Louise K. Schmidtgen

Guard against MitM attack: remove node name from the token

19

I propose enhancing the security of microcluster join tokens by removing the node name from the token payload. Currently, including the node name in the token compromises the validation process,...

## Description Backport of https://github.com/canonical/microk8s/pull/4975. Unblocking Microk8s release CI by pre-install xdelta3 since snapd deb does not ship with it.

## Description Bump the k8s-dqlite version to v1.6.0. For the details of the fix read the release notes at: https://github.com/canonical/k8s-dqlite/releases/tag/v1.6.0 ... waiting on Dqlite release.

fix: add consistency checks across core_cluster_members, truststore, and dqlite

9

## Problem Microcluster can enter inconsistent states where core_cluster_members (database), truststore, and dqlite cluster configuration become out of sync during partial failures. This leads to failed operations and difficult recovery...

Microcluster itself can be out of sync with the underlying Dqlite’s membership configuration.

2

I tested clustering with Canonical k8s and embedded etcd. Hereby, I noticed that Microcluster itself can be out of sync with the underlying Dqlite’s membership configuration. In this scenario we...

Multipass info command should skip unreachable VMs in its output

1

**Describe the bug** I have multiple multipass VMs on my machine. After applying usg, fips and stig guidelines authentication is only possible via my rsa key. When I try to...

When we add a new node via a Dqlite clients request, Dqlite is returning before the cluster membership state is fully committed. Our client has no way of knowing whether...

During Canonical Kubernetes clustering tests I discovered that the Dqlite client (cluster.yaml) only gets updated every second leaving a race window during membership operations where snap refreshes/ node restarts/crashes prevent...