diff --git a/.go-version b/.go-version index 7bdcec52d093c..eb716f77a7b8d 100644 --- a/.go-version +++ b/.go-version @@ -1 +1 @@ -1.23.12 +1.24.9 diff --git a/CHANGELOG/CHANGELOG-1.31.md b/CHANGELOG/CHANGELOG-1.31.md index b770e6b68eef9..18abac882853d 100644 --- a/CHANGELOG/CHANGELOG-1.31.md +++ b/CHANGELOG/CHANGELOG-1.31.md @@ -1,281 +1,280 @@ -- [v1.31.12](#v13112) - - [Downloads for v1.31.12](#downloads-for-v13112) +- [v1.31.13](#v13113) + - [Downloads for v1.31.13](#downloads-for-v13113) - [Source Code](#source-code) - [Client Binaries](#client-binaries) - [Server Binaries](#server-binaries) - [Node Binaries](#node-binaries) - [Container Images](#container-images) - - [Changelog since v1.31.11](#changelog-since-v13111) - - [Important Security Information](#important-security-information) - - [CVE-2025-5187: Nodes can delete themselves by adding an OwnerReference](#cve-2025-5187-nodes-can-delete-themselves-by-adding-an-ownerreference) + - [Changelog since v1.31.12](#changelog-since-v13112) - [Changes by Kind](#changes-by-kind) - [Feature](#feature) - [Bug or Regression](#bug-or-regression) + - [Other (Cleanup or Flake)](#other-cleanup-or-flake) - [Dependencies](#dependencies) - [Added](#added) - [Changed](#changed) - [Removed](#removed) -- [v1.31.11](#v13111) - - [Downloads for v1.31.11](#downloads-for-v13111) +- [v1.31.12](#v13112) + - [Downloads for v1.31.12](#downloads-for-v13112) - [Source Code](#source-code-1) - [Client Binaries](#client-binaries-1) - [Server Binaries](#server-binaries-1) - [Node Binaries](#node-binaries-1) - [Container Images](#container-images-1) - - [Changelog since v1.31.10](#changelog-since-v13110) + - [Changelog since v1.31.11](#changelog-since-v13111) + - [Important Security Information](#important-security-information) + - [CVE-2025-5187: Nodes can delete themselves by adding an OwnerReference](#cve-2025-5187-nodes-can-delete-themselves-by-adding-an-ownerreference) - [Changes by Kind](#changes-by-kind-1) + - [Feature](#feature-1) - [Bug or Regression](#bug-or-regression-1) - [Dependencies](#dependencies-1) - [Added](#added-1) - [Changed](#changed-1) - [Removed](#removed-1) -- [v1.31.10](#v13110) - - [Downloads for v1.31.10](#downloads-for-v13110) +- [v1.31.11](#v13111) + - [Downloads for v1.31.11](#downloads-for-v13111) - [Source Code](#source-code-2) - [Client Binaries](#client-binaries-2) - [Server Binaries](#server-binaries-2) - [Node Binaries](#node-binaries-2) - [Container Images](#container-images-2) - - [Changelog since v1.31.9](#changelog-since-v1319) + - [Changelog since v1.31.10](#changelog-since-v13110) - [Changes by Kind](#changes-by-kind-2) - - [Feature](#feature-1) - [Bug or Regression](#bug-or-regression-2) - - [Other (Cleanup or Flake)](#other-cleanup-or-flake) - [Dependencies](#dependencies-2) - [Added](#added-2) - [Changed](#changed-2) - [Removed](#removed-2) -- [v1.31.9](#v1319) - - [Downloads for v1.31.9](#downloads-for-v1319) +- [v1.31.10](#v13110) + - [Downloads for v1.31.10](#downloads-for-v13110) - [Source Code](#source-code-3) - [Client Binaries](#client-binaries-3) - [Server Binaries](#server-binaries-3) - [Node Binaries](#node-binaries-3) - [Container Images](#container-images-3) - - [Changelog since v1.31.8](#changelog-since-v1318) + - [Changelog since v1.31.9](#changelog-since-v1319) - [Changes by Kind](#changes-by-kind-3) - [Feature](#feature-2) - [Bug or Regression](#bug-or-regression-3) + - [Other (Cleanup or Flake)](#other-cleanup-or-flake-1) - [Dependencies](#dependencies-3) - [Added](#added-3) - [Changed](#changed-3) - [Removed](#removed-3) -- [v1.31.8](#v1318) - - [Downloads for v1.31.8](#downloads-for-v1318) +- [v1.31.9](#v1319) + - [Downloads for v1.31.9](#downloads-for-v1319) - [Source Code](#source-code-4) - [Client Binaries](#client-binaries-4) - [Server Binaries](#server-binaries-4) - [Node Binaries](#node-binaries-4) - [Container Images](#container-images-4) - - [Changelog since v1.31.7](#changelog-since-v1317) + - [Changelog since v1.31.8](#changelog-since-v1318) - [Changes by Kind](#changes-by-kind-4) + - [Feature](#feature-3) - [Bug or Regression](#bug-or-regression-4) - [Dependencies](#dependencies-4) - [Added](#added-4) - [Changed](#changed-4) - [Removed](#removed-4) -- [v1.31.7](#v1317) - - [Downloads for v1.31.7](#downloads-for-v1317) +- [v1.31.8](#v1318) + - [Downloads for v1.31.8](#downloads-for-v1318) - [Source Code](#source-code-5) - [Client Binaries](#client-binaries-5) - [Server Binaries](#server-binaries-5) - [Node Binaries](#node-binaries-5) - [Container Images](#container-images-5) - - [Changelog since v1.31.6](#changelog-since-v1316) + - [Changelog since v1.31.7](#changelog-since-v1317) - [Changes by Kind](#changes-by-kind-5) - [Bug or Regression](#bug-or-regression-5) - - [Other (Cleanup or Flake)](#other-cleanup-or-flake-1) - [Dependencies](#dependencies-5) - [Added](#added-5) - [Changed](#changed-5) - [Removed](#removed-5) -- [v1.31.6](#v1316) - - [Downloads for v1.31.6](#downloads-for-v1316) +- [v1.31.7](#v1317) + - [Downloads for v1.31.7](#downloads-for-v1317) - [Source Code](#source-code-6) - [Client Binaries](#client-binaries-6) - [Server Binaries](#server-binaries-6) - [Node Binaries](#node-binaries-6) - [Container Images](#container-images-6) - - [Changelog since v1.31.5](#changelog-since-v1315) - - [Important Security Information](#important-security-information-1) - - [CVE-2025-0426: Node Denial of Service via Kubelet Checkpoint API](#cve-2025-0426-node-denial-of-service-via-kubelet-checkpoint-api) + - [Changelog since v1.31.6](#changelog-since-v1316) - [Changes by Kind](#changes-by-kind-6) - - [Feature](#feature-3) - [Bug or Regression](#bug-or-regression-6) - [Other (Cleanup or Flake)](#other-cleanup-or-flake-2) - [Dependencies](#dependencies-6) - [Added](#added-6) - [Changed](#changed-6) - [Removed](#removed-6) -- [v1.31.5](#v1315) - - [Downloads for v1.31.5](#downloads-for-v1315) +- [v1.31.6](#v1316) + - [Downloads for v1.31.6](#downloads-for-v1316) - [Source Code](#source-code-7) - [Client Binaries](#client-binaries-7) - [Server Binaries](#server-binaries-7) - [Node Binaries](#node-binaries-7) - [Container Images](#container-images-7) - - [Changelog since v1.31.4](#changelog-since-v1314) - - [Important Security Information](#important-security-information-2) - - [CVE-2024-9042: Command Injection affecting Windows nodes via nodes/*/logs/query API](#cve-2024-9042-command-injection-affecting-windows-nodes-via-nodeslogsquery-api) + - [Changelog since v1.31.5](#changelog-since-v1315) + - [Important Security Information](#important-security-information-1) + - [CVE-2025-0426: Node Denial of Service via Kubelet Checkpoint API](#cve-2025-0426-node-denial-of-service-via-kubelet-checkpoint-api) - [Changes by Kind](#changes-by-kind-7) - - [API Change](#api-change) - [Feature](#feature-4) - [Bug or Regression](#bug-or-regression-7) + - [Other (Cleanup or Flake)](#other-cleanup-or-flake-3) - [Dependencies](#dependencies-7) - [Added](#added-7) - [Changed](#changed-7) - [Removed](#removed-7) -- [v1.31.4](#v1314) - - [Downloads for v1.31.4](#downloads-for-v1314) +- [v1.31.5](#v1315) + - [Downloads for v1.31.5](#downloads-for-v1315) - [Source Code](#source-code-8) - [Client Binaries](#client-binaries-8) - [Server Binaries](#server-binaries-8) - [Node Binaries](#node-binaries-8) - [Container Images](#container-images-8) - - [Changelog since v1.31.3](#changelog-since-v1313) + - [Changelog since v1.31.4](#changelog-since-v1314) + - [Important Security Information](#important-security-information-2) + - [CVE-2024-9042: Command Injection affecting Windows nodes via nodes/*/logs/query API](#cve-2024-9042-command-injection-affecting-windows-nodes-via-nodeslogsquery-api) - [Changes by Kind](#changes-by-kind-8) + - [API Change](#api-change) - [Feature](#feature-5) - [Bug or Regression](#bug-or-regression-8) - [Dependencies](#dependencies-8) - [Added](#added-8) - [Changed](#changed-8) - [Removed](#removed-8) -- [v1.31.3](#v1313) - - [Downloads for v1.31.3](#downloads-for-v1313) +- [v1.31.4](#v1314) + - [Downloads for v1.31.4](#downloads-for-v1314) - [Source Code](#source-code-9) - [Client Binaries](#client-binaries-9) - [Server Binaries](#server-binaries-9) - [Node Binaries](#node-binaries-9) - [Container Images](#container-images-9) - - [Changelog since v1.31.2](#changelog-since-v1312) + - [Changelog since v1.31.3](#changelog-since-v1313) - [Changes by Kind](#changes-by-kind-9) + - [Feature](#feature-6) - [Bug or Regression](#bug-or-regression-9) - [Dependencies](#dependencies-9) - [Added](#added-9) - [Changed](#changed-9) - [Removed](#removed-9) -- [v1.31.2](#v1312) - - [Downloads for v1.31.2](#downloads-for-v1312) +- [v1.31.3](#v1313) + - [Downloads for v1.31.3](#downloads-for-v1313) - [Source Code](#source-code-10) - [Client Binaries](#client-binaries-10) - [Server Binaries](#server-binaries-10) - [Node Binaries](#node-binaries-10) - [Container Images](#container-images-10) - - [Changelog since v1.31.1](#changelog-since-v1311) + - [Changelog since v1.31.2](#changelog-since-v1312) - [Changes by Kind](#changes-by-kind-10) - - [Feature](#feature-6) - [Bug or Regression](#bug-or-regression-10) - - [Other (Cleanup or Flake)](#other-cleanup-or-flake-3) - - [Uncategorized](#uncategorized) - [Dependencies](#dependencies-10) - [Added](#added-10) - [Changed](#changed-10) - [Removed](#removed-10) -- [v1.31.1](#v1311) - - [Downloads for v1.31.1](#downloads-for-v1311) +- [v1.31.2](#v1312) + - [Downloads for v1.31.2](#downloads-for-v1312) - [Source Code](#source-code-11) - [Client Binaries](#client-binaries-11) - [Server Binaries](#server-binaries-11) - [Node Binaries](#node-binaries-11) - [Container Images](#container-images-11) - - [Changelog since v1.31.0](#changelog-since-v1310) + - [Changelog since v1.31.1](#changelog-since-v1311) - [Changes by Kind](#changes-by-kind-11) - - [Deprecation](#deprecation) - - [API Change](#api-change-1) - [Feature](#feature-7) - [Bug or Regression](#bug-or-regression-11) - [Other (Cleanup or Flake)](#other-cleanup-or-flake-4) + - [Uncategorized](#uncategorized) - [Dependencies](#dependencies-11) - [Added](#added-11) - [Changed](#changed-11) - [Removed](#removed-11) -- [v1.31.0](#v1310) - - [Downloads for v1.31.0](#downloads-for-v1310) +- [v1.31.1](#v1311) + - [Downloads for