Kernel 5.11 added support for rootless overlayfs, but still incompatible
with SELinux, so we should always use fuse-overlayfs.

Related: moby/moby issue 42333
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

Signed-off-by: Jamie Phillips <jamie.phillips@suse.com>

containerd: v1.4.4-k3s2

Bump channel stable version to v1.20.7+k3s1

Pull in backport of containerd/containerd#5017

Addresses #3296
Signed-off-by: Jacob Blain Christen <dweomer5@gmail.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

- Addresses #3299
Signed-off-by: Jacob Blain Christen <dweomer5@gmail.com>

Move object channel defer close to goroutine

Signed-off-by: Brian Downs <brian.downs@gmail.com>

add retention default and wire in s3 prune

Signed-off-by: Brian Downs <brian.downs@gmail.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Add etcd snapshot save subcommand

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brian Downs <brian.downs@gmail.com>

Update Kubernetes to v1.21.1-k3s1

* add prune subcommand to force rentention policy enforcement

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

change --disable-api-server flag to --disable-apiserver

Signed-off-by: MonzElmasry <menna.elmasry@rancher.com>

- bump the runc version to v1.0.0-rc94
- build runc from its own source tree instead of from ./vendor/
  - side-steps incompatibility with upstream kubelet container manager
Signed-off-by: Jacob Blain Christen <dweomer5@gmail.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* add ability to list local and s3 etcd snapshots

* Move registries.yaml handling out to rancher/wharfie
* Add system-default-registry support
* Add CLI support for kubelet image credential providers
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Add the ability to delete a given set of etcd snapshots from the CLI for locally stored and S3 store snapshots.

Problem:
Only the client CA is passed to the kube-controller-manager and
therefore CSRs with the signer name "kubernetes.io/kubelet-serving" are
signed with the client CA. Serving certificates must be signed with the
server CA otherwise e.g. "kubectl logs" fails with the error message
"x509: certificate signed by unknown authority".

Solution:
Instead of providing only one CA via the kube-controller-manager
parameter "--cluster-signing-cert-file", the corresponding CA for every
signer is set with the parameters
"--cluster-signing-kube-apiserver-client-cert-file",
"--cluster-signing-kubelet-client-cert-file",
"--cluster-signing-kubelet-serving-cert-file", and
"--cluster-signing-legacy-unknown-cert-file".
Signed-off-by: Siegfried Weber <mail@siegfriedweber.net>

Add `.github/workflows/cgroup2.yaml` for running Fedora on Vagrant on
GitHub Actions to test cgroup2 environment.

Only very basic smoke tests are executed, as Vagrant is too slow to run
the entire sonobuoy.

Relevant:
- kubernetes-sigs/kind PR 2017
- https://github.com/rootless-containers/usernetes/blob/v20210201.0/.github/workflows/main.yamlSigned-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

Add ci step to validate incorrect replacement fork

Co-authored-by: Brian Downs <brian.downs@gmail.com>

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

Signed-off-by: MonzElmasry <menna.elmasry@rancher.com>

Reference node name when needed

Signed-off-by: Brian Downs <brian.downs@gmail.com>

Signed-off-by: angelnu <git@angelnucom>

remove accidentially commited dapper files