From f75fe689e5fa17bb308fb0d61a16ff26de52af34 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Sat, 26 Sep 2026 14:32:10 +0000
Subject: [PATCH] Update k3s to v1.37.0+k3s1

---
 envs/k3s_administration/main.tf           |  2 +-
 modules/k3s/server_node/vendor/install.sh | 59 ++++++++++++++++++-----
 vendir.lock.yml                           |  6 +--
 vendir.yml                                |  2 +-
 4 files changed, 52 insertions(+), 17 deletions(-)

diff --git a/envs/k3s_administration/main.tf b/envs/k3s_administration/main.tf
index ef6258fa..e8e08419 100644
--- a/envs/k3s_administration/main.tf
+++ b/envs/k3s_administration/main.tf
@@ -42,7 +42,7 @@ module "server_node" {
   ssh_user = "pipeline"
 
   # renovate: datasource=github-releases depName=k3s-io/k3s
-  k3s_version = "v1.36.4+k3s1"
+  k3s_version = "v1.37.0+k3s1"
   datastore   = "sqlite"
   tls_san     = [var.server_administration_ip]
 }
diff --git a/modules/k3s/server_node/vendor/install.sh b/modules/k3s/server_node/vendor/install.sh
index 9820742e..5483d39d 100644
--- a/modules/k3s/server_node/vendor/install.sh
+++ b/modules/k3s/server_node/vendor/install.sh
@@ -605,11 +605,14 @@ setup_selinux() {
         rpm_target=sle
         rpm_site_infix=microos
         package_installer=zypper
-        if [ "${ID_LIKE:-}" = suse ] && ( [ "${VARIANT_ID:-}" = sle-micro ] || [ "${ID:-}" = sle-micro ] ); then
-            rpm_target=sle
+
+        # SleMicro 6.2 and SLEs 16 uses the same ID and same VERSION_ID in case the ID and VERSION_ID changes we will catch SLEMicro 6.2 using VARIANT_ID transactional
+        if [ "${ID:-}" = sles ] && [ -n "${VERSION_ID}" ] && [ "${VERSION_ID%%.*}" -ge 16 ]; then
+            rpm_site_infix=slemicro
+        elif [ "${VARIANT_ID:-}" = sle-micro ] || [ "${VARIANT_ID:-}" = transactional ] || [ "${ID:-}" = sle-micro ] || [ "${ID:-}" = sl-micro ] || [ "${ID:-}" = sle-micro-rancher ]; then
             rpm_site_infix=slemicro
-            package_installer=zypper
         fi
+
     # cover any atomic fedora flavors using rpm-ostree
     elif  { [ "${ID:-}" = fedora ] || [ "${ID_LIKE:-}" = fedora ]; } && [ -n "${OSTREE_VERSION:-}" ]; then
         rpm_target=coreos
@@ -962,19 +965,51 @@ rm -rf /var/lib/kubelet
 rm -f ${BIN_DIR}/k3s
 rm -f ${KILLALL_K3S_SH}
 
