[release-1.35] Backports for 2026-01

.github/actions/setup-go/action.yaml

@@ -1,29 +1,44 @@
-name: 'Setup golang with main only caching'
+name: 'Setup Go with Limited Cache'
 description: 'A composite action that installs golang, but with a caching strategy that only updates the cache on main branch.'
+inputs:
+  go-version:
+    description: 'The Go version to download (if necessary) and use. Supports semver spec and ranges. Be sure to enclose this option in single quotation marks.'
+    default: ''
+
 runs:
   using: 'composite'
   steps:
-    - uses: actions/setup-go@v5
+    - name: Find Latest Release Branch
+      shell: bash
+      run: |
+        LATEST_RELEASE_BRANCH=$(gh api repos/k3s-io/k3s/branches?per_page=100 --jq '[.[].name | select(startswith("release-"))] | sort_by(ltrimstr("release-") | tonumber) | last')
+        echo "LATEST_RELEASE_REF=refs/heads/$LATEST_RELEASE_BRANCH" | tee -a "$GITHUB_ENV"
+      env:
+        GH_TOKEN: ${{ github.token }}
+
+    - name: Setup Go
+      uses: actions/setup-go@v6
       with:
-        go-version-file: 'go.mod'  # Just use whatever version is in the go.mod file
-        cache: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/release-1.32' }}
+        go-version: ${{ env.INPUT_GO_VERSION }}
+        go-version-file: 'go.mod'  # if go-version is not set, just use whatever version is in the go.mod file
+        cache: ${{ github.ref == 'refs/heads/main' || github.ref == env.LATEST_RELEASE_REF }}  # use default cache for main and most recent minor
 
     - name: Prepare for go cache
-      if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/release-1.32'
+      if: github.ref != 'refs/heads/main' && github.ref != env.LATEST_RELEASE_REF  # use custom cache for older minors
       shell: bash
       run: |
         echo "GO_CACHE=$(go env GOCACHE)" | tee -a "$GITHUB_ENV"
         echo "GO_MODCACHE=$(go env GOMODCACHE)" | tee -a "$GITHUB_ENV"
         echo "GO_VERSION=$(go env GOVERSION | tr -d 'go')" | tee -a "$GITHUB_ENV"
 
     - name: Setup read-only cache
-      if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/release-1.32'
-      uses: actions/cache/restore@v4
+      if: github.ref != 'refs/heads/main' && github.ref != env.LATEST_RELEASE_REF # use custom cache for older minors
+      uses: actions/cache/restore@v5
       with:
         path: |
           ${{ env.GO_MODCACHE }}
           ${{ env.GO_CACHE }}
         # Match the cache key to the setup-go action https://github.com/actions/setup-go/blob/main/src/cache-restore.ts#L34
         key: setup-go-${{ runner.os }}-${{ env.ImageOS }}-go-${{ env.GO_VERSION }}-${{ hashFiles('go.sum') }}
         restore-keys: |
-          setup-go-${{ runner.os }}-
+          setup-go-${{ runner.os }}-

