[release-1.28] Backports for 2024-06 release cycle

[brandond]

Proposed Changes

Backports:

• Add WithSkipMissing to not fail import on missing blobs #10136
• Use fixed stream server bind address for cri-dockerd #9975
• Switch stargz over to cri registry config_path #9977
• Bump to containerd v1.7.17, etcd v3.5.13 #10123
• Bump spegel version #10118
• Fix issue with externalTrafficPolicy: Local for single-stack services on dual-stack nodes #9963
• Update local-path-provisioner helper script #9964
• Add support for svclb pod PriorityClassName #10045
• bump minio-go to v7.0.70 #10081
• Bump kine to v0.11.9 to fix pagination #10082
• Update valid resolv conf #9948
• Add missing kernel config check #10100
• Follow directory symlinks in auto deploying manifests (#9288) #10049
• Fix bug: allow helm controller set owner reference #10048
• Bump klipper-helm image for tls secret support #10187
• Fix issue with k3s-etcd informers not starting #10047
• Enable serving supervisor metrics #10019
• Bump alpine from 3.18 to 3.20 in /conformance #10210
• Bump alpine from 3.18 to 3.20 in /package #10211
• Bump ubuntu from 22.04 to 24.04 in /tests/e2e/scripts #10040
• Fix netpol crash when node remains tained uninitialized #10073
• Fix issue caused by sole server marked as failed under load #10241
• Add write-kubeconfig-group flag to server #9233

Types of Changes

Verification

Testing

See linked issues

Linked Issues

• [Release-1.28] - K3s fails to import tarball produced by ctr image export #10149
• [Release-1.28] - Set cri-dockerd streaming-bind-addr to fixed address #10152
• [Release-1.28] - Support containerd config_path for stargz snapshotter #10155
• [Release-1.28] - Bump containerd to >= v1.7.17 #10158
• [Release-1.28] - Bump etcd to >= v3.5.13 #10161
• [Release-1.28] - Spegel mirror returns 500 instead of 404 on unavailable images #10164
• [Release-1.28] - LoadBalancers crashing after updating from 1.27.3 to 1.29.3 #10167
• [Release-1.28] - local path provisioner helper script does not support -a flag #10170
• [Release-1.28] - Allow setting priorityClassName on ServiceLB daemonset. #10173
• [Release-1.28] - Update minio-go to v7.0.70 or newer #10185
• [Release-1.28] - MySQL + Kine Conformance Checks Fail #10190
• [Release-1.28] - Validate resolv.conf for presence of nameserver entries #10194
• [Release-1.28] - missing kernel config check #10197
• [Release-1.28] - Auto-Deploying Manifests ignores symlinked directories #10200
• [Release-1.28] - Embedded helm controller does not track owner references properly #10203
• [Release-1.28] - Add client certificate auth support to HelmChart controller / job image #10225
• [Release-1.28] - leader-elected etcd controllers not consistently functional when leader election/lease mismatches occur #10231
• [Release-1.28] - Expose K3s metrics via supervisor port #10234
• [Release-1.28] - Image pulls from embedded registry fail if --bind-address is set (and not 127.0.0.1) #10247
• [Release-1.28] - k3s crashes if I do not start the cloud-provider #10237
• [Release-1.28] - Health checks may remove all available servers from load-balancer under high load #10244
• [Release-1.28] - New k3s server flag: --write-kubeconfig-own or --write-kubeconfig-group #10261

User-Facing Change

Add WithSkipMissing to not fail import on missing blobs
Use fixed stream server bind address for cri-dockerd
Switch stargz over to cri registry config_path
Bump to containerd v1.7.17, etcd v3.5.13
Bump spegel version
Fix issue with externalTrafficPolicy: Local for single-stack services on dual-stack nodes
ServiceLB now sets the priorityClassName on svclb pods to `system-node-critical` by default. This can be overridden on a per-service basis via the `svccontroller.k3s.cattle.io/priorityclassname` annotation.
bump minio-go to v7.0.70
Bump kine to v0.11.9 to fix pagination
Update valid resolv conf
Add missing kernel config check
Symlinked sub-directories are now respected when scanning Auto-Deploying Manifests (AddOns) 
Fix bug: allow helm controller set owner reference
Bump klipper-helm image for tls secret support
Fix issue with k3s-etcd informers not starting
`--enable-pprof` can now be set on agents to enable the debug/pprof endpoints. When set, agents will listen on the supervisor port.
`--supervisor-metrics` can now be set on servers to enable serving internal metrics on the supervisor endpoint; when set agents will listen on the supervisor port.
Fix netpol crash when node remains tained unintialized
The embedded load-balancer will now fall back to trying all servers with health-checks ignored, if all servers have been marked unavailable due to failed health checks.

Further Comments

[codecov]

Codecov Report

Attention: Patch coverage is 31.79012% with 221 lines in your changes are missing coverage. Please review.

Project coverage is 36.26%. Comparing base (7b8f0e1) to head (ea47376).

Files	Patch %	Lines
pkg/agent/https/https.go	0.00%	55 Missing ⚠️
pkg/util/net.go	14.81%	45 Missing and 1 partial ⚠️
pkg/deploy/controller.go	0.00%	12 Missing and 1 partial ⚠️
pkg/profile/profile.go	0.00%	13 Missing ⚠️
pkg/util/file.go	0.00%	11 Missing ⚠️
pkg/spegel/spegel.go	0.00%	10 Missing ⚠️
pkg/metrics/metrics.go	0.00%	9 Missing ⚠️
pkg/agent/run.go	0.00%	4 Missing and 2 partials ⚠️
pkg/cli/agent/agent.go	45.45%	3 Missing and 3 partials ⚠️
pkg/cli/server/server.go	70.00%	3 Missing and 3 partials ⚠️
... and 21 more

Additional details and impacted files

@@               Coverage Diff                @@
##           release-1.28   #10258      +/-   ##
================================================
- Coverage         42.91%   36.26%   -6.65%     
================================================
  Files               158      160       +2     
  Lines             16427    14042    -2385     
================================================
- Hits               7050     5093    -1957     
+ Misses             8123     7954     -169     
+ Partials           1254      995     -259     

Flag	Coverage Δ
e2etests	36.26% <31.79%> (-9.82%)	⬇️
unittests	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.