replicatedhq
diff --git a/‎.github/workflows/ci.yaml‎
Lines changed: 12 additions & 4 deletions b/‎.github/workflows/ci.yaml‎
Lines changed: 12 additions & 4 deletions
diff --git a/‎Makefile‎
Lines changed: 1 addition & 1 deletion b/‎Makefile‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎cmd/buildtools/addon.go‎
Lines changed: 14 additions & 5 deletions b/‎cmd/buildtools/addon.go‎
Lines changed: 14 additions & 5 deletions
diff --git a/‎cmd/buildtools/k0s.go‎
Lines changed: 3 additions & 0 deletions b/‎cmd/buildtools/k0s.go‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎cmd/installer/cli/install.go‎
Lines changed: 11 additions & 7 deletions b/‎cmd/installer/cli/install.go‎
Lines changed: 11 additions & 7 deletions
diff --git a/‎cmd/local-artifact-mirror/migrate_containerd_config.go‎
Lines changed: 32 additions & 0 deletions b/‎cmd/local-artifact-mirror/migrate_containerd_config.go‎
Lines changed: 32 additions & 0 deletions
diff --git a/‎cmd/local-artifact-mirror/root.go‎
Lines changed: 1 addition & 0 deletions b/‎cmd/local-artifact-mirror/root.go‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎dev/dockerfiles/local-artifact-mirror/Dockerfile.ttlsh‎
Lines changed: 1 addition & 1 deletion b/‎dev/dockerfiles/local-artifact-mirror/Dockerfile.ttlsh‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎dev/dockerfiles/operator/Dockerfile.local‎
Lines changed: 1 addition & 1 deletion b/‎dev/dockerfiles/operator/Dockerfile.local‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎dev/dockerfiles/operator/Dockerfile.ttlsh‎
Lines changed: 1 addition & 1 deletion b/‎dev/dockerfiles/operator/Dockerfile.ttlsh‎
Lines changed: 1 addition & 1 deletion
@@ -25,6 +25,7 @@ jobs:
     outputs:
       git_sha: ${{ steps.git_sha.outputs.git_sha }}
       ec_version: ${{ steps.output_vars.outputs.ec_version }}
+      helm_version: ${{ steps.output_vars.outputs.helm_version }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -39,6 +40,10 @@ jobs:
           EC_VERSION=$(./scripts/print-ec-version.sh "$ec_version" "$k0s_minor_version")
           echo "EC_VERSION=\"$EC_VERSION\""
           echo "ec_version=$EC_VERSION" >> $GITHUB_OUTPUT
+          # Pin the helm binary used by tests to the same version embedded-cluster ships
+          # (versions.mk), instead of latest.
+          helm_version=$(make print-HELM_VERSION)
+          echo "helm_version=$helm_version" >> $GITHUB_OUTPUT
 
   sanitize:
     name: Sanitize
@@ -155,7 +160,7 @@ jobs:
       - name: Setup Helm
         uses: azure/setup-helm@v5
         with:
-          version: latest
+          version: ${{ needs.output-vars.outputs.helm_version }}
       - name: Run tests
         run: |
           export VERSION=${{ needs.output-vars.outputs.ec_version }}
@@ -231,7 +236,7 @@ jobs:
       - name: Setup Helm
         uses: azure/setup-helm@v5
         with:
-          version: latest
+          version: ${{ needs.output-vars.outputs.helm_version }}
       - name: Run tests
         run: |
           export VERSION=${{ needs.output-vars.outputs.ec_version }}
@@ -261,7 +266,7 @@ jobs:
       - name: Setup Helm
         uses: azure/setup-helm@v5
         with:
-          version: latest
+          version: ${{ needs.output-vars.outputs.helm_version }}
       - name: Run tests
         run: |
           export VERSION=${{ needs.output-vars.outputs.ec_version }}
@@ -528,9 +533,12 @@ jobs:
           k0s_minor_version=$(make print-K0S_MINOR_VERSION)
           previous_k0s_minor_version=$(($k0s_minor_version - 1))
           k0s_majmin_version="1.${previous_k0s_minor_version}"
+          # Pick the release `previous_release_gap` versions back, falling back to the
+          # oldest available when the previous minor has fewer releases than that (e.g.
+          # right after a new minor is added).
           EC_VERSION="$(gh release list --repo replicatedhq/embedded-cluster \
            --exclude-drafts --exclude-pre-releases --json name --order desc \
-           --jq "[.[] | select(.name | contains(\"k8s-${k0s_majmin_version}\"))] | .[${previous_release_gap}] | .name")"
+           --jq "[.[] | select(.name | contains(\"k8s-${k0s_majmin_version}\"))] | (.[${previous_release_gap}] // .[-1]) | .name")"
 