.github/workflows/e2e.yaml

@@ -54,6 +54,25 @@ jobs:
         etest: [btrfs, embeddedmirror, externalip, privateregistry, rootless, s3, startup, wasm, multus]
       max-parallel: 5
     steps:
+      - name: Remove Unnecessary Tools
+        working-directory: /
+        run: |
+          sudo rm -rf \
+            /home/linuxbrew \
+            /home/packer \
+            /opt/az \
+            /opt/microsoft \
+            /usr/lib/firefox \
+            /usr/lib/google-cloud-sdk \
+            /usr/local/julia* \
+            /usr/local/share/boost \
+            /usr/local/share/chromium \
+            /usr/local/share/powershell \
+            /usr/share/az* \
+            /usr/share/dotnet \
+            /usr/share/miniconda \
+            /usr/share/swift
+          df -khl
       - name: "Checkout"
         uses: actions/checkout@v6
         with: {fetch-depth: 1}
@@ -67,14 +86,14 @@ jobs:
         uses: ./.github/actions/vagrant-setup
       - name: Vagrant R/W Cache
         if: matrix.etest != 'btrfs' && github.ref == 'refs/heads/main'
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
              ~/.vagrant.d/boxes
           key: ${{ matrix.etest != 'btrfs' && 'vagrant-box-ubuntu-2404' || 'vagrant-box-leap' }}
       - name: Vagrant Read Cache
         if: matrix.etest != 'btrfs' && github.ref != 'refs/heads/main'
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: |
              ~/.vagrant.d/boxes
@@ -88,28 +107,10 @@ jobs:
            curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
            sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
       - name: "Download k3s binary"
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           name: k3s-amd64
           path: ./dist/artifacts
-      - name: Remove Unnecessary Tools
-        run: |
-          sudo rm -rf \
-            /home/linuxbrew \
-            /home/packer \
-            /opt/az \
-            /opt/microsoft \
-            /usr/lib/firefox \
-            /usr/lib/google-cloud-sdk \
-            /usr/local/julia* \
-            /usr/local/share/boost \
-            /usr/local/share/chromium \
-            /usr/local/share/powershell \
-            /usr/share/az* \
-            /usr/share/dotnet \
-            /usr/share/miniconda \
-            /usr/share/swift
-          df -khl
       - name: Run ${{ matrix.etest }} Test
         env:
           E2E_GOCOVER: "true"
@@ -202,10 +203,29 @@ jobs:
     env:
       CHANNEL: ${{ needs.build-go-tests.outputs.channel }}
     steps:
+    - name: Remove Unnecessary Tools
+      working-directory: /
+      run: |
+        sudo rm -rf \
+          /home/linuxbrew \
+          /home/packer \
+          /opt/az \
+          /opt/microsoft \
+          /usr/lib/firefox \
+          /usr/lib/google-cloud-sdk \
+          /usr/local/julia* \
+          /usr/local/share/boost \
+          /usr/local/share/chromium \
+          /usr/local/share/powershell \
+          /usr/share/az* \
+          /usr/share/dotnet \
+          /usr/share/miniconda \
+          /usr/share/swift
+        df -khl
     - name: Checkout
       uses: actions/checkout@v6
     - name: "Download K3s image"
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v7
       with:
         name: k3s-${{ matrix.arch }}
         path: ./dist/artifacts
@@ -225,28 +245,10 @@ jobs:
         IMAGE_TAG=$(docker image ls --format '{{.Repository}}:{{.Tag}}' | grep 'rancher/k3s')
         echo "K3S_IMAGE=$IMAGE_TAG" >> $GITHUB_ENV
     - name: Download Go Tests
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v7
       with:
         name: docker-go-tests-${{ matrix.arch }}
         path: ./dist/artifacts
-    - name: Remove Unnecessary Tools
-      run: |
-        sudo rm -rf \
-          /home/linuxbrew \
-          /home/packer \
-          /opt/az \
-          /opt/microsoft \
-          /usr/lib/firefox \
-          /usr/lib/google-cloud-sdk \
-          /usr/local/julia* \
-          /usr/local/share/boost \
-          /usr/local/share/chromium \
-          /usr/local/share/powershell \
-          /usr/share/az* \
-          /usr/share/dotnet \
-          /usr/share/miniconda \
-          /usr/share/swift
-        df -khl
     - name: Run ${{ matrix.dtest }} Test
       # Put the compiled test binary back in the same place as the test source
       run: |

.github/workflows/govulncheck.yml

@@ -18,10 +18,6 @@ jobs:
         uses: actions/checkout@v6
       - name: Install Go
         uses: ./.github/actions/setup-go
-      - name: Go Generate
-        run: |
-          ./scripts/download
-          ./scripts/generate
       - name: Install govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest
       - name: Run govulncheck

.github/workflows/install.yaml

@@ -38,25 +38,8 @@ jobs:
     env:
       INSTALL_K3S_SKIP_DOWNLOAD: binary
     steps:
-      - name: "Checkout"
-        uses: actions/checkout@v6
-        with: {fetch-depth: 1}
-      - name: Set up vagrant and libvirt
-        uses: ./.github/actions/vagrant-setup
-      - name: "Vagrant Cache"
-        uses: actions/cache@v4
-        with:
-          path: |
-             ~/.vagrant.d/boxes
-          key: vagrant-box-${{ matrix.vm }}
-      - name: "Vagrant Plugin(s)"
-        run: vagrant plugin install vagrant-k3s vagrant-reload vagrant-scp
-      - name: "Download k3s binary"
-        uses: actions/download-artifact@v6
-        with:
-          name: k3s-amd64
-          path: tests/install/${{ matrix.vm }}
       - name: Remove Unnecessary Tools
+        working-directory: /
         run: |
           sudo rm -rf \
             /home/linuxbrew \
@@ -74,6 +57,24 @@ jobs:
             /usr/share/miniconda \
             /usr/share/swift
           df -khl
+      - name: "Checkout"
+        uses: actions/checkout@v6
+        with: {fetch-depth: 1}
+      - name: Set up vagrant and libvirt
+        uses: ./.github/actions/vagrant-setup
+      - name: "Vagrant Cache"
+        uses: actions/cache@v5
+        with:
+          path: |
+             ~/.vagrant.d/boxes
+          key: vagrant-box-${{ matrix.vm }}
+      - name: "Vagrant Plugin(s)"
+        run: vagrant plugin install vagrant-k3s vagrant-reload vagrant-scp
+      - name: "Download k3s binary"
+        uses: actions/download-artifact@v7
+        with:
+          name: k3s-amd64
+          path: tests/install/${{ matrix.vm }}
       - name: "Vagrant Up"
         run: vagrant up --no-tty --no-provision
       - name: "Upload k3s binary to VM"

