Centralize Fleet consts

Clean up additional rancher namespaces

Update ldap library to v3

airgap HA automation

Adding code for hardened HA local cluster

When Rancher is behind a proxy with a certificate, a tls-ca-additional
secret should be created by the user in the cattle-system namespace.
However, the machine provisioning job (for both creation and deletion)
needs this secret as well. Since this job runs in the fleet-default
namespace, the secret must also exists in this namespace.

This change will look for such a secret in the cattle-system namespace
and copy it to the fleet-default namespace on startup.

Add retries to steve proxy dialer

Add etcd member management controller for RKE2/K3s clusters

Signed-off-by: Chris Kim <oats87g@gmail.com>

If the cluster agent is disconnected (for instance, due to an upgrade)
and is being slow to reconnect, the transport's DialContext will fail to
get a connection to the cluster which bubbles up as an Internal Server
Error and makes it appear to the user as though Rancher itself has
crashed if they were trying to access the disconnected cluster at the
time. This change address the problem by adding retries to the dialer in
the steve proxy, which should give the agent enough time to reconnect
before a response needs to be returned to the user. This is similar to
how the dialer works in the aggregation server[1]. In this case we have
a Dialer function rather than a remotedialer Server object so we can't
use HasSession, but catching the error from the dial attempt has the
same effect.

[1] https://github.com/rancher/rancher/blob/76e743c2b38970c42e8f7a2f419c7b030c17dfb8/pkg/api/steve/aggregation/aggregation.go#L99

node labels: update DO image and size

When a user enables a node driver, there are CRDs that are are created
in Kubernetes that Rancher watches with the dynamic client. When a user
disables a node driver, the CRDs are deleted but Rancher will not stop
watching them with the dynamic client.

This change will cause the dynamic client to stop watching CRDs that are
deleted.

In addition, the machine create job would be created if the providerID
for a machine was not set or if the create job had not completed.
However, this would cause a problem if the providerID was set and the
machine create job was created.

After this change, the machine create job will be created if the
providerID has not been set.

Update controller names to be unique

Problem:
Some controllers have the same name, this makes following controller
execution and troubleshooting harder in both logs and metrics

Solution:
Update controller names to be unique

Notes:
- the v3 major release coincided with an update to use Go modules[1] but
  is an otherwise backwards-compatible release. It was not related to
  compatibility with the LDAP V3 protocol, the ldap.v2 package was
  already compatible with the LDAP V3 protocol.
- the import path changed shortly after the v3 release[2], but it is the
  same package as before

[1] https://github.com/go-ldap/ldap/pull/247
[2] https://github.com/go-ldap/ldap/commit/c135faacbf0f8457d9cb53203f4a8baf1d3a31ab

Fix nil dereference for cluster cleanup

Bump wrangler to v0.8.7

Add two additional system namespaces to the cluster cleanup agent,
cattle-fleet-system and cattle-impersonation-system.

Ensure that the 'local' namespace has the 'local' cluster as an owner
reference. This way, running `system-tools remove` on an imported
downstream cluster will cause the 'local' namespace to be automatically
removed when the 'local' cluster is removed.

Update dockerfile dependencies

Include labels on global secret create in Cluster Manager for default namespace

Fix link in README

[2.6.2] Add simple password length and username comparison validation

updating password token field to include rancher server version

Validate AKS clusters with enableNetworkPolicy

Set node-external-ip even if no args are passed