[release-1.35] Backports for 2026-03

.github/workflows/airgap.yaml

@@ -20,7 +20,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up Docker
-        uses: docker/setup-docker-action@v4
+        uses: docker/setup-docker-action@v5
         with:
           version: type=image,tag=28
           daemon-config: '{"features":{"containerd-snapshotter":true}}'

.github/workflows/build-k3s.yaml

@@ -38,12 +38,12 @@ jobs:
 
     - name: Set up QEMU
       if: inputs.arch == 'arm'
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@v4
       with:
         cache-image: false
 
     - name: Set up Docker
-      uses: docker/setup-docker-action@v4
+      uses: docker/setup-docker-action@v5
       with:
         version: type=image,tag=28
         daemon-config: '{"features":{"containerd-snapshotter":true}}'
@@ -67,7 +67,7 @@ jobs:
       if: inputs.arch == 'arm64' || inputs.arch == 'amd64'
       env:
           DOCKER_BUILD_SUMMARY: false
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@v7
       with:
         context: .
         file: ./Dockerfile.local
@@ -89,7 +89,7 @@ jobs:
       env:
         PLATFORM: ${{ inputs.arch == 'arm' && 'linux/arm/v7' || format('linux/{0}', inputs.arch) }}
         DOCKER_BUILD_SUMMARY: false
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@v7
       with:
         context: .
         file: ./Dockerfile.local

.github/workflows/e2e.yaml

@@ -77,7 +77,7 @@ jobs:
         uses: actions/checkout@v6
         with: {fetch-depth: 1}
       - name: Set up Docker
-        uses: docker/setup-docker-action@v4
+        uses: docker/setup-docker-action@v5
         with:
           version: type=image,tag=28
           daemon-config: '{"features":{"containerd-snapshotter":true}}'
@@ -108,7 +108,7 @@ jobs:
            curl -LO "https://dl.k8s.io/release/${STABLE_VERSION}/bin/linux/amd64/kubectl"
            sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
       - name: "Download k3s binary"
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: k3s-amd64
           path: ./dist/artifacts
@@ -187,13 +187,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        dtest: [autoimport, basics, bootstraptoken, cacerts, dualstack, etcd, hardened, lazypull, skew, secretsencryption, snapshotrestore, svcpoliciesandfirewall, token, upgrade]
+        dtest: [autoimport, basics, bootstraptoken, cacerts, dualstack, etcd, hardened, lazypull, nixsnapshotter, skew, secretsencryption, snapshotrestore, svcpoliciesandfirewall, token, upgrade]
         arch: [amd64, arm64]
         exclude:
           - dtest: autoimport
             arch: arm64
           - dtest: dualstack
             arch: arm64
+          - dtest: nixsnapshotter
+            arch: arm64
           - dtest: secretsencryption
             arch: arm64
           - dtest: snapshotrestore
@@ -226,12 +228,12 @@ jobs:
     - name: Checkout
       uses: actions/checkout@v6
     - name: "Download K3s image"
-      uses: actions/download-artifact@v7
+      uses: actions/download-artifact@v8
       with:
         name: k3s-${{ matrix.arch }}
         path: ./dist/artifacts
     - name: Set up Docker
-      uses: docker/setup-docker-action@v4
+      uses: docker/setup-docker-action@v5
       with:
         version: type=image,tag=28
         daemon-config: '{"features":{"containerd-snapshotter":true}}'
@@ -245,8 +247,16 @@ jobs:
         docker image load -i ./dist/artifacts/k3s-image.tar
         IMAGE_TAG=$(docker image ls --format '{{.Repository}}:{{.Tag}}' | grep 'rancher/k3s')
         echo "K3S_IMAGE=$IMAGE_TAG" >> $GITHUB_ENV
+    - name: Install Nix
+      if: matrix.dtest == 'nixsnapshotter'
+      uses: DeterminateSystems/nix-installer-action@v21
+    - name: Build nix test image
+      if: matrix.dtest == 'nixsnapshotter'
+      run: |
+        nix build github:pdtpartners/nix-snapshotter#image-hello
+        cp result ./tests/docker/resources/nix-hello-image.tar
     - name: Download Go Tests
-      uses: actions/download-artifact@v7
+      uses: actions/download-artifact@v8
       with:
         name: docker-go-tests-${{ matrix.arch }}
         path: ./dist/artifacts

.github/workflows/install.yaml

@@ -71,7 +71,7 @@ jobs:
       - name: "Vagrant Plugin(s)"
         run: vagrant plugin install vagrant-k3s vagrant-reload vagrant-scp
       - name: "Download k3s binary"
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: k3s-amd64
           path: tests/install/${{ matrix.vm }}

.github/workflows/integration.yaml

@@ -74,7 +74,7 @@ jobs:
     - name: Install Go
       uses: ./.github/actions/setup-go
     - name: "Download k3s binary"
-      uses: actions/download-artifact@v7
+      uses: actions/download-artifact@v8
       with:
         name: k3s-amd64
         path: ./dist/artifacts
@@ -120,7 +120,7 @@ jobs:
     - name: Install Go
       uses: ./.github/actions/setup-go
     - name: Download k3s binary
-      uses: actions/download-artifact@v7
+      uses: actions/download-artifact@v8
       with:
         name: k3s-windows
         path: dist/artifacts/

.github/workflows/release.yml

@@ -42,7 +42,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up Docker
-        uses: docker/setup-docker-action@v4
+        uses: docker/setup-docker-action@v5
         with:
           version: type=image,tag=28
           daemon-config: '{"features":{"containerd-snapshotter":true}}'
@@ -154,7 +154,7 @@ jobs:
           tags: ${{ steps.tag_config.outputs.tag_spec }}
 
