[release-1.31] Backports for 2024-11

Dockerfile

@@ -118,7 +118,7 @@ RUN rm -vf /charts/*.sh /charts/*.md /charts/chart_versions.yaml
 # must be placed in bin/ of the file image and subdirectories of bin/ will be flattened during installation.
 # This means bin/foo/bar will become bin/bar when rke2 installs this to the host
 FROM rancher/hardened-kubernetes:v1.31.2-rke2r1-build20241023 AS kubernetes
-FROM rancher/hardened-containerd:v1.7.22-k3s1-build20241010 AS containerd
+FROM rancher/hardened-containerd:v1.7.23-k3s1-build20241106 AS containerd
 FROM rancher/hardened-crictl:v1.31.1-build20241011 AS crictl
 FROM rancher/hardened-runc:v1.1.14-build20240910 AS runc
 

Dockerfile.windows

@@ -38,7 +38,7 @@ RUN curl -sL https://raw.githubusercontent.com/golangci/golangci-lint/master/ins
 WORKDIR /source
 # End Dapper stuff
 
-FROM --platform=$BUILDPLATFORM rancher/hardened-containerd:v1.7.22-k3s1-build20241010-amd64-windows AS containerd
+FROM --platform=$BUILDPLATFORM rancher/hardened-containerd:v1.7.23-k3s1-build20241106-amd64-windows AS containerd
 FROM build as windows-runtime-collect
 ARG KUBERNETES_VERSION=dev
 

bundle/bin/rke2-killall.sh

@@ -43,8 +43,7 @@ do_unmount_and_remove() {
     MOUNTS=$(printf ${MOUNTS} | grep "^$1" | sort -r)
     if [ -n "${MOUNTS}" ]; then
         set -x
-        umount ${MOUNTS}
-        rm -rf --one-file-system ${MOUNTS}
+        umount -- ${MOUNTS} && rm -rf --one-file-system -- ${MOUNTS}
     else
         set -x
     fi

pkg/cli/cmds/agent.go

@@ -31,6 +31,7 @@ var (
 		"docker":                            dropFlag,
 		"container-runtime-endpoint":        copyFlag,
 		"disable-default-registry-endpoint": copyFlag,
+		"nonroot-devices":                   copyFlag,
 		"image-service-endpoint":            dropFlag,
 		"pause-image":                       dropFlag,
 		"default-runtime":                   copyFlag,

pkg/cli/cmds/server.go

@@ -97,6 +97,7 @@ var (
 		"docker":                            dropFlag,
 		"container-runtime-endpoint":        copyFlag,
 		"disable-default-registry-endpoint": copyFlag,
+		"nonroot-devices":                   copyFlag,
 		"embedded-registry":                 copyFlag,
 		"supervisor-metrics":                copyFlag,
 		"image-service-endpoint":            dropFlag,

pkg/rke2/rke2_linux.go

@@ -4,16 +4,10 @@
 package rke2
 
 import (
-	"bytes"
-	"context"
 	"fmt"
-	"io/ioutil"
-	"net/http"
-	"os/exec"
 	"path/filepath"
 	"strconv"
 	"strings"
-	"time"
 
 	"github.com/k3s-io/k3s/pkg/agent/config"
 	"github.com/k3s-io/k3s/pkg/cli/cmds"
@@ -24,7 +18,6 @@ import (
 	"github.com/rancher/rke2/pkg/cli/defaults"
 	"github.com/rancher/rke2/pkg/images"
 	"github.com/rancher/rke2/pkg/podexecutor"
-	"github.com/sirupsen/logrus"
 	"github.com/urfave/cli"
 )
 
@@ -96,19 +89,6 @@ func initExecutor(clx *cli.Context, cfg Config, isServer bool) (*podexecutor.Sta
 			Name: cfg.CloudProviderName,
 			Path: cfg.CloudProviderConfig,
 		}
-		if clx.String("node-name") == "" && cfg.CloudProviderName == "aws" {
-			fqdn := hostnameFromMetadataEndpoint(context.Background())
-			if fqdn == "" {
-				hostFQDN, err := hostnameFQDN()
-				if err != nil {
-					return nil, err
-				}
-				fqdn = hostFQDN
-			}
-			if err := clx.Set("node-name", fqdn); err != nil {
-				return nil, err
-			}
-		}
 	}
 
