[release-1.33] Backports for 2026-01

.github/actions/setup-go/action.yaml

@@ -1,29 +1,44 @@
-name: 'Setup golang with main only caching'
+name: 'Setup Go with Limited Cache'
 description: 'A composite action that installs golang, but with a caching strategy that only updates the cache on main branch.'
+inputs:
+  go-version:
+    description: 'The Go version to download (if necessary) and use. Supports semver spec and ranges. Be sure to enclose this option in single quotation marks.'
+    default: ''
+
 runs:
   using: 'composite'
   steps:
-    - uses: actions/setup-go@v5
+    - name: Find Latest Release Branch
+      shell: bash
+      run: |
+        LATEST_RELEASE_BRANCH=$(gh api repos/k3s-io/k3s/branches?per_page=100 --jq '[.[].name | select(startswith("release-"))] | sort_by(ltrimstr("release-") | tonumber) | last')
+        echo "LATEST_RELEASE_REF=refs/heads/$LATEST_RELEASE_BRANCH" | tee -a "$GITHUB_ENV"
+      env:
+        GH_TOKEN: ${{ github.token }}
+
+    - name: Setup Go
+      uses: actions/setup-go@v6
       with:
-        go-version-file: 'go.mod'  # Just use whatever version is in the go.mod file
-        cache: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/release-1.32' }}
+        go-version: ${{ env.INPUT_GO_VERSION }}
+        go-version-file: 'go.mod'  # if go-version is not set, just use whatever version is in the go.mod file
+        cache: ${{ github.ref == 'refs/heads/main' || github.ref == env.LATEST_RELEASE_REF }}  # use default cache for main and most recent minor
 
     - name: Prepare for go cache
-      if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/release-1.32'
+      if: github.ref != 'refs/heads/main' && github.ref != env.LATEST_RELEASE_REF  # use custom cache for older minors
       shell: bash
       run: |
         echo "GO_CACHE=$(go env GOCACHE)" | tee -a "$GITHUB_ENV"
         echo "GO_MODCACHE=$(go env GOMODCACHE)" | tee -a "$GITHUB_ENV"
         echo "GO_VERSION=$(go env GOVERSION | tr -d 'go')" | tee -a "$GITHUB_ENV"
 
     - name: Setup read-only cache
-      if: github.ref != 'refs/heads/main' && github.ref != 'refs/heads/release-1.32'
-      uses: actions/cache/restore@v4
+      if: github.ref != 'refs/heads/main' && github.ref != env.LATEST_RELEASE_REF # use custom cache for older minors
+      uses: actions/cache/restore@v5
       with:
         path: |
           ${{ env.GO_MODCACHE }}
           ${{ env.GO_CACHE }}
         # Match the cache key to the setup-go action https://github.com/actions/setup-go/blob/main/src/cache-restore.ts#L34
         key: setup-go-${{ runner.os }}-${{ env.ImageOS }}-go-${{ env.GO_VERSION }}-${{ hashFiles('go.sum') }}
         restore-keys: |
-          setup-go-${{ runner.os }}-
+          setup-go-${{ runner.os }}-

.github/workflows/airgap.yaml

@@ -40,7 +40,7 @@ jobs:
           ./scripts/package-airgap ${{ matrix.arch }}
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: images-${{ matrix.arch }}
           path: dist/artifacts/k3s-airgap-images-${{ matrix.arch }}.*

.github/workflows/build-k3s.yaml

@@ -128,7 +128,7 @@ jobs:
         mv ./build/out/data-linux.tar.zst ./dist/artifacts/data-linux${{ env.ARCH_EXT }}.tar.zst
 
     - name: "Upload K3s Artifacts"
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v6
       with:
         name: k3s${{ env.ARCH_EXT }}
         path: dist/artifacts/

