Signed-off-by: Pedro Tashima <pedro.tashima@suse.com>
Co-authored-by: Pedro Tashima <pedro.tashima@suse.com>

* Adjust default kubeconfig permissions
Signed-off-by: Derek Nola <derek.nola@suse.com>

Signed-off-by: Ian Cardoso <osodracnai@gmail.com>
(cherry picked from commit 58a8deb2)

* Don't use zgrep if apparmor is enforced for it

* Bump e2e se timeouts for reencryption time
Signed-off-by: Derek Nola <derek.nola@suse.com>

Problem:
When support for etcd was added in 39571424, generation of certificates and keys for etcd was not gated behind use of managed etcd.
Keys are generated and distributed across servers even if managed etcd is not enabled.

Solution:
Allow generation of certificates and keys only if managed etc is enabled. Check config.DisableETCD flag.
Signed-off-by: Bartossh <lenartconsulting@gmail.com>
Signed-off-by: Derek Nola <derek.nola@suse.com>
Co-authored-by: Bartosz Lenart <lenart.consulting@gmail.com>

Adding cli to custom klipper helm image
Signed-off-by: Vitor Savian <vitor.savian@suse.com>
(cherry picked from commit 0809187c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 7f50b40c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Need to add a cli flag for this. Also, should probably have config file loading support for the certificate commands.
Signed-off-by: leilei.zhai <leilei.zhai@qingteng.cn>
(cherry picked from commit 72d50b1f)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Derek Nola <derek.nola@suse.com>

Signed-off-by: Ian Cardoso <osodracnai@gmail.com>
(cherry picked from commit 9e334153)

Signed-off-by: Ian Cardoso <osodracnai@gmail.com>
(cherry picked from commit 324f9ad4)

[Release 1.25] Support setting control server URL for Tailscale.

This change enables the use of Headscale - open source implementation of the Tailscale control server.
Signed-off-by: Denys Smirnov <dennwc@pm.me>

[Release 1.25] Check if we are on ipv4, ipv6 or dualStack when doing tailscale

Signed-off-by: Manuel Buil <mbuil@suse.com>

Signed-off-by: Daishan Peng <daishan@acorn.io>
Co-authored-by: Daishan Peng <daishan@acorn.io>

[Release 1.25] Fix code spell check

[Release 1.25] Remove file_windows.go

Signed-off-by: Manuel Buil <mbuil@suse.com>

Signed-off-by: Manuel Buil <mbuil@suse.com>

Signed-off-by: Derek Nola <derek.nola@suse.com>

Signed-off-by: Brooks Newberry <brooks@newberry.com>

[Release 1.25] Fix logging and cleanup in Tailscale

Signed-off-by: Manuel Buil <mbuil@suse.com>

Signed-off-by: Manuel Buil <mbuil@suse.com>

This commit adds the format command to make it easier to be compliant to golangci-lint issues
Signed-off-by: Ian Cardoso <osodracnai@gmail.com>

[Release 1.25] Remove unused libvirt config 

Signed-off-by: Manuel Buil <mbuil@suse.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

These were unintentionally dropped when moving containerd back into the main multicall binary
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e5e1a674)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 5170bc5a)

Allows nodes to join the cluster during a webhook outage. This also
enhances auditability by creating Kubernetes events for the deferred
verification.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 45d8c1a1)

It is no way we can configure the lb image because it is a const value.
It would be better that we make it variable value and we can override
the value like the `helm-controller` job image when compiling k3s/rke2
Signed-off-by: Yuxing Deng <jxfa0043379@hotmail.com>
(cherry picked from commit b64a226e)

Made with ❤️️ by updatecli

(cherry picked from commit a5928ee1)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 61247375)

Only actual admin actions should use the admin kubeconfig; everything done by the supervisor/deploy/helm controllers will now use a distinct account for audit purposes.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 64a5f58f)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 8748813a)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e9958cf0)

Fixes issue with localhost access to ServiceLB when
ExternalTrafficPolicy=Local
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 93279d2f)

Signed-off-by: Andrew Roffey <andrew@roffey.au>
(cherry picked from commit 0485a56f)