K3s 1.35.0+k3s3 → 1.37.1+k3s1
17 releases · 1 breaking change · 3 security fixes · 0 advisories fixed
3security1breaking0deprecated12feature28fix
Breaking changes
- breaking Fix removal of init node (#13630) in 1.35.1+k3s1
Security changes
- security Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445 (#14614) in 1.37.0+k3s1
- security Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445 (#14620) in 1.36.5+k3s1
- security Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445 (#14621) in 1.35.9+k3s1
Every release in between
otherBackports for 2026-09 (#14631)
fixFix restore from compressed etcd snapshot #14528
otherEnable seccomp in riscv64 builds #14529
otherUse ginkgo CLI to run tests #14531
otherBump k3s-io/api to v0.2.0 #14570
otherServicelb multiple lbpools #14547
otherClose minio.Object after read #14580
otherBump k3s-io/apis again #14589
fixFix --flannel-cni-conf not reaching the embedded flannel #14598
otherCheck-config: suppress colors when stdout is not a terminal #14595
fixFix deploy controller not re-applying manifests when mtime is pinned to the epoch #14568
otherBump etcd to v3.7.1-k3s3 for nonblocking logging support #14628
otherBump kine to v0.17.1 #14627
otherBump helm-controller (#14684)
otherBump k3s-io/kubernetes and Go references (#14695)
otherBump cadvisor to v0.60.5-k3s1 (#14698)
otherReject anonymous access to supervisor router (spegel/pprof/metrics) (#14701)
otherImprove CA hash validation (#14705)
otherOpen issues here
otherJoin our Slack channel
otherCheck out our documentation for guidance on how to get started or to dive deep into K3s.
otherRead how you can contribute here
otherBump mirrored-pause to 3.10.2 (#14339)
otherBuild(deps): bump the action-deps group with 14 updates (#14394)
otherBump dynamiclistener for atomic write fix (#14382)
otherBump helm-controller/klipper-helm (#14403)
otherSimplify WriteSubnetFile cleanup and make atomic (#14405)
fixFix typo in snapshot prune event (#14410)
otherBump rancher/mirrored-coredns-coredns image version (#14415)
featureAdd updatecli manifest to bump Kubernetes across multiple release branches (#14402)
otherBump metrics-server to v0.9.0 (#14416)
otherUpdatecli: relax metrics-server semver filter et al. (#14429)
featureUpdatecli: add missing requiredEnv (#14434)
otherBump helm-controller and klipper-helm for --force-conflicts support (#14446)
otherBump k3s-io/kubernetes and Go references (#14457)
otherBump etcd to v3.6.14 (#14460)
fixFix production builds always enabling Go coverage instrumentation (#14465)
featureFeat: support custom kubeconfig name (#14440)
featureAdded --write-kubeconfig-name server flag to set the name for cluster, user and context in generated kubeconfig.
otherRequire node password informer sync before using cache (#14459)
otherBump helm-controller and klipper-helm (#14474)
otherEnable unit tests (#14480)
fixFix: change sles to use slemicro rpms instead of microos (#14472)
otherTests: make rootless uidmap install robust against stale apt cache (#14490)
otherUpdate stable channel to v1.36.3+k3s1 (#14492)
otherEtcd client locking (#14488)
otherTests: Install rke2-multus-crd chart for multus e2e test (#14489)
otherFilter large untemplated issues (#14435)
fixFix typo in spegel deferred store comment (#14485)
otherMake explicit where coredns customizations should be made (#14503)
otherBump docker version in CI to 29 (#14506)
otherDon't retag images for a registry they are already hosted by (#14484)
fixFixed an issue where airgap image imports could fail with an "already exists" error, or accumulate duplicate image tags on every restart, when system-default-registry matched the registry the images were already tagged for.
otherTidy dockerfile and build stages (#14511)
featureAdd advertise-address to SANs before generating apiserver cert (#14516)
fixFixed the apiserver serving certificate not including the value of --advertise-address in its subject alternative names.
