Mirror of git.yoctoproject.org/meta-virtualization https://git.enea.com/cgit/linux/meta-virtualization.git/atom?h=master-next 2026-05-29T17:40:22+00:00 2026-05-29T17:40:22+00:00 Bruce Ashfield bruce.ashfield@gmail.com 2026-05-29T17:40:22+00:00 urn:sha1:f2af4d6cddd866e8d8bd9f26f4c6679a55be27f4 Aggressive jump release-1.35 -> release-1.36 (latest tagged minor), landing on v1.36.1+k3s1 exactly. Recipe changes beyond the SRCREV/PV/branch bump: - GO_MOD_DISCOVERY_LICENSE_TARGETS = "./cmd/server/main.go" — explicitly declares the recipe's build entry-point so the license-scan filter uses the new tier-1 mechanism (go list -deps) rather than the narrower GOMODCACHE walk. Critical for k3s given its ~2810-module discovery graph — only ~403 modules contribute code to the binary, and the precise filter avoids 2400+ stale LIC_FILES_CHKSUM entries. - include go-mod-licenses.inc (not require) so the recipe parses cleanly on first-time generation before the sidecar file exists. All 5 go-mod sidecars regenerated; new go-mod-licenses.inc (~416 lines, 407 license-bearing modules). do_populate_lic passes cleanly thanks to the companion script changes for module-path encoding. Bumping k3s to version v1.36.1+k3s1, which comprises the following commits: a9663261a7 Bump klipper-helm image tag 9da548c2bc Update to v1.36.1 (#14051) 76c84e57ac chore: Update rancher/local-path-provisioner image version 7bbbf7c9b2 Fix install-go cache key a4b0bc0b01 Bump kine to v0.15.0 bcc8df1ace add lost return e52c00c4a8 chore: Update rancher/klipper-lb image versions 5231ff7ef0 chore: Update CoreDNS image version in manifests/coredns.yaml 9f9f75591b chore: Update CoreDNS image version in scripts/airgap/image-list c96142270f Bump spegel to v0.7.0 32687ebb94 Move advertise-address setup before server prepare 73f157cfeb Replace PreparingExecutor with explicit executor init 7939da6c48 chore: Update rancher/klipper-lb image versions Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> 2026-04-07T16:05:39+00:00 Bruce Ashfield bruce.ashfield@gmail.com 2026-04-07T16:05:39+00:00 urn:sha1:d138800d7925a007fc61366bb20a3c90412a45c6 Add infrastructure for booting the same container-image-host image as either a k3s server or agent, controlled via kernel cmdline parameters (k3s.role=server|agent). k3s-role-setup.service / k3s-role-setup.sh: - Reads k3s.role, k3s.server, k3s.token, k3s.node-name, k3s.node-ip, k3s.iface from kernel cmdline - Configures cluster network interface IP via networkd drop-in - For agent role: masks k3s.service, writes agent environment file, starts k3s-agent.service - For server role: masks k3s-agent.service (default) 10-k3s-cluster.network: - Claims the cluster interface (eth1) via virt_networking bbclass - Disables DHCP to prevent systemd-networkd from interfering - Static IP added at boot by role-setup via drop-in k3s-get-token.sh: - Helper script to display the server join token - Waits for token file if k3s is still starting k3s-agent.service: - Add EnvironmentFile for /etc/default/k3s-agent (K3S_URL, K3S_TOKEN) - Add After=k3s-role-setup.service and network-online.target k3s.service: - Add After=k3s-role-setup.service packagegroup-kubernetes.bb: - k3s-host packagegroup now includes k3s-agent (both roles available) - Both k3s-host and k3s-node include k3s-net-conf Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> 2026-04-06T23:49:24+00:00 Bruce Ashfield bruce.ashfield@gmail.com 2026-04-06T20:47:03+00:00 urn:sha1:545ecc18af39a48a0543c844aa1652c2ed29c5d0 Embed system manifests and Helm charts into the k3s binary so that k3s's deploy.Stage() can extract and process them at runtime with template variable substitution (e.g., %{SYSTEM_DEFAULT_REGISTRY}%). Previously, raw manifest files were installed directly to the server manifests directory, but template variables were not substituted, causing InvalidImageName errors for system pods. Now manifests are copied to