v1.31.1](#downloads-for-v1311) - [Source Code](#source-code-12) - [Client Binaries](#client-binaries-12) - [Server Binaries](#server-binaries-12) - [Node Binaries](#node-binaries-12) - [Container Images](#container-images-12) - - [Changelog since v1.30.0](#changelog-since-v1300) - - [Urgent Upgrade Notes](#urgent-upgrade-notes) - - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade) + - [Changelog since v1.31.0](#changelog-since-v1310) - [Changes by Kind](#changes-by-kind-12) - - [Deprecation](#deprecation-1) - - [API Change](#api-change-2) + - [Deprecation](#deprecation) + - [API Change](#api-change-1) - [Feature](#feature-8) - - [Failing Test](#failing-test) - [Bug or Regression](#bug-or-regression-12) - [Other (Cleanup or Flake)](#other-cleanup-or-flake-5) - [Dependencies](#dependencies-12) - [Added](#added-12) - [Changed](#changed-12) - [Removed](#removed-12) -- [v1.31.0-rc.1](#v1310-rc1) - - [Downloads for v1.31.0-rc.1](#downloads-for-v1310-rc1) +- [v1.31.0](#v1310) + - [Downloads for v1.31.0](#downloads-for-v1310) - [Source Code](#source-code-13) - [Client Binaries](#client-binaries-13) - [Server Binaries](#server-binaries-13) - [Node Binaries](#node-binaries-13) - [Container Images](#container-images-13) - - [Changelog since v1.31.0-rc.0](#changelog-since-v1310-rc0) + - [Changelog since v1.30.0](#changelog-since-v1300) + - [Urgent Upgrade Notes](#urgent-upgrade-notes) + - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade) - [Changes by Kind](#changes-by-kind-13) - - [API Change](#api-change-3) + - [Deprecation](#deprecation-1) + - [API Change](#api-change-2) - [Feature](#feature-9) + - [Failing Test](#failing-test) - [Bug or Regression](#bug-or-regression-13) + - [Other (Cleanup or Flake)](#other-cleanup-or-flake-6) - [Dependencies](#dependencies-13) - [Added](#added-13) - [Changed](#changed-13) - [Removed](#removed-13) -- [v1.31.0-rc.0](#v1310-rc0) - - [Downloads for v1.31.0-rc.0](#downloads-for-v1310-rc0) +- [v1.31.0-rc.1](#v1310-rc1) + - [Downloads for v1.31.0-rc.1](#downloads-for-v1310-rc1) - [Source Code](#source-code-14) - [Client Binaries](#client-binaries-14) - [Server Binaries](#server-binaries-14) - [Node Binaries](#node-binaries-14) - [Container Images](#container-images-14) - - [Changelog since v1.31.0-beta.0](#changelog-since-v1310-beta0) - - [Urgent Upgrade Notes](#urgent-upgrade-notes-1) - - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade-1) + - [Changelog since v1.31.0-rc.0](#changelog-since-v1310-rc0) - [Changes by Kind](#changes-by-kind-14) - - [Deprecation](#deprecation-2) - - [API Change](#api-change-4) + - [API Change](#api-change-3) - [Feature](#feature-10) - - [Failing Test](#failing-test-1) - [Bug or Regression](#bug-or-regression-14) - - [Other (Cleanup or Flake)](#other-cleanup-or-flake-6) - [Dependencies](#dependencies-14) - [Added](#added-14) - [Changed](#changed-14) - [Removed](#removed-14) -- [v1.31.0-beta.0](#v1310-beta0) - - [Downloads for v1.31.0-beta.0](#downloads-for-v1310-beta0) +- [v1.31.0-rc.0](#v1310-rc0) + - [Downloads for v1.31.0-rc.0](#downloads-for-v1310-rc0) - [Source Code](#source-code-15) - [Client Binaries](#client-binaries-15) - [Server Binaries](#server-binaries-15) - [Node Binaries](#node-binaries-15) - [Container Images](#container-images-15) - - [Changelog since v1.31.0-alpha.3](#changelog-since-v1310-alpha3) + - [Changelog since v1.31.0-beta.0](#changelog-since-v1310-beta0) + - [Urgent Upgrade Notes](#urgent-upgrade-notes-1) + - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade-1) - [Changes by Kind](#changes-by-kind-15) - - [API Change](#api-change-5) + - [Deprecation](#deprecation-2) + - [API Change](#api-change-4) - [Feature](#feature-11) + - [Failing Test](#failing-test-1) - [Bug or Regression](#bug-or-regression-15) - [Other (Cleanup or Flake)](#other-cleanup-or-flake-7) - [Dependencies](#dependencies-15) - [Added](#added-15) - [Changed](#changed-15) - [Removed](#removed-15) -- [v1.31.0-alpha.3](#v1310-alpha3) - - [Downloads for v1.31.0-alpha.3](#downloads-for-v1310-alpha3) +- [v1.31.0-beta.0](#v1310-beta0) + - [Downloads for v1.31.0-beta.0](#downloads-for-v1310-beta0) - [Source Code](#source-code-16) - [Client Binaries](#client-binaries-16) - [Server Binaries](#server-binaries-16) - [Node Binaries](#node-binaries-16) - [Container Images](#container-images-16) - - [Changelog since v1.31.0-alpha.2](#changelog-since-v1310-alpha2) + - [Changelog since v1.31.0-alpha.3](#changelog-since-v1310-alpha3) - [Changes by Kind](#changes-by-kind-16) - - [API Change](#api-change-6) + - [API Change](#api-change-5) - [Feature](#feature-12) - [Bug or Regression](#bug-or-regression-16) - [Other (Cleanup or Flake)](#other-cleanup-or-flake-8) @@ -283,50 +282,160 @@ - [Added](#added-16) - [Changed](#changed-16) - [Removed](#removed-16) -- [v1.31.0-alpha.2](#v1310-alpha2) - - [Downloads for v1.31.0-alpha.2](#downloads-for-v1310-alpha2) +- [v1.31.0-alpha.3](#v1310-alpha3) + - [Downloads for v1.31.0-alpha.3](#downloads-for-v1310-alpha3) - [Source Code](#source-code-17) - [Client Binaries](#client-binaries-17) - [Server Binaries](#server-binaries-17) - [Node Binaries](#node-binaries-17) - [Container Images](#container-images-17) - - [Changelog since v1.31.0-alpha.1](#changelog-since-v1310-alpha1) - - [Urgent Upgrade Notes](#urgent-upgrade-notes-2) - - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade-2) + - [Changelog since v1.31.0-alpha.2](#changelog-since-v1310-alpha2) - [Changes by Kind](#changes-by-kind-17) - - [API Change](#api-change-7) + - [API Change](#api-change-6) - [Feature](#feature-13) - - [Failing Test](#failing-test-2) - [Bug or Regression](#bug-or-regression-17) - [Other (Cleanup or Flake)](#other-cleanup-or-flake-9) - [Dependencies](#dependencies-17) - [Added](#added-17) - [Changed](#changed-17) - [Removed](#removed-17) -- [v1.31.0-alpha.1](#v1310-alpha1) - - [Downloads for v1.31.0-alpha.1](#downloads-for-v1310-alpha1) +- [v1.31.0-alpha.2](#v1310-alpha2) + - [Downloads for v1.31.0-alpha.2](#downloads-for-v1310-alpha2) - [Source Code](#source-code-18) - [Client Binaries](#client-binaries-18) - [Server Binaries](#server-binaries-18) - [Node Binaries](#node-binaries-18) - [Container Images](#container-images-18) - - [Changelog since v1.30.0](#changelog-since-v1300-1) - - [Urgent Upgrade Notes](#urgent-upgrade-notes-3) - - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade-3) + - [Changelog since v1.31.0-alpha.1](#changelog-since-v1310-alpha1) + - [Urgent Upgrade Notes](#urgent-upgrade-notes-2) + - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade-2) - [Changes by Kind](#changes-by-kind-18) - - [Deprecation](#deprecation-3) - - [API Change](#api-change-8) + - [API Change](#api-change-7) - [Feature](#feature-14) - - [Failing Test](#failing-test-3) + - [Failing Test](#failing-test-2) - [Bug or Regression](#bug-or-regression-18) - [Other (Cleanup or Flake)](#other-cleanup-or-flake-10) - [Dependencies](#dependencies-18) - [Added](#added-18) - [Changed](#changed-18) - [Removed](#removed-18) +- [v1.31.0-alpha.1](#v1310-alpha1) + - [Downloads for v1.31.0-alpha.1](#downloads-for-v1310-alpha1) + - [Source Code](#source-code-19) + - [Client Binaries](#client-binaries-19) + - [Server Binaries](#server-binaries-19) + - [Node Binaries](#node-binaries-19) + - [Container Images](#container-images-19) + - [Changelog since v1.30.0](#changelog-since-v1300-1) + - [Urgent Upgrade Notes](#urgent-upgrade-notes-3) + - [(No, really, you MUST read this before you upgrade)](#no-really-you-must-read-this-before-you-upgrade-3) + - [Changes by Kind](#changes-by-kind-19) + - [Deprecation](#deprecation-3) + - [API Change](#api-change-8) + - [Feature](#feature-15) + - [Failing Test](#failing-test-3) + - [Bug or Regression](#bug-or-regression-19) + - [Other (Cleanup or Flake)](#other-cleanup-or-flake-11) + - [Dependencies](#dependencies-19) + - [Added](#added-19) + - [Changed](#changed-19) + - [Removed](#removed-19) +# v1.31.13 + + +## Downloads for v1.31.13 + + + +### Source Code + +filename | sha512 hash +-------- | ----------- +[kubernetes.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes.tar.gz) | 6a5461586f7d1317b444792dca5cc1b8fec524ae2a4dba3561d1f45aed22074765f29916293bfd0466c348e4734ad4b0ff1adecb849e1595554a4e2e454dbc56 +[kubernetes-src.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-src.tar.gz) | f88da6525ac8a3e1656579f11c0756e56650e658f4136209e31d49cebb2c5e5ecf934ce64c9e73c9499b55e0bba7fd918537db3f17052fa04433f58fe9d37227 + +### Client Binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-client-darwin-amd64.tar.gz) | 4ab09bba9e5cf82bb904c03acb736a5bd693b045df915677f491aa0957f42358800db001b83c7506f1853e0b4c140aad461f70684335a43fff157263035e2ccc +[kubernetes-client-darwin-arm64.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-client-darwin-arm64.tar.gz) | 02ce81d68db07f9f97cd7505dc16bade39615f93ce0b82edbc36bee182b0f3360bfa7bc5220799aaa3577c11e83c849b1a3226836dba4d10ad04c02290d5cce9 +[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-client-linux-386.tar.gz) | 35dd9fb210de771184621c0cbdcb97858cfaac0ec76030feec7ccc41a830720d824bf27ad9c635c8a5423238afe53bd1026a9e117f9cca11767dfb12a1de2de6 +[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-client-linux-amd64.tar.gz) | 724a8082d31664e70320f954564548ab222bf9a60b5a117456e93c56d0e8c921fe427dc639e25f5d256d4886aff61ef74a2fe535dc1873e56a681cc62a322610 +[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-client-linux-arm.tar.gz) | 8858d6ddc5ae83345704b2c4e8dad1a8a097c37b0655824989e6ac5c307a4f3f003074dc59f041b7dcef16fa2ec6d5cb5b7043153a86e728c1e1c7faee53fb9e +[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-client-linux-arm64.tar.gz) | d275c20fd3e0c17511a294e352247794063bb2f8ab15713f9db7b6d0b771574736f7986debea51c59c8aecec312c8caf4c76cebf7ca7d070397ba0c460dda5d6 +[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-client-linux-ppc64le.tar.gz) | 6d0def56bc875519eecfe3335f3d6ac6dbd498f40e6ce2f153db793e370b0afcaf797e96f3c794ba7ee377a620e1a4742358095333a9cc4858183833a3acb1ed +[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-client-linux-s390x.tar.gz) | 955dd96156e91d6bb5d1f42cb3907f87b7484e6524141ae7aa5125c02ef1cf68e21413bbcefcb2662532a8fa2796c08942fe7e03b89453b00104134c43ccfbd6 +[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-client-windows-386.tar.gz) | 66cd33ed9bc1acff3df2cc9088ad28766cc78ebe22bf481a6a8bca59e02cf75ce5e907499de9c249d16ee8f820155d62d1d9aa3dc3c43f039477cab32ff69ca8 +[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-client-windows-amd64.tar.gz) | ff707576b7ba9dfe7abcc1998633946f343d438883557cfdc7f210dbb33518d9e63fa23bb35977054080abc24497b5b7c086cc03cd4e95ef57c5f8b2cc54ab13 +[kubernetes-client-windows-arm64.