Signed-off-by: Brooks Newberry <brooks@newberry.com>

Signed-off-by: Derek Nola <derek.nola@suse.com>
(cherry picked from commit 035c03cf)

Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>

Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>

Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>

Signed-off-by: Manuel Buil <mbuil@suse.com>

Before this change, kube-router was always assuming that IPv4 is
enabled, which is not the case in IPv6-only clusters. To enable network
policies in IPv6-only, we need to explicitly let kube-router know when
to disable IPv4.
Signed-off-by: Michal Rostecki <vadorovsky@gmail.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 43508341)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Having separate tokens for server and agent nodes is a nice feature.

However, passing server's plain `K3S_AGENT_TOKEN` value
to `k3s agent --token` without CA hash is insecure when CA is
self-signed, and k3s warns about it in the logs:

```
Cluster CA certificate is not trusted by the host CA bundle, but the token does not include a CA hash.
Use the full token from the server's node-token file to enable Cluster CA validation.
```

Okay so I need CA hash but where should I get it?

This commit attempts to fix this issue by saving agent token value to
`agent-token` file with CA hash appended.
Signed-off-by: Vladimir Kochnev <hashtable@yandex.ru>
(cherry picked from commit 13af0b1d)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 04900445)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Requires tweaking existing method signature to allow specifying whether or not IPv6 addresses should be return URL-safe.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 5eaa0a94)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 84fb8787)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Use INVOCATION_ID to detect execution under systemd, since as of a9b5a193 NOTIFY_SOCKET is now cleared by the server code.
* Set the unit type to notify by default for both server and agent, which is what Rancher-managed installs have done for a while.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit bd5fdfce)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Addressess issue where the compact may take more than 10 seconds on slower disks. These disks probably aren't really suitable for etcd, but apparently run fine otherwise.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 1674b9d6)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

This avoids an issue with u-root 7.0.0 which has been retracted by the
author:

  $ go list -u -m all
  $ go list -m: github.com/u-root/u-root@v7.0.0+incompatible: retracted by module author: Published v7 too early (before migrating to go modules)
Signed-off-by: Dirk Müller <dirk@dmllr.de>
(cherry picked from commit 93ca992c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Update etcd error to match correct url 
* Bump macos version used by GH actions
Signed-off-by: Derek Nola <derek.nola@suse.com>

Signed-off-by: Derek Nola <derek.nola@suse.com>

Signed-off-by: Nikolai Shields <nikolai@nikolaishields.com>

* Increase the default snapshot timeout. The timeout is not currently
  configurable from Rancher, and larger clusters are frequently seeing
  uploads fail at 30 seconds.
* Enable compression for scheduled snapshots if enabled on the
  command-line. The CLI flag was not being passed into the etcd config.
* Only set the S3 content-type to application/zip if the file is zipped.
* Don't run more than one snapshot at once, to prevent misconfigured
  etcd snapshot cron schedules from stacking up.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Includes fix for ENOSYS/EPERM issue on s390x.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Includes fix for recently identified memory leak.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Since #4438 removed 2-way sync and treats any changed+newer files on disk as an error, we no longer need to determine if files are newer on disk/db or if there is a conflicting mix of both. Any changed+newer file is an error, unless we're doing a cluster reset in which case everything is unconditionally replaced.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Properly skip restoring bootstrap data for files that don't have a path
set because the feature that would set it isn't enabled.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 3cebde92)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Service.Spec.IPFamilyPolicy may be a nil pointer on freshly upgraded clusters.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Use same kubelet-preferred-address-types setting as RKE2 to improve reliability of the egress selector when using a HTTP proxy. Also, use BindAddressOrLoopback to ensure that the correct supervisor address is used when --bind-address is set.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Properly handle unset egress-selector-mode from existing servers during cluster upgrade.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Move to fixed version of continuity
Signed-off-by: Derek Nola <derek.nola@suse.com>

Signed-off-by: Derek Nola <derek.nola@suse.com>

* Testing directory rework
* New cert rotation test
* Remove unnecessary e2e go.mod
* Move cgroup and install tests out of the vagrant directory
* Remove unit test from Drone
Signed-off-by: Derek Nola <derek.nola@suse.com>

Update to v1.22.11-k3s1

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

[Release 1.22] Flannel version update to 0.18.1 and added the ability to configure additional options for wireguard backend

Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>

Allow the flannel backend to be specified as
backend=option=val,option2=val2 to select a given backend with extra options.

In particular this adds the following options to wireguard-native
backend:
* Mode - flannel wireguard tunnel mode
* PersistentKeepaliveInterval- wireguard persistent keepalive interval
Signed-off-by: Sjoerd Simons <sjoerd@collabora.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>