otherBump Local Path Provisioner version (#14496)
otherBump containerd to v2.3.4-k3s1.36 (#14510)
otherBump kine to v0.16.4 for nats replay fix (#14521)
featureFeat: Add Project Bluefin to adopters list (#14549)
otherBump k8s to v1.37 (#14509)
securityBump google.golang.org/grpc to v1.83.2 for CVE-2026-84445 (#14614)
+10 more items in the release notesotherBump rancher/mirrored-coredns-coredns image version (#14534)
otherBump gateway-api and traefik image versions for K3s 1.36 (#14567)
otherBump Traefik image to 3.7.12 and gateway-api to 1.6.1
otherBump Traefik to v3.7.13 (#14610)
securityBump google.golang.org/grpc to v1.83.2 for CVE-2026-84445 (#14620)
otherBackports for 2026-09 (#14632)
fixFix restore from compressed etcd snapshot #14528
otherEnable seccomp in riscv64 builds #14529
otherUse ginkgo CLI to run tests #14531
otherBump k3s-io/api to v0.2.0 #14570
otherServicelb multiple lbpools #14547
otherClose minio.Object after read #14580
otherBump k3s-io/apis again #14589
fixFix --flannel-cni-conf not reaching the embedded flannel #14598
otherCheck-config: suppress colors when stdout is not a terminal #14595
fixFix deploy controller not re-applying manifests when mtime is pinned to the epoch #14568
otherBump etcd to v3.7.1-k3s3 for nonblocking logging support #14628
otherBump kine to v0.17.1 #14627
otherRequire node password informer sync before using cache (#14673)
otherBump helm-controller (#14685)
otherBump k3s-io/kubernetes and Go references (#14694)
otherReject anonymous access to supervisor router (spegel/pprof/metrics) (#14702)
otherImprove CA hash validation (#14706)
otherOpen issues here
otherJoin our Slack channel
otherCheck out our documentation for guidance on how to get started or to dive deep into K3s.
otherRead how you can contribute here
otherBackport tests changes (#14517)
otherBump Local Path Provisioner version (#14498)
otherBump containerd to v2.3.4-k3s1.36 (#14512)
otherBackports for 2026-08 (#14522)
otherUpdate to v1.36.4-k3s1 and Go 1.26.7 (#14545)
otherOpen issues here
otherJoin our Slack channel
otherCheck out our documentation for guidance on how to get started or to dive deep into K3s.
otherRead how you can contribute here
otherBump dynamiclistener to v0.9.0-rc.2 for wildcard tls-san support (#14312)
featureAdd support for wildcard domains in --tls-san (e.g. --tls-san=*.example.com).
otherJuly Testing Backports (#14328)
otherJuly K3s Build Rework + GHA bumps (#14332)
otherBackports for 2026-07 (#14348)
otherBump mirrored-pause to 3.10.2 (#14389)
otherBump Traefik to v3.7.7 (#14381)
otherMore backports for 2026-07 (#14406)
fixFix typo in snapshot prune event (#14411)
otherBump rancher/mirrored-coredns-coredns image version (#14424)
otherBump golang:alpine image version (#14432)
otherBump rancher/mirrored-metrics-server image version (#14437)
featureUse new Traefik v3.7.8 (#14426)
otherBump helm-controller and klipper-helm for --force-conflicts support (#14442)
otherBump k3s-io/kubernetes and Go references (#14456)
otherBump etcd to v3.6.14 (#14461)
fixFix production builds always enabling Go coverage instrumentation (#14466)
otherBump helm-controller and klipper-helm (#14475)
otherOpen issues here
otherJoin our Slack channel
otherCheck out our documentation for guidance on how to get started or to dive deep into K3s.
otherRead how you can contribute here
otherBackport GitHub Action SHA pin updates from main (#14127)
otherBackports for 2026-06 (#14151)
otherBump v3.7.4 Traefik (#14193)
otherMore backports for 2026-06 (#14211)
otherTesting Backports 2026-06 (#14213)
otherBump klipper-helm for CVE reasons (#14235) (#14236)
fixBump containerd with the fix for []byte (#14243)
otherUpdate to v1.36.2-k3s1 and Go 1.26.4 (#14230)
otherBump containerd to v2.3.2-k3s1 (#14254)
otherBump cri-api and containerd for upstream env string fix (#14277)
otherOpen issues here
otherJoin our Slack channel
otherCheck out our documentation for guidance on how to get started or to dive deep into K3s.
