fix(lifecycle): support Kubernetes 1.33 upgrade flow (#6929)
* fix: wait for registry before pulling kubeadm images
* fix: support kubeadm upgrade to newer minors
* fix: recover kubelet config during upgrades
* fix: handle kubelet upgrade recovery edge cases
* fix: refresh rootfs sealctl before use
* fix: tolerate existing temporary registry
* fix: ignore kubeadm upgrade health check job
* fix(kubernetes): align cert identity handling with kubeadm v1.29+ (#83)
* build(lifecycle): auto-detect C compiler and CC
Add CC and CC_<platform> Makefile options and implement compiler
resolution for CGO-enabled sealos/sealctl builds. Update DEVELOPGUIDE
with usage and a cross-compile example.
* fix(kubernetes): align cert identity handling with kubeadm v1.29+
- migrate remote control-plane certs across the v1.29 identity boundary
- repair remote admin.conf on all masters during upgrade
- keep local sealos PKI and kubeconfigs aligned with the v1.29+ model
- keep super-admin.conf local-only during renew and upgrade flows
- preserve pre-v1.31 long-lived cert policy and use v1beta4 fields on
v1.31+
- fix v1.31 remote admin.conf migration config distribution across
masters
---------
* fix(lifecycle): sync and upgrade codex
* fix: cert and add timeout for cluster role binding create
---------
Signed-off-by: Yun Pan <dinoallo@netc.it>
Co-authored-by: yy <56745951+lingdie@users.noreply.github.com>
Co-authored-by: Yun Pan <dinoallo@netc.it>
fix(lifecycle): fallback registry sync for oci media type (#6841)
fix: fallback registry sync for oci media type
Co-authored-by: Jiahui <4543bxy@gmail.com>
fix(lifecycle): clear stale registry auth when saving public images (#6808)
* fix(lifecycle): clear stale registry auth when saving public images
* fix: license
Co-authored-by: zijiren <84728412+zijiren233@users.noreply.github.com>
fix(dependencies): replace gcc-aarch64-linux-gnu with binutils-aarch6… (#6766)
* fix(dependencies): replace gcc-aarch64-linux-gnu with binutils-aarch64-linux-gnu in Dockerfile and YAML files
* fix(ci): update runs-on configuration for arm64 architecture in CI scripts
* fix(ci): update runs-on configuration for arm64 architecture in CI scripts
---------
Signed-off-by: cuisongliu <cuisongliu@qq.com>
Co-authored-by: cuisongliu <cuisongliu@qq.com>
fix(image-cri-shim): handle missing HOME env in systemd environments (#6620)
Fix kubeconfig lookup in buildKubeClient to properly handle systemd
environments where HOME environment variable may not be set.
Changes:
- Add fallback to /root as default home directory when HOME is empty
- This ensures kubeconfig can be found at /root/.kube/config in systemd services
Resolves issue where image-cri-shim managed by systemd could not locate
kubeconfig file due to missing HOME environment variable.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Jiahui <4543bxy@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
feat(image-cri-shim): add registry priority support for intelligent image matching (#6503)
* feat(image-cri-shim): add registry priority support for intelligent image matching
Implemented priority-based registry selection to optimize image pull performance
by prioritizing faster registries like sealos.hub while supporting custom
priority configuration for user-defined registries.
