Signed-off-by: Alireza Eskandari <alireza.eskandari@wsd.com>
(cherry picked from commit 22fb7049)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Use higher QPS for secrets reencryption
Signed-off-by: Derek Nola <derek.nola@suse.com>

* Allow pprof to run on server with `--disable-agent`
* Allow supervisor metrics to run on server with `--disable-agent`
Signed-off-by: Derek Nola <derek.nola@suse.com>

* Remove unnecessary hardened arguments
Signed-off-by: Derek Nola <derek.nola@suse.com>

* slim down hardened arguments
Signed-off-by: Derek Nola <derek.nola@suse.com>

---------
Signed-off-by: Derek Nola <derek.nola@suse.com>

Looking at metrics revealed the cloudprovider controller name was anempty string.

k8s.io/cloud-provider/names isn't available until 1.28, so just hardcode
it for 1.27. ref: https://github.com/kubernetes/kubernetes/pull/115813Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit bffdf463)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e168438d)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Co-authored-by: Derek Nola <derek.nola@suse.com>
Signed-off-by: Will Andrews <will7989@hotmail.com>
(cherry picked from commit e2179aa9)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Will <will7989@hotmail.com>
(cherry picked from commit e4f3cc7b)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

This is a partial revert of 095ecdb0,
with the workaround moved into klipper-lb.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit d4c3422a)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 21611c56)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Make secretsencrypt page size and iteration consistent with other paginators
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 891e72f9)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit c2216a62)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

No v24 release has been tagged with the authz fix, so we have to use an untagged commit from the v24 release branch.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
(cherry picked from commit bf6e8742415b718d78ccc7ebe8eb4525169680dd)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

FindString would silently skip parsing dropins if the main config file
didn't exist. If a custom config file path was passed it would raise an
error, but if we were parsing the default config file and it didn't
exist it would just silently fail to load the dropins.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

This was only used to pass the bundled strongswan path through to the flannel ipsec backend, and is no longer needed. Ref: #719
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brooks Newberry <brooks@newberry.com>

* Move test-compat to GHA (#10414)
Signed-off-by: Derek Nola <derek.nola@suse.com>

* For E2E upgrade test, automatically determine the channel to use (#10461)
Signed-off-by: Derek Nola <derek.nola@suse.com>

---------
Signed-off-by: Derek Nola <derek.nola@suse.com>

Fixes an issue where running etcd-snapshot commands on a node that has a server address set in the config will manage snapshots on that server, instead of on the local node as intended.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

This should give us more detail on how long dials take before failing, so that we can perhaps better tune the retry loop in the future.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

I should have caught `[]string{cfg.NodeIP}[0]` and `[]string{envInfo.NodeIP.String()}[0]` in code review...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

We shouldn't be replacing the configured server address on agents. Doing
so breaks the agent's ability to fall back to the fixed registration
endpoint when all servers are down, since we replaced it with the first
discovered apiserver address. The fixed registration endpoint will be
restored as default when the service is restarted, but this is not the
correct behavior. This should have only been done on etcd-only nodes
that start up using their local supervisor, but need to switch to a
control-plane node as soon as one is available.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

https://github.com/k3s-io/kine/compare/v0.11.9...v0.11.11Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Move snapshot structs and functions into pkg/etcd/snapshot
* Move s3 client code and functions into pkg/etcd/s3
* Refactor pkg/etcd to track snapshot and s3 moves
* Add support for reading s3 client config from secret
* Add minio client cache, since S3 client configuration can now be
  changed at runtime by modifying the secret, and don't want to have to
  create a new minio client every time we read config.
* Add tests for pkg/etcd/s3
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit c36db53e)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Made with ❤️️ by updatecli

(cherry picked from commit 5508589f)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit eb8bd158)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* chore: Bump Local Path Provisioner version

Made with ❤️️ by updatecli

---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
(cherry picked from commit a0b37450)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Bumps [github.com/hashicorp/go-retryablehttp](https://github.com/hashicorp/go-retryablehttp) from 0.7.4 to 0.7.7.
- [Changelog](https://github.com/hashicorp/go-retryablehttp/blob/main/CHANGELOG.md)
- [Commits](https://github.com/hashicorp/go-retryablehttp/compare/v0.7.4...v0.7.7)

---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-retryablehttp
  dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit f6942f3d)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Also remove the wg-add script that has been unused since v1.26 dropped the legacy wireguard backend
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 047664b6)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>

Fixes an issue where the semaphore wasn't permanently initialized
until a scheduled snapshot was taken, allowing multiple on-demand
snapshots to be taken until the first scheduled snapshot was triggered.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brooks Newberry <brooks@newberry.com>

Signed-off-by: Harrison Affel <harrisonaffel@gmail.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Francisco <francisco.moral@suse.com>

* Add snapshot retention folder fix
Signed-off-by: Vitor Savian <vitor.savian@suse.com>

* Add snapshot retention E2E test
Signed-off-by: Vitor Savian <vitor.savian@suse.com>

---------
Signed-off-by: Vitor Savian <vitor.savian@suse.com>