       - name: "Download K3s build"
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           pattern: k3s*
           path: ./dist/artifacts
@@ -166,7 +166,7 @@ jobs:
           cp ./dist/artifacts/data-* ./build/out
 
       - name: Build and push K3s runtime image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./package/Dockerfile
@@ -215,14 +215,14 @@ jobs:
           secret/data/github/repo/${{ github.repository }}/k3s-suse-registry/credentials registry | REGISTRY
 
     - name: Configure AWS Credentials (s3)
-      uses: aws-actions/configure-aws-credentials@v4
+      uses: aws-actions/configure-aws-credentials@v6
       with:
         aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
         aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
         aws-region: us-east-1
 
     - name: "Download Artifacts"
-      uses: actions/download-artifact@v7
+      uses: actions/download-artifact@v8
       with:
         pattern: "*"
         path: ./dist/artifacts
@@ -249,7 +249,7 @@ jobs:
         ./scripts/validate-artifacts
 
     - name: Upload Assets to Release
-      uses: softprops/action-gh-release@v2.2.1
+      uses: softprops/action-gh-release@v2.5.0
       with:
         files: |
           dist/artifacts/k3s*

.github/workflows/stale.yml

@@ -13,7 +13,7 @@ jobs:
       contents: write
     steps:
       - name: Close Stale Issues
-        uses: actions/stale@v10.1.0
+        uses: actions/stale@v10.2.0
         with:
           # ensure PRs are exempt
           days-before-pr-stale: -1

.github/workflows/trivy-scan.yml

@@ -58,7 +58,7 @@ jobs:
         run: curl -fsSO https://raw.githubusercontent.com/rancher/vexhub/refs/heads/main/reports/rancher.openvex.json
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.33.1
+        uses: aquasecurity/trivy-action@0.34.1
         with:
           image-ref: 'rancher/k3s:latest'
           format: 'table'
@@ -85,7 +85,7 @@ jobs:
 
     steps:       
       - name: Download Trivy Report artifact
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         if: needs.trivy_scan.result == 'success'
         with:
           name: trivy-report

Dockerfile.manifest

@@ -1,4 +1,4 @@
-ARG GOLANG=golang:1.25.7-alpine3.22
+ARG GOLANG=golang:1.25.7-alpine3.23
 FROM ${GOLANG}
 
 COPY --from=plugins/manifest:1.2.3 /bin/* /bin/

Dockerfile.test

@@ -1,4 +1,4 @@
-ARG GOLANG=golang:1.25.7-alpine3.22
+ARG GOLANG=golang:1.25.7-alpine3.23
 FROM ${GOLANG} AS test-base
 
 RUN apk -U --no-cache add bash jq

cmd/containerd/main.go

@@ -7,5 +7,6 @@ import (
 
 func main() {
 	klog.InitFlags(nil)
+	klog.EnableContextualLogging(true)
 	containerd.Main()
 }

cmd/k3s/main.go

@@ -3,7 +3,6 @@ package main
 import (
 	"bytes"
 	"context"
-	"errors"
 	"io"
 	"io/fs"
 	"os"
@@ -20,9 +19,9 @@ import (
 	"github.com/k3s-io/k3s/pkg/dataverify"
 	"github.com/k3s-io/k3s/pkg/flock"
 	"github.com/k3s-io/k3s/pkg/untar"
+	"github.com/k3s-io/k3s/pkg/util/errors"
+	"github.com/k3s-io/k3s/pkg/util/home"
 	"github.com/k3s-io/k3s/pkg/version"
-	pkgerrors "github.com/pkg/errors"
-	"github.com/rancher/wrangler/v3/pkg/resolvehome"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/pflag"
 	"github.com/urfave/cli/v2"
@@ -212,7 +211,7 @@ func stageAndRunCLI(cli *cli.Context, cmd string, dataDir string, args []string)
 func stageAndRun(dataDir, cmd string, args []string, calledAsInternal bool) error {
 	dir, err := extract(dataDir)
 	if err != nil {
-		return pkgerrors.WithMessage(err, "extracting data")
+		return errors.WithMessage(err, "extracting data")
 	}
 	logrus.Debugf("Asset dir %s", dir)
 
@@ -386,7 +385,7 @@ func extract(dataDir string) (string, error) {
 func findCriConfig(dataDir string) string {
 	searchList := []string{filepath.Join(dataDir, "agent", criDefaultConfigPath)}
 
-	if homeDataDir, err := resolvehome.Resolve(datadir.DefaultHomeDataDir); err == nil {
+	if homeDataDir, err := home.Resolve(datadir.DefaultHomeDataDir); err == nil {
 		searchList = append(searchList, filepath.Join(homeDataDir, "agent", criDefaultConfigPath))
 	} else {
 		logrus.Warnf("Failed to resolve user home directory: %s", err)

cmd/k3s/main_linux.go

@@ -6,14 +6,14 @@ import (
 	"os"
 	"syscall"
 
-	pkgerrors "github.com/pkg/errors"
+	"github.com/k3s-io/k3s/pkg/util/errors"
 )
 
 const programPostfix = ""
 
 func runExec(cmd string, args []string, calledAsInternal bool) (err error) {
 	if err := syscall.Exec(cmd, args, os.Environ()); err != nil {
-		return pkgerrors.WithMessagef(err, "exec %s failed", cmd)
+		return errors.WithMessagef(err, "exec %s failed", cmd)
 	}
 	return nil
 }