.github/workflows/integration.yaml

@@ -48,14 +48,33 @@ jobs:
         itest: [certrotation, cacertrotation, etcdrestore, localstorage, startup, custometcdargs, etcdsnapshot, kubeflags, longhorn, secretsencryption, flannelnone]
       max-parallel: 3
     steps:
+    - name: Remove Unnecessary Tools
+      working-directory: /
+      run: |
+        sudo rm -rf \
+          /home/linuxbrew \
+          /home/packer \
+          /opt/az \
+          /opt/microsoft \
+          /usr/lib/firefox \
+          /usr/lib/google-cloud-sdk \
+          /usr/local/julia* \
+          /usr/local/share/boost \
+          /usr/local/share/chromium \
+          /usr/local/share/powershell \
+          /usr/share/az* \
+          /usr/share/dotnet \
+          /usr/share/miniconda \
+          /usr/share/swift
+        df -khl
     - name: Checkout
       uses: actions/checkout@v6
       with:
         fetch-depth: 1
     - name: Install Go
       uses: ./.github/actions/setup-go
     - name: "Download k3s binary"
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v7
       with:
         name: k3s-amd64
         path: ./dist/artifacts
@@ -101,7 +120,7 @@ jobs:
     - name: Install Go
       uses: ./.github/actions/setup-go
     - name: Download k3s binary
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v7
       with:
         name: k3s-windows
         path: dist/artifacts/

.github/workflows/nightly-install.yaml

@@ -24,19 +24,8 @@ jobs:
     env:
       INSTALL_K3S_CHANNEL: ${{ matrix.channel }}
     steps:
-      - name: "Checkout"
-        uses: actions/checkout@v6
-        with: {fetch-depth: 1}
-      - name: Set up vagrant and libvirt
-        uses: ./.github/actions/vagrant-setup
-      - name: "Vagrant Cache"
-        uses: actions/cache@v4
-        with:
-          path: |
-             ~/.vagrant.d/boxes
-          key: vagrant-box-${{ matrix.vm }}
-        id: vagrant-cache
       - name: Remove Unnecessary Tools
+        working-directory: /
         run: |
           sudo rm -rf \
             /home/linuxbrew \
@@ -54,6 +43,18 @@ jobs:
             /usr/share/miniconda \
             /usr/share/swift
           df -khl
+      - name: "Checkout"
+        uses: actions/checkout@v6
+        with: {fetch-depth: 1}
+      - name: Set up vagrant and libvirt
+        uses: ./.github/actions/vagrant-setup
+      - name: "Vagrant Cache"
+        uses: actions/cache@v5
+        with:
+          path: |
+             ~/.vagrant.d/boxes
+          key: vagrant-box-${{ matrix.vm }}
+        id: vagrant-cache
       - name: "Vagrant Plugin(s)"
         run: vagrant plugin install vagrant-k3s vagrant-reload
       - name: "Vagrant Up ⏩ Install K3s"

.github/workflows/trivy-scan.yml

@@ -85,7 +85,7 @@ jobs:
 
     steps:       
       - name: Download Trivy Report artifact
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         if: needs.trivy_scan.result == 'success'
         with:
           name: trivy-report

.github/workflows/updatecli.yaml

@@ -23,10 +23,8 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version: 'stable'
-          cache: false
+        uses: ./.github/actions/setup-go
+
       - name: Delete leftover UpdateCLI branches
         run: |
           gh pr list --search "is:closed is:pr head:updatecli_" --json headRefName --jq ".[].headRefName" | sort -u > closed_prs_branches.txt