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-client-windows-arm64.tar.gz) | 81f276e6ad6e25301225b532573be1510fe16979da9cdbf953dfd916198345a9cd44e3873703227774fe3f15c3698735407516477951b6f698adf904d35c300b + +### Server Binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-server-linux-amd64.tar.gz) | a88d6e147f3e82ea57f8cc7257c7f1aae3928caa5421c141d09752d089932ca9ceb73341d0420768ef1d49663c828bbebc1c4a2e0479d2b784094f390c6c6c6e +[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-server-linux-arm64.tar.gz) | 88e0eff7da9ee15511784103f6bda284dec8a8317a1499dc68b25e4862bfd9b6bb3d51ac64971fd57a5558582425c8a1d528b94b7cb787e26067fb1d81f3e35d +[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-server-linux-ppc64le.tar.gz) | 0828b289b3303b20d38ca20ba869e12db15b2ddced920eca8d233376b612d3ebfa2abadbf7e6fa83e2d67a200ad10c67db9c7d0832690366dff4754ebde84769 +[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-server-linux-s390x.tar.gz) | 16abbde3e57583dc8b9607941b56e81b13e885e726315a8f7cafb3be45538c9f1bd77a30347153d364cb0278598c937090018aadeba8e93e9279448288e39d34 + +### Node Binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-node-linux-amd64.tar.gz) | dee47bd8e8c1b6a1c58ccb0b58d19abc40968c5c6650b8a5cb9d642e3cfadfe6fb110408857abc5b32c90c89c39b90b06ebf2c1640ebec9fbaeffea80caa8d82 +[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-node-linux-arm64.tar.gz) | f0da7e0ae7b7d209659338a7bb17eec9deb0dbe6edec8f98946a9e68078b6fd2977f65cccf68dcfe5a359a6ea728f036fa2801944ed697d81f58c3d26cd100e8 +[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-node-linux-ppc64le.tar.gz) | 66e254839eb2f1ebd859668ddb5b52bb33b9c274c4ee391d12633dce46c80243173a145197b12673a40c19e5121f099968ce7ca9b025b9ed5e96fbca6bc8e0c6 +[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-node-linux-s390x.tar.gz) | 55b0ef086db62ec49472c38774d0a3a8b21101822e5e087dffb5698e284d4a022ff5bb807bb07f87d2bc115fbecef8158ee275c557d7d166b81c3c416a89fcd0 +[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.31.13/kubernetes-node-windows-amd64.tar.gz) | 1f8f0c6aa8b0d251398fe8e068ac6ba32a5a0a9223540ad79c0e8d46c7bfb9c9d444a2d73a7b1d1026e4192b0914f0389ea743f2783ce261991363a30bb94346 + +### Container Images + +All container images are available as manifest lists and support the described +architectures. It is also possible to pull a specific architecture directly by +adding the "-$ARCH" suffix to the container image name. + +name | architectures +---- | ------------- +[registry.k8s.io/conformance:v1.31.13](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/conformance) | [amd64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/conformance-amd64), [arm64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/conformance-arm64), [ppc64le](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/conformance-ppc64le), [s390x](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/conformance-s390x) +[registry.k8s.io/kube-apiserver:v1.31.13](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-apiserver) | [amd64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-apiserver-amd64), [arm64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-apiserver-arm64), [ppc64le](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-apiserver-ppc64le), [s390x](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-apiserver-s390x) +[registry.k8s.io/kube-controller-manager:v1.31.13](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-controller-manager) | [amd64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-controller-manager-amd64), [arm64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-controller-manager-arm64), [ppc64le](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-controller-manager-ppc64le), [s390x](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-controller-manager-s390x) +[registry.k8s.io/kube-proxy:v1.31.13](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-proxy) | [amd64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-proxy-amd64), [arm64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-proxy-arm64), [ppc64le](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-proxy-ppc64le), [s390x](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-proxy-s390x) +[registry.k8s.io/kube-scheduler:v1.31.13](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-scheduler) | [amd64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-scheduler-amd64), [arm64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-scheduler-arm64), [ppc64le](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-scheduler-ppc64le), [s390x](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kube-scheduler-s390x) +[registry.k8s.io/kubectl:v1.31.13](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kubectl) | [amd64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kubectl-amd64), [arm64](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kubectl-arm64), [ppc64le](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kubectl-ppc64le), [s390x](https://console.cloud.google.com/artifacts/docker/k8s-artifacts-prod/southamerica-east1/images/kubectl-s390x) + +## Changelog since v1.31.12 + +## Changes by Kind + +### Feature + +- Kubernetes is now built using Go 1.23.12 ([#133517](https://github.com/kubernetes/kubernetes/pull/133517), [@cpanato](https://github.com/cpanato)) [SIG Release and Testing] + +### Bug or Regression + +- Kubeadm: fixed bug where v1beta3's ClusterConfiguration.APIServer.TimeoutForControlPlane is not respected in newer versions of kubeadm where v1beta4 is the default. ([#133776](https://github.com/kubernetes/kubernetes/pull/133776), [@HirazawaUi](https://github.com/HirazawaUi)) [SIG Cluster Lifecycle] + +### Other (Cleanup or Flake) + +- Masked off access to Linux thermal interrupt info in `/proc` and `/sys`. ([#132987](https://github.com/kubernetes/kubernetes/pull/132987), [@saschagrunert](https://github.com/saschagrunert)) [SIG Node] + +## Dependencies + +### Added +_Nothing has changed._ + +### Changed +_Nothing has changed._ + +### Removed +_Nothing has changed._ + + + # v1.31.12 diff --git a/build/build-image/cross/VERSION b/build/build-image/cross/VERSION index 4908e0002d466..ac7840e901231 100644 --- a/build/build-image/cross/VERSION +++ b/build/build-image/cross/VERSION @@ -1 +1 @@ -v1.31.0-go1.23.12-bullseye.0 +v1.31.0-go1.24.9-bullseye.0 diff --git a/build/common.sh b/build/common.sh index e767ce4fa476c..e2850cdc5f4a1 100755 --- a/build/common.sh +++ b/build/common.sh @@ -97,9 +97,9 @@ readonly KUBE_RSYNC_PORT="${KUBE_RSYNC_PORT:-}" readonly KUBE_CONTAINER_RSYNC_PORT=8730 # These are the default versions (image tags) for their respective base images. -readonly __default_distroless_iptables_version=v0.6.13 -readonly __default_go_runner_version=v2.4.0-go1.23.12-bookworm.0 -readonly __default_setcap_version=bookworm-v1.0.3 +readonly __default_distroless_iptables_version=v0.7.11 +readonly __default_go_runner_version=v2.4.0-go1.24.9-bookworm.0 +readonly __default_setcap_version=bookworm-v1.0.6 # These are the base images for the Docker-wrapped binaries. readonly KUBE_GORUNNER_IMAGE="${KUBE_GORUNNER_IMAGE:-$KUBE_BASE_IMAGE_REGISTRY/go-runner:$__default_go_runner_version}" diff --git a/build/dependencies.yaml b/build/dependencies.yaml index 0ba70638049d7..70fc9a6290cf1 100644 --- a/build/dependencies.yaml +++ b/build/dependencies.yaml @@ -64,7 +64,7 @@ dependencies: # etcd - name: "etcd" - version: 3.5.15 + version: 3.5.24 refPaths: - path: cluster/gce/manifests/etcd.manifest match: etcd_docker_tag|etcd_version @@ -74,10 +74,6 @@ dependencies: match: DefaultEtcdVersion = - path: hack/lib/etcd.sh match: ETCD_VERSION= - - path: staging/src/k8s.io/sample-apiserver/artifacts/example/deployment.yaml - match: gcr.io/etcd-development/etcd - - path: test/utils/image/manifest.go - match: configs\[Etcd\] = Config{list\.GcEtcdRegistry, "etcd", "\d+\.\d+.\d+(-(alpha|beta|rc).\d+)?(-\d+)?"} - name: "etcd-image" version: 3.5.15 @@ -116,7 +112,7 @@ dependencies: # Golang - name: "golang: upstream version" - version: 1.23.12 + version: 1.24.9 refPaths: - path: .go-version - path: build/build-image/cross/VERSION @@ -131,7 +127,7 @@ dependencies: # This entry is a stub of the major version to allow dependency checks to # pass when building Kubernetes using a pre-release of Golang. - name: "golang: 1." - version: 1.23 + version: 1.24 refPaths: - path: build/build-image/cross/VERSION # Disabled since incrementing from the original go minor for this release branch @@ -139,13 +135,13 @@ dependencies: # match: minimum_go_version=go([0-9]+\.[0-9]+) - name: "registry.k8s.io/kube-cross: dependents" - version: v1.31.0-go1.23.12-bullseye.0 + version: v1.31.0-go1.24.9-bullseye.0 refPaths: - path: build/build-image/cross/VERSION # Base images - name: "registry.k8s.io/debian-base: dependents" - version: bookworm-v1.0.3 + version: bookworm-v1.0.6 refPaths: - path: cluster/images/etcd/Makefile match: BASEIMAGE\?\=registry\.k8s\.io\/build-image\/debian-base:[a-zA-Z]+\-v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?) @@ -177,7 +173,7 @@ dependencies: match: registry\.k8s\.io\/build-image\/debian-base:[a-zA-Z]+\-v((([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?)(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?) - name: "registry.k8s.io/distroless-iptables: dependents" - version: v0.6.13 + version: v0.7.11 refPaths: - path: build/common.sh match: __default_distroless_iptables_version= @@ -185,7 +181,7 @@ dependencies: match: configs\[DistrolessIptables\] = Config{list\.BuildImageRegistry, "distroless-iptables", "v([0-9]+)\.([0-9]+)\.([0-9]+)"} - name: "registry.k8s.io/go-runner: dependents" - version: v2.4.0-go1.23.12-bookworm.0 + version: v2.4.0-go1.24.9-bookworm.0 refPaths: - path: build/common.sh match: __default_go_runner_version= @@ -245,7 +241,7 @@ dependencies: match: configs\[Pause\] = Config{list\.GcRegistry, "pause", "\d+\.