k3s-io / k3s

Lightweight Kubernetes
https://k3s.io
Apache License 2.0
28.16k stars 2.35k forks source link

Fix etcd backup/restore test and add guardrail for etcd-snapshot #11314

Open manuelbuil opened 1 week ago

manuelbuil commented 1 week ago

Proposed Changes

This PR does two things: 1 - Fixes the e2e test doing backup/restore from a snapshot. It was failing with:

FATA[0000] cannot perform cluster-reset while server URL is set - remove server from configuration before resetting

When comparing the steps it was following and the documentation, it was indeed wrong. The rest of the servers don't have to run --cluster-reset. When removing the step Resets non bootstrap nodes, the e2e test works again

2 - I must confess that I wasted an hour trying to use k3s etcd-snapshot in a k3s cluster that was not using etcd. When doing that, the error we get is super confusing:

FATA[0000] see server log for details: Unauthorized

However, there is nothing in the logs. The problem is that we are treating a 404 (url does not exist) as Unauthorized https://github.com/k3s-io/k3s/blob/master/pkg/server/router.go#L87. We have been doing that for a long time, so it is probably risky to change that. Therefore, I decided to check if kine.sock exists and db/etcd/config not in the dataDir. If that's the case, we print K3s is not deployed with an etcd datastore

Types of Changes

Test fix + guardrail

Verification

1 - Run the e2e test 2 - Run any k3s etcd-snapshot command without etcd as datastore

Testing

Linked Issues

User-Facing Change

Further Comments

codecov[bot] commented 1 week ago

Codecov Report

Attention: Patch coverage is 72.72727% with 3 lines in your changes missing coverage. Please review.

Project coverage is 42.44%. Comparing base (b93fd98) to head (cd5478f). Report is 3 commits behind head on master.

Files with missing lines Patch % Lines
pkg/cluster/managed.go 72.72% 2 Missing and 1 partial :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #11314 +/- ## ========================================== - Coverage 46.89% 42.44% -4.45% ========================================== Files 179 179 Lines 18587 18610 +23 ========================================== - Hits 8716 7899 -817 - Misses 8518 9505 +987 + Partials 1353 1206 -147 ``` | [Flag](https://app.codecov.io/gh/k3s-io/k3s/pull/11314/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=k3s-io) | Coverage Δ | | |---|---|---| | [e2etests](https://app.codecov.io/gh/k3s-io/k3s/pull/11314/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=k3s-io) | `34.33% <72.72%> (-7.61%)` | :arrow_down: | | [inttests](https://app.codecov.io/gh/k3s-io/k3s/pull/11314/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=k3s-io) | `18.81% <0.00%> (-15.85%)` | :arrow_down: | | [unittests](https://app.codecov.io/gh/k3s-io/k3s/pull/11314/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=k3s-io) | `13.82% <0.00%> (+0.17%)` | :arrow_up: | Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=k3s-io#carryforward-flags-in-the-pull-request-comment) to find out more.

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.


🚨 Try these New Features:

manuelbuil commented 1 week ago
  • Add a default handler in managed.go that is only added if etcd isn't enabled. This is probably technically safer, since it would avoid installing the error handler if etcd is running.

Thanks for the explanation and the suggestion. I took this path, I also agree it is safer

cwayne18 commented 4 days ago

/trivy

github-actions[bot] commented 4 days ago

:x: Trivy scan action failed, check logs :x:

github-actions[bot] commented 4 days ago

:x: Trivy scan action failed, check logs :x:

manuelbuil commented 4 days ago

❌ Trivy scan action failed, check logs ❌

2024-11-21T18:45:05Z    ERROR   [vulndb] Failed to download artifact    repo="ghcr.io/aquasecurity/trivy-db:2" err="OCI repository error: 1 error occurred:\n\t* GET https://ghcr.io/v2/aquasecurity/trivy-db/manifests/2: TOOMANYREQUESTS: retry-after: 324.606µs, allowed: 44000/minute\n\n"

scale up trivy!

github-actions[bot] commented 2 days ago

:star2: No High or Critical CVEs Found :star2: