* Update embedded kube-router
Signed-off-by: dereknola <derek.nola@suse.com>

* Changes local storage pods to have 700 permissions
Signed-off-by: dereknola <derek.nola@suse.com>

* Move cloud-controller-manager into an embedded executor
* Import K3s cloud provider and clean up imports
Signed-off-by: Chris Kim <oats87g@gmail.com>

[Backport 1.21] - fix possible race where bootstrap data might not save

Signed-off-by: Brian Downs <brian.downs@gmail.com>

* Update to v1.21.2
Signed-off-by: dereknola <derek.nola@suse.com>

Signed-off-by: dereknola <derek.nola@suse.com>

* update agent to sent systemd notify after everything starts

* update agent to sent systemd notify after everything starts
Signed-off-by: Brian Downs <brian.downs@gmail.com>

Changed iptables version check for fail if version is between 1.8.0 and 1.8.3 and using nf_tables mode (#3454)
Signed-off-by: dereknola <derek.nola@suse.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

[ Backport 1.21 ] - etcd subcommands 1.21

* Changed cloud-controller-manager user name in ccm.yaml
* Changed RBAC name in server.go and deps.go
Signed-off-by: dereknola <derek.nola@suse.com>

[Backport 1.21] Add a path for wireguard's privatekey

[Backport  1.21] Update flannel version

Signed-off-by: Manuel Buil <mbuil@suse.com>

Signed-off-by: Manuel Buil <mbuil@suse.com>

[backport 1.21] containerd: v1.4.4-k3s2

Pull in backport of containerd/containerd#5017

Addresses #3296
Signed-off-by: Jacob Blain Christen <dweomer5@gmail.com>

- Addresses #3299
Signed-off-by: Jacob Blain Christen <dweomer5@gmail.com>

Signed-off-by: Brian Downs <brian.downs@gmail.com>

Signed-off-by: Brian Downs <brian.downs@gmail.com>

Signed-off-by: Brian Downs <brian.downs@gmail.com>

(cherry picked from commit 7e175e8a)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Update Kubernetes to v1.21.1-k3s1

* add prune subcommand to force rentention policy enforcement

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

change --disable-api-server flag to --disable-apiserver

Signed-off-by: MonzElmasry <menna.elmasry@rancher.com>

- bump the runc version to v1.0.0-rc94
- build runc from its own source tree instead of from ./vendor/
  - side-steps incompatibility with upstream kubelet container manager
Signed-off-by: Jacob Blain Christen <dweomer5@gmail.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* add ability to list local and s3 etcd snapshots

* Move registries.yaml handling out to rancher/wharfie
* Add system-default-registry support
* Add CLI support for kubelet image credential providers
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Add the ability to delete a given set of etcd snapshots from the CLI for locally stored and S3 store snapshots.

Problem:
Only the client CA is passed to the kube-controller-manager and
therefore CSRs with the signer name "kubernetes.io/kubelet-serving" are
signed with the client CA. Serving certificates must be signed with the
server CA otherwise e.g. "kubectl logs" fails with the error message
"x509: certificate signed by unknown authority".

Solution:
Instead of providing only one CA via the kube-controller-manager
parameter "--cluster-signing-cert-file", the corresponding CA for every
signer is set with the parameters
"--cluster-signing-kube-apiserver-client-cert-file",
"--cluster-signing-kubelet-client-cert-file",
"--cluster-signing-kubelet-serving-cert-file", and
"--cluster-signing-legacy-unknown-cert-file".
Signed-off-by: Siegfried Weber <mail@siegfriedweber.net>