Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

[Release-1.20] Update to the newest flannel

Signed-off-by: Manuel Buil <mbuil@suse.com>

Using MAINPID breaks systemd's exit detection, as it stops watching the
original pid, but is unable to watch the new pid as it is not a child
of systemd itself. The best we can do is just notify when execing the child
process.

We also need to consolidate forking into a sigle place so that we don't
end up with multiple levels of child processes if both redirecting log
output and reaping child processes.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit dc18ef2e)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 156bae29)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Update Kubernetes to v1.20.11

Signed-off-by: Manuel Buil <mbuil@suse.com>

Signed-off-by: dereknola <derek.nola@suse.com>

Signed-off-by: Manuel Buil <mbuil@suse.com>

* Fix condition for adding kubernetes endpoints (#3941)

* Fix condition for adding kubernetes endpoints
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* Fix condition for adding kubernetes endpoints
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fix get addresses
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

Reset load balancer state during restoraion
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* Fix URL pruning when joining an etcd member

Problem:
Existing member clientURLs were checked if they contain the joining
node's IP. In some edge cases this would prune valid URLs when the
joining IP is a substring match of the only existing member's IP.
Because of this, it was impossible to e.g. join 10.0.0.2 to an existing
node that has an IP of 10.0.0.2X or 10.0.0.2XX:

level=fatal msg="starting kubernetes: preparing server: start managed database:
joining etcd cluster: etcdclient: no available endpoints"

Solution:
Fixed by properly parsing the URLs and comparing the IPs for equality
instead of substring match.
Signed-off-by: Malte Starostik <info@stellaware.de>
(cherry picked from commit b23955e8)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

* account for an s3 folder when listing objects

* fix Node stuck at deletion
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fix Node stuck at deletion
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

[Release-1.20] Fix multiple bootstrap keys found

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

migrate empty string key properly
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

simplifying the code
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

migrate old token key format
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

fix warning msg
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

replace error with warn in delete
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

more fixes
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

more fixes
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: dereknola <derek.nola@suse.com>

[release-1.20] Upgrade k3s-root version

Bump k3s-root to 0.9.1

Linked issue: https://github.com/k3s-io/k3s/issues/3634Signed-off-by: Manuel Buil <mbuil@suse.com>

* Bump golang to 1.15.14
* Update to v1.20.9
Signed-off-by: Chris Kim <oats87g@gmail.com>

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

[release-1.20] - Backport K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token (#3516)

* Fix storing bootstrap data with empty token string (#3422)

* Fix storing bootstrap data with empty token string
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* delete node password secret after restoration

fixes to bootstrap key

vendor update
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fix comment
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fix typo
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* more fixes
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fixes
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fixes
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* typos
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* Removing dynamic listener file after restoration
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go mod tidy
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* go mod vendor
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* fix a runtime core panic
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* update kine
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* revert the helm controller update
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* Fix calling delete in kine
Signed-off-by: galal-hussein <hussein.galal.ahmed.11@gmail.com>

* Add the ability to list etcd snapshots (#3303)
* add ability to list local and s3 etcd snapshots
* Add the ability to prune etcd snapshots (#3310)
* add prune subcommand to force rentention policy enforcement
* add etcd snapshot save subcommand
* add retention default and wire in s3 prune

* prevent snapshot save when snapshots are disabled

Problem:
Only the client CA is passed to the kube-controller-manager and
therefore CSRs with the signer name "kubernetes.io/kubelet-serving" are
signed with the client CA. Serving certificates must be signed with the
server CA otherwise e.g. "kubectl logs" fails with the error message
"x509: certificate signed by unknown authority".

Solution:
Instead of providing only one CA via the kube-controller-manager
parameter "--cluster-signing-cert-file", the corresponding CA for every
signer is set with the parameters
"--cluster-signing-kube-apiserver-client-cert-file",
"--cluster-signing-kubelet-client-cert-file",
"--cluster-signing-kubelet-serving-cert-file", and
"--cluster-signing-legacy-unknown-cert-file".
Signed-off-by: Siegfried Weber <mail@siegfriedweber.net>
(cherry picked from commit e77fd182)