[release-1.28] Bump containerd for image rewrite fix

[brandond]

Proposed Changes

Bump containerd to fix rewrites

• The container bump in Bump k3s, etcd, containerd #7214 did not handle all cases where registry references needed to be rewritten - this is fixed in k3s-io/containerd@d157dab

Types of Changes

version bump, bugfix

Verification

See linked issues

Testing

Linked Issues

• [Release-1.28] - Bump containerd to v1.7.23 #7304

User-Facing Change

Bump containerd to v1.7.23-k3s2

Further Comments

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 23.70%. Comparing base (62bc262) to head (956b75e).

Additional details and impacted files

@@              Coverage Diff              @@
##           release-1.28    #7380   +/-   ##
=============================================
  Coverage         23.70%   23.70%           
=============================================
  Files                33       33           
  Lines              3392     3392           
=============================================
  Hits                804      804           
  Misses             2541     2541           
  Partials             47       47           

Flag	Coverage Δ
inttests	8.99% <ø> (ø)
unittests	16.84% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[sdiamond2]

Can this be release in a new RKE2 release for 1.28. I don't see a release with this change.

[brandond]

No. 1.28 is dead. Upstream is not putting out any more releases so neither are we. This was backported on the off chance upstream did another release in November, but they did not.

https://kubernetes.io/releases/patch-releases/#non-active-branch-history

Minor Version	Final Patch Release	End Of Life Date	Note
1.28	1.28.15	2024-10-22

You should upgrade to 1.29 or newer.

[sdiamond2]

So if I need this fix and I am 1.26. You are telling me I need to use 1.27.9 then go straight to v1.29.11?

[brandond]

No, you must go through all intermediate minors when upgrading:
https://kubernetes.io/releases/version-skew-policy/#supported-component-upgrade-order

Project policies for API deprecation and API change guidelines require kube-apiserver to not skip minor versions when upgrading, even in single-instance clusters.

You should use the latest patch on each minor, why would you go to 1.27.9?
v1.26.x -> v1.27.16+rke2r2 -> v1.28.15+rke2r1 -> v1.29.11+rke2r1

[sdiamond2]

That is what I attempted earlier this week but because of the Rewrite not working, I could only go to 1.27.9. The latest version of RKE2 does not support this fix.

[sdiamond2]

Unless there is a way for me to force to use the latest version of containerd when I install RKE2.

[brandond]

The build of containerd (v1.7.23-k3s1) affected by the issue mentioned in this PR was never in a released version of RKE2. The issue was caught by QA prior to release, and we're shipping v1.7.23-k3s2 for this patch cycle.

What issue are you ACTUALLY affected by?

I'm going to lock this conversation as it is going off topic from this PR. Please open a new issue, and fill out the issue template to describe your environment and what problem you're trying to resolve.