Skip to content

[release-1.35] Backports for 2026-01#13446

Merged
brandond merged 48 commits intok3s-io:release-1.35from
brandond:2026-01-backports_release-1.35
Jan 9, 2026
Merged

[release-1.35] Backports for 2026-01#13446
brandond merged 48 commits intok3s-io:release-1.35from
brandond:2026-01-backports_release-1.35

Conversation

@brandond
Copy link
Copy Markdown
Member

@brandond brandond commented Jan 9, 2026 •
edited
Loading

dependabot bot and others added 30 commits January 9, 2026 21:56
@dependabot @brandond
Bump actions/download-artifact from 6 to 7 (k3s-io#13346)
a77d7ec 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6 to 7.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v6...v7)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit eb443b4)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@dependabot @brandond
Bump actions/cache from 4 to 5 (k3s-io#13347)
d208eeb 
Bumps [actions/cache](https://github.com/actions/cache) from 4 to 5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](actions/cache@v4...v5)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 8e41618)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Bump golangci-lint for go1.25
e71047f 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 2d313a6)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Add lint/validate job
d65dd16 
`make validate` use to run in drone, move it into GHA

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 900f6cf)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: file is not properly formatted
26a5c61 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 8086d7c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: redundant-build-tag
ff6564e 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 3164649)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: use-any
5f1c5ab 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit eee8234)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: dot-imports
71a7044 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit d9c4adc)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: comment-spacings
4adac95 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 5bf4dc7)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: deep-exit
a591850 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 850de3d)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: bare-return
63c2dc6 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 55f8d9f)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: bool-literal-in-expr
38dc578 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 1227f2c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: defer,get-return
9aefc4c 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 2309312)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: duplicated-imports
080d4a9 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 100cb63)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: empty-lines
156e57d 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 7c7e442)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: exported
2ef5ffe 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit f279a97)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: if-return
6099e37 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit d8af4f1)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: import-alias-naming
6d1ac0e 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 4d1ad3d)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: indent-error-flow
2e5f5cb 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 26b4f21)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: redefines-builtin-id
f9c6290 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 2910861)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: struct-tag
7e15571 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e416f10)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: superfluous-else
80b9861 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 83feb3c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: unchecked-type-assertion
8acaf9e 
Adds a generic wrapper around lru.Cache

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 62d2737)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: unexported-naming
cfd15a4 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 46c7ade)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: unexported-return
e5f7839 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 49d080c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: unnecessary-stmt
91e5ed8 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 91a41d8)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: useless-break
5075da0 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 8e0e37e)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: identical-switch-branches
dcc99ea 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit c1f02b8)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: unhandled-error
ee0dbdf 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 003fd44)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
lint: unnecessary-format,use-errors-new
e67ebaf 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit fc506e5)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
brandond and others added 18 commits January 9, 2026 21:56
@brandond
lint: nested-structs
8771220 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e44a77d)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Fix PR lint checkout depth
9a3f799 
Need to check out one deeper than the number of commits in order to compare to the target branch

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 421e364)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Bump stable to 1.34 and add 1.35
f8a04ad 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit f08deaf)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Don't enforce use of wg.Go instead of Add/Done
b15c943 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit da15d31)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Replace temporary etcd server with raw mvcc store access
719c1a3 
Fixes an issue where copying files out from under a currently-running etcd instance can cause startup reconcile to fail. Direct creation of a mvcc store without any of the raft stuff is faster, and gives us direct control over how the store handles snapshot recovery.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit d38b4b3)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Fix etcd reconcile with empty TLS dirs
d8118e0 
Reconcile against local etcd would short-circuit and skip reading from the datastore if the cert dirs were missing.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 0563fc2)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Add tests for etcd local reconcile
0d4cada 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit ae59cd0)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Remove flannel external-ip annotations when disabled
6918aa6 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 1f2f610)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Bump CNI plugins
5d6f54e 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit ade30b4)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Drop use of deprecated docker reexec package
484737f 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 926bbce)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@luojiyin1987 @brandond
Fix atomic write in WriteSubnetFile
03cba3c 
   - Use os.CreateTemp to avoid race conditions with fixed temp filename
   - Add f.Sync() before close to ensure data durability
   - Check all fmt.Fprintf errors instead of ignoring them
   - Preserve original file permissions when overwriting
   - Handle dir== edge case from filepath.Split
   - Check os.MkdirAll error
   - Proper cleanup on all error paths

Signed-off-by: luojiyin <luojiyin@hotmail.com>

Add documentation comments to WriteSubnetFile

   Clarify the design choices for atomic file writing:
   - Explain why CreateTemp is used (defense-in-depth, avoids pre-existing file issues)
   - Document the single-instance assumption
   - Note the permission preservation logic

Signed-off-by: luojiyin <luojiyin@hotmail.com>

Update WriteSubnetFile comment to clarify CreateTemp rationale

   Remove misleading reference to concurrent writes (K3s is single-instance).
   Focus on the actual benefits: avoiding stale temp files from crashes,
   handling unexpected permissions/ownership, and O_EXCL guarantees.