           gh release download "$EC_VERSION" --repo replicatedhq/embedded-cluster --pattern 'metadata.json'
           K0S_VERSION="$(jq -r '.Versions.Kubernetes' metadata.json)"
 
@@ -267,7 +267,7 @@ embedded-cluster-darwin-arm64: embedded-cluster
 .PHONY: embedded-cluster
 embedded-cluster: build-deps
 	CGO_ENABLED=0 GOOS=$(OS) GOARCH=$(ARCH) go build \
-		-tags osusergo,netgo \
+		-tags $(GO_INSTALLER_BUILD_TAGS) \
 		-ldflags="-s -w $(LD_FLAGS) -extldflags=-static" \
 		-o ./build/embedded-cluster-$(OS)-$(ARCH) \
 		./cmd/installer
 
@@ -17,6 +17,11 @@ type addonComponent struct {
 	getWolfiPackageVersion       func(opts addonComponentOptions) string
 	upstreamVersionInputOverride string
 	useUpstreamImage             bool
+	// usePlainTag emits the image tag as-is (no "-<arch>@<digest>" suffix). Required for
+	// the sandbox/pause image: containerd 2.x (k0s >= 1.36) pulls it by digest but then
+	// resolves the sandbox image by its full reference, and a synthetic arch-suffixed tag
+	// that does not exist in the registry fails that lookup ("failed to get sandbox image").
+	usePlainTag bool
 }
 
 type addonComponentOptions struct {
@@ -105,13 +110,17 @@ func (c *addonComponent) resolveCustomImageRepoAndTag(ctx context.Context, image
 		return "", "", fmt.Errorf("failed to get image name for %s: %w", c.name, err)
 	}
 
-	digest, err := GetImageDigest(ctx, customImage, arch)
-	if err != nil {
-		return "", "", fmt.Errorf("failed to get image %s digest: %w", customImage, err)
+	var tag string
+	if c.usePlainTag {
+		tag = TagFromImage(customImage)
+	} else {
+		digest, err := GetImageDigest(ctx, customImage, arch)
+		if err != nil {
+			return "", "", fmt.Errorf("failed to get image %s digest: %w", customImage, err)
+		}
+		tag = fmt.Sprintf("%s-%s@%s", TagFromImage(customImage), arch, digest)
 	}
 
-	tag := fmt.Sprintf("%s-%s@%s", TagFromImage(customImage), arch, digest)
-
 	repo := FamiliarImageName(RemoveTagFromImage(customImage))
 	repo = addProxyAnonymousPrefix(repo)
 
 
@@ -88,6 +88,9 @@ var k0sImageComponents = map[string]addonComponent{
 
 var pauseComponent = addonComponent{
 	name: "pause",
+	// Pin the sandbox image by plain tag (no arch suffix / digest) so containerd 2.x can
+	// resolve it; see addonComponent.usePlainTag.
+	usePlainTag: true,
 	getCustomImageName: func(opts addonComponentOptions) (string, error) {
 		k0sConfig := k0sv1beta1.DefaultClusterConfig()
 		pauseVersion := k0sConfig.Spec.Images.Pause.Version
 
@@ -673,13 +673,17 @@ func runInstall(ctx context.Context, flags installFlags, installCfg *installConf
 
