Signed-off-by: Brooks Newberry <brooks@newberry.com>

* Move test-compat to GHA (#10414)
Signed-off-by: Derek Nola <derek.nola@suse.com>

* For E2E upgrade test, automatically determine the channel to use (#10461)
Signed-off-by: Derek Nola <derek.nola@suse.com>

Fixes an issue where running etcd-snapshot commands on a node that has a server address set in the config will manage snapshots on that server, instead of on the local node as intended.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

This should give us more detail on how long dials take before failing, so that we can perhaps better tune the retry loop in the future.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

I should have caught `[]string{cfg.NodeIP}[0]` and `[]string{envInfo.NodeIP.String()}[0]` in code review...
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

We shouldn't be replacing the configured server address on agents. Doing
so breaks the agent's ability to fall back to the fixed registration
endpoint when all servers are down, since we replaced it with the first
discovered apiserver address. The fixed registration endpoint will be
restored as default when the service is restarted, but this is not the
correct behavior. This should have only been done on etcd-only nodes
that start up using their local supervisor, but need to switch to a
control-plane node as soon as one is available.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

https://github.com/k3s-io/kine/compare/v0.11.9...v0.11.11Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Move snapshot structs and functions into pkg/etcd/snapshot
* Move s3 client code and functions into pkg/etcd/s3
* Refactor pkg/etcd to track snapshot and s3 moves
* Add support for reading s3 client config from secret
* Add minio client cache, since S3 client configuration can now be
  changed at runtime by modifying the secret, and don't want to have to
  create a new minio client every time we read config.
* Add tests for pkg/etcd/s3
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit c36db53e)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Made with ❤️️ by updatecli

(cherry picked from commit 5508589f)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit eb8bd158)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* chore: Bump Local Path Provisioner version

Made with ❤️️ by updatecli

---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
(cherry picked from commit a0b37450)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Bumps [github.com/hashicorp/go-retryablehttp](https://github.com/hashicorp/go-retryablehttp) from 0.7.4 to 0.7.7.
- [Changelog](https://github.com/hashicorp/go-retryablehttp/blob/main/CHANGELOG.md)
- [Commits](https://github.com/hashicorp/go-retryablehttp/compare/v0.7.4...v0.7.7)

---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-retryablehttp
  dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit f6942f3d)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Also remove the wg-add script that has been unused since v1.26 dropped the legacy wireguard backend
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 047664b6)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>

Fixes an issue where the semaphore wasn't permanently initialized
until a scheduled snapshot was taken, allowing multiple on-demand
snapshots to be taken until the first scheduled snapshot was triggered.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brooks Newberry <brooks@newberry.com>

Signed-off-by: Derek Nola <derek.nola@suse.com>

Signed-off-by: Harrison Affel <harrisonaffel@gmail.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Francisco <francisco.moral@suse.com>

* Add snapshot retention folder fix
Signed-off-by: Vitor Savian <vitor.savian@suse.com>

* Add snapshot retention E2E test
Signed-off-by: Vitor Savian <vitor.savian@suse.com>

---------
Signed-off-by: Vitor Savian <vitor.savian@suse.com>

If proxy.SetAPIServerPort was called multiple times, all calls after the
first one would cause the apiserver address to be set to the default
server address, bypassing the local load-balancer. This was most likely
to occur on RKE2, where the supervisor may be up for a period of time
before it is ready to manage node password secrets, causing the agent
to retry.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 1661f102)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Koen de Laat <koen.de.laat@philips.com>
(cherry picked from commit 79ba10f5)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* chore: Bump Local Path Provisioner version

Made with ❤️️ by updatecli

(cherry picked from commit 1268779e)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Add write-kubeconfig-group flag to server
* update kubectl unable to read config message for kubeconfig mode/group
Signed-off-by: Katherine Pata <me@kitty.sh>
(cherry picked from commit 7a0ea3c9)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

If health checks are failing for all servers, make a second pass through the server list with health-checks ignored before returning failure
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit ca39614d4e7cb9963ee002dc798884167f2d2acf)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

It is concievable that users might take more than 60 seconds to deploy their own cloud-provider. Instead of exiting, we should wait forever, but with more logging to indicate what's being waited on.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit ed23a2bb)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Made with ❤️️ by updatecli

(cherry picked from commit f2e7c01a)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Bumps ubuntu from 22.04 to 24.04.

---
updated-dependencies:
- dependency-name: ubuntu
  dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 4cb4542c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 84b578ec)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Bumps alpine from 3.18 to 3.20.

---
updated-dependencies:
- dependency-name: alpine
  dependency-type: direct:production
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 86875c97)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Bumps alpine from 3.18 to 3.20.

---
updated-dependencies:
- dependency-name: alpine
  dependency-type: direct:production
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit de4cda57)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 2eca3f1e)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit f8e06483)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Refactor agent supervisor listener startup and authn/authz to use upstream
  auth delegators to perform for SubjectAccessReview for access to
  metrics.
* Convert spegel and pprof handlers over to new structure.
* Promote bind-address to agent flag to allow setting supervisor bind
  address for both agent and server.
* Promote enable-pprof to agent flag to allow profiling agents. Access
  to the pprof endpoint now requires client cert auth, similar to the
  spegel registry api endpoint.
* Add prometheus metrics handler.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit ff679fb3)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>
(cherry picked from commit 48ff3bcddb8f5a95bbd81d9629702d7d8b42eb85)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Start shared informer caches when k3s-etcd controller wins leader election. Previously, these were only started when the main k3s apiserver controller won an election. If the leaders ended up going to different nodes, some informers wouldn't be started
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 3d14092f)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>