## Key Features
- **Priority System**:
- sealos.hub defaults to highest priority (1000)
- User registries default to priority 500
- Configurable priority range: 0-1000
- Auto-clamping for out-of-range values
- **Smart Matching**:
- Checks registries in priority order (highest first)
- Tries sealos.hub first, then user registries by priority
- Caches match results to avoid redundant manifest checks
- Falls back to original image if no registry has it
- **Backward Compatible**:
- Existing configs work without modification
- Priority field is optional
- Default values ensure reasonable behavior
## Changes
### Configuration (pkg/types/config.go)
- Added Priority field to Registry struct
- Added priority constants (SealosHubDefaultPriority=1000, RegistryDefaultPriority=500)
- Extended ShimAuthConfig with CRIPriorities and OfflinePriority
- Auto-clamping and default value assignment in PreProcess()
### Auth Store (pkg/server/auth_store.go)
- Added GetSortedRegistries() for priority-based ordering
- Added GetCRIPriorities() and GetOfflinePriority() accessors
- Introduced RegistryEntry type for registry metadata
- Implemented sortRegistriesByPriority() with tie-breaking rules
### Image Matching (pkg/server/utils.go)
- Added RegistryWithPriority type
- Implemented ReplaceImageWithPriority() for sequential registry attempts
- Enhanced logging for priority-based matching
### CRI Service (pkg/server/cri_server_v1.go)
- Refactored rewriteImage() to use priority-based selection
- Simplified PullImage() by removing complex fallback logic
- Added domain miss tracking for cache statistics
### Testing (pkg/server/priority_test.go)
- Comprehensive tests for priority sorting and ordering
- Config processing tests with boundary value validation
- 100% coverage of new functionality
### Documentation
- Updated README.md with priority configuration guide
- Added priority-example.yaml with detailed examples
- Documented priority rules, behavior, and use cases
## Example Configuration
```yaml
address: http://sealos.hub:5000
auth: admin:passw0rd
registries:
- address: docker.io
auth: user:pass
# priority: 500 (default)
- address: registry.example.com
auth: user:pass
priority: 800 # higher than docker.io
```
## Testing
All tests pass including:
- Priority ordering and sorting
- Config parsing with boundary values
- Cache statistics tracking
- Backward compatibility with existing tests
🤖 Generated with [Claude Code](https://claude.com/claude-code)
* feat(image-cri-shim): add customizable offlinePriority for sealos.hub
Added support for customizing sealos.hub priority through the optional
`offlinePriority` configuration field while maintaining full backward
compatibility with existing configurations.
## Key Features
- **Optional Configuration**: New `offlinePriority` field in Config struct
- **Smart Defaults**:
- Unconfigured or set to 0: uses default 1000 (highest priority)
- Allows lowering sealos.hub priority to favor other registries
- **Boundary Safety**: Auto-clamps to [0, 10000] range with warnings
- **Fully Backward Compatible**: Existing configs work unchanged
## Use Cases
1. **Default Behavior** (backward compatible):
- sealos.hub priority = 1000 (highest)
- Tried before all user registries
2. **Custom Lower Priority**:
- Set `offlinePriority: 700` to try fast-registry (900) first
- Useful when external registries are faster than sealos.hub
3. **Flexible Control**:
- Fine-tune registry selection order per deployment
- Adapt to different network environments
## Changes
### Configuration (pkg/types/config.go)
- Added `OfflinePriority int` field to Config struct
- Extended PreProcess() to handle custom offlinePriority:
- 0 or unset: use SealosHubDefaultPriority (1000)
- < 0: clamp to MinPriority (0) with warning
- > 10000: clamp to MaxPriority (10000) with warning
### Testing (pkg/server/priority_test.go)
- Added TestOfflinePriorityConfig:
- Tests default, custom, and boundary values
- Validates clamping behavior
- Added TestOfflinePriorityWithRegistries:
- Tests sealos.hub priority relative to other registries
- Verifies correct sorting order
### Documentation
- Updated README.md with offlinePriority field documentation
- Added examples showing how to customize sealos.hub priority
- Documented backward compatibility guarantees
- Updated priority-example.yaml with offlinePriority usage
## Example Configuration
```yaml
address: http://sealos.hub:5000
auth: admin:passw0rd
# Lower sealos.hub priority to try other registries first
offlinePriority: 700
registries:
- address: fast-registry.io
auth: user:pass
priority: 900 # Will be tried before sealos.hub
```
## Testing
All tests pass including:
- Default offlinePriority behavior
- Custom priority configuration
- Boundary value handling
- Priority ordering with multiple registries
- Backward compatibility (existing tests)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
* feat(image-cri-shim): add ConfigMap priority sync support and comprehensive documentation
Enable ConfigMap to fully support priority field synchronization for registries.
