[release-1.29] Backports for 2024-06 release cycle

[brandond]

Proposed Changes

Backports:

• Add WithSkipMissing to not fail import on missing blobs #10136
• Use fixed stream server bind address for cri-dockerd #9975
• Switch stargz over to cri registry config_path #9977
• Bump to containerd v1.7.17, etcd v3.5.13 #10123
• Bump spegel version #10118
• Fix issue with externalTrafficPolicy: Local for single-stack services on dual-stack nodes #9963
• Update local-path-provisioner helper script #9964
• Add support for svclb pod PriorityClassName #10045
• bump minio-go to v7.0.70 #10081
• Bump kine to v0.11.9 to fix pagination #10082
• Update valid resolv conf #9948
• Add missing kernel config check #10100
• Follow directory symlinks in auto deploying manifests (#9288) #10049
• Fix bug: allow helm controller set owner reference #10048
• Bump klipper-helm image for tls secret support #10187
• Fix issue with k3s-etcd informers not starting #10047
• Enable serving supervisor metrics #10019
• Bump alpine from 3.18 to 3.20 in /conformance #10210
• Bump alpine from 3.18 to 3.20 in /package #10211
• Bump ubuntu from 22.04 to 24.04 in /tests/e2e/scripts #10040
• Fix netpol crash when node remains tained uninitialized #10073
• Fix issue caused by sole server marked as failed under load #10241
• Add write-kubeconfig-group flag to server #9233

Types of Changes

Verification

Testing

See linked issues

Linked Issues

• [Release-1.29] - K3s fails to import tarball produced by ctr image export #10148
• [Release-1.29] - Set cri-dockerd streaming-bind-addr to fixed address #10151
• [Release-1.29] - Support containerd config_path for stargz snapshotter #10154
• [Release-1.29] - Bump containerd to >= v1.7.17 #10157
• [Release-1.29] - Bump etcd to >= v3.5.13 #10160
• [Release-1.29] - Spegel mirror returns 500 instead of 404 on unavailable images #10163
• [Release-1.29] - LoadBalancers crashing after updating from 1.27.3 to 1.29.3 #10166
• [Release-1.29] - local path provisioner helper script does not support -a flag #10169
• [Release-1.29] - Allow setting priorityClassName on ServiceLB daemonset. #10172
• [Release-1.29] - Update minio-go to v7.0.70 or newer #10184
• [Release-1.29] - MySQL + Kine Conformance Checks Fail #10189
• [Release-1.29] - Validate resolv.conf for presence of nameserver entries #10193
• [Release-1.29] - missing kernel config check #10196
• [Release-1.29] - Auto-Deploying Manifests ignores symlinked directories #10199
• [Release-1.29] - Embedded helm controller does not track owner references properly #10202
• [Release-1.29] - Add client certificate auth support to HelmChart controller / job image #10224
• [Release-1.29] - leader-elected etcd controllers not consistently functional when leader election/lease mismatches occur #10230
• [Release-1.29] - Expose K3s metrics via supervisor port #10233
• [Release-1.29] - Image pulls from embedded registry fail if --bind-address is set (and not 127.0.0.1) #10246
• [Release-1.29] - k3s crashes if I do not start the cloud-provider #10236
• [Release-1.29] - Health checks may remove all available servers from load-balancer under high load #10243
• [Release-1.29] - New k3s server flag: --write-kubeconfig-own or --write-kubeconfig-group #10260

User-Facing Change

Add WithSkipMissing to not fail import on missing blobs
Use fixed stream server bind address for cri-dockerd
Switch stargz over to cri registry config_path
Bump to containerd v1.7.17, etcd v3.5.13
Bump spegel version
Fix issue with externalTrafficPolicy: Local for single-stack services on dual-stack nodes
ServiceLB now sets the priorityClassName on svclb pods to `system-node-critical` by default. This can be overridden on a per-service basis via the `svccontroller.k3s.cattle.io/priorityclassname` annotation.
bump minio-go to v7.0.70
Bump kine to v0.11.9 to fix pagination
Update valid resolv conf
Add missing kernel config check
Symlinked sub-directories are now respected when scanning Auto-Deploying Manifests (AddOns) 
Fix bug: allow helm controller set owner reference
Bump klipper-helm image for tls secret support
Fix issue with k3s-etcd informers not starting
`--enable-pprof` can now be set on agents to enable the debug/pprof endpoints. When set, agents will listen on the supervisor port.
`--supervisor-metrics` can now be set on servers to enable serving internal metrics on the supervisor endpoint; when set agents will listen on the supervisor port.
Fix netpol crash when node remains tained unintialized
The embedded load-balancer will now fall back to trying all servers with health-checks ignored, if all servers have been marked unavailable due to failed health checks.

Further Comments

[codecov]

Codecov Report

Attention: Patch coverage is 32.71605% with 218 lines in your changes are missing coverage. Please review.

Project coverage is 43.29%. Comparing base (fa35125) to head (3c8f89e).

Files	Patch %	Lines
pkg/agent/https/https.go	0.00%	55 Missing ⚠️
pkg/util/net.go	14.81%	45 Missing and 1 partial ⚠️
pkg/deploy/controller.go	0.00%	12 Missing and 1 partial ⚠️
pkg/profile/profile.go	0.00%	13 Missing ⚠️
pkg/util/file.go	0.00%	11 Missing ⚠️
pkg/spegel/spegel.go	0.00%	10 Missing ⚠️
pkg/metrics/metrics.go	0.00%	9 Missing ⚠️
pkg/agent/run.go	0.00%	4 Missing and 2 partials ⚠️
pkg/cli/agent/agent.go	45.45%	3 Missing and 3 partials ⚠️
pkg/cli/server/server.go	70.00%	3 Missing and 3 partials ⚠️
... and 18 more

Additional details and impacted files

@@               Coverage Diff                @@
##           release-1.29   #10249      +/-   ##
================================================
- Coverage         48.69%   43.29%   -5.41%     
================================================
  Files               158      163       +5     
  Lines             14048    14195     +147     
================================================
- Hits               6841     6146     -695     
- Misses             5906     6872     +966     
+ Partials           1301     1177     -124     

Flag	Coverage Δ
e2etests	36.25% <32.09%> (-10.29%)	⬇️
inttests	37.12% <27.46%> (?)
unittests	16.38% <6.77%> (-0.18%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.