Skip to content

[release-1.32] Backports for 2026-03#13792

Merged
brandond merged 24 commits intok3s-io:release-1.32from
brandond:2026-03-backports_release-1.32
Mar 12, 2026
Merged

[release-1.32] Backports for 2026-03#13792
brandond merged 24 commits intok3s-io:release-1.32from
brandond:2026-03-backports_release-1.32

Conversation

@brandond
Copy link
Copy Markdown
Member

@brandond brandond commented Mar 12, 2026

Proposed Changes

Backports:

Types of Changes

Backports

Verification

See linked issues

Testing

Linked Issues

User-Facing Change

Further Comments

fidencio and others added 24 commits March 11, 2026 23:48
@fidencio @brandond
config: add default imports to containerd base templates
b8503a7 
Add imports to the generated containerd config so containerd loads
drop-in TOML files: config.toml.d for v2, config-v3.toml.d for v3
(e.g. /var/lib/rancher/k3s/agent/etc/containerd/config.toml.d and
/var/lib/rancher/k3s/agent/etc/containerd/config-v3.toml.d).

Also fix the v3 header comment to say config-v3.toml.tmpl instead
of config.toml.tmpl.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
(cherry picked from commit b51167a)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@nuketownada @joshperry @brandond
Add nix-snapshotter support to the embedded containerd
2eaeb69 
Add support for the "nix" snapshotter, which enables running container
images built with nix2container. Nix images reference store paths
directly, avoiding layer tarballs and enabling deduplication through
the nix store.

Changes:
- Register nix-snapshotter as a builtin containerd plugin
- Add NixSupported() validation (checks nix-store is in PATH)
- Configure nix-snapshotter image service proxy in V2/V3 templates
  with containerd_address for CRI image operations
- Add Transfer service unpack_config with differ=walking for
  multi-arch support
- Use containerd state dir for socket path (rootless compatible)
- Disable NRI in rootless mode to prevent bind failures

Usage: k3s server --snapshotter nix

Signed-off-by: Ada <ada@6bit.com>
Co-Authored-By: Joshua Perry <josh@6bit.com>
Signed-off-by: Ada <ada@6bit.com>
(cherry picked from commit de59b63)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@nuketownada @joshperry @brandond
Add nix-snapshotter integration test
8702024 
Docker-based integration test that verifies nix-snapshotter works
with k3s. The test builds a nix hello image, starts k3s with
--snapshotter nix, pulls the image via nix:0 ref, and runs it as
a pod, verifying "Hello, world!" output.

Signed-off-by: Ada <ada@6bit.com>
Co-Authored-By: Joshua Perry <josh@6bit.com>
Signed-off-by: Ada <ada@6bit.com>
(cherry picked from commit 20c02ed)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Do not create etcd name file if etcd is not in use
9d45da1 
etcd.setName was being called during managed driver creation, even if the managed driver (etcd) is not in use. Let etcd.Register handle calling setName.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 8908d5f)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@dependabot @brandond
Bump actions/download-artifact from 7 to 8
a093ea4 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7 to 8.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v7...v8)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 45bdf9c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@dependabot @brandond
build(deps): bump actions/stale from 10.1.1 to 10.2.0
445ea5e 
Bumps [actions/stale](https://github.com/actions/stale) from 10.1.1 to 10.2.0.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@v10.1.1...v10.2.0)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: 10.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit d648c8c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@dependabot @brandond
build(deps): bump aquasecurity/trivy-action from 0.33.1 to 0.34.1
3d687d3 
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.33.1 to 0.34.1.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](aquasecurity/trivy-action@0.33.1...0.34.1)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-version: 0.34.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 7563007)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@dependabot @brandond
build(deps): bump aws-actions/configure-aws-credentials from 5 to 6
f01e9c1 
Bumps [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) from 5 to 6.
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](aws-actions/configure-aws-credentials@v5...v6)

---
updated-dependencies:
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 340623b)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@dependabot @brandond
Bump softprops/action-gh-release from 2.2.1 to 2.5.0
2b0758a 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.2.1 to 2.5.0.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@v2.2.1...v2.5.0)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 669bb79)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Bump klipper-lb and klipper-helm
0f02eee 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 6ffcd77)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@github-actions @brandond
chore: Bump golang:alpine image version in Dockerfiles
edad0e2 
Made with ❤️️ by updatecli

(cherry picked from commit 64207c3)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Update packages to remove dep on archived github.com/pkg/errors
82aafe1 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 3acf8db)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Replace merr.NewErrors with errors.Join
5f49a8a 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 270484f)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Drop use of github.com/gorilla/mux
4bb3d0c 
mux is replaced with a simple wrapper around http.ServeMux with middleware chain support

