k3s.yaml

package:
  name: k3s
  version: 1.31.4.1
  epoch: 2
  description:
  copyright:
    - license: Apache-2.0
  dependencies:
    runtime:
      - busybox
      - conntrack-tools
      # containerd-shim-runc-v2 is now pulling in versions > 2.0.0 by default. (https://github.com/containerd/containerd/issues/10984)
      # pinning is required because any version >2.0.0 is not compatible with daemon < 2.0.0
      # daemon in this case is coming from k3s itself and they've not migrated yet to version > 2.0.0
      # there's is an issue tracking k3s update to containerd > 2.0.0 (https://github.com/k3s-io/k3s/issues/11375)
      # remove pin once upstream migrates to containerd > 2.0.0
      - containerd-shim-runc-v2=~1
      - ip6tables # this pulls in iptables as well
      - kmod
      - libseccomp
      - mount
      - runc
      - umount
      # Do not include runtime dependencies already included in the multicall k3s
      # - ctr
      # - crictl
      # - containerd
      # - kubectl

environment:
  contents:
    packages:
      - build-base
      - busybox
      - ca-certificates-bundle
      - crane
      - curl
      - go
      - libseccomp-dev
      - libseccomp-static
      - openssf-compiler-options
      - sqlite-dev
      - yq
      - zlib-dev
      - zlib-static
      - zstd

var-transforms:
  # Transform melange version 1.30.2.2 => 1.30.2+k3s2
  - from: ${{package.version}}
    match: \.(\d+)$
    replace: +k3s$1
    to: full-package-version

# Upstream uses `dapper` to initialize build environments, but since melange
# already provides a consistent build environment, we adopt upstreams ./scripts
# as much as possible.
pipeline:
  - uses: git-checkout
    with:
      repository: https://github.com/k3s-io/k3s
      tag: v${{vars.full-package-version}}
      expected-commit: a562d090b05cf8d55b6a8b57556787c24c8ce21a
  # Build things (almost) identical to upstream, with the k3s components
  # embedded in the "outer" multicall binary.
  - runs: |
      # Don't include the k3s-root since it conflicts with wolfi variants (ie: busybox and ip6tables)
      sed -e '/curl --compressed/d' -i scripts/download
      mkdir -p build/static bin/aux etc
      ./scripts/download
  - uses: go/bump
    with:
      deps: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.54.0 github.com/opencontainers/runc@v1.1.14 github.com/quic-go/quic-go@v0.48.2 github.com/libp2p/go-libp2p@v0.37.2 golang.org/x/crypto@v0.31.0
      replaces: google.golang.org/grpc=google.golang.org/grpc@v1.68.0
  - runs: |
      # Override the go version check at runtime to always match the go version at build time
      # Ref: https://github.com/k3s-io/k3s/pull/9054
      GOVERSION=$(go env GOVERSION)
      sed -i "s/\${VERSION_GOLANG}/$GOVERSION/g" scripts/build

      ./scripts/build
  # k3s embedds a lot of useful components (containerd, kubectl, etc...) in a
  # very efficient manner that can't be replicated with external runtime
  # components. To ensure we have an optimally packaged k3s, we try to mimic
  # as much of the upstream k3s space savings while still building all the
  # components from source. We use some light sed surgery instead of
  # maintaining patches for every version. Ultimately this means Wolfi's
  # version of k3s should feel identical to upstream (with containerd,
  # kubectl, crictl, etc...) all embedded, but with Wolfi variants where
  # applicable (runc).
  - runs: |
      # Remove non-embedded components and replace with Wolfi variants at runtime
      rm -rf bin/runc
      rm -rf bin/containerd-shim-runc-v2

      for cni in bandwidth bridge firewall flannel host-local loopback portmap; do
        ln -s cni bin/$cni
      done

      mkdir -p "${{targets.destdir}}/bin"
      cp -r bin/* "${{targets.destdir}}/bin/"
  - uses: strip

subpackages:
  - name: k3s-multicall
    description: "The k3s multicall binary with embedded components"
    dependencies:
      runtime:
        - busybox
        - conntrack-tools
        - containerd-shim-runc-v2
        - ip6tables
        - libseccomp
        - runc
        - mount
        - umount
        - kmod
    pipeline:
      - runs: |
          # Remove the upload portion from the upstream package-cli script
          sed -e '/scripts\/build-upload/d' -i scripts/package-cli

          ./scripts/package-cli

          # Install the "outer" k3s multicall binary. This should only
          # contain the go runtime plus the self extracting multicall logic, and
          # should be a relatively small binary (~<15Mb).
          install -Dm755 dist/artifacts/k3s* "${{targets.contextdir}}/bin/k3s"

