rbrtbnfgl · github-actions · Feb 23, 2026 · Apr 3, 2026
diff --git a/.github/workflows/updatecli.yml b/.github/workflows/updatecli.yml
@@ -50,7 +50,7 @@ jobs:
 
       - name: Apply Updatecli
         # Never use '--debug' option, because it might leak the access tokens.
-        run: "updatecli apply --clean --config ./updatecli/updatecli.d/ --values ./updatecli/values.yaml"
+        run: "updatecli pipeline apply --clean --config ./updatecli/updatecli.d/ --values ./updatecli/values.yaml"
         env:
           UPDATECLI_GITHUB_ACTOR: ${{ github.actor }}
           UPDATECLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/charts/chart_versions.yaml b/charts/chart_versions.yaml
@@ -2,7 +2,7 @@ charts:
   - version: 1.19.001
     filename: /charts/rke2-cilium.yaml
     bootstrap: true
-  - version: v3.31.3-build2026020600
+  - version: v3.31.4-build2026032700
     filename: /charts/rke2-canal.yaml
     bootstrap: true
   - version: v3.31.300
@@ -29,7 +29,7 @@ charts:
   - version: v4.2.314
     filename: /charts/rke2-multus.yaml
     bootstrap: true
-  - version: v0.28.101
+  - version: v0.28.000
     filename: /charts/rke2-flannel.yaml
     bootstrap: true
   - version: 1.13.000

diff --git a/scripts/build-images b/scripts/build-images
@@ -38,8 +38,8 @@ xargs -n1 -t $PULL_CMD << EOF > build/images-traefik.txt
 EOF
 
 xargs -n1 -t $PULL_CMD_CORE << EOF > build/images-canal.txt
-    ${REGISTRY}/rancher/hardened-calico:v3.31.3-build20260206
-    ${REGISTRY}/rancher/hardened-flannel:v0.28.1-build20260206
+    ${REGISTRY}/rancher/hardened-calico:v3.31.4-build20260327
+    ${REGISTRY}/rancher/hardened-flannel:v0.28.2-build20260327
 EOF
 
 if [ "${GOARCH}" != "s390x" ]; then
@@ -111,7 +111,7 @@ xargs -n1 -t $PULL_CMD << EOF > build/images-harvester.txt
 EOF
 
 xargs -n1 -t $PULL_CMD << EOF > build/images-flannel.txt
-    ${REGISTRY}/rancher/hardened-flannel:v0.28.1-build20260206
+    ${REGISTRY}/rancher/hardened-flannel:v0.28.0-build20260206
     ${REGISTRY}/rancher/hardened-cni-plugins:v1.9.0-build20260206
 EOF
 fi

diff --git a/updatecli/scripts/cilium_values.yaml b/updatecli/scripts/cilium_values.yaml
@@ -0,0 +1,10 @@
+clustermesh:
+  useAPIServer: true
+envoy:
+  enabled: true
+hubble:
+  ui:
+    enabled: true
+  relay:
+    enabled: true
+  enabled: true
diff --git a/updatecli/scripts/create-issue.sh b/updatecli/scripts/create-issue.sh
@@ -0,0 +1,76 @@
+#!/bin/bash
+
+GITHUB_REPOSITORY="rbrtbnfgl/rke2"
+CHART_VERSIONS_FILE="charts/chart_versions.yaml"
+CHART_NAME=${1}
+CHART_VERSION=${2}
+
+check-issue() {
+    MILESTONES_JSON=$(gh api repos/${GITHUB_REPOSITORY}/milestones)
+    TODAY=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+    TARGET_MILESTONE=$(echo "$MILESTONES_JSON" | jq -r --arg today "$TODAY" '
+      [ .[] | select(.title | contains("Release Cycle")) | select(.due_on >= $today) | select(.state == "open")] 
+      | sort_by(.due_on) 
+      | .[0].title
+    ')
+
+    if [ "$TARGET_MILESTONE" == "null" ] || [ -z "$TARGET_MILESTONE" ]; then
+      echo "No unexpired Release Cycle milestone found."