\d+(.\d+)?"} - name: "registry.k8s.io/build-image/setcap: dependents" - version: bookworm-v1.0.3 + version: bookworm-v1.0.6 refPaths: - path: build/common.sh match: __default_setcap_version= diff --git a/cluster/common.sh b/cluster/common.sh index 448b3fe1218bb..1111f5ef418ee 100755 --- a/cluster/common.sh +++ b/cluster/common.sh @@ -481,13 +481,13 @@ EOF ;; server) echo "Generate server certificates..." - echo '{"CN":"'"${member_ip}"'","hosts":[""],"key":{"algo":"ecdsa","size":256}}' \ + echo '{"CN":"'"${member_ip}"'","hosts":[],"key":{"algo":"ecdsa","size":256}}' \ | ${CFSSL_BIN} gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=server -hostname="${member_ip},127.0.0.1" - \ | ${CFSSLJSON_BIN} -bare "${prefix}" ;; peer) echo "Generate peer certificates..." - echo '{"CN":"'"${member_ip}"'","hosts":[""],"key":{"algo":"ecdsa","size":256}}' \ + echo '{"CN":"'"${member_ip}"'","hosts":[],"key":{"algo":"ecdsa","size":256}}' \ | ${CFSSL_BIN} gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=peer -hostname="${member_ip},127.0.0.1" - \ | ${CFSSLJSON_BIN} -bare "${prefix}" ;; diff --git a/cluster/gce/gci/configure-helper.sh b/cluster/gce/gci/configure-helper.sh index 3e04dc52d6b75..6d8fa0af13943 100755 --- a/cluster/gce/gci/configure-helper.sh +++ b/cluster/gce/gci/configure-helper.sh @@ -1955,10 +1955,14 @@ def resolve(host): fi sed -i -e "s@{{ *etcd_protocol *}}@$etcd_protocol@g" "${temp_file}" sed -i -e "s@{{ *etcd_apiserver_protocol *}}@$etcd_apiserver_protocol@g" "${temp_file}" - sed -i -e "s@{{ *etcd_creds *}}@$etcd_creds@g" "${temp_file}" + + etcd_creds_and_extra_args="${etcd_creds} ${etcd_apiserver_creds} ${etcd_extra_args}" + etcd_creds_and_extra_args=$(echo "$etcd_creds_and_extra_args" | awk '{for (i=1;i<=NF;i++) printf "\"%s\"%s", $i, (i>/var/log/etcd{{ suffix }}.log 2>&1; fi; exec /usr/local/bin/etcd --name etcd-{{ hostname }} --listen-peer-urls {{ etcd_protocol }}://{{ host_ip }}:{{ server_port }} --initial-advertise-peer-urls {{ etcd_protocol }}://{{ hostname }}:{{ server_port }} --advertise-client-urls {{ etcd_apiserver_protocol }}://127.0.0.1:{{ port }} --listen-client-urls {{ etcd_apiserver_protocol }}://{{ listen_client_ip }}:{{ port }} {{ quota_bytes }} --data-dir /var/etcd/data{{ suffix }} --initial-cluster-state {{ cluster_state }} --initial-cluster {{ etcd_cluster }} {{ etcd_creds }} {{ etcd_apiserver_creds }} {{ etcd_extra_args }} 1>>/var/log/etcd{{ suffix }}.log 2>&1" - ], + "/usr/local/bin/etcd", + "--name=etcd-{{ hostname }}", + "--listen-peer-urls={{ etcd_protocol }}://{{ host_ip }}:{{ server_port }}", + "--initial-advertise-peer-urls={{ etcd_protocol }}://{{ hostname }}:{{ server_port }}", + "--advertise-client-urls={{ etcd_apiserver_protocol }}://127.0.0.1:{{ port }}", + "--listen-client-urls={{ etcd_apiserver_protocol }}://{{ listen_client_ip }}:{{ port }}", + "{{ quota_bytes }}", + "--data-dir=/var/etcd/data{{ suffix }}", + "--initial-cluster-state={{ cluster_state }}", + "--initial-cluster={{ etcd_cluster }}", + "--log-outputs=/var/log/etcd{{ suffix }}.log", + {{ etcd_creds_and_extra_args }} + ], "env": [ { "name": "TARGET_STORAGE", "value": "{{ pillar.get('storage_backend', 'etcd3') }}" }, { "name": "TARGET_VERSION", - "value": "{{ pillar.get('etcd_version', '3.5.15') }}" + "value": "{{ pillar.get('etcd_version', '3.5.24') }}" }, { "name": "DO_NOT_MOVE_BINARIES", @@ -52,12 +61,6 @@ { "name": "INITIAL_ADVERTISE_PEER_URLS", "value": "{{ etcd_protocol }}://{{ hostname }}:{{ server_port }}" }, - { "name": "ETCD_CREDS", - "value": "{{ etcd_creds }}" - }, - { "name": "ETCD_APISERVER_CREDS", - "value": "{{ etcd_apiserver_creds }}" - }, { "name": "ETCD_SNAPSHOT_COUNT", "value": "10000" }, @@ -72,9 +75,12 @@ "livenessProbe": { "exec": { "command": [ - "/bin/sh", - "-c", - "set -x; exec /usr/local/bin/etcdctl --endpoints=127.0.0.1:{{ port }} {{ etcdctl_certs }} --command-timeout=15s endpoint health" + "/usr/local/bin/etcdctl", + "--endpoints=127.0.0.1:{{ port }}", + "--command-timeout=15s", + {{ etcdctl_certs }} + "endpoint", + "health" ] }, "initialDelaySeconds": {{ liveness_probe_initial_delay }}, diff --git a/cluster/gce/upgrade-aliases.sh b/cluster/gce/upgrade-aliases.sh index abe1dc73b09da..6dab64ce5d701 100755 --- a/cluster/gce/upgrade-aliases.sh +++ b/cluster/gce/upgrade-aliases.sh @@ -170,8 +170,8 @@ export KUBE_GCE_ENABLE_IP_ALIASES=true export SECONDARY_RANGE_NAME="pods-default" export STORAGE_BACKEND="etcd3" export STORAGE_MEDIA_TYPE="application/vnd.kubernetes.protobuf" -export ETCD_IMAGE=3.5.15-0 -export ETCD_VERSION=3.5.15 +export ETCD_IMAGE=3.5.24-0 +export ETCD_VERSION=3.5.24 # Upgrade master with updated kube envs "${KUBE_ROOT}/cluster/gce/upgrade.sh" -M -l diff --git a/cluster/gce/util.sh b/cluster/gce/util.sh index f6ecf40e6793c..43f51c03660a3 100755 --- a/cluster/gce/util.sh +++ b/cluster/gce/util.sh @@ -1838,7 +1838,7 @@ function generate-certs { # make the config for the signer echo '{"signing":{"default":{"expiry":"43800h","usages":["signing","key encipherment","client auth"]}}}' > "ca-config.json" # create the kubelet client cert with the correct groups - echo '{"CN":"kubelet","names":[{"O":"system:nodes"}],"hosts":[""],"key":{"algo":"rsa","size":2048}}' | "${CFSSL_BIN}" gencert -ca=pki/ca.crt -ca-key=pki/private/ca.key -config=ca-config.json - | "${CFSSLJSON_BIN}" -bare kubelet + echo '{"CN":"kubelet","names":[{"O":"system:nodes"}],"hosts":[],"key":{"algo":"rsa","size":2048}}' | "${CFSSL_BIN}" gencert -ca=pki/ca.crt -ca-key=pki/private/ca.key -config=ca-config.json - | "${CFSSLJSON_BIN}" -bare kubelet mv "kubelet-key.pem" "pki/private/kubelet.key" mv "kubelet.pem" "pki/issued/kubelet.crt" rm -f "kubelet.csr" @@ -1903,7 +1903,7 @@ function generate-aggregator-certs { # make the config for the signer echo '{"signing":{"default":{"expiry":"43800h","usages":["signing","key encipherment","client auth"]}}}' > "ca-config.json" # create the aggregator client cert with the correct groups - echo '{"CN":"aggregator","hosts":[""],"key":{"algo":"rsa","size":2048}}' | "${CFSSL_BIN}" gencert -ca=pki/ca.crt -ca-key=pki/private/ca.key -config=ca-config.json - | "${CFSSLJSON_BIN}" -bare proxy-client + echo '{"CN":"aggregator","hosts":[],"key":{"algo":"rsa","size":2048}}' | "${CFSSL_BIN}" gencert -ca=pki/ca.crt -ca-key=pki/private/ca.key -config=ca-config.json - | "${CFSSLJSON_BIN}" -bare proxy-client mv "proxy-client-key.pem" "pki/private/proxy-client.key" mv "proxy-client.pem" "pki/issued/proxy-client.crt" rm -f "proxy-client.csr" @@ -1964,7 +1964,7 @@ function generate-konnectivity-server-certs { # make the config for the signer echo '{"signing":{"default":{"expiry":"43800h","usages":["signing","key encipherment","client auth"]}}}' > "ca-config.json" # create the konnectivity server cert with the correct groups - echo '{"CN":"konnectivity-server","hosts":[""],"key":{"algo":"rsa","size":2048}}' | "${CFSSL_BIN}" gencert -ca=pki/ca.crt -ca-key=pki/private/ca.key -config=ca-config.json - | "${CFSSLJSON_BIN}" -bare konnectivity-server + echo '{"CN":"konnectivity-server","hosts":[],"key":{"algo":"rsa","size":2048}}' | "${CFSSL_BIN}" gencert -ca=pki/ca.crt -ca-key=pki/private/ca.key -config=ca-config.json - | "${CFSSLJSON_BIN}" -bare konnectivity-server rm -f "konnectivity-server.csr" # Make the agent <-> konnectivity server side certificates. @@ -1980,7 +1980,7 @@ function generate-konnectivity-server-certs { # make the config for the signer echo '{"signing":{"default":{"expiry":"43800h","usages":["signing","key encipherment","agent auth"]}}}' > "ca-config.json" # create the konnectivity server cert with the correct groups - echo '{"CN":"koonectivity-server","hosts":[""],"key":{"algo":"rsa","size":2048}}' | "${CFSSL_BIN}" gencert -ca=pki/ca.crt -ca-key=pki/private/ca.key -config=ca-config.json - | "${CFSSLJSON_BIN}" -bare konnectivity-agent + echo '{"CN":"koonectivity-server","hosts":[],"key":{"algo":"rsa","size":2048}}' | "${CFSSL_BIN}" gencert -ca=pki/ca.crt -ca-key=pki/private/ca.key -config=ca-config.json - | "${CFSSLJSON_BIN}" -bare konnectivity-agent rm -f "konnectivity-agent.csr" echo "completed main certificate section") &>"${cert_create_debug_output}" || true @@ -2042,7 +2042,7 @@ function generate-cloud-pvl-admission-certs { # make the config for the signer echo '{"signing":{"default":{"expiry":"43800h","usages":["signing","key encipherment","client auth"]}}}' > "ca-config.json" # create the cloud-pvl-admission cert with the correct groups - echo '{"CN":"cloud-pvl-admission","hosts":[""],"key":{"algo":"rsa","size":2048}}' | "${CFSSL_BIN}" gencert -ca=pki/ca.crt -ca-key=pki/private/ca.key -config=ca-config.json - | "${CFSSLJSON_BIN}" -bare cloud-pvl-admission + echo '{"CN":"cloud-pvl-admission","hosts":[],"key":{"algo":"rsa","size":2048}}' | "${CFSSL_BIN}" gencert -ca=pki/ca.crt -ca-key=pki/private/ca.key -config=ca-config.json - | "${CFSSLJSON_BIN}" -bare cloud-pvl-admission rm -f "cloud-pvl-admission.csr" # Make the cloud-pvl-admission server side certificates. @@ -2058,7 +2058,7 @@ function generate-cloud-pvl-admission-certs { # make the config for the signer echo '{"signing":{"default":{"expiry":"43800h","usages":["signing","key encipherment","agent auth"]}}}' > "ca-config.json" # create the cloud-pvl-admission server cert with the correct groups - echo '{"CN":"cloud-pvl-admission","hosts":[""],"key":{"algo":"rsa","size":2048}}' | "${CFSSL_BIN}" gencert -ca=pki/ca.crt -ca-key=pki/private/ca.key -config=ca-config.json - | "${CFSSLJSON_BIN}" -bare konnectivity-agent + echo '{"CN":"cloud-pvl-admission","hosts":[],"key":{"algo":"rsa","size":2048}}' | "${CFSSL_BIN}" gencert -ca=pki/ca.crt -ca-key=pki/private/ca.key -config=ca-config.json - | "${CFSSLJSON_BIN}" -bare konnectivity-agent rm -f "konnectivity-agent.csr" echo "completed main certificate section") &>"${cert_create_debug_output}" || true diff --git a/cluster/images/etcd/Makefile b/cluster/images/etcd/Makefile index 0e9b675dd3efe..95f31c9911053 100644 --- a/cluster/images/etcd/Makefile +++ b/cluster/images/etcd/Makefile @@ -92,19 +92,19 @@ DOCKERFILE.windows = Dockerfile.windows DOCKERFILE := ${DOCKERFILE.${OS}} ifeq ($(ARCH),amd64) - BASEIMAGE?=registry.k8s.io/build-image/debian-base:bookworm-v1.0.3 + BASEIMAGE?=registry.k8s.io/build-image/debian-base:bookworm-v1.0.6 endif ifeq ($(ARCH),arm) - BASEIMAGE?