Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

These were unintentionally dropped when moving containerd back into the main multicall binary
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e5e1a674)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 5170bc5a)

Allows nodes to join the cluster during a webhook outage. This also
enhances auditability by creating Kubernetes events for the deferred
verification.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 45d8c1a1)

It is no way we can configure the lb image because it is a const value.
It would be better that we make it variable value and we can override
the value like the `helm-controller` job image when compiling k3s/rke2
Signed-off-by: Yuxing Deng <jxfa0043379@hotmail.com>
(cherry picked from commit b64a226e)

Made with ️️ by updatecli

(cherry picked from commit a5928ee1)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 61247375)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 7b61aacb)

Only actual admin actions should use the admin kubeconfig; everything done by the supervisor/deploy/helm controllers will now use a distinct account for audit purposes.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 64a5f58f)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 8748813a)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e9958cf0)

Fixes issue with localhost access to ServiceLB when
ExternalTrafficPolicy=Local
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 93279d2f)

Signed-off-by: Andrew Roffey <andrew@roffey.au>
(cherry picked from commit 0485a56f)

[Release 1.26] Remove unused libvirt config

Signed-off-by: Manuel Buil <mbuil@suse.com>

[Release 1.26] Fix spelling check

Signed-off-by: Manuel Buil <mbuil@suse.com>

[Release 1.26] VPN integration

* add private registry e2e test (#7653)

add private registry e2e test
Signed-off-by: Ian Cardoso <osodracnai@gmail.com>
Co-authored-by: Derek Nola <derek.nola@suse.com>

* E2E: Startup test cleanup + RunCommand Enhancement (#7388)

* Add beforesuite to startup
* Reduce timeouts for startup
* Fix cleanup + set kubeconfig
Signed-off-by: Derek Nola <derek.nola@suse.com>

---------
Signed-off-by: Ian Cardoso <osodracnai@gmail.com>
Signed-off-by: Derek Nola <derek.nola@suse.com>
Co-authored-by: Derek Nola <derek.nola@suse.com>

Signed-off-by: Manuel Buil <mbuil@suse.com>

* Bump docker go.mod (#7681)
* Shortcircuit commands with version or help flags (#7683)
* Fix for longhorn integration test
* Add Rotation certification Check (#7097)
* Add Certification Test to Validate Cluster
* Fix to stop/start for k3s certificate rotation
* E2E: Use sudo for all RunCmdOnNode
* Remove unnecessary daemonset addition/deletion
Signed-off-by: Derek Nola <derek.nola@suse.com>
Signed-off-by: est-suse <esteban.esquivel@suse.com>
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Co-authored-by: Esteban Esquivel Alvarado <esteban.alvarado@suse.com>
Co-authored-by: est-suse <esteban.esquivel@suse.com>
Co-authored-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Derek Nola <derek.nola@suse.com>

[Release 1.26] Update flannel version

Signed-off-by: Manuel Buil <mbuil@suse.com>

Fix regression in legacy API prefix, until upstream pulls in support for MergePathStrategy from https://github.com/emicklei/go-restful/pull/523

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

[Release 1.26] Add '-all' flag to apply to inactive units

Signed-off-by: Manuel Buil <mbuil@suse.com>

[Release 1.26] Wrap error stating that it is coming from netpol

Signed-off-by: Manuel Buil <mbuil@suse.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

As per https://github.com/golang/go/issues/47001

 even subtle.ConstantTimeCompare should never be used with variable-length inputs, as it will return 0 if the lengths do not match. Switch to consistently using constant-time comparisons of hashes for password checks to avoid any possible side-channel leaks that could be combined with other vectors to discover password lengths.
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 239021e7)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit b32bf495)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit c98137dd)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit cf9ebb32)

Also add bandwidth and firewall plugins. The bandwidth plugin is
automatically registered with the appropriate capability, but the
firewall plugin must be configured by the user if they want to use it.

Ref: https://www.cni.dev/plugins/current/meta/firewall/

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit cedefeff)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e61fde93)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 91afb387)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit f1b6a354)