-if type yum >/dev/null 2>&1; then
-    yum remove -y k3s-selinux
-    rm -f /etc/yum.repos.d/rancher-k3s-common*.repo
-elif type rpm-ostree >/dev/null 2>&1; then
-    rpm-ostree uninstall k3s-selinux
-    rm -f /etc/yum.repos.d/rancher-k3s-common*.repo
-elif type zypper >/dev/null 2>&1; then
+# uninstall k3s-selinux package if a compatible package manager is found
+zypper_remove_selinux_rpm() {
     uninstall_cmd="zypper remove -y k3s-selinux"
     if [ "\${TRANSACTIONAL_UPDATE=false}" != "true" ] && [ -x /usr/sbin/transactional-update ]; then
         uninstall_cmd="transactional-update --no-selfupdate -d run \$uninstall_cmd"
     fi
-    $SUDO \$uninstall_cmd
+    \$uninstall_cmd
+}
+dnf_remove_selinux_rpm() {
+    package_manager=dnf
+    # yum is only needed for rhel 7, which is EOM since 2024 anyway
+    if ! type dnf >/dev/null 2>&1; then
+        package_manager=yum
+    fi
+    \$package_manager remove -y k3s-selinux
+}
+rpm_ostree_uninstall_cmd="rpm-ostree uninstall --idempotent k3s-selinux"
+
+# shellcheck source=/dev/null
+[ -r /etc/os-release ] && . /etc/os-release
+
+if [ "\$(expr "\${ID_LIKE}" : ".*suse.*")" != 0 ]; then
+    zypper_remove_selinux_rpm
+# cover any standard & atomic rhel/centos/fedora + derivatives like amazon linux
+elif [ "\${ID:-}" = fedora ] || [ "\$(expr "\${ID_LIKE}" : ".*fedora.*\|.*rhel.*\|.*centos.*")" != 0 ]; then
+    if [ -n "\${OSTREE_VERSION:-}" ]; then
+        \$rpm_ostree_uninstall_cmd
+    else
+        dnf_remove_selinux_rpm
+    fi
+# if we did not match yet just check for package managers commonly found on selinux-enabled distributions
+elif type rpm-ostree >/dev/null 2>&1; then
+    \$rpm_ostree_uninstall_cmd
+elif type zypper >/dev/null 2>&1; then
+    zypper_remove_selinux_rpm
+elif type yum >/dev/null 2>&1; then
+    dnf_remove_selinux_rpm
+elif [ -d /usr/share/selinux ]; then
+    echo '[WARN] Automatic removal of "k3s-selinux" package not possible, please remove it manually.' >&2
+fi
+
+if [ -d /etc/zypp/repos.d ]; then
     rm -f /etc/zypp/repos.d/rancher-k3s-common*.repo
+elif [ -d /etc/yum.repos.d ]; then
+    rm -f /etc/yum.repos.d/rancher-k3s-common*.repo
 fi
 EOF
     $SUDO chmod 755 ${UNINSTALL_K3S_SH}
@@ -993,7 +1028,7 @@ create_env_file() {
     info "env: Creating environment file ${FILE_K3S_ENV}"
     $SUDO touch ${FILE_K3S_ENV}
     $SUDO chmod 0600 ${FILE_K3S_ENV}
-    sh -c export | while read x v; do echo $v; done | grep -E '^(K3S|CONTAINERD)_' | $SUDO tee ${FILE_K3S_ENV} >/dev/null
+    sh -c export | while read x v; do echo $v; done | grep -E '^(K3S|CONTAINERD|KINE)_' | $SUDO tee ${FILE_K3S_ENV} >/dev/null
     sh -c export | while read x v; do echo $v; done | grep -Ei '^(NO|HTTP|HTTPS)_PROXY' | $SUDO tee -a ${FILE_K3S_ENV} >/dev/null
 }
 
diff --git a/vendir.lock.yml b/vendir.lock.yml
index dbcc21cb..0534186a 100644
--- a/vendir.lock.yml
+++ b/vendir.lock.yml
@@ -2,10 +2,10 @@ apiVersion: vendir.k14s.io/v1alpha1
 directories:
 - contents:
   - git:
-      commitTitle: '[release-1.36] Update to v1.36.4-k3s1 and Go 1.26.7 (#14545)...'
-      sha: 4dedb15be78017a8ddd5b9e81acd44f3481078ed
+      commitTitle: Update hashicorp gpg fingerprint...
+      sha: bb7cf0657bafdfbb4349d1740810442d09c2248a
       tags:
-      - v1.36.4+k3s1
+      - v1.37.0+k3s1
     path: .
   path: modules/k3s/server_node/vendor
 - contents:
diff --git a/vendir.yml b/vendir.yml
index df0d102b..85efc7f6 100644
--- a/vendir.yml
+++ b/vendir.yml
@@ -7,7 +7,7 @@ directories:
       - path: .
         git:
           url: https://github.com/k3s-io/k3s
-          ref: v1.36.4+k3s1
+          ref: v1.37.0+k3s1
           depth: 1
         includePaths:
           - install.sh