pkg/deploy/embed/ before Go compilation, matching upstream's scripts/build workflow. Traefik ingress controller support is added as a PACKAGECONFIG option (enabled by default). When enabled, the traefik and traefik-crd Helm chart tarballs are downloaded during do_fetch and embedded into the binary at pkg/static/embed/charts/. When disabled, traefik is added to the disable list in config.yaml. A default /etc/rancher/k3s/config.yaml is installed that disables the cloud-controller-manager (not needed for standalone/QEMU environments) and conditionally disables traefik. The --disable-cloud-controller flag is removed from k3s.service since it is now in the config file. To disable traefik: PACKAGECONFIG:remove:pn-k3s = "traefik" Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> 2026-04-06T23:49:24+00:00 Bruce Ashfield bruce.ashfield@gmail.com 2026-04-06T15:49:46+00:00 urn:sha1:540f1aee43c9694912869ef6d32a570ffbf7c123 Several issues prevented k3s from starting and running pods in the Yocto image: k3s.service / k3s-agent.service: - Add /opt/cni/bin and /usr/libexec/cni to PATH so k3s can find CNI plugin binaries (host-local, flannel, bridge, etc.) - Create /run/flannel/subnet.env at startup if not present — k3s's embedded flannel controller expects this file for CNI configuration - Add --disable-cloud-controller to server — the cloud controller manager is for cloud provider integration (AWS/GCP) and causes a timeout loop in standalone/QEMU environments k3s_git.bb: - Create /var/lib/rancher/k3s/server/manifests/ directory — k3s expects this at startup for auto-deploying system components - Switch CNI config from cni-containerd-net.conf (containerd bridge with 10.88.0.0/16 subnet) to cni-flannel.conflist which matches k3s's flannel networking (10.42.0.0/16 via flannel plugin) cni-flannel.conflist: - New flannel CNI config that delegates to the flannel plugin with hairpin mode, forceAddress, and portmap capabilities Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> 2026-03-19T02:01:11+00:00 Bruce Ashfield bruce.ashfield@gmail.com 2026-03-18T21:00:07+00:00 urn:sha1:0f795c808590cc808f35f58aba580b11056d34c5 We drop one patch that is no longer needed, and pick up the following commits: 13563febb4 Update to v1.35.2 (#13707) b7a5ea520a Bump Traefik to v3.6.9 5505935bd5 Improve resilience of datastore bootstrap reconcile from etcd 6a11814e1e Install binutils-gold only for arm64 builds 971abd7839 Bump kine to v0.14.12 ef3352b33a Fix rootless test to work with -local flag 25fe4279fe Revert "Move to rootlesskit v2 (#13486)" a3f1ddbc62 Bump rancher/systemd-node version for docker tests 6043b5c5b9 Fix support for E2E commit installs 50fa2d70c2 Update to v1.35.1 (#13637) 3d825d02bd Fix removal of init node cf8b2aba13 Bump klipper-helm and klipper-lb images 57a9ba0151 Add registry prefix to image-list file (#13602) 2e474257cd Bump metrics-server to v0.8.1 1e853f688f chore: Bump rancher/mirrored-coredns-coredns image version eb44ad66dc chore: Bump rancher/mirrored-coredns-coredns image version a2e38967f6 Fix VPN node IP not being applied to kubelet (#13560) bc8ee0e64d Bump kine for list/watch revision fixes 4044d9a886 Add helper function for including stack trace with error message 24a60f8e70 Handle empty token file as nonexistent 70a776fb46 Add IPv6 loopback to kubelet-serving cert 5d394478f5 Fix filter for wildcards c9be8a6180 Explicitly close mvcc backend cfad6a6a67 Bump scorecard checkout to match all other versions bba659457c Use channel.yaml instead of curling for stable for kubectl install (#13531) 9ccb98edf7 Update install tests with new images, add alma10 (#13489) 05d985ac44 Move to rootlesskit v2 (#13486) c8ae7d1beb Prevent caching on PR of golangci-lint entries (#13487) 323b952450 Fix restart of control-plane-only nodes attempting to reconcile from local datastore 312c2388cf Update to v1.35.0 (#13523) 69c0aad6c2 Bump etcd to v3.6.7 1869c121ba