Signed-off-by: luojiyin <luojiyin@hotmail.com>

Refactor cleanup to use merr.NewErrors for better error aggregation

   Address review feedback from @brandond to improve error handling:
   - Change cleanup function to accept error parameter
   - Use merr.NewErrors to aggregate original error with Close/Remove errors
   - Simplify error handling with consistent return cleanup(err) pattern

Signed-off-by: luojiyin <luojiyin@hotmail.com>

Fix Close error handling to preserve original error

   Add cleanupNoClose helper to avoid double Close and preserve the
   original Close error when file close fails.

Signed-off-by: luojiyin <luojiyin@hotmail.com>
(cherry picked from commit f42523c)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Bump expr-lang/expr
8ebcd5e 
Fixes HIGH CVE-2025-68156. This is an indirect dep from github.com/nats-io/jsm.go but it appears they have not yet bumped it either

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit e4f6784)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Bump spegel to v0.6.0
f8ef0e5 
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit efeacc1)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Add deferred store implimentation
ac3c94d 
Spegel insists on checking containerd features when the store is created, so defer creating it until after contaienerd is up

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 2ed73be)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Update longhorn version in integration test from v1.4.0 to v1.10.1
3f46da3 
Manifest from https://raw.githubusercontent.com/longhorn/longhorn/v1.10.1/deploy/longhorn.yaml - with modifications to use rancher-mirrored images to avoid image pull rate limits, and allow operation on a node with fewer resources.

Also adds more log dumping on integration test failure.

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 9587f67)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Bump kine for NATS conformance fixes
f6aa1dd 
Includes the long-awaited fixes from
* k3s-io/kine#549

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 8c3587d)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Fix setup-go cache issues
0e40dd7 
* Move cleanup earlier, to prevent running out of space when restoring caches
* Consistently use local setup-go action to avoid saving cache on PR runs
* Update local setup-go action

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 358c8cc)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond
Remove download/generate from vulncheck
44cc8ba 
This has been broken since july when cb06168 was merged

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
(cherry picked from commit 9307d82)
Signed-off-by: Brad Davidson <brad.davidson@rancher.com>
@brandond brandond requested a review from a team as a code owner January 9, 2026 22:01
@codecov
Copy link
Copy Markdown

codecov bot commented Jan 9, 2026 •
edited
Loading

Codecov Report

❌ Patch coverage is 19.49911% with 450 lines in your changes missing coverage. Please review.
✅ Project coverage is 21.44%. Comparing base (b54634c) to head (44cc8ba).
⚠️ Report is 49 commits behind head on release-1.35.

Files with missing lines Patch % Lines
pkg/etcd/store/store.go 25.19% 91 Missing and 7 partials ⚠️
pkg/agent/flannel/flannel.go 0.00% 53 Missing ⚠️
pkg/spegel/store.go 0.00% 44 Missing ⚠️
pkg/spegel/spegel.go 0.00% 38 Missing ⚠️
pkg/agent/flannel/setup.go 0.00% 23 Missing ⚠️
pkg/cluster/bootstrap.go 0.00% 23 Missing ⚠️
pkg/cluster/storage.go 43.33% 16 Missing and 1 partial ⚠️
pkg/util/lru.go 45.83% 13 Missing ⚠️
pkg/cli/server/server.go 0.00% 10 Missing ⚠️
pkg/util/net.go 0.00% 7 Missing ⚠️
... and 45 more
Additional details and impacted files 
@@               Coverage Diff                @@
##           release-1.35   #13446      +/-   ##
================================================
- Coverage         21.51%   21.44%   -0.08%     
================================================
  Files               187      190       +3     
  Lines             15332    15480     +148     
================================================
+ Hits               3299     3320      +21     
- Misses            11580    11707     +127     
  Partials            453      453
Flag Coverage Δ
unittests 21.44% <19.49%> (-0.08%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@brandond brandond merged commit 2efebf2 into k3s-io:release-1.35 Jan 9, 2026
91 of 93 checks passed
@codecrafter404 codecrafter404 mentioned this pull request Feb 5, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mgfritch mgfritch mgfritch approved these changes

@ShylajaDevadiga ShylajaDevadiga ShylajaDevadiga approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@brandond @mgfritch @ShylajaDevadiga @luojiyin1987