          # Create our own links to the multicall binary, which won't be present until k3s is unpacked
          for bin in kubectl ctr crictl containerd; do
            ln -s k3s "${{targets.contextdir}}/bin/$bin"
          done
      - uses: strip
    test:
      pipeline:
        - runs: |
            # Verify that the multicall symlinks were created
            [ "$(readlink $(which kubectl))" = "k3s" ] || { echo "Error: the multicall symlinks are not set up appropriately" >&2; exit 1; }
            [ "$(readlink $(which ctr))" = "k3s" ] || { echo "Error: the multicall symlinks are not set up appropriately" >&2; exit 1; }
            [ "$(readlink $(which crictl))" = "k3s" ] || { echo "Error: the multicall symlinks are not set up appropriately" >&2; exit 1; }
            [ "$(readlink $(which containerd))" = "k3s" ] || { echo "Error: the multicall symlinks are not set up appropriately" >&2; exit 1; }
            containerd --version
            containerd --help
            k3s --help

  - name: k3s-static
    description: "k3s built with statically linked components"
    dependencies:
      runtime:
        - busybox
        - conntrack-tools
        - ip6tables
        - mount
        - runc
        - umount
        - kmod
    options:
      # Do not provide copies of the statically linked embedded components (like containerd)
      no-provides: true
    pipeline:
      - runs: |
          sed -i '/VERSION_RUNC=$(get-module-version github.com\/opencontainers\/runc)/a VERSION_RUNC="v1.1.14"' ./scripts/version.sh
          # Clean up the build directory
          rm -rf bin etc

          # Override the go version check at runtime to always match the go version at build time
          # Ref: https://github.com/k3s-io/k3s/pull/9054
          GOVERSION=$(go env GOVERSION)
          sed -i "s/\${VERSION_GOLANG}/$GOVERSION/g" scripts/build

          STATIC_BUILD=true ./scripts/build

          # Remove non-embedded components and replace with Wolfi variants at runtime
          rm -rf bin/runc

          for cni in bandwidth bridge firewall flannel host-local loopback portmap; do ln -s cni bin/$cni; done

          mkdir -p "${{targets.subpkgdir}}/bin"
          cp -r bin/* "${{targets.subpkgdir}}/bin/"
      - uses: strip
    test:
      environment:
        contents:
          packages:
            - binutils
      pipeline:
        - runs: |
            # Verify libseccomp is statically linked against k3s
            objdump -x $(which k3s) | grep -v "DYNAMIC"
            strings $(which k3s) | grep -q "libseccomp"

            # Verify runc is statically linked
            objdump -x $(which runc) | grep -v "DYNAMIC"

            # Verify containerd is statically linked
            objdump -x $(which containerd) | grep -v "DYNAMIC"
            bandwidth --version
            bandwidth --help
            bridge --version
            bridge --help
            cni --version
            cni --help
            containerd-shim-runc-v2 --help
            ctr --version
            ctr --help
            firewall --version
            firewall --help
            flannel --version
            flannel --help
            host-local --version
            host-local --help
            k3s-agent --version
            k3s-agent --help
            k3s-certificate --version
            k3s-certificate --help
            k3s-completion --version
            k3s-completion --help
            k3s-etcd-snapshot --version
            k3s-etcd-snapshot --help
            k3s-secrets-encrypt --version
            k3s-secrets-encrypt --help
            k3s-server --version
            k3s-server --help
            k3s-token --version
            k3s-token --help
            kubectl --version
            kubectl --help
            loopback --version
            loopback --help
            portmap --version
            portmap --help

update:
  enabled: true
  # Ignore any release-candidate tags
  ignore-regex-patterns:
    - -rc*
  # Example: Upstream tag: v1.31.0+k3s1 would become v1.31.0.1
  version-transform:
    - match: \+k3s(\d+)$
      replace: .$1
  github:
    identifier: k3s-io/k3s
    strip-prefix: v

test:
  pipeline:
    - name: Basic version smoketest
      runs: |
        k3s --version
        bandwidth --version
        bandwidth --help
        bridge --version
        bridge --help
        cni --version
        cni --help
        crictl --version
        crictl --help
        ctr --version
        ctr --help
        firewall --version
        firewall --help
        flannel --version
        flannel --help
        host-local --version
        host-local --help
        k3s-agent --version
        k3s-agent --help
        k3s-certificate --version
        k3s-certificate --help
        k3s-completion --version
        k3s-completion --help
        k3s-etcd-snapshot --version
        k3s-etcd-snapshot --help
        k3s-secrets-encrypt --version
        k3s-secrets-encrypt --help
        k3s-server --version
        k3s-server --help
        k3s-token --version
        k3s-token --help
        kubectl --version
        kubectl --help
        loopback --version
        loopback --help
        portmap --version
        portmap --help
    - name: Ensure the various tools are appropriately symlinked
      runs: |
        # Ensure the various tools are appropriately symlinked
        [ "$(readlink $(which kubectl))" = "k3s" ] || { echo "Error: the multicall symlinks are not set up appropriately" >&2; exit 1; }
        [ "$(readlink $(which ctr))" = "k3s" ] || { echo "Error: the multicall symlinks are not set up appropriately" >&2; exit 1; }
        [ "$(readlink $(which crictl))" = "k3s" ] || { echo "Error: the multicall symlinks are not set up appropriately" >&2; exit 1; }
        [ "$(readlink $(which containerd))" = "k3s" ] || { echo "Error: the multicall symlinks are not set up appropriately" >&2; exit 1; }