* Enhance network policy to isolate synced workload pods and improve cross-cluster pod isolation handling
* Add test for label update on synced Pod to ensure isolation label persistence
* Derive host pod CIDRs dynamically for the isolation NetworkPolicy
Compute the egress-exclude CIDRs from the --cluster-cidr flag or the live
Node PodCIDR(s) via FindPodCIDRs, instead of a hardcoded guess, so cross-cluster
pod isolation is enforced against the host's real pod network. Adds unit,
integration, and e2e coverage.
* update comment
* Sort CIDR list in FindPodCIDRs function to ensure consistent order for egress rules
* Use `t.Context()` instead of `context.Background()`
Co-authored-by: Kevin McDermott <bigkevmcd@gmail.com>
* Use Ginkgo provided context
* Refactor FindPodCIDRs to use sets for CIDR collection and simplify logic
* fix lint
---------
Co-authored-by: Kevin McDermott <bigkevmcd@gmail.com>
* Add tests asserting GetPods is scoped to the node's own Pods
Adds a unit test (fake host + virtual clients, Pods across multiple nodes plus
a dangling one) and a multi-node e2e test (a Deployment with one nginx Pod per
node via required anti-affinity; restart every k3k-kubelet agent Pod; assert no
workload Pod is deleted from the host or virtual cluster). Both pin the intended
behavior and fail against the current code; the fix follows in the next commit.
* Scope Provider.GetPods to the node's own Pods to prevent cross-node dangling-pod deletion
GetPods() listed host Pods cluster-wide (by the k3k.io/clusterName label only).
The vendored virtual-kubelet library's deleteDanglingPods reconciliation deletes
any Pod returned here that is missing from this instance's virtual Pod lister,
which is scoped to spec.nodeName == agentHostname. On a multi-node host cluster,
every restarting k3k-kubelet instance therefore saw Pods owned by other nodes as
'dangling' and deleted them from the host (and, in turn, the virtual cluster).
Scope GetPods by the *virtual* Pod's spec.nodeName -- the same ownership signal
the framework uses -- excluding Pods owned by other nodes while still returning
own-node Pods and genuinely dangling ones. The host Pod's physical node is not a
reliable owner (it is scheduled with only a soft, sometimes-absent affinity), so
it must not be used. Virtual Pods are read live to avoid a startup cache-sync
race. Makes the previous commit's tests pass.
* Refactor GetPods to scope to the cluster namespace and update tests accordingly
* Add AgentNameLabel to track Pods synced by the k3k-kubelet agent and update tests accordingly
* Add failing test for updatePod
* Add E2E tests for multi-node setup and kubelet restart scenarios
* Update Kubernetes version options in conformance tests workflow
* Enhance VM provisioning action to support dynamic bridge CIDR prefix and pin package versions
* Update k3s version in test suites to v1.36.2-k3s1
- Updated the k3sVersion and k3sOldVersion constants in both cli and e2e test suites to reflect the new version v1.36.2-k3s1 and the previous version v1.36.0-k3s1.
* updated README.md
* Add HCP (Hosted Control Plane) support
Introduce hosted control plane mode for k3k virtual clusters, including
API types, controller logic, server endpoint handling, CLI flags,
CRD updates, kubeconfig generation, and examples.
Co-Authored-By: RuFlo <ruv@ruv.net>
* removed hcpRegitration command
added HCP conformance tests
warning for hcp
fix multi-VM HCP conformance test networking
Both QEMU workers booted with `-net user` and ended up registering the
same InternalIP (10.0.2.15) because each VM gets its own isolated NAT
slirp. Flannel propagated this to `public-ip` on both nodes, so VXLAN
could not tunnel between workers and any cross-node pod traffic broke
(89 failed / 335 passed of 424 conformance specs).
Replace user-mode networking with a Linux bridge (k3kbr0,
192.168.100.0/24) and one TAP device per VM, so the two workers share
an L2 segment with unique routable IPs. NAT outbound from the bridge
keeps internet access working for image pulls.
Also set unique hostnames via cloud-init (worker-1/worker-2) and drop
the `--node-name` flag from INSTALL_K3S_EXEC, since k3s now picks the
correct node name from the OS hostname on its own.