+      exit 1
+    fi
+
+    ISSUE_TITLE="Update CNIs for $TARGET_MILESTONE"
+
+    issue=$(
+        gh issue list \
+            --repo ${GITHUB_REPOSITORY} \
+            --state "open" \
+            --search "${ISSUE_TITLE}" \
+            --json number,body
+    )
+    if [[ $(echo "$issue" | jq '. | length') -eq 0 ]]; then
+       issue_url=$(gh issue create \
+           --title "${ISSUE_TITLE}" \
+           --body "Update CNIs for latest release:
+- ${CHART_NAME}:${CHART_VERSION}" \
+           --repo ${GITHUB_REPOSITORY} \
+           --milestone "${TARGET_MILESTONE}" 2>&1)
+       if [ $? -eq 0 ]; then
+	  number=$(echo "$issue_url" | awk -F'/' '{print $NF}')
+       else
+          echo "Failed to create issue"
+          exit 1
+       fi
+    else
+       number=$(echo $issue | jq -s 'sort_by(.[].number) | .[0]' | jq -r '.[].number')
+       body=$(echo $issue | jq -s 'sort_by(.[].number) | .[0]' | jq -r '.[].body')
+       new_body=$(update_issue_body "${body}" ${CHART_NAME} ${CHART_VERSION})
+       issue_url=$(gh issue edit \
+              ${number} \
+              --repo ${GITHUB_REPOSITORY} \
+	      --body "${new_body}")
+    fi
+    echo $number
+}
+
+update_issue_body() {
+    local original_body="$1"
+    local chart_name="$2"
+    local new_chart="$2:$3"
+
+    if echo "$original_body" | grep -q "$chart_name:"; then
+        echo "$original_body" | sed "s|^- $chart_name:.*|- $new_chart|"
+    else
+        if [[ -z "$original_body" ]]; then
+            echo "$new_chart"
+        else
+            printf "%s\n%s" "$original_body" "- $new_chart"
+        fi
+    fi
+}
+
+CURRENT_VERSION=$(yq -r '.charts[] | select(.filename == "/charts/'"${CHART_NAME}"'.yaml") | .version' ${CHART_VERSIONS_FILE})
+if [ "${CURRENT_VERSION}" != "${CHART_VERSION}" ]; then
+    check-issue
+fi
diff --git a/updatecli/scripts/update_chart_and_images_cni.sh b/updatecli/scripts/update_chart_and_images_cni.sh
@@ -0,0 +1,140 @@
+#!/bin/bash
+
+info()
+{
+    echo '[INFO] ' "$@"
+}
+warn()
+{
+    echo '[WARN] ' "$@" >&2
+}
+fatal()
+{
+    echo '[ERROR] ' "$@" >&2
+    exit 1
+}
+
+update_chart_version() {
+    info "updating chart ${1} in ${CHART_VERSIONS_FILE}"
+    CURRENT_VERSION=$(yq -r '.charts[] | select(.filename == "/charts/'"${1}"'.yaml") | .version' ${CHART_VERSIONS_FILE})
+    NEW_VERSION=${2}
+    if [ "${CURRENT_VERSION}" != "${NEW_VERSION}" ]; then
+        info "found version ${CURRENT_VERSION}, updating to ${NEW_VERSION}"
+        chart_updated=true
+        if test "$DRY_RUN" == "false"; then
+            sed -i "s/${CURRENT_VERSION}/${NEW_VERSION}/g" ${CHART_VERSIONS_FILE}
+        else
+            info "dry-run is enabled, no changes will occur"
+        fi
+    else
+        info "no new version found"
+    fi
+}
+
+update_chart_images() {
+    info "downloading chart ${1} version ${2} to extract image versions"
+    tempdir=$(mktemp -d)
+    CHART_URL="https://github.com/rancher/rke2-charts/raw/main/assets/${1}/${1}-${2}.tgz"
+    curl -s -L -o $tempdir/${1}-${2}.tgz ${CHART_URL}
+    if test "$chart_updated" == "true"; then
+        # get all images and tags for the latest constraint
