# K3s changelog

> Lightweight Kubernetes.

- Vendor: SUSE
- Category: Infrastructure & DevOps
- License: Apache-2.0
- Language: Go
- Official site: https://k3s.io
- Tracked by: What's New (https://whatsnew.fyi/product/k3s)
- Harvested from: GitHub (k3s-io/k3s)
- Entries below: 25 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: release facts (products, versions, dates, links, CVE ids and flags) are open data under CC BY 4.0, from the API at https://whatsnew.fyi/api/v1 or the nightly dataset at https://github.com/whatsnew-fyi/dataset. The summaries, labels and curation are © What's New: quote freely with attribution and a link back; wholesale republication of them is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v1.37.1+k3s1

- Date: 2026-09-30
- Version: v1.37.1+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.37.1%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.37.1-k3s1

- **fixed** — Fix restore from compressed etcd snapshot
- **added** — Enable seccomp in riscv64 builds
- **added** — Servicelb multiple lbpools
- **fixed** — Close minio.Object after read
- **fixed** — Fix --flannel-cni-conf not reaching the embedded flannel
- **changed** — Check-config suppress colors when stdout is not a terminal
- **fixed** — Fix deploy controller not re-applying manifests when mtime is pinned to the epoch
- **changed** — Bump etcd to v3.7.1-k3s3 for nonblocking logging support
- **changed** — Bump kine to v0.17.1
- **changed** — Bump helm-controller to v0.17.9
- **changed** — Bump k3s-io/kubernetes and Go references
- **changed** — Bump cadvisor to v0.60.5-k3s1
- **security** — Reject anonymous access to supervisor router (spegel/pprof/metrics)
- **changed** — Improve CA hash validation

<!-- v1.37.1+k3s1 -->

This release updates Kubernetes to v1.37.1, and fixes a number of issues.

For more details on what's new, see the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.37.md#changelog-since-v1370).

##### Changes since v1.37.0+k3s1:

* Backports for 2026-09 [(#14631)](https://github.com/k3s-io/k3s/pull/14631)
  * Fix restore from compressed etcd snapshot #14528
  * Enable seccomp in riscv64 builds #14529
  * Use ginkgo CLI to run tests #14531
  * Bump k3s-io/api to v0.2.0 #14570
  * Servicelb multiple lbpools #14547
  * Close minio.Object after read #14580
  * Bump k3s-io/apis again #14589
  * Fix --flannel-cni-conf not reaching the embedded flannel #14598
  * Check-config: suppress colors when stdout is not a terminal #14595
  * Fix deploy controller not re-applying manifests when mtime is pinned to the epoch #14568
  * Bump etcd to v3.7.1-k3s3 for nonblocking logging support #14628
  * Bump kine to v0.17.1 #14627
* Bump helm-controller [(#14684)](https://github.com/k3s-io/k3s/pull/14684)
* Bump k3s-io/kubernetes and Go references [(#14695)](https://github.com/k3s-io/k3s/pull/14695)
* Bump cadvisor to v0.60.5-k3s1 [(#14698)](https://github.com/k3s-io/k3s/pull/14698)
* Reject anonymous access to supervisor router (spegel/pprof/metrics) [(#14701)](https://github.com/k3s-io/k3s/pull/14701)
* Improve CA hash validation [(#14705)](https://github.com/k3s-io/k3s/pull/14705)

##### Embedded Component Versions
| Component | Version |
|---|---|
| Kubernetes | [v1.37.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.37.md#v1371) |
| Kine | [v0.17.1](https://github.com/k3s-io/kine/releases/tag/v0.17.1) |
| SQLite | [3.53.4](https://sqlite.org/releaselog/3_53_4.html) |
| Etcd | [v3.7.1-k3s3](https://github.com/k3s-io/etcd/releases/tag/v3.7.1-k3s3) |
| Containerd | [v2.3.4-k3s1](https://github.com/k3s-io/containerd/releases/tag/v2.3.4-k3s1) |
| Runc | [v1.4.2](https://github.com/opencontainers/runc/releases/tag/v1.4.2) |
| Flannel | [v0.28.4](https://github.com/flannel-io/flannel/releases/tag/v0.28.4) | 
| Metrics-server | [v0.9.0](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.9.0) |
| Traefik | [v3.7.13](https://github.com/traefik/traefik/releases/tag/v3.7.13) |
| CoreDNS | [v1.14.7](https://github.com/coredns/coredns/releases/tag/v1.14.7) | 
| Helm-controller | [v0.17.9](https://github.com/k3s-io/helm-controller/releases/tag/v0.17.9) |
| Local-path-provisioner | [v0.0.37](https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.37) |

##### Helpful Links
As always, we welcome and appreciate feedback from our community of users. Please feel free to:
- [Open issues here](https://github.com/rancher/k3s/issues/new/choose)
- [Join our Slack channel](https://slack.rancher.io/)
- [Check out our documentation](https://rancher.com/docs/k3s/latest/en/) for guidance on how to get started or to dive deep into K3s.
- [Read how you can contribute here](https://github.com/rancher/k3s/blob/master/CONTRIBUTING.md)