Add sudo to go coverage in CI 084963abc6 Update Traefik version to v3.6.7 f03b0e91bd Bump to coredns 1.14.0 2efebf2379 Remove download/generate from vulncheck c6e9ccb101 Fix setup-go cache issues f028f773d5 Bump kine for NATS conformance fixes 9dfce1de28 Update longhorn version in integration test from v1.4.0 to v1.10.1 89949bc0f6 Add deferred store implimentation f56a11018f Bump spegel to v0.6.0 179bc20bc7 Bump expr-lang/expr 69bd545420 Fix atomic write in WriteSubnetFile f35890692e Drop use of deprecated docker reexec package 5326e4845c Bump CNI plugins e271b600f1 Remove flannel external-ip annotations when disabled 93e5cdc665 Add tests for etcd local reconcile 14d0946392 Fix etcd reconcile with empty TLS dirs 35325987e3 Replace temporary etcd server with raw mvcc store access 17be721d99 Don't enforce use of wg.Go instead of Add/Done b3b4b64a31 Bump stable to 1.34 and add 1.35 74afe498d0 Fix PR lint checkout depth 344a1bfd1f lint: nested-structs 3816096e46 lint: unnecessary-format,use-errors-new 09484feb7c lint: unhandled-error 05f0cdf080 lint: identical-switch-branches c45212f932 lint: useless-break 6964eca111 lint: unnecessary-stmt 2b9f2f465c lint: unexported-return b43f4a90cb lint: unexported-naming 43c58a897c lint: unchecked-type-assertion 44bb326fcc lint: superfluous-else d2bbcb8ce2 lint: struct-tag d27b113d58 lint: redefines-builtin-id 986915c381 lint: indent-error-flow dd97235fc1 lint: import-alias-naming 035a60f295 lint: if-return 7506516bfa lint: exported c290d10a57 lint: empty-lines b32993713c lint: duplicated-imports 313966fbee lint: defer,get-return a005161b4b lint: bool-literal-in-expr d360faf2b3 lint: bare-return 5c7c49e36d lint: deep-exit 3c0ed0293b lint: comment-spacings 7f1a90166f lint: dot-imports 08918b90a6 lint: use-any b80668fc2d lint: redundant-build-tag a9b96775dc lint: file is not properly formatted 2ccbe1f844 Add lint/validate job e1ef30f0ef Bump golangci-lint for go1.25 5dddbc8a66 Bump actions/cache from 4 to 5 (#13347) 5a793c4cff Bump actions/download-artifact from 6 to 7 (#13346) 26217f45bf Push GA images to staging registry (#13437) b54634c463 Bump local path provisioner to v0.0.34 (#13426) 14c744d013 Bump coredns to 1.13.2 625139da72 Bump traefik to 3.6.6 4a49c0a04a chore: Bump Local Path Provisioner version (#13387) 591dda9fa6 Fix upgrade test eventually 8e7b3caa5c Allow k3s secrets-encrypt enable on existing clusters 01795824eb Bump rancher/systemd-node to v0.0.7 (SLES 16.0) 519317e02e Use Get, not Head for channel page 25dc06d9a9 Replace legacy ReplicationController with Deployment 4b2777b55f Expand docker upgrade test, sunset E2E upgrade test cf90ac502d Add firewall section to check-config.sh (#13390) a6c6cd15c0 Fix panic in test cleanup when client is unset 6840e435cd Fix event strings 2ac57a7e2c Fix prometheus metrics parsing 3943327933 Bump kubernetes v1.35.0 and golang v1.25.5 e060c0b18f Bump actions/upload-artifact from 5 to 6 650fed932d Validate collected files for release 7806fa6b9c Move sha256sum from workflow to script d3732ec3fc Combine airgap and binary publishing steps 7c6c338e2f Fix release workflow b27276dc81 Add job to lint all workflows on change 61e248b04c Reduce image pull spew a5ab12b82c Reuse airgap workflow in release d0052281a9 Fix arm airgap platforms 4116b53e86 Override DefaultHelmJob at build time (#13351) c0b1314d15 Bump kine to v0.14.9 463678586d [main] Update to v1.34.3-k3s1 and Go 1.24.11 (#13308) f223247d63 Pass platform option to `docker save` b4b33afbde Bump kube-router to v2.6.3-k3s1 764e98cbb4 Bump kine to v0.14.8 613a5e4787 Bump runc to v1.4.0 aaa7fa237b Bump kine and etcd d337570de1 Fix inconsistent curl flags in tests c3ca02aa75 Move embed into separate package from executor d582a0da84 Reorganize flannel consts and fields d1989567ea Use patch helper for secrets-encryption labels and annotations 1cb80fbe75 Use patch helper for spegel annotations and labels 57210b87cc