Skip to content

Commit c32a5d8

Browse files
bert-ebert-e
committed
Merge branch 'improvement/MK8S-94-support-etcd-distroless' into q/133.0
2 parents 566d427 + fab28ca commit c32a5d8

File tree

4 files changed

+65
-56
lines changed

4 files changed

+65
-56
lines changed

‎.github/actions/remove-node/action.yaml‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -29,24 +29,26 @@ runs:
2929
with:
3030
NODE: ${{ inputs.from-node }}
3131
COMMAND: >
32-
sudo crictl exec -i \"${{ steps.get-container.outputs.RESULT }}\" sh -c \"
33-
ETCDCTL_API=3 etcdctl --endpoints https://127.0.0.1:2379
34-
--cert /etc/kubernetes/pki/etcd/server.crt
35-
--key /etc/kubernetes/pki/etcd/server.key
36-
--cacert /etc/kubernetes/pki/etcd/ca.crt
37-
member list\" | awk -F ', ' '\$3 ~ \"${{ inputs.node-to-remove }}\" { print \$1 }'
32+
sudo crictl exec -i \"${{ steps.get-container.outputs.RESULT }}\"
33+
etcdctl
34+
--endpoints=https://127.0.0.1:2379
35+
--cert=/etc/kubernetes/pki/etcd/server.crt
36+
--key=/etc/kubernetes/pki/etcd/server.key
37+
--cacert=/etc/kubernetes/pki/etcd/ca.crt
38+
member list | awk -F ', ' '\$3 ~ \"${{ inputs.node-to-remove }}\" { print \$1 }'
3839
CAPTURE_RESULT: "true"
3940
- name: "Remove the etcd member"
4041
uses: ./.github/actions/run-command-ssh
4142
with:
4243
NODE: ${{ inputs.from-node }}
4344
COMMAND: >
44-
sudo crictl exec -i \"${{ steps.get-container.outputs.RESULT }}\" sh -c \"
45-
ETCDCTL_API=3 etcdctl --endpoints https://127.0.0.1:2379
46-
--cert /etc/kubernetes/pki/etcd/server.crt
47-
--key /etc/kubernetes/pki/etcd/server.key
48-
--cacert /etc/kubernetes/pki/etcd/ca.crt
49-
member remove ${{ steps.get-id.outputs.RESULT }}\"
45+
sudo crictl exec -i \"${{ steps.get-container.outputs.RESULT }}\"
46+
etcdctl
47+
--endpoints=https://127.0.0.1:2379
48+
--cert=/etc/kubernetes/pki/etcd/server.crt
49+
--key=/etc/kubernetes/pki/etcd/server.key
50+
--cacert=/etc/kubernetes/pki/etcd/ca.crt
51+
member remove \"${{ steps.get-id.outputs.RESULT }}\"
5052
- name: "Remove the node object"
5153
uses: ./.github/actions/run-command-ssh
5254
with:

‎CHANGELOG.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,11 @@
22

33
## Release 133.0.0 (in development)
44

5+
### Enhancements
6+
7+
- Support etcd distroless images for Kubernetes 1.33+. Above etcd 3.5.21, etcd images are now distroless and upstreamed to the etcd project.
8+
(PR[#4740](https://github.com/scality/metalk8s/pull/4740))
9+
510
## Release 132.0.0 (in development)
611

712
### Enhancements

‎docs/operation/disaster_recovery/bootstrap_backup_restore.rst‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -56,21 +56,21 @@ Restoring a Bootstrap Node
5656
.. code::
5757
5858
crictl exec -it "$CONT_ID" \
59-
etcdctl --endpoints https://localhost:2379 \
60-
--cacert /etc/kubernetes/pki/etcd/ca.crt \
61-
--key /etc/kubernetes/pki/etcd/server.key \
62-
--cert /etc/kubernetes/pki/etcd/server.crt \
59+
etcdctl --endpoints=https://localhost:2379 \
60+
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
61+
--key=/etc/kubernetes/pki/etcd/server.key \
62+
--cert=/etc/kubernetes/pki/etcd/server.crt \
6363
member list
6464
6565
#. Remove the etcd member (replace ``<etcd_id>`` in the command).
6666

6767
.. code::
6868
6969
crictl exec -it "$CONT_ID" \
70-
etcdctl --endpoints https://localhost:2379 \
71-
--cacert /etc/kubernetes/pki/etcd/ca.crt \
72-
--key /etc/kubernetes/pki/etcd/server.key \
73-
--cert /etc/kubernetes/pki/etcd/server.crt \
70+
etcdctl --endpoints=https://localhost:2379 \
71+
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
72+
--key=/etc/kubernetes/pki/etcd/server.key \
73+
--cert=/etc/kubernetes/pki/etcd/server.crt \
7474
member remove <etcd_id>
7575
7676
#. Because multiple bootstrap nodes are not supported, remove the old

