* Use higher QPS for secrets reencryption
Signed-off-by: Derek Nola <derek.nola@suse.com>

* Remove unnecessary hardened arguments
Signed-off-by: Derek Nola <derek.nola@suse.com>

* slim down hardened arguments
Signed-off-by: Derek Nola <derek.nola@suse.com>

---------
Signed-off-by: Derek Nola <derek.nola@suse.com>

* Use pagination when retrieving etcd snapshot list
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit c2216a62)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Update secretsencrypt pagination

Make secretsencrypt page size and iteration consistent with other paginators
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 891e72f9)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Cap length of generated name used for servicelb daemonset
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 21611c56)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Fix ipv6 sysctl required by non-ipv6 LoadBalancer service

This is a partial revert of 095ecdb0,
with the workaround moved into klipper-lb.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit d4c3422a)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* remove deprecated use of wait functions
Signed-off-by: Will <will7989@hotmail.com>
(cherry picked from commit e4f3cc7b)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Update pkg/secretsencrypt/config.go
Co-authored-by: Brad Davidson <brad@oatmail.org>
Signed-off-by: Will Andrews <will7989@hotmail.com>
(cherry picked from commit 3ec086f6)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Update pkg/cluster/managed.go
Co-authored-by: Derek Nola <derek.nola@suse.com>
Signed-off-by: Will Andrews <will7989@hotmail.com>
(cherry picked from commit e2179aa9)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Wire lasso metrics up to common gatherer
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e168438d)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Fix cloudprovider controller name

Looking at metrics revealed the cloudprovider controller name was anempty string.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit bffdf463)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

---------
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Signed-off-by: Will <will7989@hotmail.com>
Signed-off-by: Will Andrews <will7989@hotmail.com>
Co-authored-by: Will <will7989@hotmail.com>
Co-authored-by: Derek Nola <derek.nola@suse.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

FindString would silently skip parsing dropins if the main config file
didn't exist. If a custom config file path was passed it would raise an
error, but if we were parsing the default config file and it didn't
exist it would just silently fail to load the dropins.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

This was only used to pass the bundled strongswan path through to the flannel ipsec backend, and is no longer needed. Ref: #719
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brooks Newberry <brooks@newberry.com>

* Move test-compat to GHA (#10414)
Signed-off-by: Derek Nola <derek.nola@suse.com>

* For E2E upgrade test, automatically determine the channel to use (#10461)
Signed-off-by: Derek Nola <derek.nola@suse.com>

Fixes an issue where running etcd-snapshot commands on a node that has a server address set in the config will manage snapshots on that server, instead of on the local node as intended.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

This should give us more detail on how long dials take before failing, so that we can perhaps better tune the retry loop in the future.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

I should have caught `[]string{cfg.NodeIP}[0]` and `[]string{envInfo.NodeIP.String()}[0]` in code review...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

We shouldn't be replacing the configured server address on agents. Doing
so breaks the agent's ability to fall back to the fixed registration
endpoint when all servers are down, since we replaced it with the first
discovered apiserver address. The fixed registration endpoint will be
restored as default when the service is restarted, but this is not the
correct behavior. This should have only been done on etcd-only nodes
that start up using their local supervisor, but need to switch to a
control-plane node as soon as one is available.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

https://github.com/k3s-io/kine/compare/v0.11.9...v0.11.11Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Move snapshot structs and functions into pkg/etcd/snapshot
* Move s3 client code and functions into pkg/etcd/s3
* Refactor pkg/etcd to track snapshot and s3 moves
* Add support for reading s3 client config from secret
* Add minio client cache, since S3 client configuration can now be
  changed at runtime by modifying the secret, and don't want to have to
  create a new minio client every time we read config.
* Add tests for pkg/etcd/s3
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit c36db53e)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Made with ❤️️ by updatecli

(cherry picked from commit 5508589f)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit eb8bd158)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Made with ❤️️ by updatecli

(cherry picked from commit 0b417385)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* chore: Bump Local Path Provisioner version

Made with ❤️️ by updatecli

---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
(cherry picked from commit a0b37450)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Bumps [github.com/hashicorp/go-retryablehttp](https://github.com/hashicorp/go-retryablehttp) from 0.7.4 to 0.7.7.
- [Changelog](https://github.com/hashicorp/go-retryablehttp/blob/main/CHANGELOG.md)
- [Commits](https://github.com/hashicorp/go-retryablehttp/compare/v0.7.4...v0.7.7)

---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-retryablehttp
  dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit f6942f3d)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Also remove the wg-add script that has been unused since v1.26 dropped the legacy wireguard backend
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 047664b6)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Derek Nola <derek.nola@suse.com>

Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>

Signed-off-by: Brooks Newberry <brooks@newberry.com>

Fixes an issue where the semaphore wasn't permanently initialized
until a scheduled snapshot was taken, allowing multiple on-demand
snapshots to be taken until the first scheduled snapshot was triggered.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brooks Newberry <brooks@newberry.com>

Signed-off-by: Harrison Affel <harrisonaffel@gmail.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Derek Nola <derek.nola@suse.com>

* Add snapshot retention folder fix
Signed-off-by: Vitor Savian <vitor.savian@suse.com>

* Add snapshot retention E2E test
Signed-off-by: Vitor Savian <vitor.savian@suse.com>

---------
Signed-off-by: Vitor Savian <vitor.savian@suse.com>

Signed-off-by: Francisco <francisco.moral@suse.com>

* Add ADR for etcd s3 config secret
* Update ADR with changes from initial review
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

If proxy.SetAPIServerPort was called multiple times, all calls after the
first one would cause the apiserver address to be set to the default
server address, bypassing the local load-balancer. This was most likely
to occur on RKE2, where the supervisor may be up for a period of time
before it is ready to manage node password secrets, causing the agent
to retry.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Koen de Laat <koen.de.laat@philips.com>

* chore: Bump Local Path Provisioner version

Made with ❤️️ by updatecli

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Add write-kubeconfig-group flag to server
* update kubectl unable to read config message for kubeconfig mode/group
Signed-off-by: Katherine Pata <me@kitty.sh>