Signed-off-by: Craig Jellick <craig@rancher.com>

* cli: add --selinux flag to agent/server sub-cmds

Introduces --selinux flag to affirmatively enable SELinux in containerd.
Deprecates --disable-selinux flag which now defaults to true which
auto-detection of SELinux configuration for containerd is no longer
supported.  Specifying both --selinux and --disable-selinux will result
in an error message encouraging you to pick a side.

* Update pkg/agent/containerd/containerd.go

update log warning message about enabled selinux host but disabled runtime
Co-authored-by: Brad Davidson <brad@oatmail.org>
Signed-off-by: Jacob Blain Christen <jacob@rancher.com>

Update helm-controller

golang: 1.13.15

- https://github.com/golang/go/issues?q=milestone%3AGo1.13.15+label%3ACherryPickApprovedSigned-off-by: Jacob Blain Christen <jacob@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Fix removal of /run directories

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

updated containerd/cri selinux support

install.sh: cleanup /run on uninstall

Listen insecurely on localhost only

update rootlesskit to v0.10.0

Before this change, k3s configured the scheduler and controller's
insecure ports to listen on 0.0.0.0. Those ports include pprof, which
provides a DoS vector at the very least.

These ports are only enabled for componentstatus checks in the first
place, and componentstatus is hardcoded to only do the check on
localhost anyway (see
https://github.com/kubernetes/kubernetes/blob/v1.18.2/pkg/registry/core/rest/storage_core.go#L341-L344),
so there shouldn't be any downside to switching them to listen only on
localhost.

Fix intermittent "Connection reset by peer" error during port forwarding

https://github.com/rootless-containers/rootlesskit/issues/153Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

Update dynamiclistener

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

add pull request template

* Add etcd members as learners
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* Ignore errors in promote member
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

Call setproctitle to conceal node args in ps output

This is related to #2014.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Update base image version in Dockerfiles

Should hopefully fix issues that cropped up with arm builds failing due
to the sqlite libs from alpine 3.10 no longer being compatible with
alpine edge, which was probably never a safe assumption to begin with.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Correctly report and propagate kubeconfig write failures

Remove $NOTIFY_SOCKET, if present, from env when invoking containerd to
prevent gratuitous notifications sent to systemd.
Signed-off-by: Jacob Blain Christen <jacob@rancher.com>

Always validate K3S_URL if running agent.

Bump k3s-root to v0.6.0-rc3

As seen in issues such as #15 #155 #518 #570 there are situations where
k3s will fail to write the kubeconfig file, but reports that it wrote it
anyway as the success message is printed unconditionally. Also, secondary
actions like setting file mode and creating a symlink are also attempted
even if the file was not created.

This change skips attempting additional actions, and propagates the
failure back upwards.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Chris Kim <oats87g@gmail.com>

Also move K3S_URL validation to its own function.
Signed-off-by: Josh McSavaney <mcsaucy@csh.rit.edu>

Update coredns version for master

Update k3s-root to pull in updated slirp4netns

Needed for #1844
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

update cis flag implementation to propogate the rest of the way 

Signed-off-by: Brian Downs <brian.downs@gmail.com>

Update flannel to v0.12.0-k3s1

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Related to #1709
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>