### v1.36.5+k3s1

- Date: 2026-09-30
- Version: v1.36.5+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.36.5%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.36.5-k3s1

- **changed** — Update Kubernetes to v1.36.5
- **changed** — Bump Traefik image to v3.7.13
- **changed** — Bump gateway-api to v1.6.1
- **changed** — Bump CoreDNS image version
- **security** — Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445
- **fixed** — Fix restore from compressed etcd snapshot
- **added** — Enable seccomp in riscv64 builds
- **changed** — Bump k3s-io/api to v0.2.0
- **changed** — Bump etcd to v3.7.1-k3s3 for nonblocking logging support
- **changed** — Bump kine to v0.17.1
- **fixed** — Fix --flannel-cni-conf not reaching the embedded flannel
- **fixed** — Suppress colors in check-config when stdout is not a terminal
- **fixed** — Fix deploy controller not re-applying manifests when mtime is pinned to the epoch
- **changed** — Support servicelb multiple lbpools
- **fixed** — Close minio.Object after read
- **changed** — Require node password informer sync before using cache
- **changed** — Bump helm-controller to v0.17.9
- **security** — Reject anonymous access to supervisor router for spegel, pprof, and metrics
- **changed** — Improve CA hash validation

<!-- v1.36.5+k3s1 -->

> [!WARNING]
> This release upgrades Traefik chart to v40.x which includes a breaking change for the ingress-nginx migration: the provider name changes from `kubernetesIngressNginx` to `kubernetesIngressNGINX`. Check https://github.com/traefik/traefik-helm-chart/releases/tag/v40.0.0 for more details

This release updates Kubernetes to v1.36.5, and fixes a number of issues.

For more details on what's new, see the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.36.md#changelog-since-v1364).

##### Changes since v1.36.4+k3s1:

* Bump rancher/mirrored-coredns-coredns image version [(#14534)](https://github.com/k3s-io/k3s/pull/14534)
* Bump gateway-api and traefik image versions for K3s 1.36 [(#14567)](https://github.com/k3s-io/k3s/pull/14567)
  * Bump Traefik image to 3.7.12 and gateway-api to 1.6.1
* Bump Traefik to v3.7.13 [(#14610)](https://github.com/k3s-io/k3s/pull/14610)
* Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445 [(#14620)](https://github.com/k3s-io/k3s/pull/14620)
* Backports for 2026-09 [(#14632)](https://github.com/k3s-io/k3s/pull/14632)
  * Fix restore from compressed etcd snapshot #14528
  * Enable seccomp in riscv64 builds #14529
  * Use ginkgo CLI to run tests #14531
  * Bump k3s-io/api to v0.2.0 #14570
  * Servicelb multiple lbpools #14547
  * Close minio.Object after read #14580
  * Bump k3s-io/apis again #14589
  * Fix --flannel-cni-conf not reaching the embedded flannel #14598
  * Check-config: suppress colors when stdout is not a terminal #14595
  * Fix deploy controller not re-applying manifests when mtime is pinned to the epoch #14568
  * Bump etcd to v3.7.1-k3s3 for nonblocking logging support #14628
  * Bump kine to v0.17.1 #14627
* Require node password informer sync before using cache [(#14673)](https://github.com/k3s-io/k3s/pull/14673)
* Bump helm-controller [(#14685)](https://github.com/k3s-io/k3s/pull/14685)
* Bump k3s-io/kubernetes and Go references [(#14694)](https://github.com/k3s-io/k3s/pull/14694)
* Reject anonymous access to supervisor router (spegel/pprof/metrics) [(#14702)](https://github.com/k3s-io/k3s/pull/14702)
* Improve CA hash validation [(#14706)](https://github.com/k3s-io/k3s/pull/14706)

##### Embedded Component Versions
| Component | Version |
|---|---|
| Kubernetes | [v1.36.5](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.36.md#v1365) |
| Kine | [v0.16.5](https://github.com/k3s-io/kine/releases/tag/v0.16.5) |
| SQLite | [3.53.4](https://sqlite.org/releaselog/3_53_4.html) |
| Etcd | [v3.6.14-k3s3](https://github.com/k3s-io/etcd/releases/tag/v3.6.14-k3s3) |
| Containerd | [v2.3.4-k3s1.36](https://github.com/k3s-io/containerd/releases/tag/v2.3.4-k3s1.36) |
| Runc | [v1.4.2](https://github.com/opencontainers/runc/releases/tag/v1.4.2) |
| Flannel | [v0.28.4](https://github.com/flannel-io/flannel/releases/tag/v0.28.4) | 
| Metrics-server | [v0.9.0](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.9.0) |
| Traefik | [v3.7.13](https://github.com/traefik/traefik/releases/tag/v3.7.13) |
| CoreDNS | [v1.14.7](https://github.com/coredns/coredns/releases/tag/v1.14.7) | 
| Helm-controller | [v0.17.9](https://github.com/k3s-io/helm-controller/releases/tag/v0.17.9) |
| Local-path-provisioner | [v0.0.37](https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.37) |