=registry.k8s.io/build-image/debian-base-arm:bookworm-v1.0.3 + BASEIMAGE?=registry.k8s.io/build-image/debian-base-arm:bookworm-v1.0.6 endif ifeq ($(ARCH),arm64) - BASEIMAGE?=registry.k8s.io/build-image/debian-base-arm64:bookworm-v1.0.3 + BASEIMAGE?=registry.k8s.io/build-image/debian-base-arm64:bookworm-v1.0.6 endif ifeq ($(ARCH),ppc64le) - BASEIMAGE?=registry.k8s.io/build-image/debian-base-ppc64le:bookworm-v1.0.3 + BASEIMAGE?=registry.k8s.io/build-image/debian-base-ppc64le:bookworm-v1.0.6 endif ifeq ($(ARCH),s390x) - BASEIMAGE?=registry.k8s.io/build-image/debian-base-s390x:bookworm-v1.0.3 + BASEIMAGE?=registry.k8s.io/build-image/debian-base-s390x:bookworm-v1.0.6 endif BASE.windows = mcr.microsoft.com/windows/nanoserver diff --git a/cmd/kubeadm/app/constants/constants.go b/cmd/kubeadm/app/constants/constants.go index b2f0e12c284df..d08e4125508ad 100644 --- a/cmd/kubeadm/app/constants/constants.go +++ b/cmd/kubeadm/app/constants/constants.go @@ -319,10 +319,10 @@ const ( KubeletHealthzPort = 10248 // MinExternalEtcdVersion indicates minimum external etcd version which kubeadm supports - MinExternalEtcdVersion = "3.5.11-0" + MinExternalEtcdVersion = "3.5.24-0" // DefaultEtcdVersion indicates the default etcd version that kubeadm uses - DefaultEtcdVersion = "3.5.15-0" + DefaultEtcdVersion = "3.5.24-0" // Etcd defines variable used internally when referring to etcd component Etcd = "etcd" @@ -481,9 +481,9 @@ var ( // SupportedEtcdVersion lists officially supported etcd versions with corresponding Kubernetes releases SupportedEtcdVersion = map[uint8]string{ - 29: "3.5.15-0", - 30: "3.5.15-0", - 31: "3.5.15-0", + 29: "3.5.24-0", + 30: "3.5.24-0", + 31: "3.5.24-0", } // KubeadmCertsClusterRoleName sets the name for the ClusterRole that allows diff --git a/cmd/kubeadm/app/preflight/checks.go b/cmd/kubeadm/app/preflight/checks.go index 1cc5b1cbb9e63..0b97ad8b12e68 100644 --- a/cmd/kubeadm/app/preflight/checks.go +++ b/cmd/kubeadm/app/preflight/checks.go @@ -479,11 +479,8 @@ func (subnet HTTPProxyCIDRCheck) Check() (warnings, errorList []error) { return nil, []error{errors.Wrapf(err, "unable to get first IP address from the given CIDR (%s)", cidr.String())} } - testIPstring := testIP.String() - if len(testIP) == net.IPv6len { - testIPstring = fmt.Sprintf("[%s]:1234", testIP) - } - url := fmt.Sprintf("%s://%s/", subnet.Proto, testIPstring) + testHostString := net.JoinHostPort(testIP.String(), "1234") + url := fmt.Sprintf("%s://%s/", subnet.Proto, testHostString) req, err := http.NewRequest("GET", url, nil) if err != nil { diff --git a/cmd/kubeadm/app/util/pkiutil/pki_helpers.go b/cmd/kubeadm/app/util/pkiutil/pki_helpers.go index dbbd139f7394a..b94a31a0503fd 100644 --- a/cmd/kubeadm/app/util/pkiutil/pki_helpers.go +++ b/cmd/kubeadm/app/util/pkiutil/pki_helpers.go @@ -402,15 +402,18 @@ func GetAPIServerAltNames(cfg *kubeadmapi.InitConfiguration) (*certutil.AltNames return nil, errors.Wrapf(err, "unable to get first IP address from the given CIDR: %v", cfg.Networking.ServiceSubnet) } + var dnsNames []string + if len(cfg.NodeRegistration.Name) > 0 { + dnsNames = append(dnsNames, cfg.NodeRegistration.Name) + } + dnsNames = append(dnsNames, "kubernetes", "kubernetes.default", "kubernetes.default.svc") + if len(cfg.Networking.DNSDomain) > 0 { + dnsNames = append(dnsNames, fmt.Sprintf("kubernetes.default.svc.%s", cfg.Networking.DNSDomain)) + } + // create AltNames with defaults DNSNames/IPs altNames := &certutil.AltNames{ - DNSNames: []string{ - cfg.NodeRegistration.Name, - "kubernetes", - "kubernetes.default", - "kubernetes.default.svc", - fmt.Sprintf("kubernetes.default.svc.%s", cfg.Networking.DNSDomain), - }, + DNSNames: dnsNames, IPs: []net.IP{ internalAPIServerVirtualIP, advertiseAddress, @@ -458,9 +461,16 @@ func getAltNames(cfg *kubeadmapi.InitConfiguration, certName string) (*certutil. cfg.LocalAPIEndpoint.AdvertiseAddress) } + var dnsNames []string + if len(cfg.NodeRegistration.Name) > 0 { + dnsNames = []string{cfg.NodeRegistration.Name, "localhost"} + } else { + dnsNames = []string{"localhost"} + } + // create AltNames with defaults DNSNames/IPs altNames := &certutil.AltNames{ - DNSNames: []string{cfg.NodeRegistration.Name, "localhost"}, + DNSNames: dnsNames, IPs: []net.IP{advertiseAddress, net.IPv4(127, 0, 0, 1), net.IPv6loopback}, } @@ -707,13 +717,15 @@ func NewSelfSignedCACert(cfg *CertConfig, key crypto.Signer) (*x509.Certificate, CommonName: cfg.CommonName, Organization: cfg.Organization, }, - DNSNames: []string{cfg.CommonName}, NotBefore: notBefore, NotAfter: notAfter, KeyUsage: keyUsage, BasicConstraintsValid: true, IsCA: true, } + if len(cfg.CommonName) > 0 { + tmpl.DNSNames = []string{cfg.CommonName} + } certDERBytes, err := x509.CreateCertificate(cryptorand.Reader, &tmpl, &tmpl, key.Public(), key) if err != nil { diff --git a/hack/golangci-hints.yaml b/hack/golangci-hints.yaml index b9e0d4e1c63eb..c313b9da86734 100644 --- a/hack/golangci-hints.yaml +++ b/hack/golangci-hints.yaml @@ -15,8 +15,6 @@ run: timeout: 30m - skip-files: - - "^zz_generated.*" output: sort-results: true @@ -33,6 +31,9 @@ issues: # staticcheck: Developers tend to write in C-style with an explicit 'break' in a 'switch', so it's ok to ignore - ineffective break statement. Did you mean to break out of the outer loop + exclude-files: + - "^zz_generated.*" + # Excluding configuration per-path, per-linter, per-text and per-source exclude-rules: # exclude ineffassign linter for generated files for conversion diff --git a/hack/golangci-strict.yaml b/hack/golangci-strict.yaml index 52dca4c1f9adc..fa2dd8905bd1d 100644 --- a/hack/golangci-strict.yaml +++ b/hack/golangci-strict.yaml @@ -15,8 +15,6 @@ run: timeout: 30m - skip-files: - - "^zz_generated.*" output: sort-results: true @@ -33,6 +31,9 @@ issues: # staticcheck: Developers tend to write in C-style with an explicit 'break' in a 'switch', so it's ok to ignore - ineffective break statement. Did you mean to break out of the outer loop + exclude-files: + - "^zz_generated.*" + # Excluding configuration per-path, per-linter, per-text and per-source exclude-rules: # exclude ineffassign linter for generated files for conversion diff --git a/hack/golangci.yaml b/hack/golangci.yaml index 7b5763e6b0050..9c68070795c4a 100644 --- a/hack/golangci.yaml +++ b/hack/golangci.yaml @@ -15,8 +15,6 @@ run: timeout: 30m - skip-files: - - "^zz_generated.*" output: sort-results: true @@ -33,6 +31,9 @@ issues: # staticcheck: Developers tend to write in C-style with an explicit 'break' in a 'switch', so it's ok to ignore - ineffective break statement. Did you mean to break out of the outer loop + exclude-files: + - "^zz_generated.*" + # Excluding configuration per-path, per-linter, per-text and per-source exclude-rules: # exclude ineffassign linter for generated files for conversion @@ -68,6 +69,24 @@ issues: - ginkgolinter text: use a function call in (Eventually|Consistently) + # Some of these seem legitimate, maybe better fix code (https://github.com/kubernetes/kubernetes/issues/130449). + + - linters: + - govet + text: "lostcancel|printf" + + - linters: + - ginkgolinter + text: "wrong error assertion. Consider using `gomega.(Eventually|Consistently)|wrong comparison assertion|wrong length assertion" + + - linters: + - testifylint + text: "encoded-compare|error-nil|formatter|negative-positive|contains" + + - linters: + - gocritic + text: "append result not assigned to the same slice|put a space between `//` and comment text|sloppyLen|elseif|should rewrite switch statement to if statement|regexpMust|wrapperFunc: use strings.ReplaceAll|singleCaseSwitch|deprecatedComment|exitAfterDefer|captLocal|unlambda|underef|unslice|valSwap|typeSwitchVar" + # https://github.com/kubernetes/kubernetes/issues/117288#issuecomment-1507012435 - linters: - gocritic diff --git a/hack/golangci.yaml.in b/hack/golangci.yaml.in index 8f20d8307d69d..5a9df76a3274a 100644 --- a/hack/golangci.yaml.in +++ b/hack/golangci.yaml.in @@ -15,8 +15,6 @@ run: timeout: 30m - skip-files: - - "^zz_generated.*" output: sort-results: true @@ -33,6 +31,9 @@ issues: # staticcheck: Developers tend to write in C-style with an explicit 'break' in a 'switch', so it's ok to ignore - ineffective break statement. Did you mean to break out of the outer loop + exclude-files: + - "^zz_generated.*" + # Excluding configuration per-path, per-linter, per-text and per-source exclude-rules: # exclude ineffassign linter for generated files for conversion @@ -71,6 +72,27 @@ issues: - ginkgolinter text: use a function call in (Eventually|Consistently) + {{- if .Base}} + + # Some of these seem legitimate, maybe better fix code (https://github.com/kubernetes/kubernetes/issues/130449). + + - linters: + - govet + text: "lostcancel|printf" + + - linters: + - ginkgolinter + text: "wrong error assertion. Consider using `gomega.