Bump alpine from 3.20.3 to 3.21.0 (#448)

* Bump alpine from 3.20.3 to 3.21.0

Bumps alpine from 3.20.3 to 3.21.0.

---
updated-dependencies:
- dependency-name: alpine
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Update location of xtables files

See https://gitlab.alpinelinux.org/alpine/aports/-/commit/c49f2fa7aeab3487da65ca4398477af73fde51cb

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alejandro Pedraza <alejandro@buoyant.io>

Dockerfile

@@ -19,16 +19,16 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH GO111MODULE=on \
 ## Runtime
 ##
 
-FROM --platform=$TARGETPLATFORM alpine:3.20.3 as runtime
+FROM --platform=$TARGETPLATFORM alpine:3.21.0 as runtime
 RUN apk add iptables-legacy iptables libcap && \
     touch /run/xtables.lock && \
     chmod 0666 /run/xtables.lock
 
 COPY --link --from=go /out/linkerd2-proxy-init /usr/local/bin/proxy-init
 
 # Set sys caps for iptables utilities and proxy-init
-RUN setcap cap_net_raw,cap_net_admin+eip /sbin/xtables-legacy-multi && \
-    setcap cap_net_raw,cap_net_admin+eip /sbin/xtables-nft-multi && \
+RUN setcap cap_net_raw,cap_net_admin+eip /usr/sbin/xtables-legacy-multi && \
+    setcap cap_net_raw,cap_net_admin+eip /usr/sbin/xtables-nft-multi && \
     setcap cap_net_raw,cap_net_admin+eip /usr/local/bin/proxy-init
 
 USER 65534

Dockerfile-cni-plugin

@@ -34,7 +34,7 @@ RUN --mount=type=cache,target=target \
     just cni-repair-controller arch="$TARGETARCH" profile=release build && \
     mv "target/$target/release/linkerd-cni-repair-controller" .
 
-FROM --platform=$TARGETPLATFORM alpine:3.20.3 as runtime
+FROM --platform=$TARGETPLATFORM alpine:3.21.0 as runtime
 WORKDIR /linkerd
 RUN apk add \
     # For inotifywait