[release-1.27] Backports for 2024-06 release cycle

[brandond]

Proposed Changes

Backports:

• Add WithSkipMissing to not fail import on missing blobs #10136
• Use fixed stream server bind address for cri-dockerd #9975
• Switch stargz over to cri registry config_path #9977
• Bump to containerd v1.7.17, etcd v3.5.13 #10123
• Bump spegel version #10118
• Fix issue with externalTrafficPolicy: Local for single-stack services on dual-stack nodes #9963
• Update local-path-provisioner helper script #9964
• Add support for svclb pod PriorityClassName #10045
• bump minio-go to v7.0.70 #10081
• Bump kine to v0.11.9 to fix pagination #10082
• Update valid resolv conf #9948
• Add missing kernel config check #10100
• Follow directory symlinks in auto deploying manifests (#9288) #10049
• Fix bug: allow helm controller set owner reference #10048
• Bump klipper-helm image for tls secret support #10187
• Fix issue with k3s-etcd informers not starting #10047
• Enable serving supervisor metrics #10019
• Bump alpine from 3.18 to 3.20 in /conformance #10210
• Bump alpine from 3.18 to 3.20 in /package #10211
• Bump ubuntu from 22.04 to 24.04 in /tests/e2e/scripts #10040
• Fix netpol crash when node remains tained uninitialized #10073
• Fix issue caused by sole server marked as failed under load #10241
• Add write-kubeconfig-group flag to server #9233

Types of Changes

Verification

Testing

See linked issues

Linked Issues

• [Release-1.27] - K3s fails to import tarball produced by ctr image export #10150
• [Release-1.27] - Set cri-dockerd streaming-bind-addr to fixed address #10153
• [Release-1.27] - Support containerd config_path for stargz snapshotter #10156
• [Release-1.27] - Bump containerd to >= v1.7.17 #10159
• [Release-1.27] - Bump etcd to >= v3.5.13 #10162
• [Release-1.27] - Spegel mirror returns 500 instead of 404 on unavailable images #10165
• [Release-1.27] - LoadBalancers crashing after updating from 1.27.3 to 1.29.3 #10168
• [Release-1.27] - local path provisioner helper script does not support -a flag #10171
• [Release-1.27] - Allow setting priorityClassName on ServiceLB daemonset. #10174
• [Release-1.27] - Update minio-go to v7.0.70 or newer #10186
• [Release-1.27] - MySQL + Kine Conformance Checks Fail #10191
• [Release-1.27] - Validate resolv.conf for presence of nameserver entries #10195
• [Release-1.27] - missing kernel config check #10198
• [Release-1.27] - Auto-Deploying Manifests ignores symlinked directories #10201
• [Release-1.27] - Embedded helm controller does not track owner references properly #10204
• [Release-1.27] - Add client certificate auth support to HelmChart controller / job image #10226
• [Release-1.27] - leader-elected etcd controllers not consistently functional when leader election/lease mismatches occur #10232
• [Release-1.27] - Expose K3s metrics via supervisor port #10235
• [Release-1.27] - Image pulls from embedded registry fail if --bind-address is set (and not 127.0.0.1) #10248
• [Release-1.27] - k3s crashes if I do not start the cloud-provider #10238
• [Release-1.27] - Health checks may remove all available servers from load-balancer under high load #10245
• • [Release-1.27] - New k3s server flag: --write-kubeconfig-own or --write-kubeconfig-group #10262

User-Facing Change

Add WithSkipMissing to not fail import on missing blobs
Use fixed stream server bind address for cri-dockerd
Switch stargz over to cri registry config_path
Bump to containerd v1.7.17, etcd v3.5.13
Bump spegel version
Fix issue with externalTrafficPolicy: Local for single-stack services on dual-stack nodes
ServiceLB now sets the priorityClassName on svclb pods to `system-node-critical` by default. This can be overridden on a per-service basis via the `svccontroller.k3s.cattle.io/priorityclassname` annotation.
bump minio-go to v7.0.70
Bump kine to v0.11.9 to fix pagination
Update valid resolv conf
Add missing kernel config check
Symlinked sub-directories are now respected when scanning Auto-Deploying Manifests (AddOns) 
Fix bug: allow helm controller set owner reference
Bump klipper-helm image for tls secret support
Fix issue with k3s-etcd informers not starting
`--enable-pprof` can now be set on agents to enable the debug/pprof endpoints. When set, agents will listen on the supervisor port.
`--supervisor-metrics` can now be set on servers to enable serving internal metrics on the supervisor endpoint; when set agents will listen on the supervisor port.
Fix netpol crash when node remains tained unintialized
The embedded load-balancer will now fall back to trying all servers with health-checks ignored, if all servers have been marked unavailable due to failed health checks.

Further Comments

[codecov]

Codecov Report

Attention: Patch coverage is 31.79012% with 221 lines in your changes are missing coverage. Please review.

Project coverage is 35.94%. Comparing base (331ce70) to head (1e34e07).

Files	Patch %	Lines
pkg/agent/https/https.go	0.00%	55 Missing ⚠️
pkg/util/net.go	14.81%	45 Missing and 1 partial ⚠️
pkg/deploy/controller.go	0.00%	12 Missing and 1 partial ⚠️
pkg/profile/profile.go	0.00%	13 Missing ⚠️
pkg/util/file.go	0.00%	11 Missing ⚠️
pkg/spegel/spegel.go	0.00%	10 Missing ⚠️
pkg/metrics/metrics.go	0.00%	9 Missing ⚠️
pkg/agent/run.go	0.00%	4 Missing and 2 partials ⚠️
pkg/cli/agent/agent.go	45.45%	3 Missing and 3 partials ⚠️
pkg/cli/server/server.go	70.00%	3 Missing and 3 partials ⚠️
... and 21 more

Additional details and impacted files

@@               Coverage Diff                @@
##           release-1.27   #10259      +/-   ##
================================================
- Coverage         43.16%   35.94%   -7.23%     
================================================
  Files               158      160       +2     
  Lines             16324    13947    -2377     
================================================
- Hits               7046     5013    -2033     
+ Misses             8024     7938      -86     
+ Partials           1254      996     -258     

Flag	Coverage Δ
e2etests	35.94% <31.79%> (-10.46%)	⬇️
unittests	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.