We're not setting ``--service-account-issuer` to a https URL, which causes an
error message at startup when the feature gate is enabled. From the
docs on that flag:

> If this option is not a valid URI per the OpenID Discovery 1.0 spec, the
> ServiceAccountIssuerDiscovery feature will remain disabled, even if the
> feature gate is set to true. It is highly recommended that this value
> comply with the OpenID spec:
> https://openid.net/specs/openid-connect-discovery-1_0.html. In practice,
> this means that service-account-issuer must be an https URL. It is also
> highly recommended that this URL be capable of serving OpenID discovery
> documents at {service-account-issuer}/.well-known/openid-configuration.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Related to https://github.com/kubernetes/kubernetes/pull/95382Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

 Use secrets for node-passwd entries

* update etcd
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go mod tidy
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

Add check for `/init.scope` for cgroup

Signed-off-by: Brian Downs <brian.downs@gmail.com>

Signed-off-by: Chris Kim <oats87g@gmail.com>

Set a cgroup if containerized

* Test script cleanup backport from RKE2
Signed-off-by: Erik Wilson <Erik.E.Wilson@gmail.com>

* Update scripts/test
Co-authored-by: Brian Downs <brian.downs@gmail.com>
Co-authored-by: Brian Downs <brian.downs@gmail.com>

Signed-off-by: Chris Kim <oats87g@gmail.com>

* Add tombstone file to embedded etcd
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go mod update
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fixes
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* more fixes
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* more changes
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* gofmt and goimports
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go mod update
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go lint
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go lint
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go mod tidy
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

Limit the `testing` channel(s) to alpha, beta, and rc pre-releases.
Signed-off-by: Jacob Blain Christen <jacob@rancher.com>

Signed-off-by: Jacob Blain Christen <jacob@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* update uninstall script to remove mount point path after umount

* install.sh: test if BIN_DIR is readonly, else use /opt

On flatcar /usr is a readonly partition, while /opt is allowed for
writing.
Signed-off-by: Vincent Batts <vbatts@kinvolk.io>

* install.sh: only warn on Flatcar about selinux

This check is a bit more explicit, but only warn about finding the rpm
installed policy when on Flatcar Container Linux
Signed-off-by: Vincent Batts <vbatts@kinvolk.io>

* Update install.sh
Co-authored-by: Brad Davidson <brad@oatmail.org>
Signed-off-by: Vincent Batts <vbatts@kinvolk.io>
Co-authored-by: Brad Davidson <brad@oatmail.org>

Signed-off-by: Jacob Blain Christen <jacob@rancher.com>

Signed-off-by: Chin-Ya Huang <chin-ya.huang@suse.com>

Solution: Set priorityClassName to system-node-critical of traefik, metrics-server, local storage and coredns deployment
Signed-off-by: transhapHigsn <fet.prashantsingh@gmail.com>

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

Ubuntu and Debian kernels support mounting real overlayfs inside userns,
but the vanilla kernel still does not allow it.

OTOH fuse-overlayfs can be mounted inside userns with the vanilla kernel (>= 4.18).
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

k3s was mounting a tmpfs on `/run` by itself, so it was hiding RootlessKit's `/run`.
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

Fix #2420
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

rancher/helm-controller ➡ k3s-io/helm-controller

Part of https://github.com/rancher/k3s/issues/2189Signed-off-by: Jacob Blain Christen <jacob@rancher.com>

rancher/flannel ➡ k3s-io/flannel
rancher/go-powershell ➡ k3s-io/go-powershell

Part of https://github.com/rancher/k3s/issues/2189Signed-off-by: Jacob Blain Christen <jacob@rancher.com>

rancher/etcd ➡ k3s-io/etcd

Part of https://github.com/rancher/k3s/issues/2189Signed-off-by: Jacob Blain Christen <jacob@rancher.com>

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

rancher/kine ➡ k3s-io/kine

Part of https://github.com/rancher/k3s/issues/2189Signed-off-by: Jacob Blain Christen <jacob@rancher.com>

Add davidnuzik (David Nuzik) to the list of maintainers

Signed-off-by: David Nuzik <david.nuzik@rancher.com>

Add Oats87 (Chris Kim) to the list of maintainers for K3s

Signed-off-by: Chris Kim <oats87g@gmail.com>

Mark v1.19.4+k3s1 as stable

- rancher/cri ➡ k3s-io/cri
- rancher/cri-tools ➡ k3s-io/cri-tools
- rancher/containerd ➡ k3s-io/containerd

Part of https://github.com/rancher/k3s/issues/2189Signed-off-by: Jacob Blain Christen <jacob@rancher.com>

This change set replaces these go.mod replacement directives with references to k3s-io repositories.

- rancher/kubernetes
- rancher/nocode

Part of https://github.com/rancher/k3s/issues/2189Signed-off-by: Jacob Blain Christen <jacob@rancher.com>

Signed-off-by: MonzElmasry <menna.elmasry@rancher.com>