Bump hydrophone back to `--parallel 4` to match the single-VM job
(parallelism was reduced earlier when the failure was thought to be
resource-related).
added HCP print command
updated crds
adding e2e tests
Refactor selectNonLoopbackSAN function to accept SANs directly and update related logic in ensureHCPRegistration
* Update agent flag validation and enhance ingress host check with a warning log
Refactor descriptions for cluster provisioning mode and role in CRDs and documentation
Refactor logging in ServerURL function to use controller-runtime logger
Rename selectNonLoopbackSAN to findNonLoopbackSAN for clarity and update references
Refactor ServerURL function and related code to remove unused parameters and improve clarity
Remove unused imports from kubeconfig.go to improve code clarity
* suggested changes
* fix comment
* fix test
---------
Co-authored-by: jpgouin <jeanphilippe.gouin@suse.com>
Co-authored-by: RuFlo <ruv@ruv.net>
* Add --tls-sans flag to k3kcli cluster create
* Refine --tls-sans flag description in k3kcli documentation
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix TLS SANs handling in cluster creation by using hostname directly
* Implement extractHost function and update TLS SAN handling in cluster creation
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
- Removed K3s container setup and teardown logic from CLI and E2E test suites.
- Simplified Kubernetes client initialization by eliminating the need for K3s container.
- Updated InitFromKubeconfig function to no longer require K3s container as a parameter.
- Deleted unused HelmInstaller and RESTClientGetter implementations.
- Cleaned up logging functions related to K3s and Helm operations.
* Refactor kubeconfig generation to remove unused port parameter and update related functions
* Refactor kubeconfig generation to streamline error handling and remove unused imports
* Refactor kubeconfig URL generation functions and deprecate old implementation
* restore old behavior
* Add 'k3kcli kubeconfig get' command and update documentation
* Refactor URL generation by removing deprecated getURLFromService function and updating tests to use new implementation
* Fix expected URL for LoadBalancer test case to include hostname
* Refactor kubeconfig test documentation to clarify URL generation behavior for ClusterIP, NodePort, and LoadBalancer service types
* Refactor kubeconfig URL generation functions to improve clarity and maintainability
* Remove deprecated 'k3kcli kubeconfig get' command and update related documentation
* Set logger to discard in NewRootCmd for improved logging control
* Refactor getURLFromService to streamline ingress key retrieval
* first commit
* refactor: update golangci configuration and reorder imports in namespace.go
* refactor: update golangci configuration for linters and formatters
* check restart for logs fetch
* rverted a bit the structure
* requested changes
* WriteLogs rename
* minor fix to translated ingress tls secrets in ingress object
updated cluster ingress sync options to include extra field for SyncTLSSecrets
Signed-off-by: Gaurav Mehta <gaurav.mehta@suse.com>
* rebase changes from main, include feedback for renaming ingress secret sync field to DisableTLSSecretTranslation, and add kubelet integration tests to verify secret name translation
Signed-off-by: Gaurav Mehta <gaurav.mehta@suse.com>
---------
Signed-off-by: Gaurav Mehta <gaurav.mehta@suse.com>
* Add integration tests for Deployment and StatefulSet creation with PVC in shared cluster
* Add affinity settings for pod scheduling based on agent hostname
* increased timeout
* focus test
* rmeove cleanup
* check for existing pvc
* remove focus
* add affinity tests for Pods in shared cluster
* refactor restartServerPod to improve pod restart checks and timeout handling
* unfocus
* fix test description
* removed all webhook references
* fix tests
* removal of webhook
* updated doc
* add downward API test
* small refactor of virtual-kubelet
* split tests
* Move cli tests
* Move e2e tests to their own directory
* Move integration tests
* Fix path within the cli tests
* Move k3k-kubelet tests
* Improve the various make test- options
* Remove dead code from cli tests
* Update development.md with the new make commands
This modifies the configuration of the created nodes via virtual-kubelet
to set the node type to be worker instead of agent.
Bump the Ginkgo version to the latest - allows use of `t.Context()`
rather than creating contexts.
Co-authored-by: Enrico Candino <enrico.candino@gmail.com>
* initial implementation
restored policyName
* added test, fixed priority scheduling
* requested changes from review
- wrapped errors
- fixed some kube-api-linter issues to match k8s conventions
- moved policy namespace check in the same condition branch
* bump kubernetes to v0.33.7
* updated kuberneets api versions
* bump tests
* fix k3s version
* fix test
* centralize k8s version
* remove focus
* revert GetPodCondition, GetContainerStatus and pin of k8s.io/controller-manager
* added --namespace flag to policy create to actually bind the new policy to existing namespaces
* fix lint
* fix tests
* added overwrite flag
* updated cli docs
* fix tests 2
* moved double quotes to single quote
* fix test
* fix missing namespaces cleanup
* fix conflict namespace
* fix PVC already created error, patch for existing volume, and check with hardcoded k3k name
* removed useless test
* fix for dump covdata from external pod
* keep namespaces flag
* fix for multi-node clusters
* fix for hanging pod in isolated namespace
* update statefulset controller
* fix for single pod
* adding pod controller
* added test
* removed comment
* merged service controller
* revert statefulset
* added test
* added common owner filter
Gaurav MehtaandGitHub
Jonathan CrowtherandGitHub
Hussein GalalandGitHub