Merge branch 'rancher:master' into master

.drone.yml

@@ -20,9 +20,11 @@ steps:
             echo "Some files in PR are not ignored, $DIFF";
         fi;
     when:
-      event:
-        - push
-        - pull_request
+      ref:
+        include:
+          - refs/heads/master
+          - refs/heads/release-*
+          - refs/pull/**
 
   - name: validate-release
     image: rancher/dapper:v0.5.5
@@ -53,6 +55,13 @@ steps:
     volumes:
       - name: docker
         path: /var/run/docker.sock
+    when:
+      ref:
+        include:
+          - refs/heads/master
+          - refs/heads/release-*
+          - refs/pull/**
+          - refs/tags/*
 
   - name: fossa
     image: rancher/drone-fossa:latest
@@ -98,6 +107,11 @@ steps:
     when:
       instance:
         - drone-publish.rancher.io
+      ref:
+        include:
+          - refs/heads/master
+          - refs/heads/release-*
+          - refs/tags/*
 
   - name: test
     image: rancher/dapper:v0.5.5
@@ -113,6 +127,13 @@ steps:
     volumes:
       - name: docker
         path: /var/run/docker.sock
+    when:
+      ref:
+        include:
+          - refs/heads/master
+          - refs/heads/release-*
+          - refs/pull/**
+          - refs/tags/*
 
   - name: publish-image-runtime
     image: rancher/hardened-build-base:v1.20.4b2
@@ -201,9 +222,11 @@ steps:
             echo "Some files in PR are not ignored, $DIFF";
         fi;
     when:
-      event:
-        - push
-        - pull_request
+      ref:
+        include:
+          - refs/heads/master
+          - refs/heads/release-*
+          - refs/pull/**
 
   - name: build
     image: rancher/dapper:v0.5.8
@@ -212,6 +235,13 @@ steps:
     volumes:
       - name: docker
         path: /var/run/docker.sock
+    when:
+      ref:
+        include:
+          - refs/heads/master
+          - refs/heads/release-*
+          - refs/pull/**
+          - refs/tags/*
 
   - name: package-images
     image: rancher/dapper:v0.5.8
@@ -295,9 +325,11 @@ steps:
             echo "Some files in PR are not ignored, $DIFF";
         fi;
     when:
-      event:
-        - push
-        - pull_request
+      ref:
+        include:
+          - refs/heads/master
+          - refs/heads/release-*
+          - refs/pull/**
 
   - name: dispatch
     image: rancher/dapper:v0.5.5
@@ -350,9 +382,11 @@ steps:
             echo "Some files in PR are not ignored, $DIFF";
         fi;
     when:
-      event:
-        - push
-        - pull_request
+      ref:
+        include:
+          - refs/heads/master
+          - refs/heads/release-*
+          - refs/pull/**
 
   - name: push-runtime-manifest
     image: plugins/manifest

Dockerfile.windows

@@ -1,4 +1,4 @@
-FROM alpine:3.17 AS build
+FROM alpine:3.18 AS build
 
 RUN apk --no-cache add \
     curl \

channels.yaml

@@ -1,6 +1,6 @@
 channels:
 - name: stable
-  latest: v1.25.9+rke2r1
+  latest: v1.25.10+rke2r1
 - name: latest
   latestRegexp: .*
   excludeRegexp: (^[^+]+-|v1\.25\.5\+rke2r1|v1\.26\.0\+rke2r1)

install.sh

@@ -480,20 +480,27 @@ do_install_rpm() {
             repodir=/etc/zypp/repos.d
         fi
         if [ "${ID_LIKE%%[ ]*}" = "suse" ]; then
+            # create the /var/lib/rpm-state in SLE systems to fix the prein selinux macro
+            if [ "${TRANSACTIONAL_UPDATE=false}" != "true" ] && [ -x /usr/sbin/transactional-update ]; then
+                transactional_update_run="transactional-update --no-selfupdate -d run"
+            fi
+            ${transactional_update_run} mkdir -p /var/lib/rpm-state
+            # configure infix and rpm_installer
             rpm_site_infix=microos
+            if [ "${VARIANT_ID:-}" = sle-micro ]; then
+                rpm_site_infix=slemicro
+                package_installer=zypper
+            fi
             rpm_installer="zypper --gpg-auto-import-keys"
             if [ "${TRANSACTIONAL_UPDATE=false}" != "true" ] && [ -x /usr/sbin/transactional-update ]; then
                 rpm_installer="transactional-update --no-selfupdate -d run ${rpm_installer}"
             fi
         else
             maj_ver=$(echo "$VERSION_ID" | sed -E -e "s/^([0-9]+)\.?[0-9]*$/\1/")
             case ${maj_ver} in
-                7|8)
+                7|8|9)
                     :
                     ;;
-                9) # We are currently using EL8 packages for EL9 as well
-                    maj_ver="8"
-                    ;;
                 *) # In certain cases, like installing on Fedora, maj_ver will end up being something that is not 7 or 8
                     maj_ver="7"
                     ;;
@@ -549,6 +556,16 @@ gpgkey=https://${rpm_site}/public.key
 EOF
     fi
 