otherRead how you can contribute here
otherBackports for 2026-05 (#14032)
otherUpdate rancher/local-path-provisioner image version (#14042)
otherUpdate to v1.36.1-k3s1 and Go 1.26.2 (#14051)
otherBump klipper-helm image tag (#14055)
otherOpen issues here
otherJoin our Slack channel
otherCheck out our documentation for guidance on how to get started or to dive deep into K3s.
otherRead how you can contribute here
featureAdd sipgate to the list of adopters (#13881)
featureAdd Rocket Technologies to the list of adopters (#13890)
otherMake Dockerfile.test more secure (#13882)
otherMake tests/integration/Dockerfile.test more secure (#13883)
otherSecure the e2e yaml GHA (#13885)
otherPin govulncheck GHA version (#13887)
otherVerify sha256sum for kubelet, vagrant zip and go binary (#13889)
otherCheck the k3s-root sha256sum (#13888)
fixFix reproducibility of embedded data tarball (#13875)
fixFix S3 test to account for change to s3mock (#13906)
otherBump runc/spegel/helm-controller/kine (#13909)
otherBump runc to v1.4.2
otherBump spegel to v0.6.0-k3s2
otherBump helm-controller to v0.17.1
otherBump kine to v0.14.16
fixFix embedded executor VPN config injection (#13920)
otherBump containerd to v2.2.3 (#13931)
otherBump flannel to v0.28.4 (#13937)
otherImmutable release changes (#13902)
otherBump Traefik to 3.6.13 (#13969)
otherSwitch from draft to pre-release (#13951)
fixFix SANs added from comma-separated node-external-ip list (#13989)
fixFix docker dualstack test (#13994)
otherBump klipper-helm image for revision check fix (#13995)
otherBump upstream to v1.36 (#13986)
fixFix kubectl exec when using docker (#14021)
otherOpen issues here
otherJoin our Slack channel
otherCheck out our documentation for guidance on how to get started or to dive deep into K3s.
otherRead how you can contribute here
otherBump rancher/mirrored-coredns-coredns image version (#14533)
otherBump gateway-api and traefik image versions (#14584)
otherBump Traefik to v3.7.13 (#14611)
securityBump google.golang.org/grpc to v1.83.2 for CVE-2026-84445 (#14621)
otherBackports for 2026-09 (#14633)
fixFix restore from compressed etcd snapshot #14528
otherEnable seccomp in riscv64 builds #14529
otherUse ginkgo CLI to run tests #14531
otherBump k3s-io/api to v0.2.0 #14570
otherServicelb multiple lbpools #14547
otherClose minio.Object after read #14580
otherBump k3s-io/apis again #14589
fixFix --flannel-cni-conf not reaching the embedded flannel #14598
otherCheck-config: suppress colors when stdout is not a terminal #14595
fixFix deploy controller not re-applying manifests when mtime is pinned to the epoch #14568
otherBump etcd to v3.7.1-k3s3 for nonblocking logging support #14628
otherBump kine to v0.17.1 #14627
otherRequire node password informer sync before using cache (#14674)
otherBump helm-controller (#14686)
otherBump k3s-io/kubernetes and Go references (#14696)
otherReject anonymous access to supervisor router (spegel/pprof/metrics) (#14703)
otherImprove CA hash validation (#14707)
otherOpen issues here
otherJoin our Slack channel
otherCheck out our documentation for guidance on how to get started or to dive deep into K3s.
otherRead how you can contribute here
otherBackport tests changes (#14518)
otherBump Local Path Provisioner version (#14497)
otherBump containerd to v2.2.7-k3s1 (#14513)
otherBackports for 2026-08 (#14523)
otherUpdate to v1.35.8-k3s1 and Go 1.26.7 (#14544)
otherOpen issues here
otherJoin our Slack channel
otherCheck out our documentation for guidance on how to get started or to dive deep into K3s.
otherRead how you can contribute here
otherJuly Testing Backports (#14329)
otherJuly K3s Build Rework + GHA bumps (#14333)
otherBackports for 2026-07 (#14370)
otherBump mirrored-pause to 3.10.2 (#14390)
otherBump Traefik to v3.7.7 (#14380)
otherMore backports for 2026-07 (#14407)
fixFix typo in snapshot prune event (#14412)
otherBump rancher/mirrored-coredns-coredns image version (#14421)
otherBump golang:alpine image version (#14431)
otherBump rancher/mirrored-metrics-server image version (#14439)
featureUse new Traefik v3.7.8 (#14425)
otherBump helm-controller and klipper-helm for --force-conflicts support (#14443)
otherBump k3s-io/kubernetes and Go references (#14455)
otherBump etcd to v3.6.14 (#14462)
fixFix production builds always enabling Go coverage instrumentation (#14467)
otherBump helm-controller and klipper-helm (#14476)
otherOpen issues here
otherJoin our Slack channel
otherCheck out our documentation for guidance on how to get started or to dive deep into K3s.