##### Helpful Links
As always, we welcome and appreciate feedback from our community of users. Please feel free to:
- [Open issues here](https://github.com/rancher/k3s/issues/new/choose)
- [Join our Slack channel](https://slack.rancher.io/)
- [Check out our documentation](https://rancher.com/docs/k3s/latest/en/) for guidance on how to get started or to dive deep into K3s.
- [Read how you can contribute here](https://github.com/rancher/k3s/blob/master/CONTRIBUTING.md)

### v1.34.12+k3s1

- Date: 2026-09-30
- Version: v1.34.12+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.34.12%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.34.12-k3s1

- **changed** — Update Kubernetes to v1.34.12
- **changed** — Upgrade Traefik chart to v40.x with breaking change where ingress-nginx provider name changes from kubernetesIngressNginx to kubernetesIngressNGINX
- **changed** — Bump Traefik to v3.7.13
- **changed** — Bump gateway-api and traefik image versions
- **changed** — Bump rancher/mirrored-coredns-coredns image version
- **changed** — Bump etcd to v3.7.1-k3s3 for nonblocking logging support
- **changed** — Bump kine to v0.17.1
- **changed** — Bump k3s-io/api to v0.2.0
- **changed** — Bump helm-controller
- **security** — Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445
- **security** — Reject anonymous access to supervisor router (spegel/pprof/metrics)
- **fixed** — Fix restore from compressed etcd snapshot
- **fixed** — Fix --flannel-cni-conf not reaching the embedded flannel
- **fixed** — Fix deploy controller not re-applying manifests when mtime is pinned to the epoch
- **fixed** — Close minio.Object after read
- **fixed** — Improve CA hash validation
- **added** — Enable seccomp in riscv64 builds
- **added** — Servicelb multiple lbpools
- **changed** — Require node password informer sync before using cache
- **changed** — Check-config: suppress colors when stdout is not a terminal

<!-- v1.34.12+k3s1 -->
> [!WARNING]
> This release upgrades Traefik chart to v40.x which includes a breaking change for the ingress-nginx migration: the provider name changes from `kubernetesIngressNginx` to `kubernetesIngressNGINX`. Check https://github.com/traefik/traefik-helm-chart/releases/tag/v40.0.0 for more details

This release updates Kubernetes to v1.34.12, and fixes a number of issues.

For more details on what's new, see the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.34.md#changelog-since-v13411).

##### Changes since v1.34.11+k3s1:

* Bump rancher/mirrored-coredns-coredns image version [(#14532)](https://github.com/k3s-io/k3s/pull/14532)
* Bump gateway-api and traefik image versions [(#14585)](https://github.com/k3s-io/k3s/pull/14585)
* Bump Traefik to v3.7.13 [(#14612)](https://github.com/k3s-io/k3s/pull/14612)
* Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445 [(#14622)](https://github.com/k3s-io/k3s/pull/14622)
* Backports for 2026-09 [(#14634)](https://github.com/k3s-io/k3s/pull/14634)
  * Fix restore from compressed etcd snapshot #14528
  * Enable seccomp in riscv64 builds #14529
  * Use ginkgo CLI to run tests #14531
  * Bump k3s-io/api to v0.2.0 #14570
  * Servicelb multiple lbpools #14547
  * Close minio.Object after read #14580
  * Bump k3s-io/apis again #14589
  * Fix --flannel-cni-conf not reaching the embedded flannel #14598
  * Check-config: suppress colors when stdout is not a terminal #14595
  * Fix deploy controller not re-applying manifests when mtime is pinned to the epoch #14568
  * Bump etcd to v3.7.1-k3s3 for nonblocking logging support #14628
  * Bump kine to v0.17.1 #14627
* Require node password informer sync before using cache [(#14675)](https://github.com/k3s-io/k3s/pull/14675)
* Bump helm-controller [(#14687)](https://github.com/k3s-io/k3s/pull/14687)
* Bump k3s-io/kubernetes and Go references [(#14693)](https://github.com/k3s-io/k3s/pull/14693)
* Improve CA hash validation [(#14708)](https://github.com/k3s-io/k3s/pull/14708)
* Reject anonymous access to supervisor router (spegel/pprof/metrics) [(#14704)](https://github.com/k3s-io/k3s/pull/14704)