+    if rpm -q --quiet rke2-selinux; then 
+            # remove rke2-selinux module in el9 before upgrade to allow container-selinux to upgrade safely
+            if check_available_upgrades container-selinux && check_available_upgrades rke2-selinux; then
+                MODULE_PRIORITY=$(semodule --list=full | grep rke2 | cut -f1 -d" ")
+                if [ -n "${MODULE_PRIORITY}" ]; then
+                    semodule -X $MODULE_PRIORITY -r rke2 || true
+                fi
+            fi
+        fi
+
     if [ -z "${INSTALL_RKE2_VERSION}" ] && [ -z "${INSTALL_RKE2_COMMIT}" ]; then
         ${rpm_installer} install -y "rke2-${INSTALL_RKE2_TYPE}"
     elif [ -n "${INSTALL_RKE2_COMMIT}" ]; then
@@ -564,6 +581,21 @@ EOF
     fi
 }
 
+check_available_upgrades() {
+    . /etc/os-release
+    set +e
+    if [ "${ID_LIKE%%[ ]*}" = "suse" ]; then
+        available_upgrades=$(zypper -q -t -s 11 se -s -u --type package $1 | tail -n 1 | grep -v "No matching" | awk '{print $3}')
+    else
+        available_upgrades=$(yum -q --refresh list $1 --upgrades | tail -n 1 | awk '{print $2}')
+    fi
+    set -e
+    if [ -n "${available_upgrades}" ]; then
+        return 0
+    fi
+    return 1
+}
+
 do_install_tar() {
     setup_tmp
 

pkg/bootstrap/bootstrap.go

@@ -93,6 +93,7 @@ func Stage(resolver *images.Resolver, nodeConfig *daemonconfig.Node, cfg cmds.Ag
 
 	refBinDir := binDirForDigest(cfg.DataDir, refDigest)
 	refChartsDir := chartsDirForDigest(cfg.DataDir, refDigest)
+	manifestsDir := manifestsDir(cfg.DataDir)
 	imagesDir := imagesDir(cfg.DataDir)
 
 	if dirExists(refBinDir) && dirExists(refChartsDir) {
@@ -130,12 +131,18 @@ func Stage(resolver *images.Resolver, nodeConfig *daemonconfig.Node, cfg cmds.Ag
 			}
 		}
 
+		// preserve manifests directory mode when extracting, if it already exists
+		extractOptions := []extract.Option{}
+		if fi, err := os.Stat(manifestsDir); err == nil {
+			extractOptions = append(extractOptions, extract.WithMode(fi.Mode()))
+		}
+
 		// Extract binaries and charts
 		extractPaths := map[string]string{
 			"/bin":    refBinDir,
 			"/charts": refChartsDir,
 		}
-		if err := extract.ExtractDirs(img, extractPaths); err != nil {
+		if err := extract.ExtractDirs(img, extractPaths, extractOptions...); err != nil {
 			return "", errors.Wrap(err, "failed to extract runtime image")
 		}
 		// Ensure correct permissions on bin dir

tests/acceptance/Makefile

@@ -3,7 +3,7 @@ include ./config.mk
 
 TAGNAME ?= default
 test-env-up:
-	@cd ../.. && docker build . -q -f ./tests/acceptance/shared/scripts/Dockerfile.build -t rke2-automated-${TAGNAME}
+	@cd ../.. && docker build . -q -f ./tests/acceptance/scripts/Dockerfile.build -t rke2-automated-${TAGNAME}
 
 # -d
 .PHONY: test-run

tests/acceptance/core/service/assert/host.go

@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/rancher/rke2/tests/acceptance/shared/util"
+	"github.com/rancher/rke2/tests/acceptance/shared"
 