Unfortunately github.com/rootless-containers/rootlesskit/pkg/parent
still uses it so we can't drop the indirect dep yet.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 3f5eec4)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@dependabot @brandond
Bump DeterminateSystems/nix-installer-action from 17 to 21
01c1196 
Bumps [DeterminateSystems/nix-installer-action](https://github.com/determinatesystems/nix-installer-action) from 17 to 21.
- [Release notes](https://github.com/determinatesystems/nix-installer-action/releases)
- [Commits](DeterminateSystems/nix-installer-action@v17...v21)

---
updated-dependencies:
- dependency-name: DeterminateSystems/nix-installer-action
  dependency-version: '21'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit de13a64)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@dependabot @brandond
Bump docker/build-push-action from 6 to 7
5161467 
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6 to 7.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@v6...v7)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit be7e63d)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@dependabot @brandond
Bump docker/setup-qemu-action from 3 to 4
a7f9c83 
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3 to 4.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](docker/setup-qemu-action@v3...v4)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 3975a57)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@dependabot @brandond
Bump docker/setup-docker-action from 4 to 5
b52bb2d 
Bumps [docker/setup-docker-action](https://github.com/docker/setup-docker-action) from 4 to 5.
- [Release notes](https://github.com/docker/setup-docker-action/releases)
- [Commits](docker/setup-docker-action@v4...v5)

---
updated-dependencies:
- dependency-name: docker/setup-docker-action
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 7cd9814)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@dependabot @brandond
Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0
58dd4ba 
Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.39.0 to 1.40.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.39.0...v1.40.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.40.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit f8c5291)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@dependabot @brandond
Bump github.com/docker/cli
ea060bf 
Bumps [github.com/docker/cli](https://github.com/docker/cli) from 28.3.2+incompatible to 29.2.0+incompatible.
- [Commits](docker/cli@v28.3.2...v29.2.0)

---
updated-dependencies:
- dependency-name: github.com/docker/cli
  dependency-version: 29.2.0+incompatible
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 74ad4d3)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@dependabot @brandond
build(deps): bump github.com/pion/dtls/v3 from 3.0.6 to 3.0.11
6030ae2 
Bumps [github.com/pion/dtls/v3](https://github.com/pion/dtls) from 3.0.6 to 3.0.11.
- [Release notes](https://github.com/pion/dtls/releases)
- [Commits](pion/dtls@v3.0.6...v3.0.11)

---
updated-dependencies:
- dependency-name: github.com/pion/dtls/v3
  dependency-version: 3.0.11
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 36785d1)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Use etcd-snapshot-retention as default for s3 if etcd-s3-retention is…
591644e 
… not set

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit f4bb1e6)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Bump traefik and local-path-provisioner
77f085f 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 509562e)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Bump containerd to v2.2.2
c082984 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond brandond requested a review from a team as a code owner March 12, 2026 00:20
@brandond brandond changed the title [release-1.33] Backports for 2026-03 [release-1.32] Backports for 2026-03 Mar 12, 2026
@codecov
Copy link
Copy Markdown

codecov bot commented Mar 12, 2026 •
edited
Loading

Codecov Report

❌ Patch coverage is 18.58824% with 346 lines in your changes missing coverage. Please review.
✅ Project coverage is 22.07%. Comparing base (c9f9cf8) to head (c082984).
⚠️ Report is 24 commits behind head on release-1.32.

Files with missing lines Patch % Lines
pkg/agent/containerd/containerd.go 0.00% 22 Missing ⚠️
pkg/agent/config/config.go 0.00% 19 Missing ⚠️
pkg/util/errors/errors.go 19.04% 15 Missing and 2 partials ⚠️
pkg/agent/run.go 0.00% 15 Missing ⚠️
pkg/etcd/snapshot.go 0.00% 14 Missing ⚠️
pkg/agent/flannel/flannel.go 0.00% 13 Missing ⚠️
pkg/cluster/bootstrap.go 0.00% 13 Missing ⚠️
pkg/server/server.go 0.00% 13 Missing ⚠️
pkg/etcd/etcd.go 42.85% 12 Missing ⚠️
pkg/spegel/spegel.go 0.00% 12 Missing ⚠️
... and 56 more
Additional details and impacted files 
@@               Coverage Diff                @@
##           release-1.32   #13792      +/-   ##
================================================
+ Coverage         21.45%   22.07%   +0.61%     
================================================
  Files               192      194       +2     
  Lines             15773    15847      +74     
================================================
+ Hits               3384     3498     +114     
+ Misses            11938    11868      -70     
- Partials            451      481      +30
Flag Coverage Δ
unittests 22.07% <18.58%> (+0.61%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@brandond brandond merged commit d36393d into k3s-io:release-1.32 Mar 12, 2026
61 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vitorsavian vitorsavian vitorsavian approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@brandond @vitorsavian @fidencio @nuketownada