Improve CA hash validation

When token includes CA hash, only trust root CAs with matching hash, instead of trusting all certs in the bundle as long as one of the roots has a matching hash.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Extend token_test to reach correct if failure

Signed-off-by: Derek Nola <derek.nola@suse.com>

Improve CA hash validation

When token includes CA hash, only trust root CAs with matching hash, instead of trusting all certs in the bundle as long as one of the roots has a matching hash.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Extend token_test to reach correct if failure

Signed-off-by: Derek Nola <derek.nola@suse.com>

Improve CA hash validation

When token includes CA hash, only trust root CAs with matching hash, instead of trusting all certs in the bundle as long as one of the roots has a matching hash.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Extend token_test to reach correct if failure

Signed-off-by: Derek Nola <derek.nola@suse.com>

Improve CA hash validation

When token includes CA hash, only trust root CAs with matching hash, instead of trusting all certs in the bundle as long as one of the roots has a matching hash.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Extend token_test to reach correct if failure

Signed-off-by: Derek Nola <derek.nola@suse.com>

Improve CA hash validation

When token includes CA hash, only trust root CAs with matching hash, instead of trusting all certs in the bundle as long as one of the roots has a matching hash.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Extend token_test to reach correct if failure

Signed-off-by: Derek Nola <derek.nola@suse.com>

Improve CA hash validation

When token includes CA hash, only trust root CAs with matching hash, instead of trusting all certs in the bundle as long as one of the roots has a matching hash.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Extend token_test to reach correct if failure

Signed-off-by: Derek Nola <derek.nola@suse.com>

Reject anonymous access to supervisor router (spegel/pprof/metrics) (#…

…14704)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Signed-off-by: Derek Nola <derek.nola@suse.com>
Co-authored-by: Brad Davidson <brad.davidson@rancher.com>

Reject anonymous access to supervisor router (spegel/pprof/metrics) (#…

…14704)

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
Signed-off-by: Derek Nola <derek.nola@suse.com>
Co-authored-by: Brad Davidson <brad.davidson@rancher.com>

fix: bump cadvisor to v0.60.5-k3s1

cadvisor needs to be bumped to the fork of k3s-io
because we need to make easir for k3s to reach
the argContainerdRuntime variable in lib/containerd
because upstream deprecated from kubelet the --containerd

Signed-off-by: Vitor Savian <vitor.savian@suse.com>

[release-1.36] Bump k3s-io/kubernetes and Go references (#14694)

* chore: Bump k8s.io/kubernetes replace directive

Made with ❤️️ by updatecli

* chore: Bump k8s.io/kubernetes require line

Made with ❤️️ by updatecli

* chore: Bump k8s.io/* modules pinned to client-go version

Made with ❤️️ by updatecli

* chore: Bump k3s-io/kubernetes staging module versions

Made with ❤️️ by updatecli

* chore: Bump Go version directive in go.mod

Made with ❤️️ by updatecli

* chore: Bump Go version in Dockerfiles

Made with ❤️️ by updatecli

* chore: Run go mod tidy

Made with ❤️️ by updatecli

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>