.github/workflows/e2e.yaml

@@ -54,6 +54,25 @@ jobs:
         etest: [btrfs, embeddedmirror, externalip, privateregistry, rootless, s3, startup, wasm, multus]
       max-parallel: 5
     steps:
+      - name: Remove Unnecessary Tools
+        working-directory: /
+        run: |
+          sudo rm -rf \
+            /home/linuxbrew \
+            /home/packer \
+            /opt/az \
+            /opt/microsoft \
+            /usr/lib/firefox \
+            /usr/lib/google-cloud-sdk \
+            /usr/local/julia* \
+            /usr/local/share/boost \
+            /usr/local/share/chromium \
+            /usr/local/share/powershell \
+            /usr/share/az* \
+            /usr/share/dotnet \
+            /usr/share/miniconda \
+            /usr/share/swift
+          df -khl
       - name: "Checkout"
         uses: actions/checkout@v6
         with: {fetch-depth: 1}
@@ -67,14 +86,14 @@ jobs:
         uses: ./.github/actions/vagrant-setup
       - name: Vagrant R/W Cache
         if: matrix.etest != 'btrfs' && github.ref == 'refs/heads/main'
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
              ~/.vagrant.d/boxes
           key: ${{ matrix.etest != 'btrfs' && 'vagrant-box-ubuntu-2404' || 'vagrant-box-leap' }}
       - name: Vagrant Read Cache
         if: matrix.etest != 'btrfs' && github.ref != 'refs/heads/main'
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: |
              ~/.vagrant.d/boxes
@@ -88,28 +107,10 @@ jobs:
            curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
            sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
       - name: "Download k3s binary"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: k3s-amd64
           path: ./dist/artifacts
-      - name: Remove Unnecessary Tools
-        run: |
-          sudo rm -rf \
-            /home/linuxbrew \
-            /home/packer \
-            /opt/az \
-            /opt/microsoft \
-            /usr/lib/firefox \
-            /usr/lib/google-cloud-sdk \
-            /usr/local/julia* \
-            /usr/local/share/boost \
-            /usr/local/share/chromium \
-            /usr/local/share/powershell \
-            /usr/share/az* \
-            /usr/share/dotnet \
-            /usr/share/miniconda \
-            /usr/share/swift
-          df -khl
       - name: Run ${{ matrix.etest }} Test
         env:
           E2E_GOCOVER: "true"
@@ -118,7 +119,7 @@ jobs:
           cd tests/e2e/${{ matrix.etest }}
           go test -timeout=45m ./${{ matrix.etest }}_test.go -test.v -ginkgo.v -ci -local
       - name: On Failure, Upload Journald Logs
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         if: ${{ failure() }}
         with:
           name: e2e-${{ matrix.etest }}-logs
@@ -156,7 +157,7 @@ jobs:
         mkdir -p ./dist/artifacts
         go test -c -ldflags="-w -s" -o ./dist/artifacts ./tests/docker/...
     - name: Upload Go Tests
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v6
       with:
         name: docker-go-tests-${{ matrix.arch }}
         path: ./dist/artifacts/*.test
@@ -202,10 +203,29 @@ jobs:
     env:
       CHANNEL: ${{ needs.build-go-tests.outputs.channel }}
     steps:
+    - name: Remove Unnecessary Tools
+      working-directory: /
+      run: |
+        sudo rm -rf \
+          /home/linuxbrew \
+          /home/packer \
+          /opt/az \
+          /opt/microsoft \
+          /usr/lib/firefox \
+          /usr/lib/google-cloud-sdk \
+          /usr/local/julia* \
+          /usr/local/share/boost \
+          /usr/local/share/chromium \
+          /usr/local/share/powershell \
+          /usr/share/az* \
+          /usr/share/dotnet \
+          /usr/share/miniconda \
+          /usr/share/swift
+        df -khl
     - name: Checkout
       uses: actions/checkout@v6
     - name: "Download K3s image"
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         name: k3s-${{ matrix.arch }}
         path: ./dist/artifacts
@@ -225,28 +245,10 @@ jobs:
         IMAGE_TAG=$(docker image ls --format '{{.Repository}}:{{.Tag}}' | grep 'rancher/k3s')
         echo "K3S_IMAGE=$IMAGE_TAG" >> $GITHUB_ENV
     - name: Download Go Tests
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         name: docker-go-tests-${{ matrix.arch }}
         path: ./dist/artifacts
-    - name: Remove Unnecessary Tools
-      run: |
-        sudo rm -rf \
-          /home/linuxbrew \
-          /home/packer \
-          /opt/az \
-          /opt/microsoft \
-          /usr/lib/firefox \
-          /usr/lib/google-cloud-sdk \
-          /usr/local/julia* \
-          /usr/local/share/boost \
-          /usr/local/share/chromium \
-          /usr/local/share/powershell \
-          /usr/share/az* \
-          /usr/share/dotnet \
-          /usr/share/miniconda \
-          /usr/share/swift
-        df -khl
     - name: Run ${{ matrix.dtest }} Test
       # Put the compiled test binary back in the same place as the test source
       run: |

.github/workflows/govulncheck.yml

@@ -18,10 +18,6 @@ jobs:
         uses: actions/checkout@v6
       - name: Install Go
         uses: ./.github/actions/setup-go
-      - name: Go Generate
-        run: |
-          ./scripts/download
-          ./scripts/generate
       - name: Install govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest
       - name: Run govulncheck