+	cni=$(echo "${1}" | sed -nE 's/rke2-(.*)/\1/p')
+	case "${1}" in
+           "rke2-calico")
+              app_version="${2%??}"
+	      sed -i "/mirrored-calico-operator/b; /mirrored-calico/s/:v[0-9.]*$/:${app_version}/" ${CHART_AIRGAP_IMAGES_FILE}
+	      IMAGES_TAG=$(helm template $tempdir/${1}-${2}.tgz | grep -E image:)
+              ;;
+	   "rke2-cilium")
+              IMAGES_TAG_AWS=$(helm template --set eni.enabled=true $tempdir/${1}-${2}.tgz | grep -E image:)
+	      IMAGES_TAG_AZURE=$(helm template --set azure.enabled=true $tempdir/${1}-${2}.tgz | grep -E image:)
+	      IMAGES_TAG_GENERIC=$(helm template -f updatecli/scripts/cilium_values.yaml $tempdir/${1}-${2}.tgz | grep -E image:)
+	      IMAGES_TAG="${IMAGES_TAG_AWS}"$'\n'"${IMAGES_TAG_AZURE}"$'\n'"${IMAGES_TAG_GENERIC}"
+	      ;;
+	   "rke2-multus")
+	      IMAGES_TAG_THICK=$(helm template --set thickPlugin.enabled=true --set dynamicNetworksController.enabled=true $tempdir/${1}-${2}.tgz | grep -E image)
+	      IMAGES_TAG_MULTUS=$(helm template --set rke2-whereabouts.enabled=true $tempdir/${1}-${2}.tgz | grep -E image)
+	      IMAGES_TAG="${IMAGES_TAG_THICK}"$'\n'"${IMAGES_TAG_MULTUS}"
+	      ;;
+	   *)
+	      IMAGES_TAG=$(helm template $tempdir/${1}-${2}.tgz | grep -E image:)
+	      ;;
+        esac
+	LIST_IMAGES=""
+        while IFS= read -r line ; do 
+	      IMAGE=$(echo "${line}" | sed -nE 's/image: ([^/]+\.[^/]+\/)?(.*)/\2/p' | sed 's/\//\\\//g' | tr -dc '[:alnum:]:.\-/\\')
+	      LIST_IMAGES=$(echo "$LIST_IMAGES\${REGISTRY}/${IMAGE}\n")
+	done <<< "$IMAGES_TAG"
+        if test "$DRY_RUN" == "false"; then
+	      awk -v images_list="$LIST_IMAGES" -v cni="$cni" '
+BEGIN {
+    split(images_list, images_array, "\n");
+    for (i in images_array) {
+        n = split(images_array[i], image_tag, ":");
+        if (n == 2) images_list_array[image_tag[1]] = image_tag[2];
+    }
+    pattern = "xargs.*build/images-" cni ".txt.*"
+}
+$0 ~ pattern {
+    print;
+    while (getline > 0) {
+	if ($1 == "EOF") {
+            print;
+            next;
+        }
+        n = split($1, current_image, ":");
+        if (n == 2 && current_image[1] in images_list_array) {
+            print "    " current_image[1] ":" images_list_array[current_image[1]];
+        } else {
+            print $0;
+        }
+    }
+}
+{ print }' "${CHART_AIRGAP_IMAGES_FILE}" > "$tempdir/images_file.sh"
+              cp $tempdir/images_file.sh ${CHART_AIRGAP_IMAGES_FILE}
+        else
+              info "dry-run is enabled, no changes will occur"
+         fi
+    else
+        info "no new version found"
+    fi
+    # removing downloaded artifacts
+    rm -rf $tempdir/
+}
+
+update_chart_images_windows() {
+    app_version="${2%??}"
+    case "${1}" in
+       "rke2-flannel")
+	  sed -i "s/ENV FLANNEL_VERSION=.*/ENV FLANNEL_VERSION=\"$app_version\"/g" Dockerfile.windows
+	  CNI_VERSION=$(helm template flannel --repo https://flannel-io.github.io/flannel/ --version "$app_version" 2>/dev/null | \
+                        grep -oP 'flannel-cni-plugin:\K[\w.-]+' | \
+                        head -n 1)
+	  if [ -z "$CNI_VERSION" ]; then
+             echo "Error: Failed to extract CNI version."