##### Embedded Component Versions
| Component | Version |
|---|---|
| Kubernetes | [v1.34.12](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.34.md#v13412) |
| Kine | [v0.16.5](https://github.com/k3s-io/kine/releases/tag/v0.16.5) |
| SQLite | [3.53.4](https://sqlite.org/releaselog/3_53_4.html) |
| Etcd | [v3.6.14-k3s3](https://github.com/k3s-io/etcd/releases/tag/v3.6.14-k3s3) |
| Containerd | [v2.2.7-k3s1](https://github.com/k3s-io/containerd/releases/tag/v2.2.7-k3s1) |
| Runc | [v1.4.2](https://github.com/opencontainers/runc/releases/tag/v1.4.2) |
| Flannel | [v0.28.4](https://github.com/flannel-io/flannel/releases/tag/v0.28.4) | 
| Metrics-server | [v0.9.0](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.9.0) |
| Traefik | [v3.7.13](https://github.com/traefik/traefik/releases/tag/v3.7.13) |
| CoreDNS | [v1.14.7](https://github.com/coredns/coredns/releases/tag/v1.14.7) | 
| Helm-controller | [v0.16.27](https://github.com/k3s-io/helm-controller/releases/tag/v0.16.27) |
| Local-path-provisioner | [v0.0.37](https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.37) |

##### Helpful Links
As always, we welcome and appreciate feedback from our community of users. Please feel free to:
- [Open issues here](https://github.com/rancher/k3s/issues/new/choose)
- [Join our Slack channel](https://slack.rancher.io/)
- [Check out our documentation](https://rancher.com/docs/k3s/latest/en/) for guidance on how to get started or to dive deep into K3s.
- [Read how you can contribute here](https://github.com/rancher/k3s/blob/master/CONTRIBUTING.md)

### v1.35.9+k3s1

- Date: 2026-09-30
- Version: v1.35.9+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.35.9%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.35.9-k3s1

- **changed** — Upgrade Kubernetes to v1.35.9
- **changed** — Upgrade Traefik chart to v40.x with breaking change: ingress-nginx provider name changes from kubernetesIngressNginx to kubernetesIngressNGINX
- **changed** — Bump Traefik to v3.7.13
- **changed** — Bump gateway-api and traefik image versions
- **changed** — Bump rancher/mirrored-coredns-coredns image version
- **changed** — Bump k3s-io/api to v0.2.0
- **changed** — Bump k3s-io/apis
- **changed** — Bump etcd to v3.7.1-k3s3 for nonblocking logging support
- **changed** — Bump kine to v0.17.1
- **changed** — Bump helm-controller
- **fixed** — Fix restore from compressed etcd snapshot
- **fixed** — Fix --flannel-cni-conf not reaching the embedded flannel
- **fixed** — Fix deploy controller not re-applying manifests when mtime is pinned to the epoch
- **fixed** — Enable seccomp in riscv64 builds
- **fixed** — Close minio.Object after read
- **fixed** — Improve CA hash validation
- **security** — Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445
- **security** — Reject anonymous access to supervisor router (spegel/pprof/metrics)
- **changed** — Require node password informer sync before using cache
- **changed** — Check-config: suppress colors when stdout is not a terminal

<!-- v1.35.9+k3s1 -->
> [!WARNING]
> This release upgrades Traefik chart to v40.x which includes a breaking change for the ingress-nginx migration: the provider name changes from `kubernetesIngressNginx` to `kubernetesIngressNGINX`. Check https://github.com/traefik/traefik-helm-chart/releases/tag/v40.0.0 for more details

This release updates Kubernetes to v1.35.9, and fixes a number of issues.

For more details on what's new, see the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.35.md#changelog-since-v1358).

##### Changes since v1.35.8+k3s1:

* Bump rancher/mirrored-coredns-coredns image version [(#14533)](https://github.com/k3s-io/k3s/pull/14533)
* Bump gateway-api and traefik image versions [(#14584)](https://github.com/k3s-io/k3s/pull/14584)
* Bump Traefik to v3.7.13 [(#14611)](https://github.com/k3s-io/k3s/pull/14611)
* Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445 [(#14621)](https://github.com/k3s-io/k3s/pull/14621)
* Backports for 2026-09 [(#14633)](https://github.com/k3s-io/k3s/pull/14633)
  * Fix restore from compressed etcd snapshot #14528
  * Enable seccomp in riscv64 builds #14529
  * Use ginkgo CLI to run tests #14531
  * Bump k3s-io/api to v0.2.0 #14570
  * Servicelb multiple lbpools #14547
  * Close minio.Object after read #14580
  * Bump k3s-io/apis again #14589
  * Fix --flannel-cni-conf not reaching the embedded flannel #14598
  * Check-config: suppress colors when stdout is not a terminal #14595
  * Fix deploy controller not re-applying manifests when mtime is pinned to the epoch #14568
  * Bump etcd to v3.7.1-k3s3 for nonblocking logging support #14628
  * Bump kine to v0.17.1 #14627
* Require node password informer sync before using cache [(#14674)](https://github.com/k3s-io/k3s/pull/14674)
* Bump helm-controller [(#14686)](https://github.com/k3s-io/k3s/pull/14686)
* Bump k3s-io/kubernetes and Go references [(#14696)](https://github.com/k3s-io/k3s/pull/14696)
* Reject anonymous access to supervisor router (spegel/pprof/metrics) [(#14703)](https://github.com/k3s-io/k3s/pull/14703)
* Improve CA hash validation [(#14707)](https://github.com/k3s-io/k3s/pull/14707)