Use patch helper for node labels and annotations 713cf8fbde Use patch helper for etcd labels and annotations 2b39b6808a Use patch helper for etcd member controller 785cfad963 Use patch helper for etcd snapshot annotation patch ceebaade3e Add JSON patch helper efcf8eb7ac Move embedded flannel and vpn config setup into embedded executor ec3cc04214 Move CNI execution into executor b7ca944774 Move etcd metrics to separate package 543b6307a6 Define DefaultHelmJobImage in K3s, overriding what helm-controller defaults to. (#13258) 0d39c86b5c Move from ranchertest to mirrored-busybox cd08e731f6 Fix naming convention for docker test import 572cc8e2bf Consolidate RunCommand between Docker and E2E tests e3cc61c43c Update kube-router to v2.6.2 8e0676ad46 update busybox image version to 1.37.0 (#13237) 68749aac76 Bump actions/checkout from 5 to 6 (#13256) 96ed4393c1 Remove remaining references to drone 1262649fda update channels to 1.33.6 (#13246) 3de08883f7 Bump opencontainers/selinux f726966062 Clean tools from runners before tests 74088f5175 Use docker containerd snapshotter for stable image digests f783052df2 Fix airgap-extra-registry flag af441c29a0 Add test for sharing imported images by digest 1037dcbff4 Add digests and source labels for imported images 9806524a48 Fix spegel ready checks to give server more time to find a peer f0d54528d0 Stop waiting on CRI ready if context is cancelled 871094b5c6 Add multus e2e test 913005658c tunnel: handle pod IP reuse (#13212) ed57fb5e61 Fix windows build os (#13201) c86b66d05c Add id-token (#13209) 3cdb5f8cf5 Update to v1.34.2-k3s1 and Go 1.24.9 (#13204) 8215b940e3 Bump klipper-helm and helm-controller (#13187) 3530ab5915 Fix tailscale setup in case of an already running configuration 7146e2000e Fix apiserver starting before remote etcd is up 8f781acff4 [main] Add Prime assets upload (#13160) 858b109b92 Fix adding OwnerReferences to Nodes seen from initial list e438a3c1a0 Bump containerd to v2.1.5 a2663f8884 Bump remotedialer to fix deadlock on connection close fdc356a9ce Bump runc to v1.3.3 b8f6f958c8 Streamline E2E startup test (#13137) b9e90d3e51 Don't look at head for upgrade channel (#13130) 2459bf7c84 Bump actions/upload-artifact from 4 to 5 (#13104) 72ca761529 Migrate Docker Image publishing to GitHub Actions 19e8f83d1d Only run arm64 and amd64 test stage on drone tags e1238095f0 Bump kine to 0.14.6 9e1003029c Bump actions/download-artifact from 5 to 6 602d43081e Migrate dispatch pipeline into GitHub Actions (#13105) d8790220ff Move node password secrets into dedicated controller 139d64c129 Create node-password secrets with custom Type d622b18c20 Remove node password file migration code 0d9ef273d8 Remove node addresses from filter when node is deleted 171644cf0c Replace raw ListWatch with NewListWatchFromClient d50a4a894e Fix invalid replaced versions 92a0b7eec2 Bump helm-controller/klipper-helm cfcc9ef65e Add docker dualstack test (#13070) 5aca8e24b1 Update dispatch script (#13079) 6381cad10f rootless ports: add support for udp 517df31f65 Fix postgres DB container args for nightly conformance (#13069) 481cd6002a Bump ossf/scorecard-action from 2.4.2 to 2.4.3 (#13026) 65932372c7 Bump github/codeql-action from 3 to 4 (#13065) 989c07f6a2 Bump actions/stale from 10.0.0 to 10.1.0 (#13025) 24dda29fb8 Cleanup wording and decisions on various ADRs (#13068) 0e5bc29d34 Bump kine for idle progress fix e8e76e3cf3 move to 1.13.1 1511d362a4 Bump coredns to v1.12.4 701cc35b7a Bump kine=v0.14.4, etcd=v3.6.5 6ba8efd7a1 create policy hint only when all variables defined 09762a57df Update flannel, kube-router and cni plugins ef6d6f4c36 Bump kine for postgres object count fix 89adabb672 Drop calls to rand.Seed 3190f30de8 Update stable channel to v1.33.5+k3s1 (#13017) 7a41cce152 Fix ability to rotate server token to an invalid format 565d50a3b1 Create dynamic-cert-regenerate file in CA cert rotation handler 6edbae331b