+             echo "Check if version $app_version exists at https://flannel-io.github.io/flannel/"
+             exit 1
+          fi
+	  sed -i "s/ENV CNI_FLANNEL_VERSION=.*/ENV CNI_FLANNEL_VERSION=\"${CNI_VERSION}\"/g" Dockerfile.windows
+	  CLEAN_VERSION=$(echo "${CNI_VERSION}" | cut -d'-' -f1)
+	  sed -i "s/ENV CNI_PLUGIN_VERSION=.*/ENV CNI_PLUGIN_VERSION=\"${CLEAN_VERSION}\"/g" Dockerfile.windows
+	  ;;
+       "rke2-calico")
+          sed -i "s/ENV CALICO_VERSION=.*/ENV CALICO_VERSION=\"$app_version\"/g" Dockerfile.windows
+	  ;;
+    esac
+}
+
+CHART_VERSIONS_FILE="charts/chart_versions.yaml"
+CHART_AIRGAP_IMAGES_FILE="scripts/build-images"
+
+
+CHART_NAME=${1}
+CHART_VERSION=${2}
+chart_updated=false
+
+update_chart_version ${CHART_NAME} ${CHART_VERSION}
+update_chart_images ${CHART_NAME} ${CHART_VERSION}
+if [ ${CHART_NAME} == "rke2-flannel" -o ${CHART_NAME} == "rke2-calico" ]; then
+   update_chart_images_windows ${CHART_NAME} ${CHART_VERSION}
+fi
diff --git a/updatecli/updatecli.d/calico-cni.yml b/updatecli/updatecli.d/calico-cni.yml
@@ -0,0 +1,62 @@
+---
+name: "Update Calico charts and images"
+# Make sure we can pull in github repos from multiple orgs
+scms:
+  rke2:
+    kind: "github"
+    spec:
+      user: "{{ .github.user }}"
+      email: "{{ .github.email }}"
+      username: "{{ requiredEnv .github.username }}"
+      token: '{{ requiredEnv .github.token }}'
+      owner: "{{ .github.owner }}"
+      repository: "{{ .github.repo }}"
+      branch: master
+
+sources:
+  calico:
+    name: "Get Calico chart version"
+    kind: "helmchart"
+    spec:
+      url: https://rancher.github.io/rke2-charts
+      name: rke2-calico
+      versionfilter:
+        kind: "regex"
+        pattern: ^v?\d+\.\d+\.\d+$
+  issue:
+    name: "Get issue number"
+    kind: "shell"
+    spec:
+      command: bash ./updatecli/scripts/create-issue.sh rke2-calico {{ source "calico" }}
+      environments:
+        - name: GH_TOKEN
+          value: '{{ requiredEnv .github.token }}'
+
+conditions:
+  calicoVersionShouldBeUpdated:
+    name: "Check if Calico chart should be updated or not"
+    kind: shell
+    sourceid: calico
+    spec:
+      command: bash ./updatecli/scripts/validate_version.sh rke2-calico
+
+targets:
+  calicoCNI:
+    name: "Update the Calico airgap images"
+    kind: "shell"
+    scmid: "rke2"
+    sourceid: calico
+    spec:
+      command: bash ./updatecli/scripts/update_chart_and_images_cni.sh rke2-calico
+
+actions:
+  github:
+    kind: "github/pullrequest"
+    scmid: "rke2"
+    spec:
+      automerge: false
+      draft: false
+      mergemethod: squash
+      parent: false
+      title: 'Update Calico chart to {{ source "calico" }}'
+      description: 'This is an automated PR to update Helm chart versions. issue #{{ source "issue" }}'