‎scripts/backup.sh.in‎

Lines changed: 38 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -24,29 +24,29 @@ _usage() {
2424
}
2525

2626
while (( "$#" )); do
27-
case "$1" in
28-
-v|--verbose)
29-
VERBOSE=1
30-
;;
31-
-l|--log-file)
32-
LOGFILE="$2"
33-
shift
34-
;;
35-
-b|--backup-file)
36-
BACKUP_ARCHIVE="$2"
37-
shift
38-
;;
39-
# Disable the backup replication on other master nodes
40-
-n|--no-replication)
41-
REPLICATION=0
42-
;;
43-
*) # unsupported flags
44-
echo "Error: Unsupported flag $1" >&2
45-
_usage
46-
exit 1
47-
;;
48-
esac
49-
shift
27+
case "$1" in
28+
-v|--verbose)
29+
VERBOSE=1
30+
;;
31+
-l|--log-file)
32+
LOGFILE="$2"
33+
shift
34+
;;
35+
-b|--backup-file)
36+
BACKUP_ARCHIVE="$2"
37+
shift
38+
;;
39+
# Disable the backup replication on other master nodes
40+
-n|--no-replication)
41+
REPLICATION=0
42+
;;
43+
*) # unsupported flags
44+
echo "Error: Unsupported flag $1" >&2
45+
_usage
46+
exit 1
47+
;;
48+
esac
49+
shift
5050
done
5151

5252
TMPFILES=$(mktemp -d)
@@ -79,8 +79,8 @@ _save_cp() {
7979
if [ -f "$src" ]; then
8080
echo "Copying '$src' to '$dst'"
8181
if [ ! -d "$(dirname "$dst")" ]; then
82-
echo "Creating '$(dirname "$dst")' directory"
83-
mkdir -p "$(dirname "$dst")"
82+
echo "Creating '$(dirname "$dst")' directory"
83+
mkdir -p "$(dirname "$dst")"
8484
fi
8585
cp -a "$src" "$dst"
8686
elif [ -d "$src" ]; then
@@ -115,21 +115,23 @@ backup_cas() {
115115

116116
backup_etcd() {
117117
local -r etcd_snapshot="etcd_snapshot_$(date -u +%Y%m%d_%H%M%S)"
118-
local -r cmd=(
119-
"ETCDCTL_API=3 etcdctl --endpoints https://127.0.0.1:2379"
120-
"--cert /etc/kubernetes/pki/etcd/salt-master-etcd-client.crt"
121-
"--key /etc/kubernetes/pki/etcd/salt-master-etcd-client.key"
122-
"--cacert /etc/kubernetes/pki/etcd/ca.crt"
123-
"snapshot save $etcd_snapshot"
124-
)
125118
local etcd_container=''
126119
echo "Snapshot etcd"
127120
etcd_container="$(crictl ps -q \
128121
--label io.kubernetes.pod.namespace=kube-system \
129122
--label io.kubernetes.container.name=etcd \
130123
--state Running)"
131-
echo "Running '${cmd[*]}' in etcd container $etcd_container"
132-
crictl exec -i "$etcd_container" sh -c "${cmd[*]}"
124+
echo "Running etcdctl snapshot save in etcd container $etcd_container"
125+
# Note: etcd image in Kubernetes 1.33+ is distroless (no shell), so we must
126+
# exec etcdctl directly without using "sh -c".
127+
# etcd 3.4+ defaults to API v3, so ETCDCTL_API=3 is no longer required.
128+
crictl exec -i "$etcd_container" \
129+
etcdctl \
130+
--endpoints=https://127.0.0.1:2379 \
131+
--cert=/etc/kubernetes/pki/etcd/salt-master-etcd-client.crt \
132+
--key=/etc/kubernetes/pki/etcd/salt-master-etcd-client.key \
133+
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
134+
snapshot save "$etcd_snapshot"
133135

134136
local -r rootfs_v1="/run/containerd/io.containerd.runtime.v1.linux/k8s.io/${etcd_container}/rootfs"
135137
local -r rootfs_v2="/run/containerd/io.containerd.runtime.v2.task/k8s.io/${etcd_container}/rootfs"
@@ -175,8 +177,8 @@ replicate_archives() {
175177
salt_master_exec=(crictl exec -i "$(get_salt_container)")
176178

177179
"${salt_master_exec[@]}" salt-run --state-output=mixed state.orchestrate \
178-
metalk8s.orchestrate.backup.replication \
179-
saltenv=metalk8s-@@VERSION
180+
metalk8s.orchestrate.backup.replication \
181+
saltenv=metalk8s-@@VERSION
180182
}
181183

182184
run "Backing up MetalK8s configurations" backup_metalk8s_conf

0 commit comments

Comments
 (0)