otherRead how you can contribute here
otherBackport GitHub Action SHA pin updates from main (#14126)
otherBackports for 2026-06 (#14152)
otherBump v3.7.4 Traefik (#14194)
otherMore backports for 2026-06 (#14212)
otherTesting Backports 2026-06 (#14214)
otherBump klipper-helm for CVE reasons (#14235) (#14237)
otherBump containerd to fix []byte envvar value (#14241)
otherUpdate to v1.35.6-k3s1 and Go 1.25.11 (#14229)
otherBump containerd for 1.35 (#14251)
otherBump cri-api and containerd for upstream env string fix (#14278)
otherOpen issues here
otherJoin our Slack channel
otherCheck out our documentation for guidance on how to get started or to dive deep into K3s.
otherRead how you can contribute here
otherBackports for 2026-05 (#14033)
otherUpdate rancher/local-path-provisioner image version (#14043)
otherUpdate to v1.35.5-k3s1 and Go 1.25.9 (#14050)
otherBump klipper-helm image tag (#14056)
otherOpen issues here
otherJoin our Slack channel
otherCheck out our documentation for guidance on how to get started or to dive deep into K3s.
otherRead how you can contribute here
otherImmutable release changes (#13901)
otherBackports for 2026-04 (#13929)
otherBump flannel to v0.28.4 (#13939)
otherBump traefik to 3.6.12 (#13928)
otherUpdate to v1.35.4-k3s1 and Go 1.25.9 (#13945)
otherSwitch from draft to pre-release (#13950)
otherBump Traefik to 3.6.13 (#13969) (#13970)
fixFix SANs added from comma-separated node-external-ip list (#13990)
otherBump klipper-helm image for revision check fix (#13996)
otherOpen issues here
otherJoin our Slack channel
otherCheck out our documentation for guidance on how to get started or to dive deep into K3s.
otherRead how you can contribute here
otherBump to coredns 1.14.2 (#13757)
otherSave cluster state before reencrypting secrets with newly created key (#13771)
otherBackports for 2026-03 (#13789)
otherBump runc to v1.4.1 (#13797)
otherBump Traefik helm chart version (#13815)
otherBump cni plugins to v1.9.1 (#13822)
otherSimplify snapshot compress/decompress logic (#13827)
otherUpdate to v1.35.3-k3s1 and Go 1.25.7 (#13835)
otherChore: Update Trivy version in Dockerfile.dapper (#13851)
otherUpdate to flannel v0.28.2 (#13868)
otherOpen issues here
otherJoin our Slack channel
otherCheck out our documentation for guidance on how to get started or to dive deep into K3s.
otherRead how you can contribute here
otherRootlesskit Revert + Test Fixes (#13689)
otherBackports for 2026-02 BONUS RELEASE (#13690)
otherBump Traefik to v3.6.9 (#13703)
otherUpdate to v1.35.2-k3s1 and Go 1.25.7 (#13707)
otherOpen issues here
otherJoin our Slack channel
otherCheck out our documentation for guidance on how to get started or to dive deep into K3s.
otherRead how you can contribute here
otherBulk Backports 2026-02 (#13564)
otherExplicitly close mvcc backend to fix high CPU on initial etcd server after restart (#13570)
otherBackports for 2026-02 (#13580)
otherBump kine for list/watch revision fixes (#13576)
fixFix VPN node IP not being applied to kubelet (#13560)
otherBump to coredns 1.14.1 and metrics-server v0.8.1 (#13608)
featureAdd registry prefix to image-list file (#13602)
otherBump klipper-helm and klipper-lb images (#13619)
breakingFix removal of init node (#13630)
otherUpdate to v1.35.1-k3s1 and Go 1.25.6 (#13637)
otherOpen issues here
otherJoin our Slack channel
otherCheck out our documentation for guidance on how to get started or to dive deep into K3s.
otherRead how you can contribute here