* Add cluster deletion and completion enhancements
- Implemented `--all` flag for deleting all clusters in a namespace.
- Updated argument parsing to allow for maximum one cluster name.
- Added completion functions for cluster names with namespace filtering.
- Enhanced tests for cluster argument resolution and completion functions.
* fix docs
* Add log message for empty cluster deletion in specified namespace
* Refactor context handling in command functions to use `cmd.Context()`
* Refactor E2E tests to use a matrix strategy and update labels for better organization
* Enhance E2E test labels for better categorization and clarity
* Refactor E2E test labels for improved clarity and organization
* Add completion to `--namespace` flag
* Add namespace completion to policy create command
* Refactor namespace completion functions for consistency across commands
* addressed some comments
* Enhance network policy to isolate synced workload pods and improve cross-cluster pod isolation handling
* Add test for label update on synced Pod to ensure isolation label persistence
* Derive host pod CIDRs dynamically for the isolation NetworkPolicy
Compute the egress-exclude CIDRs from the --cluster-cidr flag or the live
Node PodCIDR(s) via FindPodCIDRs, instead of a hardcoded guess, so cross-cluster
pod isolation is enforced against the host's real pod network. Adds unit,
integration, and e2e coverage.
* update comment
* Sort CIDR list in FindPodCIDRs function to ensure consistent order for egress rules
* Use `t.Context()` instead of `context.Background()`
Co-authored-by: Kevin McDermott <bigkevmcd@gmail.com>
* Use Ginkgo provided context
* Refactor FindPodCIDRs to use sets for CIDR collection and simplify logic
* fix lint
---------
Co-authored-by: Kevin McDermott <bigkevmcd@gmail.com>
* Add tests asserting GetPods is scoped to the node's own Pods
Adds a unit test (fake host + virtual clients, Pods across multiple nodes plus
a dangling one) and a multi-node e2e test (a Deployment with one nginx Pod per
node via required anti-affinity; restart every k3k-kubelet agent Pod; assert no
workload Pod is deleted from the host or virtual cluster). Both pin the intended
behavior and fail against the current code; the fix follows in the next commit.
* Scope Provider.GetPods to the node's own Pods to prevent cross-node dangling-pod deletion
GetPods() listed host Pods cluster-wide (by the k3k.io/clusterName label only).
The vendored virtual-kubelet library's deleteDanglingPods reconciliation deletes
any Pod returned here that is missing from this instance's virtual Pod lister,
which is scoped to spec.nodeName == agentHostname. On a multi-node host cluster,
every restarting k3k-kubelet instance therefore saw Pods owned by other nodes as
'dangling' and deleted them from the host (and, in turn, the virtual cluster).
Scope GetPods by the *virtual* Pod's spec.nodeName -- the same ownership signal
the framework uses -- excluding Pods owned by other nodes while still returning
own-node Pods and genuinely dangling ones. The host Pod's physical node is not a
reliable owner (it is scheduled with only a soft, sometimes-absent affinity), so
it must not be used. Virtual Pods are read live to avoid a startup cache-sync
race. Makes the previous commit's tests pass.
* Refactor GetPods to scope to the cluster namespace and update tests accordingly
* Add AgentNameLabel to track Pods synced by the k3k-kubelet agent and update tests accordingly
* Add failing test for updatePod
- Updated action descriptions for clarity in provision-k3s-vm-workers.
- Refactored steps in provision-k3s-vm-workers for improved readability.
- Adjusted permissions formatting in multiple workflows for consistency.
- Added YAML linting step in validate workflow to ensure YAML file quality.
- Introduced .yamllint configuration file for GitHub Actions YAML files.
- Enhanced Makefile to include a target for linting YAML files.
Hussein GalalandGitHub
Enrico CandinoandGitHub
Alex BissessurandGitHub
bcraftandGitHub
Pavel ZhukovandGitHub
Kevin McDermottandGitHub
