From 88f5b2994f0d987342a3554a6d7fb25770a69b81 Mon Sep 17 00:00:00 2001 From: navigator Date: Thu, 8 Oct 2026 07:06:11 +0000 Subject: [PATCH 1/2] fix: keel-overlay-etcd 0.4.0 depends on etcd-client, the same upstream as etcd-server keel asks etcd with etcdctl over gRPC, the only way etcd 3.5 takes a client certificate's CN as its user (its JSON gateway calls etcd with the member's own certificate, and refuses a client certificate with a CN once auth is on). Keel-Linux/keel#83 makes the CN the user, so the etcd overlay brings etcdctl, and depends on the keel that asks with it (0.22.0). etcd-client and etcd-server come from Debian's etcd source, not this package's, so their binary versions cannot be tied with ${source:Version} here; both are bounded to the upstream release keel is tested against, 3.5.16, and a new upstream is a deliberate update of this package. overlay-install.bats checks that the two installed packages come from the same source version. --- packages/README.md | 2 +- packages/etcd/debian/changelog | 14 ++++++++++++++ packages/etcd/debian/control | 10 +++++++--- tests/overlay-install.bats | 12 ++++++++++++ 4 files changed, 34 insertions(+), 4 deletions(-) diff --git a/packages/README.md b/packages/README.md index 79a17336..4970268e 100644 --- a/packages/README.md +++ b/packages/README.md @@ -11,7 +11,7 @@ directory each, with its own changelog and version, released on its own | --- | --- | --- | --- | | `installer/` | `keel-overlay-installer` | Keel's `inithooks` (>= 2.3.6+keel14), `confconsole` (>= 2.2.3+keel8), `keel` (>= 0.12.0) | none; its manifest names the first boot hooks the three ship | | `wireguard/` | `keel-overlay-wireguard` | trixie's `wireguard-tools` 1.0.20210914 | none; the interface is the instance spec's | -| `etcd/` | `keel-overlay-etcd` | trixie's `etcd-server` 3.5.16, `keel` (>= 0.21.0), whose gate its drop-in runs, and `keel-overlay-wireguard`, which its manifest `requires` | `etcd.service`, and its drop-in `keel-overlay-etcd.conf`: one member restarts at a time | +| `etcd/` | `keel-overlay-etcd` | trixie's `etcd-server` 3.5.16 and its `etcd-client` (etcdctl, which keel asks etcd with over gRPC, keel#83), both bounded to that upstream release, `keel` (>= 0.22.0), whose gate its drop-in runs and whose etcd goes through etcdctl, and `keel-overlay-wireguard`, which its manifest `requires` | `etcd.service`, and its drop-in `keel-overlay-etcd.conf`: one member restarts at a time | | `vip/` | `keel-overlay-vip` | `keel` (>= 0.21.0), whose `keel vip` the units run, and `keel-overlay-wireguard`, which its manifest `requires` | `keel-vip.service`, the VIP's root helper with etcd, which starts its unprivileged controller as the transient `keel-vip-control`; and `keel-vip-check.timer`, part of it | | `crowdsec/` | `keel-overlay-crowdsec` | trixie's `crowdsec` 1.4.6-10 and `crowdsec-firewall-bouncer` 0.0.25 | `crowdsec.service`, `crowdsec-firewall-bouncer.service` | | `nginx/` | `keel-overlay-nginx` | trixie's `nginx` 1.26.3 and `libnginx-mod-stream` | `nginx.service`, enabled in every mode | diff --git a/packages/etcd/debian/changelog b/packages/etcd/debian/changelog index 9551e0df..9038d244 100644 --- a/packages/etcd/debian/changelog +++ b/packages/etcd/debian/changelog @@ -1,3 +1,17 @@ +keel-overlay-etcd (0.4.0) trixie; urgency=medium + + * Depends on etcd-client, the same upstream version as etcd-server + (3.5.16; both from Debian's etcd source, so the binary versions can + not be tied with ${source:Version} from this package's source, and + both are bounded to that upstream release instead): keel asks etcd + with etcdctl over gRPC, the only way etcd takes a client + certificate's CN as its user, and turns etcd's JSON gateway off + (Keel-Linux/keel#83). A newer etcd upstream is a deliberate update + of this package. + * Depends on keel (>= 0.22.0), which asks etcd with etcdctl. + + -- Marcos Mendez Thu, 08 Oct 2026 16:00:00 +0000 + keel-overlay-etcd (0.3.0) trixie; urgency=medium * etcd restarted one member at a time (the maintainer's requirement of diff --git a/packages/etcd/debian/control b/packages/etcd/debian/control index f79f19c4..7dffa271 100644 --- a/packages/etcd/debian/control +++ b/packages/etcd/debian/control @@ -13,14 +13,18 @@ Vcs-Browser: https://github.com/Keel-Linux/common/tree/19.x/packages/etcd Package: keel-overlay-etcd Architecture: all Depends: + etcd-client (>= 3.5.16), + etcd-client (<< 3.5.17~), etcd-server (>= 3.5.16), - keel (>= 0.21.0), + etcd-server (<< 3.5.17~), + keel (>= 0.22.0), keel-overlay-wireguard, ${misc:Depends}, Description: Keel overlay: etcd, the mesh registry The etcd overlay of Keel Linux (handbook decisions 0025 and 0036): trixie's - etcd-server, and the overlay manifest keel reads, installed as - /usr/share/keel/overlays/etcd.yaml (decision 0041). + etcd-server, its etcdctl (etcd-client, the same upstream