### Code Changes
1. **pkg/types/configmap_sync.go**: Add priority sync from ConfigMap
- Extend registryEntry struct with Priority field
- Extend registryConfigSpec struct with OfflinePriority field
- Update mergeShimConfig() to sync priority values
- Add detailed logging for debugging sync process
2. **pkg/types/configmap_sync_test.go**: Add comprehensive tests
- TestConfigMapPrioritySync: Verify priority and offlinePriority sync
- Test edge cases (zero priority, custom priorities)
- All tests passing
3. **pkg/server/cri_server_v1.go**: Add priority-aware logging
- Log sorted registry list with priorities
- Show priority order before image pull
- Indicate offline registry in logs
4. **pkg/server/utils.go**: Enhance priority matching logs
- Log each registry attempt with priority
- Show success/failure status for each attempt
- Display final image rewrite result
### Documentation
5. **CONFIGMAP_GUIDE.md**: Comprehensive ConfigMap guide (550+ lines)
- Feature overview and core capabilities
- Complete ConfigMap configuration specification
- Field-by-field documentation
- Usage scenarios and examples
- Troubleshooting guide
- Best practices
- Updated to reflect priority support
### Features
✅ ConfigMap fully supports priority field for registries
✅ ConfigMap fully supports offlinePriority for sealos.hub
✅ Detailed debug logging for troubleshooting
✅ Comprehensive documentation with examples
✅ All tests passing
### Technical Details
- Priority values are synced as-is from ConfigMap (including 0)
- Priority boundary validation (0-10000) happens in PreProcess
- ConfigMap registries completely replace local config (existing behavior)
- YAML serialization correctly includes priority fields
- Debug logs help verify sync process and priority order
🤖 Generated with [Claude Code](https://claude.com/claude-code)
* add license
---------
Co-authored-by: Jiahui <4543bxy@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
fix(lifecycle): enable configurable execution timeout for all commands (#6442)
* fix: enable configurable execution timeout for all commands
The ssh.RegisterFlags() function exists to expose execution timeout
configuration, but was never called in the command initialization flow.
This caused all script executions to be subject to a hardcoded 5-minute
timeout that users could not override.
Changes:
- Call ssh.RegisterFlags() in root command initialization
- Make --execution-timeout and --max-retry available as global flags
- Users can now configure timeout via: sealos run --execution-timeout 1h
This fix allows users to run long-running scripts in container images
without hitting the 5-minute timeout limit.
Related to #6441🤖 Generated with [Claude Code](https://claude.com/claude-code)
* test: add automated tests for execution timeout configuration
This commit adds comprehensive E2E and unit tests to validate the
execution timeout configuration feature (issue #6441).
Changes:
- Add E2E test suite with 6 comprehensive test cases
- Add unit tests for command options (4 test suites)
- Create dedicated GitHub workflow for timeout tests
- Integrate timeout tests into core E2E test matrix
Test Coverage:
- Custom execution timeout for long-running scripts (600s)
- Default timeout behavior verification (300s)
- Unlimited timeout configuration (0)
- Multiple timeout format validation (s, m, h, mixed)
- Apply/Run command integration tests
- Max-retry flag functionality
- SSH + timeout combination scenarios
New Files:
- lifecycle/test/e2e/execution_timeout_test.go
- lifecycle/test/e2e/testhelper/cmd/sealosCmdOpts_timeout_test.go
- .github/workflows/e2e_execution_timeout.yml
Modified Files:
- lifecycle/test/e2e/testhelper/cmd/sealosCmdOpts.go
- Add ExecutionTimeout and MaxRetry fields to RunOptions
- Add ExecutionTimeout field to ApplyOptions
- Update Args() methods to include new flags
- lifecycle/test/e2e/suites/operators/interface.go
- Add RunWithOpts() and ApplyOpts() to FakeClusterInterface
- lifecycle/test/e2e/suites/operators/cluster.go
- Implement RunWithOpts() and ApplyOpts() methods
- .github/workflows/e2e_test_core.yml
- Add E2E_sealos_execution_timeout_test to test matrix
Features:
- Automated CI/CD testing on push/PR
- Manual workflow dispatch support
- Test result artifact uploads
- Timeout flag availability verification
Related to #6441🤖 Generated with [Claude Code](https://claude.com/claude-code)
* refactor: migrate execution timeout from CLI flags to environment variables
Replace command-line flags (--execution-timeout, --max-retry) with global
environment variables (SEALOS_EXECUTION_TIMEOUT, SEALOS_MAX_RETRY) for
consistent configuration management across sealos.