 	. "github.com/onsi/gomega"
 )
@@ -17,7 +17,7 @@ import (
 func CheckComponentCmdHost(cmd string, asserts ...string) {
 	Eventually(func() error {
 		fmt.Println("Executing cmd: ", cmd)
-		res, err := util.RunCommandHost(cmd)
+		res, err := shared.RunCommandHost(cmd)
 		if err != nil {
 			return fmt.Errorf("error on RunCommandHost: %v", err)
 		}

tests/acceptance/core/service/assert/node.go

@@ -4,49 +4,49 @@ import (
 	"fmt"
 
 	"github.com/rancher/rke2/tests/acceptance/core/service/customflag"
-	"github.com/rancher/rke2/tests/acceptance/shared/util"
+	"github.com/rancher/rke2/tests/acceptance/shared"
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 )
 
-type NodeAssertFunc func(g Gomega, node util.Node)
+type NodeAssertFunc func(g Gomega, node shared.Node)
 
 // NodeAssertVersionTypeUpgraded  custom assertion func that asserts that node version is as expected
-func NodeAssertVersionTypeUpgraded(installType *customflag.InstallTypeValue) NodeAssertFunc {
+func NodeAssertVersionTypeUpgraded(installType *customflag.InstallTypeValueFlag) NodeAssertFunc {
 	if installType.Version != "" {
 		fmt.Printf("Asserting Version: %s\n", installType.Version)
-		return func(g Gomega, node util.Node) {
+		return func(g Gomega, node shared.Node) {
 			g.Expect(node.Version).Should(Equal(installType.Version),
 				"Nodes should all be upgraded to the specified version", node.Name)
 		}
 	}
 
 	if installType.Commit != "" {
-		version := util.GetRke2Version()
+		version := shared.GetRke2Version()
 		fmt.Printf("Asserting Commit: %s\n Version: %s", installType.Commit, version)
-		return func(g Gomega, node util.Node) {
+		return func(g Gomega, node shared.Node) {
 			g.Expect(version).Should(ContainSubstring(installType.Commit),
 				"Nodes should all be upgraded to the specified commit", node.Name)
 		}
 	}
 
-	return func(g Gomega, node util.Node) {
+	return func(g Gomega, node shared.Node) {
 		GinkgoT().Errorf("no version or commit specified for upgrade assertion")
 	}
 }
 
 // NodeAssertVersionUpgraded custom assertion func that asserts that node version is as expected
 func NodeAssertVersionUpgraded() NodeAssertFunc {
-	return func(g Gomega, node util.Node) {
-		g.Expect(&customflag.UpgradeVersionSUC).Should(ContainSubstring(node.Version),
+	return func(g Gomega, node shared.Node) {
+		g.Expect(&customflag.ServiceFlag.UpgradeVersionSUC).Should(ContainSubstring(node.Version),
 			"Nodes should all be upgraded to the specified version", node.Name)
 	}
 }
 
 // NodeAssertReadyStatus custom assertion func that asserts that the node is in Ready state.
 func NodeAssertReadyStatus() NodeAssertFunc {
-	return func(g Gomega, node util.Node) {
+	return func(g Gomega, node shared.Node) {
 		g.Expect(node.Status).Should(Equal("Ready"),
 			"Nodes should all be in Ready state")
 	}
@@ -57,7 +57,7 @@ func NodeAssertReadyStatus() NodeAssertFunc {
 func CheckComponentCmdNode(cmd, assert, ip string) {
 	Eventually(func(g Gomega) {
 		fmt.Println("Executing cmd: ", cmd)
-		res, err := util.RunCommandOnNode(cmd, ip)
+		res, err := shared.RunCommandOnNode(cmd, ip)
 		if err != nil {
 			return
 		}
@@ -66,14 +66,3 @@ func CheckComponentCmdNode(cmd, assert, ip string) {
 		fmt.Println("Result:", res+"Matched with assert:", assert)
 	}, "420s", "3s").Should(Succeed())
 }
-
-// NodeAssertCount custom assertion func that asserts that node count is as expected
-func NodeAssertCount() NodeAssertFunc {
-	return func(g Gomega, node util.Node) {
-		expectedNodeCount := util.NumServers + util.NumAgents
-		nodes, err := util.Nodes(false)
-		g.Expect(err).NotTo(HaveOccurred())
-		g.Expect(len(nodes)).To(Equal(expectedNodeCount),
-			"Number of nodes should match the spec")
-	}
-}