chore(node-bootc): move the baked k3s to v1.35.7+k3s1 #91

Merged

pipeline-bot merged 1 commit from chore/k3s-1.35.7 into trunk

2026-08-15 11:38:58 +00:00

sean commented

2026-08-15 09:35:42 +00:00

Owner

1.34 enters maintenance mode 2026-08-27, and the apiserver may not skip a minor, so 1.36 needs two hops. This is hop one.

What actually runs the fleet

/usr is read-only under bootc, so the get.k3s.io installer cannot write /usr/local/bin/k3s on a live node. node-bootc bakes the binary into /usr/bin/k3s — that Containerfile ARG is the version the fleet runs. bootstrap/nodes.env is only the fallback for a stock, non-bootc image. The two must move together; editing nodes.env alone changes nothing live.

Nothing rolls from these commits

The new version reaches a node only when node-bootc is rebuilt and the node takes the image. Order is fixed and getting it wrong is silent:

both pins bumped (these PRs)
node-bootc rebuilt
master bootc switch first — it runs the k3s server, i.e. the apiserver
workers roll to the same image

A worker rolled first puts a 1.35 kubelet under a 1.34 apiserver.

Both v1.35.7+k3s1 release assets (the k3s binary and sha256sum-amd64.txt) were confirmed present before the edit; the existing RUN block still verifies the checksum.

No VERSION file changes — node-bootc has none. It is tagged by kernel version through the node-image Shipwright Build, not by the :vN discipline the other images/ directories follow.

1.34 enters maintenance mode **2026-08-27**, and the apiserver may not skip a minor, so 1.36 needs two hops. This is hop one. ## What actually runs the fleet `/usr` is read-only under bootc, so the get.k3s.io installer cannot write `/usr/local/bin/k3s` on a live node. **node-bootc bakes the binary into `/usr/bin/k3s`** — that Containerfile `ARG` is the version the fleet runs. `bootstrap/nodes.env` is only the fallback for a stock, non-bootc image. The two must move together; editing nodes.env alone changes nothing live. ## Nothing rolls from these commits The new version reaches a node only when node-bootc is rebuilt and the node takes the image. Order is fixed and getting it wrong is silent: 1. both pins bumped (these PRs) 2. node-bootc rebuilt 3. **master `bootc switch` first** — it runs the k3s server, i.e. the apiserver 4. workers roll to the same image A worker rolled first puts a 1.35 kubelet under a 1.34 apiserver. Both v1.35.7+k3s1 release assets (the k3s binary and `sha256sum-amd64.txt`) were confirmed present before the edit; the existing RUN block still verifies the checksum. No VERSION file changes — node-bootc has none. It is tagged by kernel version through the node-image Shipwright Build, not by the `:vN` discipline the other `images/` directories follow.

sean added 1 commit

2026-08-15 09:35:42 +00:00

chore(node-bootc): move the baked k3s to v1.35.7+k3s1

pipeline/ci CI green @ b1a8c88b2625

Details

b1a8c88b26

Kubernetes support for 1.34 enters maintenance mode on 2026-08-27, and the
apiserver may not skip a minor, so 1.36 needs two hops. This is the first
one.

THIS ARG IS THE VERSION THE FLEET RUNS. /usr is read-only under bootc, so
the get.k3s.io installer cannot write /usr/local/bin/k3s on a live node.
The binary comes from this image instead. bootstrap/nodes.env in the
seanfarm repository is only the fallback for a stock, non-bootc image, so
editing that file alone changes nothing on a running node. Both move
together, and the seanfarm half is a separate pull request.

The two release assets for v1.35.7+k3s1 were confirmed present before this
edit: the k3s binary and sha256sum-amd64.txt. The existing RUN block still
verifies the checksum.

The header now records the order of operations, because getting it wrong
is silent. The master runs the k3s server, which is the apiserver, and a
kubelet may never be newer than the apiserver. So the master takes the new
image FIRST, by hand over SSH, and the workers roll to the same image only
after that. A worker rolled first would put a 1.35 kubelet under a 1.34
apiserver.

No VERSION file changes. node-bootc has none: it is tagged by kernel
version through the node-image Shipwright Build, not by the :vN discipline
that the other images under images/ follow.

sean referenced this pull request

2026-08-15 10:30:16 +00:00

seanfarm33 train: VERSION bumps + forensics gate/kargs/watchdog (recut off trunk) #92

sean force-pushed chore/k3s-1.35.7 from b1a8c88b26

pipeline/ci CI green @ b1a8c88b2625

Details

to 679185af65

pipeline/ci CI green @ 679185af6536

Details

2026-08-15 10:45:16 +00:00

Compare

pipeline-bot force-pushed chore/k3s-1.35.7 from 679185af65