Skip to content

Conversation

@ethandcosta
Copy link

Updates dqlite to use 1.1.13 to patch CVE.

bschimke95 and others added 13 commits April 3, 2024 16:56
* Add delegate config if cpuset is missing
This patch ensures that the `nf_conntrack` kernel module is loaded
before `kubelite` is started as the ProxyServer needs to read some
conntrack module-related params from procfs.

Previously, although the it would always crashed if the module wasn't
loaded, this wasn't that common of an occurrence in practice as there
are quite a few ways `nf_conntrack` gets loaded transparently:
* Cilium [automatically loads `iptable_nat`](https://github.com/cilium/cilium/blob/63cd391f93b4e2c865268241d384504348672042/pkg/datapath/iptables/iptables.go#L367-L368)
after a small startup delay, whose dependency tree includes `nf_conntrack`
* starting firewalld/ufw/most other firewall services
* setting iptables/nftables rules which imply session tracking

By explicitly loading `nf_conntrack` before starting `kubelite`,
it should ensure the procfs values ther ProxyServer reads are
always present on startup.

Signed-off-by: Nashwan Azhari <[email protected]>
* backport: [1.30] memory leak k8s-dqlite v1.1.12
* update gh actions artifact
* Trivy job fix
* CI: Distro from env variable in test (#4913)

* CI: Pins pytest to 8.3.4 for Test core addons (#4923)

* use pytest 8.3.4 in lxc install-deps

* Disable testing on debian and centos. Images missing. (#4606)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants