etcd-manager: remove kops-utils-cp and use image volumes on all supported Kubernetes versions - #18688

kOps master now requires containerd >= 2.1.0 (validation) and defaults to 2.3.4, so the runtime side of image volumes is guaranteed for every cluster. The only remaining users of the kops-utils-cp copy fallback were Kubernetes 1.32 clusters. This PR enables image volumes on 1.32 as well, by force-enabling the ImageVolume kubelet feature gate the same way kOps already does for 1.33 through 1.35, and deletes the fallback and the image.

Changes

• HasImageVolumesSupport() now only checks for Kubernetes >= 1.32.0, which is OldestSupportedKubernetesVersion. The containerd conditions were dropped: validation guarantees >= 2.1.0, and with the fallback gone a false return would only suppress the feature gate while the manifest still uses image volumes.
• The copy fallback in the etcd-manager pod builder (kops-utils-cp bootstrap init container, per-version copy containers, symlink containers) is deleted; the image-volume path is unconditional. The opt emptyDir is also dropped: etcd-manager only reads and execs binaries from /opt/etcd-v<version> (BindirForEtcdVersion) and never writes under /opt, so the volume existed solely for the fallback.
• cmd/kops-utils-cp and its build/publish plumbing are removed: Makefile targets, cloudbuild.yaml push step, hack/set-version, and the KOPS_BASE_URL image preload entry in nodeup config.
• The ImageVolume conformance skip in tests/e2e/pkg/tester/skip_regex.go is kept: on ContainerOS kOps does not install containerd, so cos-121 nodes run the OS-bundled containerd 1.7 regardless of the cluster spec.

Why enabling on Kubernetes 1.32 is safe

Verified by source-level diffs of the kubelet code between release tags:

• The 1.32.0 kubelet ImageVolume implementation is the same code as 1.33.0 for the no-subPath case: the pull path (getImageVolumes, imageVolumePulls in pkg/kubelet/kuberuntime/kuberuntime_manager.go) is byte-identical, and image GC protection (realImageGCManager.handleImageVolumes) is functionally identical since 1.31. The 1.32 to 1.33 delta is only subPath plumbing (inert, kOps mounts whole images) and three kubelet metrics.
• 1.32.0 already contains the one substantive alpha-era fix, Kubelet should honour the VolumeAttributes which are reported by the volume plugin kubernetes#126806 (CRI mount attributes and the /etc/hosts collision check). The genuinely risky alpha is 1.31.x, which never received that fix and is below the kOps 1.37 floor anyway.
• 1.34 shipped zero ImageVolume changes, and 1.35 flipped only the feature-gate default with no functional hardening. The alpha/beta/GA progression tracked container runtime availability (KEP-4639 waited for CRI-O and containerd 2.1.0, released May 2025) and API graduation process, not kubelet code maturity.
• The ImageVolumeSource API and its validation are byte-identical from 1.31 through 1.35 for no-subPath manifests. The mirror-pod behavior with the apiserver gate off is the same as with the existing 1.33/1.34 setup and is cosmetic for static pods.
• No ImageVolume fix was ever cherry-picked to any 1.31 through 1.35 patch stream, so 1.32 receives no worse patch support than 1.33 through 1.35 did in practice.
• Known shared wart, not a 1.32 delta: Fix excessive events generated for image volumes kubernetes#138655 (EnsureImageExists event spam on every SyncPod) affects 1.31 through 1.36 equally and is fixed only in 1.37. kOps uses PullIfNotPresent, which mitigates it.

Clusters older than 1.32 are already rejected unless KOPS_RUN_OBSOLETE_VERSION is set; through that escape hatch, etcd-manager will no longer work below 1.32.

/cc @rifelpet @ameukam