Fix bootstrap charts 9a6f602c75 Fix handling of vendored dependencies in version script 39d89153da fix: default forward after override imports 59b4a9d738 Bump kine to v0.14.2 for schema fix 09845c9f00 Bump traefik to 3.5.1 (#12948) d6e84ba2d1 Fix kine metrics registration without --kine-tls a26fd3ba4d Disable metrics test pending resolution of upstream issue 1026725896 Enable debug logs for embedded mirror e2e 8347597031 Bump spegel to v0.4.0 ade82387f7 Inclusive naming proposal (issue: #12110, Orlin Vasiliev) (#12383) 1e45f1de72 Bump actions/stale from 9.1.0 to 10.0.0 (#12878) 908a0b91dc Fix install script raspi cmdline message (#12842) 3854eb56d4 Run upgrade test in dedicated drone step 5b19165e9e Fix pods readiness tests a0ce2aaeaf Add sequential split-server test bfdcc7bcc8 Fix etcd member promotion 626178624f Bump aquasecurity/trivy-action from 0.32.0 to 0.33.1 (#12879) 14e919804d Fix garbled CLI (#12899) 4974fc7c24 Use sync.WaitGroup to avoid exiting before components have shut down 7e028854e7 Fix signal handling when pid 1 274498fb4d Add pkg/signals for signal handler setup b61d6f3b81 Transfer cluster leadership before removing leader member 659f2a7014 Fix perpetual etcd member removal a7d3c8559f Fix IPv6 handling for loadbalancer addresses 07d0711e5a Update hardened script for cis-1.11 (#12912) 0136cf2589 Remove NetworkManager check for nm-cloud.service 2f6283a92c chore: Bump Klipper Helm and Helm Controller version 9c6d0eb5cd Bump actions/github-script from 7 to 8 (#12881) 1b98629b2c Bump actions/setup-go from 5 to 6 (#12880) bdb92296a5 Bump dynamiclistener for secret sync fix 67c23a20e3 Update to v1.34.1 (#12897) 7e253dbf02 Fix netpol fatal error when changing node IP b3ac144e2d Move data dir into position before creating CNI symlinks 857412ae58 Add 1.34 release channel a64d872c13 Add opencontainers/runc pin Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> 2026-01-04T16:45:55+00:00 Bruce Ashfield bruce.ashfield@gmail.com 2026-01-04T16:45:55+00:00 urn:sha1:58dd80d89db767343f62565be3a61e650907560a There were some issues with hyrid vcs mode and shallow clones. The tools have been updated to deal with those issues, so we regenerate to pick them up. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> 2025-12-09T01:57:44+00:00 Bruce Ashfield bruce.ashfield@gmail.com 2025-12-09T01:53:58+00:00 urn:sha1:e05c2caec1ca17918450809ab759a4cfdd3c8864 Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> 2025-12-09T01:57:44+00:00 Bruce Ashfield bruce.ashfield@gmail.com 2025-12-04T22:39:25+00:00 urn:sha1:02f6761794d3a4480d10564aee3db16c83855f11 Convert k3s from the old vendor/modules.txt approach to the new go-mod-vcs build system that fetches Go modules via git. Changes: - Update k3s_git.bb to inherit go-mod-vcs class - Add go-mod-git.inc with SRC_URI entries for all module git repos - Add go-mod-cache.inc with module path mappings - Remove old src_uri.inc, relocation.inc, and modules.txt - Update to k3s v1.34.1+k3s1 The go-mod-vcs class will: 1. Fetch all module sources via git (defined in go-mod-git.inc) 2. Build GOMODCACHE with proper zip files and hashes 3. Enable fully offline, reproducible Go module builds This eliminates the need for vendored dependencies or network access to Go module proxies during the build. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> 2025-03-13T18:38:04+00:00 Bruce Ashfield bruce.ashfield@gmail.com 2025-03-13T18:34:40+00:00 urn:sha1:49127b1156fb2bad3a728369ed12d8fe980d8c21 The revert of the pending upgrade (that was waiting for a newer go) did not build as the upgrade was incomplete. Bumping the SCREV and modules.txt to complete the process. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> 2025-03-13T18:37:50+00:00 Bruce Ashfield bruce.ashfield@gmail.com 2025-03-11T21:00:45+00:00 urn:sha1:dfb45fb90a5eba92b21dbad8d9e3412b459ba49e This reverts commit fd1d4c65e4103141921ab66cf44d20f759be9b80.