[release-1.27] Backports for 2024-04 release cycle

[brandond]

Proposed Changes

Backports:

• Send error response if member list cannot be retrieved #9722
• Respect cloud-provider fields set by kubelet #9721
• Fix error when image has already been pulled #9770
• Add /etc/passwd and /etc/group to k3s docker image #9784
• Fix etcd snapshot reconcile for agentless servers #9809
• Add health-check support to loadbalancer #9757
• Add certificate expiry check, events, and metrics #9772
• Add workaround for containerd hosts.toml bug when passing config for default registry endpoint #9853
• Add supervisor cert/key to rotate list #9832
• Bump containerd and cri-dockerd #9886
• Move etcd snapshot management CLI to request/response #9816
• Improve etcd load-balancer startup behavior #9883
• Actually fix agent certificate rotation #9902
• Update packaged manifests #9920

Types of Changes

Verification

See linked issues

Testing

Linked Issues

• [Release-1.27] - Unrecoverable error when joining node attempts to retrieve etcd member list from itself #9791
• [Release-1.27] - [cloud-provider] only pretend that instances from the current "cloud" exist #9793
• [Release-1.27] - Errors logged when pulling images from text file #9795
• [Release-1.27] - K3s docker image is missing user info for root #9813
• [Release-1.27] - etcd snapshot controller thrashes on etcdsnapshotfile management when server is run with --disable-agent #9815
• [Release-1.27] - Stopping service on ControlPlane node causes other nodes to go NotReady #9914
• [Release-1.27] - Emit events for certificates about to expire #9899
• [Release-1.27] - Registry TLS configuration from registries.yaml is only honored for mirror endpoints #9918
• [Release-1.27] - Add client-supervior.crt and client-supervior.key to the rotation list #9916
• [Release-1.27] - Bump containerd to v1.7.15 #9894
• [Release-1.27] - Bump cri-dockerd to v0.3.12 #9896
• [Release-1.27] - k3s etcd-snapshot save fails on host with IPv6 only #9369
• [Release-1.27] - Etcd load-balancer on control-plane-only server may select removed etcd cluster member as default server #9892
• [Release-1.27] - k3s certificate rotate fails on agents #9901
• [Release-1.27] - Set defaultVolumeType for storageclass #9929
• [Release-1.27] - Traefik manifest has wrong location for podAnnotations #9931
• [Release-1.27] - Cannot use ipv6 literal as system-default-registry #9933

User-Facing Change

Send error response if member list cannot be retrieved
The k3s stub cloud provider now respects the kubelet's requested provider-id, instance type, and topology labels
Fix error when image has already been pulled
Add /etc/passwd and /etc/group to k3s docker image
Fix etcd snapshot reconcile for agentless servers 
Add health-check support to loadbalancer
Add certificate expiry check, events, and metrics
Add workaround for containerd hosts.toml bug when passing config for default registry endpoint
Add supervisor cert/key to rotate list
The embedded containerd has been bumped to v1.7.15
The embedded cri-dockerd has been bumped to v0.3.12
The `k3s etcd-snapshot` command has been reworked for improved consistency. All snapshots operations are now performed by the server process, with the CLI acting as a client to initiate and report results. As a side effect, the CLI is now less noisy when managing snapshots.
Improve etcd load-balancer startup behavior
Actually fix agent certificate rotation
Traefik has been bumped to v2.10.7.
Traefik pod annotations are now set properly in the default chart values.
The system-default-registry value now supports RFC2732 IPv6 literals.
The local-path provisioner now defaults to creating `local` volumes, instead of `hostPath`.

Further Comments

[codecov]

Codecov Report

Attention: Patch coverage is 23.37376% with 695 lines in your changes are missing coverage. Please review.

Project coverage is 35.56%. Comparing base (01461af) to head (2f2ccc9).

Files	Patch %	Lines
pkg/etcd/snapshot_handler.go	0.00%	127 Missing ⚠️
pkg/cli/etcdsnapshot/etcd_snapshot.go	0.00%	106 Missing ⚠️
pkg/etcd/snapshot.go	0.00%	81 Missing ⚠️
pkg/cli/cert/cert.go	0.00%	79 Missing ⚠️
pkg/etcd/etcd.go	2.17%	45 Missing ⚠️
pkg/util/apierrors.go	0.00%	45 Missing ⚠️
pkg/etcd/etcdproxy.go	0.00%	39 Missing ⚠️
pkg/clientaccess/token.go	20.51%	28 Missing and 3 partials ⚠️
pkg/certmonitor/certmonitor.go	70.49%	10 Missing and 8 partials ⚠️
pkg/agent/loadbalancer/servers.go	66.66%	9 Missing and 4 partials ⚠️
... and 17 more

Additional details and impacted files

@@               Coverage Diff                @@
##           release-1.27    #9912      +/-   ##
================================================
- Coverage         38.58%   35.56%   -3.02%     
================================================
  Files               154      155       +1     
  Lines             15775    13769    -2006     
================================================
- Hits               6086     4897    -1189     
+ Misses             8614     7918     -696     
+ Partials           1075      954     -121     

Flag	Coverage Δ
e2etests	35.56% <23.37%> (-3.79%)	⬇️
unittests	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.