'listen'

* docker: refactor handlers to use 'listen'

* etcd: refactor handlers to use 'listen'

* control-plane: refactor handlers to use 'listen'

* kubeadm: refactor handlers to use 'listen'

* node: refactor handlers to use 'listen'

* preinstall: refactor handlers to use 'listen'

* calico: refactor handlers to use 'listen'

* kube-router: refactor handlers to use 'listen'

* macvlan: refactor handlers to use 'listen'
      8ebeb88e
  7. Oct 30, 2023
  9. Oct 17, 2023
  11. Sep 29, 2023
  13. Sep 21, 2023
  15. Aug 23, 2023
  17. Aug 10, 2023
  19. Aug 08, 2023
  21. Jul 26, 2023
  23. Jul 05, 2023
  25. Jun 30, 2023
  27. Jun 26, 2023
  29. Jun 13, 2023
  31. Jun 12, 2023
  33. Apr 18, 2023
  35. Apr 11, 2023
  37. Mar 29, 2023
  39. Mar 27, 2023
  41. Mar 10, 2023
  43. Mar 03, 2023
  45. Feb 06, 2023
  47. Dec 28, 2022
  49. Dec 27, 2022
  51. Dec 20, 2022
  53. Dec 15, 2022
  55. Dec 05, 2022
  57. Oct 26, 2022
  59. Oct 14, 2022
  61. Oct 06, 2022
  63. Sep 29, 2022
  65. Aug 30, 2022
  67. Aug 18, 2022
    • Tomas Zvala's avatar
      Add the option to enable default Pod Security Configuration (#9017) · 30c77ea4
      Tomas Zvala authored 
      * Add the option to enable default Pod Security Configuration

Enable Pod Security in all namespaces by default with the option to
exempt some namespaces. Without the change only namespaces explicitly
configured will receive the admission plugin treatment.

* Fix the PR according to code review comments

* Revert the latest changes

- leave the empty file when kube_pod_security_use_default, but add comment explaining the empty file
- don't attempt magic at conditionally adding PodSecurity to kube_apiserver_admission_plugins_needs_configuration
      30c77ea4
  69. Jul 19, 2022
  71. Jul 04, 2022
  73. Jun 28, 2022