##### Embedded Component Versions
| Component | Version |
|---|---|
| Kubernetes | [v1.35.9](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.35.md#v1359) |
| Kine | [v0.16.5](https://github.com/k3s-io/kine/releases/tag/v0.16.5) |
| SQLite | [3.53.4](https://sqlite.org/releaselog/3_53_4.html) |
| Etcd | [v3.6.14-k3s3](https://github.com/k3s-io/etcd/releases/tag/v3.6.14-k3s3) |
| Containerd | [v2.2.7-k3s1](https://github.com/k3s-io/containerd/releases/tag/v2.2.7-k3s1) |
| Runc | [v1.4.2](https://github.com/opencontainers/runc/releases/tag/v1.4.2) |
| Flannel | [v0.28.4](https://github.com/flannel-io/flannel/releases/tag/v0.28.4) | 
| Metrics-server | [v0.9.0](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.9.0) |
| Traefik | [v3.7.13](https://github.com/traefik/traefik/releases/tag/v3.7.13) |
| CoreDNS | [v1.14.7](https://github.com/coredns/coredns/releases/tag/v1.14.7) | 
| Helm-controller | [v0.17.9](https://github.com/k3s-io/helm-controller/releases/tag/v0.17.9) |
| Local-path-provisioner | [v0.0.37](https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.37) |

##### Helpful Links
As always, we welcome and appreciate feedback from our community of users. Please feel free to:
- [Open issues here](https://github.com/rancher/k3s/issues/new/choose)
- [Join our Slack channel](https://slack.rancher.io/)
- [Check out our documentation](https://rancher.com/docs/k3s/latest/en/) for guidance on how to get started or to dive deep into K3s.
- [Read how you can contribute here](https://github.com/rancher/k3s/blob/master/CONTRIBUTING.md)

### v1.37.1-rc2+k3s1

- Date: 2026-09-24
- Version: v1.37.1-rc2+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.37.1-rc2%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.37.1-rc2-k3s1
- Labels: Pre-release

- **security** — Reject anonymous access to supervisor router (spegel/pprof/metrics)
- **changed** — Improve CA hash validation

##### What's Changed
* [Release-1.37] Reject anonymous access to supervisor router (spegel/pprof/metrics) by @dereknola in https://github.com/k3s-io/k3s/pull/14701
* [Release-1.37] Improve CA hash validation by @dereknola in https://github.com/k3s-io/k3s/pull/14705


**Full Changelog**: https://github.com/k3s-io/k3s/compare/v1.37.1-rc1+k3s1...v1.37.1-rc2+k3s1

### v1.36.5-rc2+k3s1

- Date: 2026-09-24
- Version: v1.36.5-rc2+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.36.5-rc2%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.36.5-rc2-k3s1
- Labels: Pre-release

- **security** — Reject anonymous access to supervisor router (spegel/pprof/metrics)
- **changed** — Improve CA hash validation

##### What's Changed
* [Release-1.36] Reject anonymous access to supervisor router (spegel/pprof/metrics) by @dereknola in https://github.com/k3s-io/k3s/pull/14702
* [Release-1.36] Improve CA hash validation by @dereknola in https://github.com/k3s-io/k3s/pull/14706


**Full Changelog**: https://github.com/k3s-io/k3s/compare/v1.36.5-rc1+k3s1...v1.36.5-rc2+k3s1

### v1.35.9-rc2+k3s1

- Date: 2026-09-24
- Version: v1.35.9-rc2+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.35.9-rc2%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.35.9-rc2-k3s1
- Labels: Pre-release

- **security** — Reject anonymous access to supervisor router (spegel/pprof/metrics)
- **changed** — Improve CA hash validation

##### What's Changed
* [Release-1.35] Reject anonymous access to supervisor router (spegel/pprof/metrics) by @dereknola in https://github.com/k3s-io/k3s/pull/14703
* [Release-1.35] Improve CA hash validation by @dereknola in https://github.com/k3s-io/k3s/pull/14707


**Full Changelog**: https://github.com/k3s-io/k3s/compare/v1.35.9-rc1+k3s1...v1.35.9-rc2+k3s1

### v1.34.12-rc2+k3s1

- Date: 2026-09-24
- Version: v1.34.12-rc2+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.34.12-rc2%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.34.12-rc2-k3s1
- Labels: Pre-release

- **changed** — Improve CA hash validation
- **security** — Reject anonymous access to supervisor router (spegel/pprof/metrics)

##### What's Changed
* [Release-1.34] Improve CA hash validation by @dereknola in https://github.com/k3s-io/k3s/pull/14708
* [Release-1.34] Reject anonymous access to supervisor router (spegel/pprof/metrics) by @dereknola in https://github.com/k3s-io/k3s/pull/14704


