release: constrain ip_local_port_range

[etungsten]

Issue number:
Fixes #1386 more definitively

Description of changes:

Author: Erikson Tung <etung@amazon.com>
Date:   Tue May 4 15:41:26 2021 -0700

    release: constrain ip_local_port_range
    
    containerd listens on ports in the kernel's ephemeral port range which
    can conflict with fixed ports kubelet needs when it starts up.
    
    This limits the ephemeral port range for all Bottlerocket variants
    and not just aws-ecs-1 and aws-k8s-1.20.

Testing done:

Build aws-k8s-1.19 image and launched instance. Checked sysctl and saw that the ephemeral port range is set correctly.

$ sudo sysctl -a | grep net.ipv4.ip_local_port_range
net.ipv4.ip_local_port_range = 32768	60999

Ports being used:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:50051         0.0.0.0:*               LISTEN      4865/./aws-k8s-agen 
tcp        0      0 127.0.0.1:43591         0.0.0.0:*               LISTEN      3353/containerd     
tcp        0      0 127.0.0.1:10248         0.0.0.0:*               LISTEN      3600/kubelet        
tcp        0      0 127.0.0.1:10249         0.0.0.0:*               LISTEN      4448/kube-proxy     
tcp        0      0 127.0.0.1:61679         0.0.0.0:*               LISTEN      4865/./aws-k8s-agen 
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      4120/sshd           
tcp6       0      0 :::10250                :::*                    LISTEN      3600/kubelet        
tcp6       0      0 :::61678                :::*                    LISTEN      4865/./aws-k8s-agen 
tcp6       0      0 :::9808                 :::*                    LISTEN      4749/livenessprobe  
tcp6       0      0 :::10256                :::*                    LISTEN      4448/kube-proxy     
tcp6       0      0 :::22                   :::*                    LISTEN      4120/sshd   

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[bcressey]

I'm good with this change overall, but we should reference #1386 and also the containerd port collision in the commit message, to document why we're doing it.

[tjkirch]

I'm good with this change overall, but we should reference #1386 and also the containerd port collision in the commit message, to document why we're doing it.

I'm also making a breaking-change note in the changelog (#1553) since we're affecting existing variants.

[etungsten]

^ Push above updates commit message to elaborate on reasons why we're making this change.

[etungsten]

^ fixes typo in commit message.

[etungsten]

Push above touches up the commit message.