version), which + keel asks etcd with over gRPC (keel#83), and the overlay manifest keel + reads, installed as /usr/share/keel/overlays/etcd.yaml (decision 0041). . etcd is installed disabled and stopped, the state of a simple installation: the first installation of this package disables the unit diff --git a/tests/overlay-install.bats b/tests/overlay-install.bats index fa79e74c..95202242 100644 --- a/tests/overlay-install.bats +++ b/tests/overlay-install.bats @@ -298,6 +298,18 @@ assert_simple_state() { [ "$output" != active ] } +@test "etcdctl comes with the etcd overlay, from etcd-server's source version" { + # keel asks etcd with etcdctl over gRPC (Keel-Linux/keel#83) + command -v etcdctl + run dpkg-query -W -f='${source:Package} ${source:Version}' etcd-client + [ "$status" -eq 0 ] + local client="$output" + run dpkg-query -W -f='${source:Package} ${source:Version}' etcd-server + [ "$status" -eq 0 ] + echo "etcd-client: $client; etcd-server: $output" + [ "$client" = "$output" ] +} + @test "the VIP check timer is not enabled and not running: it belongs to the controller" { run systemctl is-enabled keel-vip-check.timer echo "$output" From 67f81a99d5fb37fefea76e721ae3de1899080f64 Mon Sep 17 00:00:00 2001 From: navigator Date: Thu, 8 Oct 2026 08:24:34 +0000 Subject: [PATCH 2/2] fix: keel-overlay-etcd 0.4.0 keeps keel (>= 0.21.0) The install test builds keel from its pinned commit, 0.21.0, and a dependency on a keel not yet on main cannot be met there. The direction is keel's: 0.22.0 Breaks the overlays before 0.4.0, which lack etcdctl; an older keel beside etcdctl merely leaves it unused. --- packages/README.md | 2 +- packages/etcd/debian/changelog | 3 ++- packages/etcd/debian/control | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/packages/README.md b/packages/README.md index 4970268e..a6095f45 100644 --- a/packages/README.md +++ b/packages/README.md @@ -11,7 +11,7 @@ directory each, with its own changelog and version, released on its own | --- | --- | --- | --- | | `installer/` | `keel-overlay-installer` | Keel's `inithooks` (>= 2.3.6+keel14), `confconsole` (>= 2.2.3+keel8), `keel` (>= 0.12.0) | none; its manifest names the first boot hooks the three ship | | `wireguard/` | `keel-overlay-wireguard` | trixie's `wireguard-tools` 1.0.20210914 | none; the interface is the instance spec's | -| `etcd/` | `keel-overlay-etcd` | trixie's `etcd-server` 3.5.16 and its `etcd-client` (etcdctl, which keel asks etcd with over gRPC, keel#83), both bounded to that upstream release, `keel` (>= 0.22.0), whose gate its drop-in runs and whose etcd goes through etcdctl, and `keel-overlay-wireguard`, which its manifest `requires` | `etcd.service`, and its drop-in `keel-overlay-etcd.conf`: one member restarts at a time | +| `etcd/` | `keel-overlay-etcd` | trixie's `etcd-server` 3.5.16 and its `etcd-client` (etcdctl, which keel asks etcd with over gRPC, keel#83), both bounded to that upstream release, `keel` (>= 0.21.0), whose gate its drop-in runs (keel 0.22.0 asks etcd with the etcdctl this brings), and `keel-overlay-wireguard`, which its manifest `requires` | `etcd.service`, and its drop-in `keel-overlay-etcd.conf`: one member restarts at a time | | `vip/` | `keel-overlay-vip` | `keel` (>= 0.21.0), whose `keel vip` the units run, and `keel-overlay-wireguard`, which its manifest `requires` | `keel-vip.service`, the VIP's root helper with etcd, which starts its unprivileged controller as the transient `keel-vip-control`; and `keel-vip-check.timer`, part of it | | `crowdsec/` | `keel-overlay-crowdsec` | trixie's `crowdsec` 1.4.6-10 and `crowdsec-firewall-bouncer` 0.0.25 | `crowdsec.service`, `crowdsec-firewall-bouncer.service` | | `nginx/` | `keel-overlay-nginx` | trixie's `nginx` 1.26.3 and `libnginx-mod-stream` | `nginx.service`, enabled in every mode | diff --git a/packages/etcd/debian/changelog b/packages/etcd/debian/changelog index 9038d244..930b1611 100644 --- a/packages/etcd/debian/changelog +++ b/packages/etcd/debian/changelog @@ -8,7 +8,8 @@ keel-overlay-etcd (0.4.0) trixie; urgency=medium certificate's CN as its user, and turns etcd's JSON gateway off (Keel-Linux/keel#83). A newer etcd upstream is a deliberate update of this package. - * Depends on keel (>= 0.22.0), which asks etcd with etcdctl. + * keel (>= 0.21.0) stays: an older keel runs beside etcdctl unused, and + the keel that asks with it (0.22.0) Breaks the overlays before this. -- Marcos Mendez Thu, 08 Oct 2026 16:00:00 +0000 diff --git a/packages/etcd/debian/control b/packages/etcd/debian/control index 7dffa271..2056f440 100644 --- a/packages/etcd/debian/control +++ b/packages/etcd/debian/control @@ -17,7 +17,7 @@ Depends: etcd-client (<< 3.5.17~), etcd-server (>= 3.5.16), etcd-server (<< 3.5.17~), - keel (>= 0.22.0), + keel (>= 0.21.0), keel-overlay-wireguard, ${misc:Depends}, Description: Keel overlay: etcd, the mesh registry