[release-1.34] Backports for 2026-03

[brandond]

Proposed Changes

Backports:

• config: Add default imports to containerd base templates #13680
• Add nix-snapshotter support to the embedded containerd #13676
• Do not create etcd name file if etcd is not in use #13727
• Bump actions/download-artifact from 7 to 8 #13714
• build(deps): bump actions/stale from 10.1.1 to 10.2.0 #13670
• build(deps): bump aquasecurity/trivy-action from 0.33.1 to 0.34.1 #13669
• build(deps): bump aws-actions/configure-aws-credentials from 5 to 6 #13596
• Bump softprops/action-gh-release from 2.2.1 to 2.5.0 #13376
• Bump klipper-lb and klipper-helm #13761
• Bump golang:alpine image version #13653
• Update packages to remove unmaintained dependencies #13724
• Bump DeterminateSystems/nix-installer-action from 17 to 21 #13744
• Bump docker/build-push-action from 6 to 7 #13745
• Bump docker/setup-qemu-action from 3 to 4 #13746
• Bump docker/setup-docker-action from 4 to 5 #13747
• Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 #13713
• Bump github.com/docker/cli from 28.3.2+incompatible to 29.2.0+incompatible #13730
• build(deps): bump github.com/pion/dtls/v3 from 3.0.6 to 3.0.11 #13645
• Use etcd-snapshot-retention as default for s3 if etcd-s3-retention is not set #13770
• Bump traefik and local-path-provisioner #13787
• Bump containerd to v2.2.2 #13788

Types of Changes

Backports

Verification

See linked issues

Testing

Linked Issues

• [Release-1.34] - config: Merging base template with added configurations lead to an invalid containerd config file #13780
• [Release-1.34] - Add nix-snapshotter support to bundled containerd #13739
• [Release-1.34] - etcd name file is created even if etcd is not in use #13735
• [Release-1.34] - Bump alpine-based images for CVE-2026-22184 #13839
• [Release-1.34] - Drop use of deprecated packages #13766
• [Release-1.34] - S3 snapshot retention may not store as may snapshots as expected after upgrading to 2025-08 releases #13784
• [Release-1.34] - Update to containerd 2.2 #13842

User-Facing Change

Further Comments

[codecov]

Codecov Report

❌ Patch coverage is 18.58824% with 346 lines in your changes missing coverage. Please review.
✅ Project coverage is 22.34%. Comparing base (b645219) to head (f5a0992).
⚠️ Report is 24 commits behind head on release-1.34.

Files with missing lines	Patch %	Lines
pkg/agent/containerd/containerd.go	0.00%	22 Missing ⚠️
pkg/agent/config/config.go	0.00%	19 Missing ⚠️
pkg/util/errors/errors.go	19.04%	15 Missing and 2 partials ⚠️
pkg/agent/run.go	0.00%	15 Missing ⚠️
pkg/etcd/snapshot.go	0.00%	14 Missing ⚠️
pkg/agent/flannel/flannel.go	0.00%	13 Missing ⚠️
pkg/cluster/bootstrap.go	0.00%	13 Missing ⚠️
pkg/server/server.go	0.00%	13 Missing ⚠️
pkg/etcd/etcd.go	42.85%	12 Missing ⚠️
pkg/spegel/spegel.go	0.00%	12 Missing ⚠️
... and 56 more

Additional details and impacted files

@@               Coverage Diff                @@
##           release-1.34   #13790      +/-   ##
================================================
+ Coverage         21.78%   22.34%   +0.56%     
================================================
  Files               191      193       +2     
  Lines             15541    15615      +74     
================================================
+ Hits               3385     3489     +104     
+ Misses            11705    11647      -58     
- Partials            451      479      +28     

Flag	Coverage Δ
unittests	22.34% <18.58%> (+0.56%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.