 	// TODO (@salah): update installation status to reflect what's happening
 
-	logrus.Debugf("adding insecure registry")
-	registryIP, err := registry.GetRegistryClusterIP(rc.ServiceCIDR())
-	if err != nil {
-		return fmt.Errorf("failed to get registry cluster IP: %w", err)
-	}
-	if err := hostutils.AddInsecureRegistry(fmt.Sprintf("%s:5000", registryIP)); err != nil {
-		return fmt.Errorf("failed to add insecure registry: %w", err)
+	// Only airgap installs use the in-cluster registry; online installs don't
+	// need the insecure-registry drop-in (and k0s 1.36+ rejects its legacy v1 format).
+	if installCfg.isAirgap {
+		logrus.Debugf("setup internal registry config for containerd to pull from the in-cluster registry")
+		registryIP, err := registry.GetRegistryClusterIP(rc.ServiceCIDR())
+		if err != nil {
+			return fmt.Errorf("failed to get registry cluster IP: %w", err)
+		}
+		if err := hostutils.AddInsecureRegistry(fmt.Sprintf("%s:5000", registryIP)); err != nil {
+			return fmt.Errorf("failed to add insecure registry: %w", err)
+		}
 	}
 
 	helmOpts := buildHelmClientOptions(installCfg, rc)
 
@@ -0,0 +1,32 @@
+package main
+
+import (
+	"fmt"
+
+	"github.com/replicatedhq/embedded-cluster/pkg-new/hostutils"
+	"github.com/spf13/cobra"
+)
+
+// MigrateContainerdConfigCmd reconciles the containerd registry drop-in with the
+// k0s 1.36+ schema (see hostutils.MigrateContainerdConfigToV3): airgap migrates it
+// to the containerd 2.x schema, online deletes it if present. Run per node on upgrade.
+func MigrateContainerdConfigCmd(cli *CLI) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "migrate-containerd-config",
+		Short: "Migrate the containerd registry drop-in to the containerd 2.x (k0s 1.36+) schema",
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			cli.bindFlags(cmd.Flags())
+			return nil
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if err := hostutils.MigrateContainerdConfigToV3(cli.V.GetBool("airgap")); err != nil {
+				return fmt.Errorf("migrate containerd config: %w", err)
+			}
+			return nil
+		},
+	}
+
+	cmd.Flags().Bool("airgap", false, "Whether this is an airgap install: airgap migrates the registry drop-in to the containerd 2.x (k0s 1.36+) schema; online deletes it if present (online installs don't use the in-cluster registry)")
+
+	return cmd
+}
@@ -24,6 +24,7 @@ func RootCmd(cli *CLI) *cobra.Command {
 
 	cmd.AddCommand(ServeCmd(cli))
 	cmd.AddCommand(PullCmd(cli))
+	cmd.AddCommand(MigrateContainerdConfigCmd(cli))
 
 	cmd.PersistentFlags().String("data-dir", ecv1beta1.DefaultDataDir, "Path to the data directory")
 
 
@@ -1,4 +1,4 @@
-FROM golang:1.26.2 AS build
+FROM golang:1.26.4 AS build
 
 WORKDIR /app
 
 
@@ -1,4 +1,4 @@
-FROM golang:1.26.2-alpine AS build
+FROM golang:1.26.4-alpine AS build
 
 RUN apk add --no-cache ca-certificates curl git make bash helm
 
 
@@ -1,4 +1,4 @@
-FROM golang:1.26.2 AS build
+FROM golang:1.26.4 AS build
 
 WORKDIR /app
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM golang:1.26.2 AS build`
	`1`	`+FROM golang:1.26.4 AS build`
`2`	`2`
`3`	`3`	`WORKDIR /app`
`4`	`4`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM golang:1.26.2-alpine AS build`
	`1`	`+FROM golang:1.26.4-alpine AS build`
`2`	`2`
`3`	`3`	`RUN apk add --no-cache ca-certificates curl git make bash helm`
`4`	`4`