[release-1.25] Backports for 2023-08 release

[brandond]

Proposed Changes

Backports:

• Add FilterCN function to prevent SAN Stuffing #8085
• Make apiserver egress args conditional on egress-selector-mode #7972
• Bump versions for etcd, containerd, runc #8109
• Add support for using base template in etc/containerd/config.toml.tmpl #7991
• Bump docker/docker to master commit; cri-dockerd to 0.3.4 #8092
• Bump kine to v0.10.2 #8125
• Security bump to docker/distribution #8047

Types of Changes

backports

Verification

See linked issues

Testing

Linked Issues

• [Release-1.25] - dynamiclistener adds unwanted SubjectAlternativeName entries to certificate #8106
• [Release-1.25] - Don't set enable-aggregator-routing=true when egress-selector-mode=disabled #7997
• [Release-1.25] - Bump containerd to v1.7.3 / runc v1.1.8 #7988
• [Release-1.25] - Use base template in etc/containerd/config.toml.tmpl #8117
• [Release-1.25] - GO 1.20.6 breaks cri-dockerd #8103
• [Release-1.25] - Bump kine to v0.10.2 #8114

User-Facing Change

K3s's external apiserver listener now declines to add to its certificate any subject names not associated with the kubernetes apiserver service, server nodes, or values of the --tls-san option. This prevents the certificate's SAN list from being filled with unwanted entries.
K3s no longer enables the apiserver's `enable-aggregator-routing` flag when the egress proxy is not being used to route connections to in-cluster endpoints.
Updated the embedded containerd to v1.7.3+k3s1
Updated the embedded runc to v1.1.8
User-provided containerd config templates may now use `{{ template "base" . }}` to include the default K3s template content. This makes it easier to maintain user configuration if the only need is to add additional sections to the file.
Bump docker/docker module version to fix issues with cri-dockerd caused by recent releases of golang rejecting invalid host headers sent by the docker client.
Updated kine to v0.10.2

Further Comments

[brandond]

s390 issue; merging