(Eventually|Consistently)|wrong comparison assertion|wrong length assertion" + + - linters: + - testifylint + text: "encoded-compare|error-nil|formatter|negative-positive|contains" + + - linters: + - gocritic + text: "append result not assigned to the same slice|put a space between `//` and comment text|sloppyLen|elseif|should rewrite switch statement to if statement|regexpMust|wrapperFunc: use strings.ReplaceAll|singleCaseSwitch|deprecatedComment|exitAfterDefer|captLocal|unlambda|underef|unslice|valSwap|typeSwitchVar" + {{- end}} + # https://github.com/kubernetes/kubernetes/issues/117288#issuecomment-1507012435 - linters: - gocritic diff --git a/hack/lib/etcd.sh b/hack/lib/etcd.sh index 8261c04f1ccf5..f489cd3342235 100755 --- a/hack/lib/etcd.sh +++ b/hack/lib/etcd.sh @@ -16,7 +16,7 @@ # A set of helpers for starting/running etcd for tests -ETCD_VERSION=${ETCD_VERSION:-3.5.15} +ETCD_VERSION=${ETCD_VERSION:-3.5.24} ETCD_HOST=${ETCD_HOST:-127.0.0.1} ETCD_PORT=${ETCD_PORT:-2379} # This is intentionally not called ETCD_LOG_LEVEL: diff --git a/hack/lib/util.sh b/hack/lib/util.sh index e9197eff9bbfd..3d542170cd124 100755 --- a/hack/lib/util.sh +++ b/hack/lib/util.sh @@ -478,7 +478,7 @@ function kube::util::create_client_certkey { done ${sudo} /usr/bin/env bash -e < 0 { - id = loadBalancerIdentifier{protocol: protocol, internalPort: internalPort, externalPort: externalPort, vip: vip, endpointsHash: hash} vips = append(vips, vip) - } else { - id = loadBalancerIdentifier{protocol: protocol, internalPort: internalPort, externalPort: externalPort, endpointsHash: hash} } if lb, found := previousLoadBalancers[id]; found { diff --git a/pkg/proxy/winkernel/hns_test.go b/pkg/proxy/winkernel/hns_test.go index 6a5487173b0ee..40e3f7b953299 100644 --- a/pkg/proxy/winkernel/hns_test.go +++ b/pkg/proxy/winkernel/hns_test.go @@ -41,6 +41,8 @@ const ( epIpv6Address = "192::3" epIpAddressB = "192.168.1.4" epIpAddressRemote = "192.168.2.3" + epIpAddressLocal1 = "192.168.4.4" + epIpAddressLocal2 = "192.168.4.5" epPaAddress = "10.0.0.3" protocol = 6 internalPort = 80 diff --git a/pkg/proxy/winkernel/proxier.go b/pkg/proxy/winkernel/proxier.go index a10f567d99a91..67a469b6b6cd5 100644 --- a/pkg/proxy/winkernel/proxier.go +++ b/pkg/proxy/winkernel/proxier.go @@ -1467,7 +1467,7 @@ func (proxier *Proxier) syncProxyRules() { } if !proxier.requiresUpdateLoadbalancer(svcInfo.hnsID, len(clusterIPEndpoints)) { - proxier.deleteExistingLoadBalancer(hns, svcInfo.winProxyOptimization, &svcInfo.hnsID, svcInfo.ClusterIP().String(), Enum(svcInfo.Protocol()), uint16(svcInfo.targetPort), uint16(svcInfo.Port()), hnsEndpoints, queriedLoadBalancers) + proxier.deleteExistingLoadBalancer(hns, svcInfo.winProxyOptimization, &svcInfo.hnsID, svcInfo.ClusterIP().String(), Enum(svcInfo.Protocol()), uint16(svcInfo.targetPort), uint16(svcInfo.Port()), clusterIPEndpoints, queriedLoadBalancers) if len(clusterIPEndpoints) > 0 { // If all endpoints are terminating, then no need to create Cluster IP LoadBalancer diff --git a/pkg/proxy/winkernel/proxier_test.go b/pkg/proxy/winkernel/proxier_test.go index 8617897717438..d626e19527cd5 100644 --- a/pkg/proxy/winkernel/proxier_test.go +++ b/pkg/proxy/winkernel/proxier_test.go @@ -28,6 +28,7 @@ import ( "time" "github.com/Microsoft/hcsshim/hcn" + "github.com/stretchr/testify/assert" v1 "k8s.io/api/core/v1" discovery "k8s.io/api/discovery/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -43,15 +44,19 @@ import ( const ( testHostName = "test-hostname" testNetwork = "TestNetwork" - ipAddress = "10.0.0.1" prefixLen = 24 macAddress = "00-11-22-33-44-55" + macAddressLocal1 = "00-11-22-33-44-56" + macAddressLocal2 = "00-11-22-33-44-57" destinationPrefix = "192.168.2.0/24" providerAddress = "10.0.0.3" guid = "123ABC" + networkId = "123ABC" endpointGuid1 = "EPID-1" loadbalancerGuid1 = "LBID-1" - endpointLocal = "EP-LOCAL" + loadbalancerGuid2 = "LBID-2" + endpointLocal1 = "EP-LOCAL-1" + endpointLocal2 = "EP-LOCAL-2" endpointGw = "EP-GW" epIpAddressGw = "192.168.2.1" epMacAddressGw = "00-11-22-33-44-66" @@ -330,6 +335,195 @@ func TestCreateRemoteEndpointL2Bridge(t *testing.T) { t.Errorf("Global refCount: %v does not match endpoint refCount: %v", *proxier.endPointsRefCount[endpointGuid1], *epInfo.refCount) } } + +// TestClusterIPSvcWithITPLocal tests the following scenarios for a ClusterIP service with InternalTrafficPolicy=Local: +// 1. When a local endpoint is added to the service, the service should continue to use the local endpoints and existing loadbalancer. +// If no existing loadbalancer is present, a new loadbalancer should be created. +// 2. When one more local endpoint is added to the service, the service should delete existing loadbalancer and create a new loadbalancer. +// 3. When a remote endpoint is added to the service, the service should continue to use the local endpoints and existing loadbalancer, +// since it's a InternalTrafficPolicy=Local service. +func TestClusterIPSvcWithITPLocal(t *testing.T) { + syncPeriod := 30 * time.Second + proxier := NewFakeProxier(syncPeriod, syncPeriod, "testhost", netutils.ParseIPSloppy("10.0.0.1"), "L2Bridge") + if proxier == nil { + t.Fatal("Failed to create proxier") + } + + svcIP := "10.20.30.41" + svcPort := 80 + svcPortName := proxy.ServicePortName{ + NamespacedName: makeNSN("ns1", "svc1"), + Port: "p80", + Protocol: v1.ProtocolTCP, + } + + itpLocal := v1.ServiceInternalTrafficPolicyLocal + + makeServiceMap(proxier, + makeTestService(svcPortName.Namespace, svcPortName.Name, func(svc *v1.Service) { + svc.Spec.Type = v1.ServiceTypeClusterIP + svc.Spec.ClusterIP = svcIP + svc.Spec.InternalTrafficPolicy = &itpLocal // Setting the InternalTrafficPolicy to Local + svc.Spec.Ports = []v1.ServicePort{{ + Name: svcPortName.Port, + Port: int32(svcPort), + Protocol: v1.ProtocolTCP, + }} + }), + ) + + populateEndpointSlices(proxier, + makeTestEndpointSlice(svcPortName.Namespace, svcPortName.Name, 1, func(eps *discovery.EndpointSlice) { + eps.AddressType = discovery.AddressTypeIPv4 + eps.Endpoints = []discovery.Endpoint{ + { + Addresses: []string{epIpAddressLocal1}, // Local Endpoint 1 + }, + } + eps.Ports = []discovery.EndpointPort{{ + Name: ptr.To(svcPortName.Port), + Port: ptr.To(int32(svcPort)), + Protocol: ptr.To(v1.ProtocolTCP), + }} + }), + ) + + hcn := (proxier.hcn).(*fakehcn.HcnMock) + // Populating the endpoint to the cache, since it's a local endpoint and local endpoints are managed by CNI and not KubeProxy + // Populating here marks the endpoint to local + hcn.PopulateQueriedEndpoints(endpointLocal1, networkId, epIpAddressLocal1, macAddressLocal1, prefixLen) + + proxier.setInitialized(true) + + // Test 1: When a local endpoint is added to the service, the service should continue to use the local endpoints and existing loadbalancer. + // If no existing loadbalancer is present, a new loadbalancer should be created. + proxier.syncProxyRules() + + ep := proxier.endpointsMap[svcPortName][0] + epInfo, ok := ep.(*endpointInfo) + assert.True(t, ok, fmt.Sprintf("Failed to cast endpointInfo %q", svcPortName.String())) + assert.NotEmpty(t, epInfo.hnsID, fmt.Sprintf("Expected HNS ID to be set for endpoint %s, but got empty value", epIpAddressRemote)) + + svc := proxier.svcPortMap[svcPortName] + svcInfo, ok := svc.(*serviceInfo) + assert.True(t, ok, "Failed to cast serviceInfo %q", svcPortName.String()) + assert.Equal(t, svcInfo.hnsID, loadbalancerGuid1, fmt.Sprintf("%v does not match %v", svcInfo.hnsID, loadbalancerGuid1)) + lb, err := proxier.hcn.GetLoadBalancerByID(loadbalancerGuid1) + assert.Equal(t, nil, err, fmt.Sprintf("Failed to fetch loadbalancer: %s. Error: %v", loadbalancerGuid1, err)) + assert.NotNil(t, lb, "Loadbalancer object should not be nil") + + // Test 2: When one more local endpoint is added to the service, the service should delete existing loadbalancer and create a new loadbalancer. + + proxier.setInitialized(false) + + proxier.OnEndpointSliceUpdate( + makeTestEndpointSlice(svcPortName.Namespace, svcPortName.Name, 1, func(eps *discovery.EndpointSlice) { + eps.AddressType = discovery.AddressTypeIPv4 + eps.Endpoints = []discovery.Endpoint{{ + Addresses: []string{epIpAddressLocal1}, + }} + eps.Ports = []discovery.EndpointPort{{ + Name: ptr.To(svcPortName.Port), + Port: ptr.To(int32(svcPort)), + Protocol: ptr.To(v1.ProtocolTCP), + }} + }), + makeTestEndpointSlice(svcPortName.Namespace, svcPortName.Name, 1, func(eps *discovery.EndpointSlice) { + eps.AddressType = discovery.AddressTypeIPv4 + eps.Endpoints = []discovery.Endpoint{ + { + Addresses: []string{epIpAddressLocal1}, + }, + { + Addresses: []string{epIpAddressLocal2}, // Adding one more local endpoint + }, + } + eps.Ports = []discovery.EndpointPort{{ + Name: ptr.To(svcPortName.Port), + Port: ptr.To(int32(svcPort)), + Protocol: ptr.To(v1.ProtocolTCP), + }} + })) + + proxier.mu.Lock() + proxier.endpointSlicesSynced = true + proxier.mu.Unlock() + + proxier.setInitialized(true) + + // Creating the second local endpoint + hcn.PopulateQueriedEndpoints(endpointLocal2, networkId, epIpAddressLocal2, macAddressLocal2, prefixLen) + // Reinitiating the syncProxyRules to create new loadbalancer with the new local endpoint + proxier.syncProxyRules() + svc = proxier.svcPortMap[svcPortName] + svcInfo, ok = svc.(*serviceInfo) + assert.True(t, ok, "Failed to cast serviceInfo %q", svcPortName.String()) + assert.Equal(t, svcInfo.hnsID, loadbalancerGuid2, fmt.Sprintf("%v does not match %v", svcInfo.hnsID, loadbalancerGuid2)) + lb, err = proxier.hcn.GetLoadBalancerByID(loadbalancerGuid2) + assert.Equal(t, nil, err, fmt.Sprintf("Failed to fetch loadbalancer: %s. Error: %v", loadbalancerGuid2, err)) + assert.NotNil(t, lb, "Loadbalancer object should not be nil") + + lb, _ = proxier.hcn.GetLoadBalancerByID(loadbalancerGuid1) + assert.Nil(t, lb, fmt.Sprintf("Loadbalancer object should be nil: %s", loadbalancerGuid1)) + + // Test 3: When a remote endpoint is added to the service, the service should continue to use the local endpoints and existing loadbalancer, + // since it's a InternalTrafficPolicy=Local service. + + proxier.setInitialized(false) + + proxier.OnEndpointSliceUpdate( + makeTestEndpointSlice(svcPortName.Namespace, svcPortName.Name, 1, func(eps *discovery.EndpointSlice) { + eps.AddressType = discovery.AddressTypeIPv4 + eps.Endpoints = []discovery.Endpoint{ + { + Addresses: []string{epIpAddressLocal1}, + }, + { + Addresses: []string{epIpAddressLocal2}, + }, + } + eps.Ports = []discovery.EndpointPort{{ + Name: ptr.To(svcPortName.Port), + Port: ptr.To(int32(svcPort)), + Protocol: ptr.To(v1.ProtocolTCP), + }} + }), + makeTestEndpointSlice(svcPortName.Namespace, svcPortName.Name, 1, func(eps *discovery.EndpointSlice) { + eps.AddressType = discovery.AddressTypeIPv4 + eps.Endpoints = []discovery.Endpoint{ + { + Addresses: []string{epIpAddressLocal1}, + }, + { + Addresses: []string{epIpAddressLocal2}, // Adding one more local endpoint + }, + { + Addresses: []string{epIpAddressRemote}, // Adding one more remote endpoint to the slice + }, + } + eps.Ports = []discovery.EndpointPort{{ + Name: ptr.To(svcPortName.Port), + Port: ptr.To(int32(svcPort)), + Protocol: ptr.To(v1.ProtocolTCP), + }} + })) + + proxier.mu.Lock() + proxier.endpointSlicesSynced = true + proxier.mu.Unlock() + + proxier.setInitialized(true) + + proxier.syncProxyRules() + svc = proxier.svcPortMap[svcPortName] + svcInfo, ok = svc.