... until QA flakes can be addressed.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

The control-plane context handles requests outside the cluster and
should not be sent to the proxy.

In agent mode, we don't watch pods and just direct-dial any request for
a non-node address, which is the original behavior.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Watching pods appears to be the most reliable way to ensure that the
proxy routes and authorizes connections.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* Add shell completion CLI
Signed-off-by: Derek Nola <derek.nola@suse.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 1ef34728)

* Remove objects when removed from manifests

If a user puts a file in /var/lib/rancher/k3s/server/manifests/ then the
objects contained therein are deployed to the cluster. If the objects
are removed from that file, they are not removed from the cluster.

This change tracks the GVKs in the files and will remove objects when
there are removed from the cluster.
Signed-off-by: Donnie Adams <donnie.adams@suse.com>
(cherry picked from commit c38a8c3b)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e6385b23)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e4369ce0)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 1d4f995e)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 9d723049)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit ce5b9347)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e763fadb)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit d93b7503)

Reduces code complexity a bit and ensures we don't  have to handle closed watch channels on our own
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 13ca1066)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit c9badb4f)

This gives nicer errors from Kubernetes components during startup, and
reduces LOC a bit by using the upstream responsewriters module instead
of writing the headers and body by hand.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 3d01ca13)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit a69d635c)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 333311c7)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 1caae631)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit b12cd629)

Also update cert gen to ensure leaf certs are regenerated if other key fields change.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 99851b0f)

Don't hardcode the event namespace when creating event recorders; some controllers want to create events in other namespaces.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 965d0a08)

Also add event support to increase visibility of change events.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 44c53743)

Signed-off-by: Derek Nola <derek.nola@suse.com>

* Add systemd cgroup controller support
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Drop unnecessary intermediate variable
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Co-authored-by: Brad Davidson <brad.davidson@rancher.com>

[Release 1.22] Add "ipFamilyPolicy: PreferDualStack" to have dual-stack ingress support

Signed-off-by: Manuel Buil <mbuil@suse.com>

* Bump etcd to v3.5.4-k3s1
* Fix issue with datastore corruption on cluster-reset
* Disable unnecessary components during cluster reset
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Add RetryOnConflict around updating nodes
Signed-off-by: Derek Nola <derek.nola@suse.com>

Use ListWatch helpers to retry when the watch channel is closed.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Update to v1.22.9
Signed-off-by: Derek Nola <derek.nola@suse.com>

* Update tags to k3s-io for v1.22.9
Signed-off-by: Derek Nola <derek.nola@suse.com>

Signed-off-by: Manuel Buil <mbuil@suse.com>

* netpol: Add dual-stack support

This change allows to define two cluster CIDRs for compatibility with
Kubernetes dual-stuck, with an assumption that two CIDRs are usually
IPv4 and IPv6.

It does that by levearaging changes in out kube-router fork, with the
following downstream release:

https://github.com/k3s-io/kube-router/releases/tag/v1.3.2%2Bk3sSigned-off-by: Michal Rostecki <vadorovsky@gmail.com>
Signed-off-by: Derek Nola <derek.nola@suse.com>

* Add s390x arch support for k3s (#5018)

* Update docs to include s390x arch
Signed-off-by: Venkata Krishna Rohit Sakala <rohitsakala@gmail.com>

* Add s390x drone pipeline
Signed-off-by: Venkata Krishna Rohit Sakala <rohitsakala@gmail.com>

* Install trivy linux arch only for amd64

This is done so that trivy is not installed for s390x arch
Signed-off-by: Venkata Krishna Rohit Sakala <rohitsakala@gmail.com>

* Add s390x arch if condition for Dockerfile.test
Signed-off-by: Venkata Krishna Rohit Sakala <rohitsakala@gmail.com>

* Add s390x arch in install script
Signed-off-by: Venkata Krishna Rohit Sakala <rohitsakala@gmail.com>

* Add s390x GOARCH in build script
Signed-off-by: Venkata Krishna Rohit Sakala <rohitsakala@gmail.com>

* Add SUFFIX s390x in scripts
Signed-off-by: Venkata Krishna Rohit Sakala <rohitsakala@gmail.com>

* Skip image scan for s390x arch
Signed-off-by: Venkata Krishna Rohit Sakala <rohitsakala@gmail.com>

* Update klipper-lb to version v0.3.5
Signed-off-by: Venkata Krishna Rohit Sakala <rohitsakala@gmail.com>

* Update traefik version to v2.6.2
Signed-off-by: Venkata Krishna Rohit Sakala <rohitsakala@gmail.com>

* Update registry to v2.8.1 in tests which supports s390x
Signed-off-by: Venkata Krishna Rohit Sakala <rohitsakala@gmail.com>

* Skip compact tests for s390x arch

This is done because compact test require a previous k3s version which supports s390x and it is not available
Signed-off-by: Venkata Krishna Rohit Sakala <rohitsakala@gmail.com>
Signed-off-by: Derek Nola <derek.nola@suse.com>

* Increase k3s-root version to v0.10.0 which includes s390x support
Signed-off-by: Derek Nola <derek.nola@suse.com>
Co-authored-by: Michal Rostecki <vadorovsky@gmail.com>
Co-authored-by: Sakala Venkata Krishna Rohit <rohitsakala@gmail.com>

This change allows to define two cluster CIDRs for compatibility with
Kubernetes dual-stuck, with an assumption that two CIDRs are usually
IPv4 and IPv6.

It does that by levearaging changes in out kube-router fork, with the
following downstream release:

https://github.com/k3s-io/kube-router/releases/tag/v1.3.2%2Bk3sSigned-off-by: Michal Rostecki <vadorovsky@gmail.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 7e447692)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 5b2c14b1)