 	if cfg.KubeletPath == "" {
@@ -489,47 +469,3 @@ func parseControlPlaneMounts(cfg Config) (*podexecutor.ControlPlaneMounts, error
 		CloudControllerManager: cfg.ExtraMounts.CloudControllerManager.Value(),
 	}, nil
 }
-
-func hostnameFQDN() (string, error) {
-	cmd := exec.Command("hostname", "-f")
-
-	var b bytes.Buffer
-	cmd.Stdout = &b
-
-	if err := cmd.Run(); err != nil {
-		return "", err
-	}
-
-	return strings.TrimSpace(b.String()), nil
-}
-
-func hostnameFromMetadataEndpoint(ctx context.Context) string {
-	ctx, cancel := context.WithTimeout(ctx, time.Second)
-	defer cancel()
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, "http://169.254.169.254/latest/meta-data/local-hostname", nil)
-	if err != nil {
-		logrus.Debugf("Failed to create request for metadata endpoint: %v", err)
-		return ""
-	}
-
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		logrus.Debugf("Failed to get local-hostname from metadata endpoint: %v", err)
-		return ""
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		logrus.Debugf("Metadata endpoint returned unacceptable status code %d", resp.StatusCode)
-		return ""
-	}
-
-	b, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		logrus.Debugf("Failed to read response body from metadata endpoint: %v", err)
-		return ""
-	}
-
-	return strings.TrimSpace(string(b))
-}

scripts/build-binary

@@ -30,7 +30,7 @@ VERSION_FLAGS="
     -X ${K3S_PKG}/pkg/version.Version=${VERSION}
     -X ${K3S_PKG}/pkg/version.UpstreamGolang=${VERSION_GOLANG}
     -X ${RKE2_PKG}/pkg/images.DefaultRegistry=${REGISTRY}
-    -X ${RKE2_PKG}/pkg/images.DefaultEtcdImage=rancher/hardened-etcd:${ETCD_VERSION}-build20240910
+    -X ${RKE2_PKG}/pkg/images.DefaultEtcdImage=rancher/hardened-etcd:${ETCD_VERSION}-build20241106
     -X ${RKE2_PKG}/pkg/images.DefaultKubernetesImage=rancher/hardened-kubernetes:${KUBERNETES_IMAGE_TAG}
     -X ${RKE2_PKG}/pkg/images.DefaultPauseImage=rancher/mirrored-pause:${PAUSE_VERSION}
     -X ${RKE2_PKG}/pkg/images.DefaultRuntimeImage=${REPO}/${PROG}-runtime:${DOCKERIZED_VERSION}

scripts/build-images

@@ -16,7 +16,7 @@ xargs -n1 -t docker image pull --quiet << EOF >> build/images-core.txt
     ${REGISTRY}/rancher/hardened-coredns:v1.11.3-build20241018
     ${REGISTRY}/rancher/hardened-cluster-autoscaler:v1.8.11-build20241014
     ${REGISTRY}/rancher/hardened-dns-node-cache:1.23.1-build20241008
-    ${REGISTRY}/rancher/hardened-etcd:${ETCD_VERSION}-build20240910
+    ${REGISTRY}/rancher/hardened-etcd:${ETCD_VERSION}-build20241106
     ${REGISTRY}/rancher/hardened-k8s-metrics-server:v0.7.1-build20241008
     ${REGISTRY}/rancher/hardened-addon-resizer:1.8.20-build20241001
     ${REGISTRY}/rancher/klipper-helm:v0.9.3-build20241008

scripts/build-windows-binary

@@ -31,7 +31,7 @@ VERSION_FLAGS="
     -X ${K3S_PKG}/pkg/version.Version=${VERSION}
     -X ${K3S_PKG}/pkg/version.UpstreamGolang=${VERSION_GOLANG}
     -X ${RKE2_PKG}/pkg/images.DefaultRegistry=${REGISTRY}
-    -X ${RKE2_PKG}/pkg/images.DefaultEtcdImage=rancher/hardened-etcd:${ETCD_VERSION}-build20240910
+    -X ${RKE2_PKG}/pkg/images.DefaultEtcdImage=rancher/hardened-etcd:${ETCD_VERSION}-build20241106
     -X ${RKE2_PKG}/pkg/images.DefaultKubernetesImage=${REPO}/hardened-kubernetes:${KUBERNETES_IMAGE_TAG}
     -X ${RKE2_PKG}/pkg/images.DefaultPauseImage=rancher/mirrored-pause:${PAUSE_VERSION}
     -X ${RKE2_PKG}/pkg/images.DefaultRuntimeImage=${REPO}/${PROG}-runtime:${DOCKERIZED_VERSION}-${GOOS}-${GOARCH}

scripts/version.sh

@@ -34,7 +34,7 @@ RELEASE=${PROG}.${PLATFORM}
 # hardcode versions unless set specifically
 KUBERNETES_VERSION=${KUBERNETES_VERSION:-v1.31.2}
 KUBERNETES_IMAGE_TAG=${KUBERNETES_IMAGE_TAG:-v1.31.2-rke2r1-build20241023}
-ETCD_VERSION=${ETCD_VERSION:-v3.5.13-k3s1}
+ETCD_VERSION=${ETCD_VERSION:-v3.5.16-k3s1}
 PAUSE_VERSION=${PAUSE_VERSION:-3.6}
 CCM_VERSION=${CCM_VERSION:-v1.31.2-0.20241016053446-0955fa330f90-build20241016}