**Full Changelog**: https://github.com/k3s-io/k3s/compare/v1.34.12-rc1+k3s1...v1.34.12-rc2+k3s1

### v1.37.1-rc1+k3s1

- Date: 2026-09-24
- Version: v1.37.1-rc1+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.37.1-rc1%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.37.1-rc1-k3s1
- Labels: Pre-release

- **changed** — Bump helm-controller
- **changed** — Bump k3s-io/kubernetes and Go references
- **changed** — Bump cadvisor to v0.60.5-k3s1

##### What's Changed
* [release-1.37] Backports for 2026-09 by @brandond in https://github.com/k3s-io/k3s/pull/14631
* [release-1.37] Bump helm-controller by @brandond in https://github.com/k3s-io/k3s/pull/14684
* [release-1.37] Bump k3s-io/kubernetes and Go references by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/14695
* [Release-1.37] bump cadvisor to v0.60.5-k3s1 by @vitorsavian in https://github.com/k3s-io/k3s/pull/14698


**Full Changelog**: https://github.com/k3s-io/k3s/compare/v1.37.0+k3s1...v1.37.1-rc1+k3s1

### v1.36.5-rc1+k3s1

- Date: 2026-09-24
- Version: v1.36.5-rc1+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.36.5-rc1%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.36.5-rc1-k3s1
- Labels: Pre-release

- **security** — Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445
- **changed** — Bump rancher/mirrored-coredns-coredns image version
- **changed** — Bump gateway-api and traefik image versions
- **changed** — Bump Traefik to v3.7.13
- **fixed** — Require node password informer sync before using cache
- **changed** — Bump helm-controller
- **changed** — Bump k3s-io/kubernetes and Go references

##### What's Changed
* [release-1.36] Bump rancher/mirrored-coredns-coredns image version by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/14534
* Bump gateway-api and traefik image versions for K3s 1.36 by @manuelbuil in https://github.com/k3s-io/k3s/pull/14567
* [Release 1.36] Bump Traefik to v3.7.13 by @manuelbuil in https://github.com/k3s-io/k3s/pull/14610
* [release-1.36] Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445  by @brandond in https://github.com/k3s-io/k3s/pull/14620
* [release-1.36] Backports for 2026-09 by @brandond in https://github.com/k3s-io/k3s/pull/14632
* [release-1.36] Require node password informer sync before using cache by @brandond in https://github.com/k3s-io/k3s/pull/14673
* [release-1.36] Bump helm-controller by @brandond in https://github.com/k3s-io/k3s/pull/14685
* [release-1.36] Bump k3s-io/kubernetes and Go references by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/14694


**Full Changelog**: https://github.com/k3s-io/k3s/compare/v1.36.4+k3s1...v1.36.5-rc1+k3s1

### v1.35.9-rc1+k3s1

- Date: 2026-09-24
- Version: v1.35.9-rc1+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.35.9-rc1%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.35.9-rc1-k3s1
- Labels: Pre-release

- **security** — Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445
- **changed** — Bump rancher/mirrored-coredns-coredns image version
- **changed** — Bump gateway-api and traefik image versions
- **changed** — Bump Traefik to v3.7.13
- **changed** — Bump helm-controller
- **changed** — Bump k3s-io/kubernetes and Go references
- **fixed** — Require node password informer sync before using cache

##### What's Changed
* [release-1.35] Bump rancher/mirrored-coredns-coredns image version by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/14533
* [Release 1.35] Bump gateway-api and traefik image versions by @manuelbuil in https://github.com/k3s-io/k3s/pull/14584
* [Release 1.35] Bump Traefik to v3.7.13 by @manuelbuil in https://github.com/k3s-io/k3s/pull/14611
* [release-1.35] Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445  by @brandond in https://github.com/k3s-io/k3s/pull/14621
* [release-1.35] Backports for 2026-09 by @brandond in https://github.com/k3s-io/k3s/pull/14633
* [release-1.35] Require node password informer sync before using cache by @brandond in https://github.com/k3s-io/k3s/pull/14674
* [release-1.35] Bump helm-controller by @brandond in https://github.com/k3s-io/k3s/pull/14686
* [release-1.35] Bump k3s-io/kubernetes and Go references by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/14696


**Full Changelog**: https://github.com/k3s-io/k3s/compare/v1.35.8+k3s1...v1.35.9-rc1+k3s1

### v1.34.12-rc1+k3s1

- Date: 2026-09-24
- Version: v1.34.12-rc1+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.34.12-rc1%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.34.12-rc1-k3s1
- Labels: Pre-release

- **security** — Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445
- **changed** — Bump rancher/mirrored-coredns-coredns image version
- **changed** — Bump gateway-api and traefik image versions
- **changed** — Bump Traefik to v3.7.13
- **fixed** — Require node password informer sync before using cache
- **changed** — Bump helm-controller
- **changed** — Bump k3s-io/kubernetes and Go references