Changes:
- Add EXECUTION_TIMEOUT and MAX_RETRY to sealos env configuration system
- Refactor ssh package to read timeout/retry from system config instead of global vars
- Remove RegisterFlags() function and CLI flag registration from root command
- Update SSH operations (connect, scp) to use GetMaxRetry() and GetExecutionTimeout()
- Support multiple timeout formats: 300s, 5m, 1h, 1h30m, and 0 (unlimited)
- Rewrite E2E tests to use environment variables instead of command flags
- Update GitHub workflow to set environment variables for testing
Usage Changes:
- OLD: sealos run --execution-timeout 1h --max-retry 10 myimage
- NEW: export SEALOS_EXECUTION_TIMEOUT=1h SEALOS_MAX_RETRY=10
sealos run myimage
This is a breaking change. Users need to migrate from CLI flags to
environment variables. Default values remain unchanged (300s, 5 retries).
Related to #6441🤖 Generated with [Claude Code](https://claude.com/claude-code)
* fix: correct execution timeout test to use proper cluster images
Replace incorrect container image usage (nginx:alpine) with proper
Sealos cluster images (labring/kubernetes, labring/helm, labring/calico)
in execution timeout tests.
Changes:
- Remove PatchDockerfile and custom image building
- Use standard cluster images directly for timeout testing
- Focus on testing environment variable timeout configuration
- Simplify test cases to validate timeout behavior without complex image setup
Error Fixed:
- "can't apply application type images only since RootFS type image is not applied yet"
The tests now correctly use cluster images that are compatible with Sealos
cluster deployment while validating the SEALOS_EXECUTION_TIMEOUT and
SEALOS_MAX_RETRY environment variable configurations.
Related to #6441🤖 Generated with [Claude Code](https://claude.com/claude-code)
* fix: separate timeout format validation test to avoid cluster reset failure
Move the timeout format validation test to a separate context that doesn't
require cluster reset. The previous implementation tried to reset a cluster
that was never created, causing AfterEach to fail.
Changes:
- Create separate "timeout format validation" context
- Remove cluster reset from format validation test's AfterEach
- Only clean up environment variables in format validation tests
Error Fixed:
- "failed to reset cluster: exit status 1" in format validation test
This ensures that tests which only validate environment variable formats
don't trigger unnecessary cluster operations.
Related to #6441🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Jiahui <4543bxy@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
fix(image): implement caching and domain matching for image rewriting (#6180)
* fix(image): implement caching and domain matching for image rewriting
* fix(image): optimize image rewriting with LRU caching and domain matching
* fix(cache): add cache configuration and metrics for image rewriting
* fix(image): enhance logging for image rewriting process and cache hits
* fix(config): add cache configuration for image rewriting with hot reload support
* fix(config): add cache configuration for image rewriting with hot reload support
* fix(license): add Apache 2.0 license header to test files
* fix(docs): add example configurations for cache settings in USAGE.md
* fix(image): simplify cache access and improve thread safety in image service
* fix(image): enhance cache configuration with detailed comments for clarity
* fix(image): improve authentication handling and cache management in image service
* fix(image): refine registry matching logic to enforce exact matches and improve case sensitivity
* fix(image-cri-shim): prefer original registry; fallback offline only on failure; exact domain matching with caching (#900)
* fix(image-cri-shim): prefer original registry; fallback offline only on failure; exact domain matching with caching
* lifecycle: remove staging entrypoint for image-cri-shim and unify to CLI build; no functional change.
---------
Signed-off-by: cuisongliu <cuisongliu@qq.com>
Co-authored-by: cuisongliu <cuisongliu@qq.com>
Co-authored-by: xzy <nowinkey@tom.com>
* fix(license): update CRD version and add additional printer columns for license status (#6207)
* feat(license): implement license controller with Helm chart and RBAC configuration
* fix(license): correct logic for extending default license for devbox users
* fix(license): update license validation to use context for improved handling
* fix(license): change EncryptionKey to encryptionKey and add getter function
* fix(license): extend default license expiration for devbox users to 50 years
(cherry picked from commit 2df0bdf854)
* fix(build): enable static linking for Go binaries
* fix(build): correct extldflags syntax for static linking in Go binaries
---------
(cherry picked from commit 09d305e426)
Signed-off-by: cuisongliu <cuisongliu@qq.com>
* feat(apply): conditionally append components based on distribution type
Signed-off-by: cuisongliu <cuisongliu@qq.com>
* fix(cluster): return nil for rootfs image if image spec is empty
Signed-off-by: cuisongliu <cuisongliu@qq.com>
---------
Signed-off-by: cuisongliu <cuisongliu@qq.com>
Wang Zhihao