(*serviceInfo) + assert.True(t, ok, "Failed to cast serviceInfo %q", svcPortName.String()) + assert.Equal(t, svcInfo.hnsID, loadbalancerGuid2, fmt.Sprintf("%v does not match %v", svcInfo.hnsID, loadbalancerGuid2)) + lb, err = proxier.hcn.GetLoadBalancerByID(loadbalancerGuid2) + assert.Equal(t, nil, err, fmt.Sprintf("Failed to fetch loadbalancer: %s. Error: %v", loadbalancerGuid2, err)) + assert.NotNil(t, lb, "Loadbalancer object should not be nil") +} + func TestSharedRemoteEndpointDelete(t *testing.T) { syncPeriod := 30 * time.Second proxier := NewFakeProxier(syncPeriod, syncPeriod, "testhost", netutils.ParseIPSloppy("10.0.0.1"), "L2Bridge") @@ -1038,7 +1232,7 @@ func TestCreateDsrLoadBalancer(t *testing.T) { hcn := (proxier.hcn).(*fakehcn.HcnMock) proxier.rootHnsEndpointName = endpointGw - hcn.PopulateQueriedEndpoints(endpointLocal, guid, epIpAddressRemote, macAddress, prefixLen) + hcn.PopulateQueriedEndpoints(endpointLocal1, guid, epIpAddressRemote, macAddress, prefixLen) hcn.PopulateQueriedEndpoints(endpointGw, guid, epIpAddressGw, epMacAddressGw, prefixLen) proxier.setInitialized(true) proxier.syncProxyRules() diff --git a/pkg/volume/plugins.go b/pkg/volume/plugins.go index 6b2c69164bedc..e1b706ce224ae 100644 --- a/pkg/volume/plugins.go +++ b/pkg/volume/plugins.go @@ -983,7 +983,7 @@ func NewPersistentVolumeRecyclerPodTemplate() *v1.Pod { Containers: []v1.Container{ { Name: "pv-recycler", - Image: "registry.k8s.io/build-image/debian-base:bookworm-v1.0.3", + Image: "registry.k8s.io/build-image/debian-base:bookworm-v1.0.6", Command: []string{"/bin/sh"}, Args: []string{"-c", "test -e /scrub && find /scrub -mindepth 1 -delete && test -z \"$(ls -A /scrub)\" || exit 1"}, VolumeMounts: []v1.VolumeMount{ diff --git a/staging/publishing/rules.yaml b/staging/publishing/rules.yaml index 5baca854e8daa..10da656ada6b6 100644 --- a/staging/publishing/rules.yaml +++ b/staging/publishing/rules.yaml @@ -2898,4 +2898,4 @@ rules: - staging/src/k8s.io/endpointslice recursive-delete-patterns: - '*/.gitattributes' -default-go-version: 1.23.12 +default-go-version: 1.24.9 diff --git a/staging/src/k8s.io/client-go/util/cert/cert.go b/staging/src/k8s.io/client-go/util/cert/cert.go index 1220461264c65..48c78b595ef38 100644 --- a/staging/src/k8s.io/client-go/util/cert/cert.go +++ b/staging/src/k8s.io/client-go/util/cert/cert.go @@ -75,13 +75,15 @@ func NewSelfSignedCACert(cfg Config, key crypto.Signer) (*x509.Certificate, erro CommonName: cfg.CommonName, Organization: cfg.Organization, }, - DNSNames: []string{cfg.CommonName}, NotBefore: notBefore, NotAfter: now.Add(duration365d * 10).UTC(), KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign, BasicConstraintsValid: true, IsCA: true, } + if len(cfg.CommonName) > 0 { + tmpl.DNSNames = []string{cfg.CommonName} + } certDERBytes, err := x509.CreateCertificate(cryptorand.Reader, &tmpl, &tmpl, key.Public(), key) if err != nil { diff --git a/test/conformance/image/Makefile b/test/conformance/image/Makefile index 3fcd83df233da..61a963f6352ca 100644 --- a/test/conformance/image/Makefile +++ b/test/conformance/image/Makefile @@ -33,7 +33,7 @@ CLUSTER_DIR?=$(shell pwd)/../../../cluster/ # This is defined in root Makefile, but some build contexts do not refer to them KUBE_BASE_IMAGE_REGISTRY?=registry.k8s.io -BASE_IMAGE_VERSION?=bookworm-v1.0.3 +BASE_IMAGE_VERSION?=bookworm-v1.0.6 RUNNERIMAGE?=${KUBE_BASE_IMAGE_REGISTRY}/build-image/debian-base-${ARCH}:${BASE_IMAGE_VERSION} TEMP_DIR:=$(shell mktemp -d -t conformance-XXXXXX) diff --git a/test/images/Makefile b/test/images/Makefile index 0dec9d48d11b5..4cda4a67fcdf7 100644 --- a/test/images/Makefile +++ b/test/images/Makefile @@ -16,7 +16,7 @@ REGISTRY ?= registry.k8s.io/e2e-test-images GOARM ?= 7 DOCKER_CERT_BASE_PATH ?= QEMUVERSION=v5.1.0-2 -GOLANG_VERSION=1.23.12 +GOLANG_VERSION=1.24.9 export ifndef WHAT diff --git a/test/images/nonroot/BASEIMAGE b/test/images/nonroot/BASEIMAGE index fa0e707f8dbad..b0a0270b001af 100644 --- a/test/images/nonroot/BASEIMAGE +++ b/test/images/nonroot/BASEIMAGE @@ -1,7 +1,7 @@ -linux/amd64=registry.k8s.io/build-image/debian-base-amd64:bookworm-v1.0.3 -linux/arm=registry.k8s.io/build-image/debian-base-arm:bookworm-v1.0.3 -linux/arm64=registry.k8s.io/build-image/debian-base-arm64:bookworm-v1.0.3 -linux/ppc64le=registry.k8s.io/build-image/debian-base-ppc64le:bookworm-v1.0.3 -linux/s390x=registry.k8s.io/build-image/debian-base-s390x:bookworm-v1.0.3 +linux/amd64=registry.k8s.io/build-image/debian-base-amd64:bookworm-v1.0.6 +linux/arm=registry.k8s.io/build-image/debian-base-arm:bookworm-v1.0.6 +linux/arm64=registry.k8s.io/build-image/debian-base-arm64:bookworm-v1.0.6 +linux/ppc64le=registry.k8s.io/build-image/debian-base-ppc64le:bookworm-v1.0.6 +linux/s390x=registry.k8s.io/build-image/debian-base-s390x:bookworm-v1.0.6 windows/amd64/1809=mcr.microsoft.com/windows/nanoserver:1809 windows/amd64/ltsc2022=mcr.microsoft.com/windows/nanoserver:ltsc2022 diff --git a/test/images/pets/peer-finder/BASEIMAGE b/test/images/pets/peer-finder/BASEIMAGE index ce1a52b92fb1e..8b900d2f419b1 100644 --- a/test/images/pets/peer-finder/BASEIMAGE +++ b/test/images/pets/peer-finder/BASEIMAGE @@ -1,5 +1,5 @@ -linux/amd64=registry.k8s.io/build-image/debian-base-amd64:bookworm-v1.0.3 -linux/arm=registry.k8s.io/build-image/debian-base-arm:bookworm-v1.0.3 -linux/arm64=registry.k8s.io/build-image/debian-base-arm64:bookworm-v1.0.3 -linux/ppc64le=registry.k8s.io/build-image/debian-base-ppc64le:bookworm-v1.0.3 -linux/s390x=registry.k8s.io/build-image/debian-base-s390x:bookworm-v1.0.3 +linux/amd64=registry.k8s.io/build-image/debian-base-amd64:bookworm-v1.0.6 +linux/arm=registry.k8s.io/build-image/debian-base-arm:bookworm-v1.0.6 +linux/arm64=registry.k8s.io/build-image/debian-base-arm64:bookworm-v1.0.6 +linux/ppc64le=registry.k8s.io/build-image/debian-base-ppc64le:bookworm-v1.0.6 +linux/s390x=registry.k8s.io/build-image/debian-base-s390x:bookworm-v1.0.6 diff --git a/test/images/pets/redis-installer/BASEIMAGE b/test/images/pets/redis-installer/BASEIMAGE index 06a59e5bc9d8f..afc96c3e3017d 100644 --- a/test/images/pets/redis-installer/BASEIMAGE +++ b/test/images/pets/redis-installer/BASEIMAGE @@ -1,4 +1,4 @@ -linux/amd64=registry.k8s.io/build-image/debian-base-amd64:bookworm-v1.0.3 -linux/arm=registry.k8s.io/build-image/debian-base-arm:bookworm-v1.0.3 -linux/arm64=registry.k8s.io/build-image/debian-base-arm64:bookworm-v1.0.3 -linux/ppc64le=registry.k8s.io/build-image/debian-base-ppc64le:bookworm-v1.0.3 +linux/amd64=registry.k8s.io/build-image/debian-base-amd64:bookworm-v1.0.6 +linux/arm=registry.k8s.io/build-image/debian-base-arm:bookworm-v1.0.6 +linux/arm64=registry.k8s.io/build-image/debian-base-arm64:bookworm-v1.0.6 +linux/ppc64le=registry.k8s.io/build-image/debian-base-ppc64le:bookworm-v1.0.6 diff --git a/test/images/pets/zookeeper-installer/BASEIMAGE b/test/images/pets/zookeeper-installer/BASEIMAGE index 06a59e5bc9d8f..afc96c3e3017d 100644 --- a/test/images/pets/zookeeper-installer/BASEIMAGE +++ b/test/images/pets/zookeeper-installer/BASEIMAGE @@ -1,4 +1,4 @@ -linux/amd64=registry.k8s.io/build-image/debian-base-amd64:bookworm-v1.0.3 -linux/arm=registry.k8s.io/build-image/debian-base-arm:bookworm-v1.0.3 -linux/arm64=registry.k8s.io/build-image/debian-base-arm64:bookworm-v1.0.3 -linux/ppc64le=registry.k8s.io/build-image/debian-base-ppc64le:bookworm-v1.0.3 +linux/amd64=registry.k8s.io/build-image/debian-base-amd64:bookworm-v1.0.6 +linux/arm=registry.k8s.io/build-image/debian-base-arm:bookworm-v1.0.6 +linux/arm64=registry.k8s.io/build-image/debian-base-arm64:bookworm-v1.0.6 +linux/ppc64le=registry.k8s.io/build-image/debian-base-ppc64le:bookworm-v1.0.6 diff --git a/test/images/regression-issue-74839/BASEIMAGE b/test/images/regression-issue-74839/BASEIMAGE index ce1a52b92fb1e..8b900d2f419b1 100644 --- a/test/images/regression-issue-74839/BASEIMAGE +++ b/test/images/regression-issue-74839/BASEIMAGE @@ -1,5 +1,5 @@ -linux/amd64=registry.k8s.io/build-image/debian-base-amd64:bookworm-v1.0.3 -linux/arm=registry.k8s.io/build-image/debian-base-arm:bookworm-v1.0.3 -linux/arm64=registry.k8s.io/build-image/debian-base-arm64:bookworm-v1.0.3 -linux/ppc64le=registry.k8s.io/build-image/debian-base-ppc64le:bookworm-v1.0.3 -linux/s390x=registry.k8s.io/build-image/debian-base-s390x:bookworm-v1.0.3 +linux/amd64=registry.k8s.io/build-image/debian-base-amd64:bookworm-v1.0.6 +linux/arm=registry.k8s.io/build-image/debian-base-arm:bookworm-v1.0.6 +linux/arm64=registry.k8s.io/build-image/debian-base-arm64:bookworm-v1.0.6 +linux/ppc64le=registry.k8s.io/build-image/debian-base-ppc64le:bookworm-v1.0.6 +linux/s390x=registry.k8s.io/build-image/debian-base-s390x:bookworm-v1.0.6 diff --git a/test/images/resource-consumer/BASEIMAGE b/test/images/resource-consumer/BASEIMAGE index fa0e707f8dbad..b0a0270b001af 100644 --- a/test/images/resource-consumer/BASEIMAGE +++ b/test/images/resource-consumer/BASEIMAGE @@ -1,7 +1,7 @@ -linux/amd64=registry.k8s.io/build-image/debian-base-amd64:bookworm-v1.0.3 -linux/arm=registry.k8s.io/build-image/debian-base-arm:bookworm-v1.0.3 -linux/arm64=registry.k8s.io/build-image/debian-base-arm64:bookworm-v1.0.3 -linux/ppc64le=registry.k8s.io/build-image/debian-base-ppc64le:bookworm-v1.0.3 -linux/s390x=registry.k8s.io/build-image/debian-base-s390x:bookworm-v1.0.3 +linux/amd64=registry.k8s.io/build-image/debian-base-amd64:bookworm-v1.0.6 +linux/arm=registry.k8s.io/build-image/debian-base-arm:bookworm-v1.0.6 +linux/arm64=registry.k8s.io/build-image/debian-base-arm64:bookworm-v1.0.6 +linux/ppc64le=registry.k8s.io/build-image/debian-base-ppc64le:bookworm-v1.0.6 +linux/s390x=registry.k8s.io/build-image/debian-base-s390x:bookworm-v1.0.6 windows/amd64/1809=mcr.microsoft.com/windows/nanoserver:1809 windows/amd64/ltsc2022=mcr.microsoft.com/windows/nanoserver:ltsc2022 diff --git a/test/integration/auth/auth_test.go b/test/integration/auth/auth_test.go index 5569f11138f68..08f1a54fb91aa 100644 --- a/test/integration/auth/auth_test.go +++ b/test/integration/auth/auth_test.go @@ -41,10 +41,9 @@ import ( "testing" "time" - utiltesting "k8s.io/client-go/util/testing" - "github.com/google/go-cmp/cmp" + authenticationv1 "k8s.io/api/authentication/v1" authenticationv1beta1 "k8s.io/api/authentication/v1beta1" certificatesv1 "k8s.io/api/certificates/v1" rbacv1 "k8s.io/api/rbac/v1" @@ -65,6 +64,7 @@ import ( "k8s.io/client-go/rest" v1 "k8s.io/client-go/tools/clientcmd/api/v1" resttransport "k8s.io/client-go/transport" + utiltesting "k8s.io/client-go/util/testing" "k8s.io/kubernetes/cmd/kube-apiserver/app/options" kubeapiservertesting "k8s.io/kubernetes/cmd/kube-apiserver/app/testing" "k8s.io/kubernetes/pkg/apis/autoscaling" @@ -1568,3 +1568,48 @@ func newTestWebhookTokenAuthServer() *httptest.Server { server.Start() return server } + +func TestSloppySANCertificates(t *testing.T) { + tCtx := ktesting.Init(t) + _, kubeConfig, tearDownFn := framework.StartTestServer(tCtx, t, framework.TestServerSetup{ + ModifyServerRunOptions: func(opts *options.ServerRunOptions) { + // append to opts.Authentication.ClientCert.ClientCA + fmt.Println(opts.Authentication.ClientCert.ClientCA) + caData, err := os.ReadFile(opts.Authentication.ClientCert.ClientCA) + if err != nil { + t.Fatal(err) + } + sloppyCAData, err := os.ReadFile("testdata/sloppy-san-root.pem") + if err != nil { + t.Fatal(err) + } + err = os.WriteFile(opts.Authentication.ClientCert.ClientCA, []byte(string(caData)+"\n"+string(sloppyCAData)), os.FileMode(0644)) + if err != nil { + t.Fatal(err) + } + }, + }) + defer tearDownFn() + + var err error + kubeConfig = rest.AnonymousClientConfig(kubeConfig) + kubeConfig.CertData, err = os.ReadFile("testdata/sloppy-san-client.pem") + if err != nil { + t.Fatal(err) + } + kubeConfig.KeyData, err = os.ReadFile("testdata/sloppy-san-client-key.pem") + if err != nil { + t.Fatal(err) + } + c, err := clientset.NewForConfig(kubeConfig) + if err != nil { + t.Fatal(err) + } + r, err := c.AuthenticationV1().SelfSubjectReviews().Create(tCtx, &authenticationv1.SelfSubjectReview{}, metav1.CreateOptions{}) + if err != nil { + t.Fatal(err) + } + if r.Status.UserInfo.Username != "sloppy-san-client" { + t.Fatalf("expected sloppy-san-client, got %#v", r.Status.UserInfo) + } +} diff --git a/test/integration/auth/testdata/README.md b/test/integration/auth/testdata/README.md new file mode 100644 index 0000000000000..a78ddfbd05a3f --- /dev/null +++ b/test/integration/auth/testdata/README.md @@ -0,0 +1 @@ +Keys in this directory are generated for testing purposes only. diff --git a/test/integration/auth/testdata/sloppy-san-client-key.pem b/test/integration/auth/testdata/sloppy-san-client-key.pem new file mode 100644 index 0000000000000..b6d0a3a7c896c --- /dev/null +++ b/test/integration/auth/testdata/sloppy-san-client-key.pem @@ -0,0 +1,5 @@ +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEILndj5ixo79V24VqIlvSS0J5rwQyklP4+D+rAAjO763loAoGCCqGSM49 +AwEHoUQDQgAEXMW9sg8iyagwwhlJ94p0brB5NqSYIytoj18bs6xPZ3UqEZo5BhXi +2m2Cx8althrzoXbMIGr+ALUWDgKk7BVuSg== +-----END EC PRIVATE KEY----- diff --git a/test/integration/auth/testdata/sloppy-san-client.pem b/test/integration/auth/testdata/sloppy-san-client.pem new file mode 100644 index 0000000000000..8627574055129 --- /dev/null +++ b/test/integration/auth/testdata/sloppy-san-client.pem @@ -0,0 +1,65 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 6084561304482469822 (0x5470b444dfc3d7be) + Signature Algorithm: sha256WithRSAEncryption + Issuer: CN=sloppy-san-root + Validity + Not Before: Oct 14 00:20:19 2025 GMT + Not After : Sep 20 00:20:19 2125 GMT + Subject: CN=sloppy-san-client + Subject Public Key Info: + Public Key Algorithm: id-ecPublicKey + Public-Key: (256 bit) + pub: + 04:5c:c5:bd:b2:0f:22:c9:a8:30:c2:19:49:f7:8a: + 74:6e:b0:79:36:a4:98:23:2b:68:8f:5f:1b:b3:ac: + 4f:67:75:2a:11:9a:39:06:15:e2:da:6d:82:c7:c6: + a5:b6:1a:f3:a1:76:cc:20:6a:fe:00:b5:16:0e:02: + a4:ec:15:6e:4a + ASN1 OID: prime256v1 + NIST CURVE: P-256 + X509v3 extensions: + X509v3 Key Usage: critical + Digital Signature, Key Encipherment + X509v3 Extended Key Usage: + TLS Web Client Authentication + X509v3 Basic Constraints: critical + CA:FALSE + X509v3 Authority Key Identifier: + 9A:A1:A8:3C:30:1B:EC:1F:B2:1F:10:0E:0C:42:A8:2A:B8:97:9A:8E + X509v3 Subject Alternative Name: + DNS:, DNS:example.com., email:not-an-email + Signature Algorithm: sha256WithRSAEncryption + Signature Value: + 96:bc:48:3c:aa:f6:8c:e4:a4:b5:40:6d:fe:20:1b:60:40:12: + e9:f5:58:94:0e:0d:dc:6d:a3:83:ae:3d:05:3b:64:1a:f4:c0: + 23:c9:0d:63:02:ea:c2:f4:e8:bc:88:20:8e:2e:bb:f0:79:32: + cc:0a:59:e2:17:6f:63:aa:5e:b8:0d:54:15:2f:5c:eb:08:7e: + eb:fe:31:62:b1:e5:da:88:dc:be:9e:20:01:f1:73:40:8d:13: + 55:36:aa:2e:58:13:b4:85:aa:63:30:2c:47:a4:95:61:33:f3: + 31:c7:f8:91:d1:18:3c:65:a8:fb:a4:8f:dc:51:8e:9a:d5:dc: + eb:04:b5:b1:f9:82:f5:ff:4a:7b:27:b3:3e:8e:59:30:93:57: + 7d:f2:b4:af:94:39:2b:b9:0d:c1:e5:94:0f:8d:83:03:74:e5: + 6f:38:cd:ee:df:1b:5d:64:48:b9:05:27:5f:09:12:c8:03:96: + 36:0d:d4:19:5b:be:76:ea:7d:f3:20:08:2a:b4:c6:92:63:41: + 44:d8:2c:b1:b8:71:7c:a9:1f:26:d7:99:04:d4:9b:a6:4b:a4: + fa:ef:b2:a9:f5:e7:af:53:4b:de:00:45:5c:5b:f0:2a:1a:bc: + 40:2f:97:ca:fb:9c:53:a8:16:46:89:a0:f9:43:45:47:de:3e: + 09:8e:a6:22 +-----BEGIN CERTIFICATE----- +MIICbjCCAVagAwIBAgIIVHC0RN/D174wDQYJKoZIhvcNAQELBQAwGjEYMBYGA1UE +AxMPc2xvcHB5LXNhbi1yb290MCAXDTI1MTAxNDAwMjAxOVoYDzIxMjUwOTIwMDAy +MDE5WjAcMRowGAYDVQQDExFzbG9wcHktc2FuLWNsaWVudDBZMBMGByqGSM49AgEG +CCqGSM49AwEHA0IABFzFvbIPIsmoMMIZSfeKdG6weTakmCMraI9fG7OsT2d1KhGa +OQYV4tptgsfGpbYa86F2zCBq/gC1Fg4CpOwVbkqjfzB9MA4GA1UdDwEB/wQEAwIF +oDATBgNVHSUEDDAKBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaA +FJqhqDwwG+wfsh8QDgxCqCq4l5qOMCcGA1UdEQQgMB6CAIIMZXhhbXBsZS5jb20u +gQxub3QtYW4tZW1haWwwDQYJKoZIhvcNAQELBQADggEBAJa8SDyq9ozkpLVAbf4g +G2BAEun1WJQODdxto4OuPQU7ZBr0wCPJDWMC6sL06LyIII4uu/B5MswKWeIXb2Oq +XrgNVBUvXOsIfuv+MWKx5dqI3L6eIAHxc0CNE1U2qi5YE7SFqmMwLEeklWEz8zHH ++JHRGDxlqPukj9xRjprV3OsEtbH5gvX/Snsnsz6OWTCTV33ytK+UOSu5DcHllA+N +gwN05W84ze7fG11kSLkFJ18JEsgDljYN1BlbvnbqffMgCCq0xpJjQUTYLLG4cXyp +HybXmQTUm6ZLpPrvsqn1569TS94ARVxb8CoavEAvl8r7nFOoFkaJoPlDRUfePgmO +piI= +-----END CERTIFICATE----- diff --git a/test/integration/auth/testdata/sloppy-san-root.pem b/test/integration/auth/testdata/sloppy-san-root.pem new file mode 100644 index 0000000000000..54386e1487a3b --- /dev/null +++ b/test/integration/auth/testdata/sloppy-san-root.pem @@ -0,0 +1,78 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 2937139693522916239 (0x28c2d0fd5822138f) + Signature Algorithm: sha256WithRSAEncryption + Issuer: CN=sloppy-san-root + Validity + Not Before: Oct 14 00:20:19 2025 GMT + Not After : Sep 20 00:20:19 2125 GMT + Subject: CN=sloppy-san-root + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + Public-Key: (2048 bit) + Modulus: + 00:9e:00:38:70:8d:a7:9c:fd:89:e4:33:f9:7e:e3: + 99:1f:19:69:a9:a3:7c:ca:8e:f4:52:ef:c8:a8:3d: + fc:6c:08:95:8b:14:f9:d9:a2:2b:25:7c:15:8e:aa: + a9:ec:19:fe:62:9f:18:33:12:72:b0:2f:37:b6:de: + d0:24:fe:19:ef:78:93:b7:7d:7a:44:46:4c:14:bd: + d7:23:a7:fc:44:43:6d:f9:29:f8:79:2a:61:fc:1f: + d4:79:49:19:53:5b:6d:5a:66:cd:59:a9:2b:38:c7: + c5:38:96:b8:12:36:c5:60:d8:dc:ea:86:df:9a:cd: + 50:95:be:5f:1a:38:67:dc:bf:67:24:5e:ed:06:79: + 32:b5:19:bd:11:ec:ff:61:b7:e2:32:05:8d:b6:c9: + 12:ba:92:7c:2a:9e:26:71:b2:d0:85:95:9d:68:79: + d0:3e:e5:8b:ac:e8:e4:22:6d:79:a3:77:58:01:72: + f9:67:7d:d8:5e:7f:5c:56:45:31:36:8e:f5:be:48: + c4:66:f1:14:ed:38:43:ae:5f:cc:20:66:7b:48:df: + 78:d5:f4:4f:67:2a:d4:ee:7b:36:d2:c1:5f:d1:3b: + e4:bb:31:0f:94:0c:19:f7:17:99:99:04:eb:b7:b4: + 34:6c:f9:0b:8c:61:e9:a5:5b:50:62:f7:24:51:25: + 3d:43 + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Key Usage: critical + Digital Signature, Key Encipherment, Certificate Sign + X509v3 Basic Constraints: critical + CA:TRUE + X509v3 Subject Key Identifier: + 9A:A1:A8:3C:30:1B:EC:1F:B2:1F:10:0E:0C:42:A8:2A:B8:97:9A:8E + X509v3 Subject Alternative Name: + DNS:, DNS:example.com. + Signature Algorithm: sha256WithRSAEncryption + Signature Value: + 4d:4f:ef:47:a0:41:96:9a:e0:98:e3:e6:5e:4f:70:6a:b1:16: + 3c:10:8b:f9:2b:12:57:58:28:88:a4:1a:e8:4c:a4:be:a0:c1: + ad:07:95:dd:d9:bc:db:a9:db:31:5f:42:30:60:19:e2:28:fb: + 72:78:91:a7:83:e7:bd:0f:52:b8:2b:fe:d0:0e:03:64:0e:08: + 8b:62:b9:bc:30:1d:76:86:42:a6:fe:f0:55:0d:3c:16:97:32: + 3a:9f:1a:0e:5b:01:68:9d:37:76:d5:ed:a8:e5:e6:1b:7d:ff: + b2:e3:c0:a0:8f:cb:2f:98:e5:6b:e5:b6:ef:fe:a4:c4:f8:33: + 6f:e1:90:89:16:69:58:c8:ca:95:99:d1:84:8e:0e:83:ed:a7: + ae:ac:4e:32:7e:72:95:fa:ce:3f:62:ae:06:57:40:b2:bf:79: + 8f:b2:f6:69:07:ee:d8:7c:70:b0:52:8d:f6:08:f9:de:a8:6a: + 90:77:6a:65:52:67:82:98:32:68:66:4d:8e:6b:a8:dd:b5:3c: + a7:fe:b4:98:d0:69:70:1b:60:60:1b:10:30:88:5c:9b:f0:6b: + 9e:52:47:2f:83:7d:77:e3:e2:af:a5:fb:de:65:91:51:0f:27: + b2:34:25:8f:97:55:ee:11:d0:d1:4e:8f:7a:cf:9f:7d:8e:e6: + 27:24:61:cf +-----BEGIN CERTIFICATE----- +MIIDFTCCAf2gAwIBAgIIKMLQ/VgiE48wDQYJKoZIhvcNAQELBQAwGjEYMBYGA1UE +AxMPc2xvcHB5LXNhbi1yb290MCAXDTI1MTAxNDAwMjAxOVoYDzIxMjUwOTIwMDAy +MDE5WjAaMRgwFgYDVQQDEw9zbG9wcHktc2FuLXJvb3QwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCeADhwjaec/YnkM/l+45kfGWmpo3zKjvRS78ioPfxs +CJWLFPnZoislfBWOqqnsGf5inxgzEnKwLze23tAk/hnveJO3fXpERkwUvdcjp/xE +Q235Kfh5KmH8H9R5SRlTW21aZs1ZqSs4x8U4lrgSNsVg2Nzqht+azVCVvl8aOGfc +v2ckXu0GeTK1Gb0R7P9ht+IyBY22yRK6knwqniZxstCFlZ1oedA+5Yus6OQibXmj +d1gBcvlnfdhef1xWRTE2jvW+SMRm8RTtOEOuX8wgZntI33jV9E9nKtTuezbSwV/R +O+S7MQ+UDBn3F5mZBOu3tDRs+QuMYemlW1Bi9yRRJT1DAgMBAAGjXTBbMA4GA1Ud +DwEB/wQEAwICpDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSaoag8MBvsH7If +EA4MQqgquJeajjAZBgNVHREEEjAQggCCDGV4YW1wbGUuY29tLjANBgkqhkiG9w0B +AQsFAAOCAQEATU/vR6BBlprgmOPmXk9warEWPBCL+SsSV1goiKQa6EykvqDBrQeV +3dm826nbMV9CMGAZ4ij7cniRp4PnvQ9SuCv+0A4DZA4Ii2K5vDAddoZCpv7wVQ08 +FpcyOp8aDlsBaJ03dtXtqOXmG33/suPAoI/LL5jla+W27/6kxPgzb+GQiRZpWMjK +lZnRhI4Og+2nrqxOMn5ylfrOP2KuBldAsr95j7L2aQfu2HxwsFKN9gj53qhqkHdq +ZVJngpgyaGZNjmuo3bU8p/60mNBpcBtgYBsQMIhcm/BrnlJHL4N9d+Pir6X73mWR +UQ8nsjQlj5dV7hHQ0U6Pes+ffY7mJyRhzw== +-----END CERTIFICATE----- diff --git a/test/utils/image/manifest.go b/test/utils/image/manifest.go index c00ebb8ffbe91..e4f740d0e4652 100644 --- a/test/utils/image/manifest.go +++ b/test/utils/image/manifest.go @@ -229,7 +229,7 @@ func initImageConfigs(list RegistryList) (map[ImageID]Config, map[ImageID]Config configs[BusyBox] = Config{list.PromoterE2eRegistry, "busybox", "1.36.1-1"} configs[CudaVectorAdd] = Config{list.PromoterE2eRegistry, "cuda-vector-add", "1.0"} configs[CudaVectorAdd2] = Config{list.PromoterE2eRegistry, "cuda-vector-add", "2.3"} - configs[DistrolessIptables] = Config{list.BuildImageRegistry, "distroless-iptables", "v0.6.13"} + configs[DistrolessIptables] = Config{list.BuildImageRegistry, "distroless-iptables", "v0.7.11"} configs[Etcd] = Config{list.GcEtcdRegistry, "etcd", "3.5.15-0"} configs[Httpd] = Config{list.PromoterE2eRegistry, "httpd", "2.4.38-4"} configs[HttpdNew] = Config{list.PromoterE2eRegistry, "httpd", "2.4.39-4"}