##### What's Changed
* [release-1.34] Bump rancher/mirrored-coredns-coredns image version by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/14532
* [Release 1.34] Bump gateway-api and traefik image versions by @manuelbuil in https://github.com/k3s-io/k3s/pull/14585
* [Release 1.34] Bump Traefik to v3.7.13 by @manuelbuil in https://github.com/k3s-io/k3s/pull/14612
* [release-1.34] Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445  by @brandond in https://github.com/k3s-io/k3s/pull/14622
* [release-1.34] Backports for 2026-09 by @brandond in https://github.com/k3s-io/k3s/pull/14634
* [release-1.34] Require node password informer sync before using cache by @brandond in https://github.com/k3s-io/k3s/pull/14675
* [release-1.34] Bump helm-controller by @brandond in https://github.com/k3s-io/k3s/pull/14687
* [release-1.34] Bump k3s-io/kubernetes and Go references by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/14693


**Full Changelog**: https://github.com/k3s-io/k3s/compare/v1.34.11+k3s1...v1.34.12-rc1+k3s1

### v1.37.0+k3s1

- Date: 2026-09-14
- Version: v1.37.0+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.37.0%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.37.0-k3s1

- **added** — Add --write-kubeconfig-name server flag to set the name for cluster, user and context in generated kubeconfig
- **changed** — Update Kubernetes to v1.37.0
- **changed** — Bump mirrored-pause to 3.10.2
- **changed** — Bump metrics-server to v0.9.0
- **changed** — Bump etcd to v3.7.1-k3s1
- **changed** — Bump containerd to v2.3.4-k3s1
- **changed** — Bump kine to v0.17.0
- **changed** — Bump Traefik to v3.7.13
- **changed** — Bump critools to v1.37
- **changed** — Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445
- **changed** — Bump Local Path Provisioner version
- **changed** — Bump rancher/mirrored-coredns-coredns image version
- **changed** — Bundle gateway-api crds with Traefik
- **fixed** — Fix production builds always enabling Go coverage instrumentation
- **fixed** — Fix typo in snapshot prune event
- **fixed** — Fix an issue where airgap image imports could fail with an already exists error, or accumulate duplicate image tags on every restart, when system-default-registry matched the registry the images were already tagged for
- **fixed** — Fix the apiserver serving certificate not including the value of --advertise-address in its subject alternative names
- **fixed** — Fix SLES to use slemicro rpms instead of microos
- **fixed** — Simplify WriteSubnetFile cleanup and make atomic

<!-- v1.37.0+k3s1 -->

This release updates Kubernetes to v1.37.0, and fixes a number of issues.

For more details on what's new, see the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.37.md#changelog-since-v1360).

##### Changes since v1.36.3+k3s1:

* Bump mirrored-pause to 3.10.2 [(#14339)](https://github.com/k3s-io/k3s/pull/14339)
* Build(deps): bump the action-deps group with 14 updates [(#14394)](https://github.com/k3s-io/k3s/pull/14394)
* Bump dynamiclistener for atomic write fix [(#14382)](https://github.com/k3s-io/k3s/pull/14382)
* Bump helm-controller/klipper-helm [(#14403)](https://github.com/k3s-io/k3s/pull/14403)
* Simplify WriteSubnetFile cleanup and make atomic [(#14405)](https://github.com/k3s-io/k3s/pull/14405)
* Fix typo in snapshot prune event [(#14410)](https://github.com/k3s-io/k3s/pull/14410)
* Bump rancher/mirrored-coredns-coredns image version [(#14415)](https://github.com/k3s-io/k3s/pull/14415)
* Add updatecli manifest to bump Kubernetes across multiple release branches [(#14402)](https://github.com/k3s-io/k3s/pull/14402)
* Bump metrics-server to v0.9.0 [(#14416)](https://github.com/k3s-io/k3s/pull/14416)
* Updatecli: relax metrics-server semver filter et al. [(#14429)](https://github.com/k3s-io/k3s/pull/14429)
* Updatecli: add missing requiredEnv [(#14434)](https://github.com/k3s-io/k3s/pull/14434)
* Bump helm-controller and klipper-helm for `--force-conflicts` support [(#14446)](https://github.com/k3s-io/k3s/pull/14446)
* Bump k3s-io/kubernetes and Go references [(#14457)](https://github.com/k3s-io/k3s/pull/14457)
* Bump etcd to v3.6.14 [(#14460)](https://github.com/k3s-io/k3s/pull/14460)
* Fix production builds always enabling Go coverage instrumentation [(#14465)](https://github.com/k3s-io/k3s/pull/14465)
* Feat: support custom kubeconfig name [(#14440)](https://github.com/k3s-io/k3s/pull/14440)
  * Added `--write-kubeconfig-name` server flag to set the name for cluster, user and context in generated kubeconfig.
* Require node password informer sync before using cache [(#14459)](https://github.com/k3s-io/k3s/pull/14459)
* Bump helm-controller and klipper-helm [(#14474)](https://github.com/k3s-io/k3s/pull/14474)
* Enable unit tests [(#14480)](https://github.com/k3s-io/k3s/pull/14480)
* Fix: change sles to use slemicro rpms instead of microos [(#14472)](https://github.com/k3s-io/k3s/pull/14472)
* Tests: make rootless uidmap install robust against stale apt cache [(#14490)](https://github.com/k3s-io/k3s/pull/14490)
* Update stable channel to v1.36.3+k3s1 [(#14492)](https://github.com/k3s-io/k3s/pull/14492)
* Etcd client locking [(#14488)](https://github.com/k3s-io/k3s/pull/14488)
* Tests: Install rke2-multus-crd chart for multus e2e test [(#14489)](https://github.com/k3s-io/k3s/pull/14489)
* Filter large untemplated issues [(#14435)](https://github.com/k3s-io/k3s/pull/14435)
* Fix typo in spegel deferred store comment [(#14485)](https://github.com/k3s-io/k3s/pull/14485)
* Make explicit where coredns customizations should be made [(#14503)](https://github.com/k3s-io/k3s/pull/14503)
* Bump docker version in CI to 29 [(#14506)](https://github.com/k3s-io/k3s/pull/14506)
* Don't retag images for a registry they are already hosted by [(#14484)](https://github.com/k3s-io/k3s/pull/14484)
  * Fixed an issue where airgap image imports could fail with an "already exists" error, or accumulate duplicate image tags on every restart, when system-default-registry matched the registry the images were already tagged for.
* Tidy dockerfile and build stages [(#14511)](https://github.com/k3s-io/k3s/pull/14511)
* Add advertise-address to SANs before generating apiserver cert [(#14516)](https://github.com/k3s-io/k3s/pull/14516)
  * Fixed the apiserver serving certificate not including the value of --advertise-address in its subject alternative names.
* Bump Local Path Provisioner version [(#14496)](https://github.com/k3s-io/k3s/p

