k3s CA fix: tn-k3s-ca.sh, keyCertSign root, k3s pin v1.36.5 + cgroup v1, no implicit upgrade by tekn0ir · Pull Request #8 · teknoir/cli

fix(bootstrap): root CA with keyCertSign; tn-k3s-ca.sh setup, check and remediate

tekn0ir

and

claude

committed

7b3f7f5

fix(tn-k3s-ca): do not depend on the caller's info/warn/fatal

tekn0ir

and

claude

committed

b33c6a3

fix(tn-k3s-ca): fail on a failed openssl step, stop on an unusable foreign CA, new serial on OpenSSL 1.1.1

tekn0ir

and

claude

committed

ab148da

fix(tn-k3s-ca): data dir like k3s, safe regeneration, more --force cases, k3s pin

tekn0ir

and

claude

committed

eca0ea1

feat(bootstrap): cgroup v1 kubelet flag, keep the installed k3s on a re-run, final-review fixes

tekn0ir

and

claude

committed

946f20f

feat(bootstrap): agent follows its server, flag before the CA step, slow-device waits, safer refusals

tekn0ir

and

claude

committed

24ed293

fix(bootstrap): INSTALL_K3S_EXEC is final before the cgroup step, data dir guard first, harness expects the drop-in from v1.31

tekn0ir

and

claude

committed

e5fa8ad

fix(bootstrap): keep the cgroup v1 drop-in until the installer has put the flag in the unit

tekn0ir

and

claude

committed

3712031

docs(bootstrap): when the cgroup v1 drop-in is removed and when it waits for the installer

tekn0ir

and

claude

committed

c160448

fix(bootstrap): a k3s upgrade across v1.31 gets the cgroup v1 flag on its first start

tekn0ir

and

claude

committed

1d61656

Navigation Menu

Repository navigation

k3s CA fix: tn-k3s-ca.sh, keyCertSign root, k3s pin v1.36.5 + cgroup v1, no implicit upgrade - #8

k3s CA fix: tn-k3s-ca.sh, keyCertSign root, k3s pin v1.36.5 + cgroup v1, no implicit upgrade#8
tekn0ir merged 10 commits into
mainfrom
fix/k3s-ca-root-keycertsign

Commits on Oct 11, 2026

fix(bootstrap): root CA with keyCertSign; tn-k3s-ca.sh setup, check and remediate

fix(tn-k3s-ca): do not depend on the caller's info/warn/fatal

fix(tn-k3s-ca): fail on a failed openssl step, stop on an unusable foreign CA, new serial on OpenSSL 1.1.1

fix(tn-k3s-ca): data dir like k3s, safe regeneration, more --force cases, k3s pin

feat(bootstrap): cgroup v1 kubelet flag, keep the installed k3s on a re-run, final-review fixes

feat(bootstrap): agent follows its server, flag before the CA step, slow-device waits, safer refusals

fix(bootstrap): INSTALL_K3S_EXEC is final before the cgroup step, data dir guard first, harness expects the drop-in from v1.31

fix(bootstrap): keep the cgroup v1 drop-in until the installer has put the flag in the unit

docs(bootstrap): when the cgroup v1 drop-in is removed and when it waits for the installer

fix(bootstrap): a k3s upgrade across v1.31 gets the cgroup v1 flag on its first start