.github/workflows/install.yaml

@@ -38,25 +38,8 @@ jobs:
     env:
       INSTALL_K3S_SKIP_DOWNLOAD: binary
     steps:
-      - name: "Checkout"
-        uses: actions/checkout@v6
-        with: {fetch-depth: 1}
-      - name: Set up vagrant and libvirt
-        uses: ./.github/actions/vagrant-setup
-      - name: "Vagrant Cache"
-        uses: actions/cache@v4
-        with:
-          path: |
-             ~/.vagrant.d/boxes
-          key: vagrant-box-${{ matrix.vm }}
-      - name: "Vagrant Plugin(s)"
-        run: vagrant plugin install vagrant-k3s vagrant-reload vagrant-scp
-      - name: "Download k3s binary"
-        uses: actions/download-artifact@v4
-        with:
-          name: k3s-amd64
-          path: tests/install/${{ matrix.vm }}
       - name: Remove Unnecessary Tools
+        working-directory: /
         run: |
           sudo rm -rf \
             /home/linuxbrew \
@@ -74,6 +57,24 @@ jobs:
             /usr/share/miniconda \
             /usr/share/swift
           df -khl
+      - name: "Checkout"
+        uses: actions/checkout@v6
+        with: {fetch-depth: 1}
+      - name: Set up vagrant and libvirt
+        uses: ./.github/actions/vagrant-setup
+      - name: "Vagrant Cache"
+        uses: actions/cache@v5
+        with:
+          path: |
+             ~/.vagrant.d/boxes
+          key: vagrant-box-${{ matrix.vm }}
+      - name: "Vagrant Plugin(s)"
+        run: vagrant plugin install vagrant-k3s vagrant-reload vagrant-scp
+      - name: "Download k3s binary"
+        uses: actions/download-artifact@v7
+        with:
+          name: k3s-amd64
+          path: tests/install/${{ matrix.vm }}
       - name: "Vagrant Up"
         run: vagrant up --no-tty --no-provision
       - name: "Upload k3s binary to VM"

.github/workflows/integration.yaml

@@ -47,14 +47,33 @@ jobs:
         itest: [certrotation, cacertrotation, etcdrestore, localstorage, startup, custometcdargs, etcdsnapshot, kubeflags, longhorn, secretsencryption, flannelnone]
       max-parallel: 3
     steps:
+    - name: Remove Unnecessary Tools
+      working-directory: /
+      run: |
+        sudo rm -rf \
+          /home/linuxbrew \
+          /home/packer \
+          /opt/az \
+          /opt/microsoft \
+          /usr/lib/firefox \
+          /usr/lib/google-cloud-sdk \
+          /usr/local/julia* \
+          /usr/local/share/boost \
+          /usr/local/share/chromium \
+          /usr/local/share/powershell \
+          /usr/share/az* \
+          /usr/share/dotnet \
+          /usr/share/miniconda \
+          /usr/share/swift
+        df -khl
     - name: Checkout
       uses: actions/checkout@v6
       with:
         fetch-depth: 1
     - name: Install Go
       uses: ./.github/actions/setup-go
     - name: "Download k3s binary"
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         name: k3s-amd64
         path: ./dist/artifacts
@@ -65,7 +84,7 @@ jobs:
         cd tests/integration/${{ matrix.itest }}
         sudo -E env "PATH=$PATH" go test -timeout=45m ./... -run Integration -ginkgo.v -test.v
     - name: On Failure, Upload Logs
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v6
       if: ${{ failure() }}
       with:
         name: integration-${{ matrix.itest }}-logs
@@ -100,7 +119,7 @@ jobs:
     - name: Install Go
       uses: ./.github/actions/setup-go
     - name: Download k3s binary
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v7
       with:
         name: k3s-windows
         path: dist/artifacts/

.github/workflows/nightly-install.yaml

@@ -24,19 +24,8 @@ jobs:
     env:
       INSTALL_K3S_CHANNEL: ${{ matrix.channel }}
     steps:
-      - name: "Checkout"
-        uses: actions/checkout@v6
-        with: {fetch-depth: 1}
-      - name: Set up vagrant and libvirt
-        uses: ./.github/actions/vagrant-setup
-      - name: "Vagrant Cache"
-        uses: actions/cache@v4
-        with:
-          path: |
-             ~/.vagrant.d/boxes
-          key: vagrant-box-${{ matrix.vm }}
-        id: vagrant-cache
       - name: Remove Unnecessary Tools
+        working-directory: /
         run: |
           sudo rm -rf \
             /home/linuxbrew \
@@ -54,6 +43,18 @@ jobs:
             /usr/share/miniconda \
             /usr/share/swift
           df -khl
+      - name: "Checkout"
+        uses: actions/checkout@v6
+        with: {fetch-depth: 1}
+      - name: Set up vagrant and libvirt
+        uses: ./.github/actions/vagrant-setup
+      - name: "Vagrant Cache"
+        uses: actions/cache@v5
+        with:
+          path: |
+             ~/.vagrant.d/boxes
+          key: vagrant-box-${{ matrix.vm }}
+        id: vagrant-cache
       - name: "Vagrant Plugin(s)"
         run: vagrant plugin install vagrant-k3s vagrant-reload
       - name: "Vagrant Up ⏩ Install K3s"

.github/workflows/scorecard.yml

@@ -64,7 +64,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: SARIF file
           path: results.sarif