Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 23d6842f)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Fixes issue with invalid HTTP host headers over unix sockets caused by
recent releases of golang rejecting invalid header values.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit a0da8ede)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Wire up a node watch to collect addresses of server nodes, to prevent adding unauthorized SANs to the dynamiclistener cert.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit aa76942d)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Guilherme Macedo <guilherme@gmacedo.com>
(cherry picked from commit cc9dce57)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Only configure enable-aggregator-routing and egress-selector-config-file
if required by egress-selector-mode.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit f21ae1d9)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Simon Kirsten <simonkirsten24@gmail.com>
(cherry picked from commit 546dc247)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Unit test for MustFindString (#8013)
* Consolidate CopyFile functions (#8079)
* Remove unnecessary E2E envs
Signed-off-by: Derek Nola <derek.nola@suse.com>

Signed-off-by: Vitor <vitor.savian@suse.com>

[Release 1.24] Update cni plugins version to v1.3.0

Signed-off-by: Manuel Buil <mbuil@suse.com>

Signed-off-by: Johnatas <johnatasr@hotmail.com>

* Adjust default kubeconfig permissions
Signed-off-by: Derek Nola <derek.nola@suse.com>

Signed-off-by: Ian Cardoso <osodracnai@gmail.com>
(cherry picked from commit 58a8deb2)

* Don't use zgrep if apparmor is enforced for it

* Bump e2e se timeouts for reencryption time
Signed-off-by: Derek Nola <derek.nola@suse.com>

Problem:
When support for etcd was added in 39571424, generation of certificates and keys for etcd was not gated behind use of managed etcd.
Keys are generated and distributed across servers even if managed etcd is not enabled.

Solution:
Allow generation of certificates and keys only if managed etc is enabled. Check config.DisableETCD flag.
Signed-off-by: Bartossh <lenartconsulting@gmail.com>
Signed-off-by: Derek Nola <derek.nola@suse.com>
Co-authored-by: Bartosz Lenart <lenart.consulting@gmail.com>

Adding cli to custom klipper helm image
Signed-off-by: Vitor Savian <vitor.savian@suse.com>
(cherry picked from commit 0809187c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 7f50b40c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Need to add a cli flag for this. Also, should probably have config file loading support for the certificate commands.
Signed-off-by: leilei.zhai <leilei.zhai@qingteng.cn>
(cherry picked from commit 72d50b1f)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Derek Nola <derek.nola@suse.com>

[Release 1.24] Remove file_windows.go

Signed-off-by: Daishan Peng <daishan@acorn.io>
Signed-off-by: Derek Nola <derek.nola@suse.com>
Co-authored-by: Daishan Peng <daishan@acorn.io>

Signed-off-by: Manuel Buil <mbuil@suse.com>

[Release 1.24] Fix code spell check

Signed-off-by: Manuel Buil <mbuil@suse.com>

Signed-off-by: Brooks Newberry <brooks@newberry.com>

This commit adds the format command to make it easier to be compliant to golangci-lint issues
Signed-off-by: Ian Cardoso <osodracnai@gmail.com>

[Release 1.24] Remove unused libvirt config

Signed-off-by: Manuel Buil <mbuil@suse.com>

Signed-off-by: Manuel Buil <mbuil@suse.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

These were unintentionally dropped when moving containerd back into the main multicall binary
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e5e1a674)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 5170bc5a)

Allows nodes to join the cluster during a webhook outage. This also
enhances auditability by creating Kubernetes events for the deferred
verification.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 45d8c1a1)

It is no way we can configure the lb image because it is a const value.
It would be better that we make it variable value and we can override
the value like the `helm-controller` job image when compiling k3s/rke2
Signed-off-by: Yuxing Deng <jxfa0043379@hotmail.com>
(cherry picked from commit b64a226e)

Made with ❤️️ by updatecli

(cherry picked from commit a5928ee1)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 61247375)

Only actual admin actions should use the admin kubeconfig; everything done by the supervisor/deploy/helm controllers will now use a distinct account for audit purposes.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 64a5f58f)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 8748813a)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e9958cf0)

Fixes issue with localhost access to ServiceLB when
ExternalTrafficPolicy=Local
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 93279d2f)