_[Truncated at 4000 characters — full notes: https://github.com/k3s-io/k3s/releases/tag/v1.37.0%2Bk3s1]_

### v1.37.0-rc5+k3s1

- Date: 2026-09-11
- Version: v1.37.0-rc5+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.37.0-rc5%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.37.0-rc5-k3s1
- Labels: Pre-release

- **security** — Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445

##### What's Changed
* [release-1.37] Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445 by @brandond in https://github.com/k3s-io/k3s/pull/14614
* [release-1.37] Bump google.golang.org/grpc to v1.83.2, not v1.82.2 by @brandond in https://github.com/k3s-io/k3s/pull/14619


**Full Changelog**: https://github.com/k3s-io/k3s/compare/v1.37.0-rc4+k3s1...v1.37.0-rc5+k3s1

### v1.37.0-rc4+k3s1

- Date: 2026-09-09
- Version: v1.37.0-rc4+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.37.0-rc4%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.37.0-rc4-k3s1
- Labels: Pre-release

- **changed** — Bump Traefik to v3.7.13

##### What's Changed
* [Release 1.37] Bump Traefik to v3.7.13 by @manuelbuil in https://github.com/k3s-io/k3s/pull/14606


**Full Changelog**: https://github.com/k3s-io/k3s/compare/v1.37.0-rc3+k3s1...v1.37.0-rc4+k3s1

### v1.37.0-rc3+k3s1

- Date: 2026-09-03
- Version: v1.37.0-rc3+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.37.0-rc3%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.37.0-rc3-k3s1
- Labels: Pre-release

- **changed** — Bump gateway-api-crd to version 3, which includes the keep annotation

##### What's Changed
* [Release 1.37] Bump gateway-api-crd version 3, which includes the keep annotation by @manuelbuil in https://github.com/k3s-io/k3s/pull/14586


**Full Changelog**: https://github.com/k3s-io/k3s/compare/v1.37.0-rc2+k3s1...v1.37.0-rc3+k3s1

### v1.37.0-rc2+k3s1

- Date: 2026-09-02
- Version: v1.37.0-rc2+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.37.0-rc2%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.37.0-rc2-k3s1
- Labels: Pre-release

- **changed** — Bump rancher/mirrored-coredns-coredns image version
- **changed** — Bump critools to v1.37

##### What's Changed
* [release-1.37] Bump rancher/mirrored-coredns-coredns image version by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/14577
* [Release-1.37] Bump critools to v1.37 by @vitorsavian in https://github.com/k3s-io/k3s/pull/14579


**Full Changelog**: https://github.com/k3s-io/k3s/compare/v1.37.0-rc1+k3s1...v1.37.0-rc2+k3s1

### v1.37.0-rc1+k3s1

- Date: 2026-09-02
- Version: v1.37.0-rc1+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.37.0-rc1%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.37.0-rc1-k3s1
- Labels: Pre-release

- **added** — Add firewall section to check-config.sh
- **added** — Enable secret encryption on existing clusters
- **changed** — Replace temporary etcd server with raw mvcc store access
- **changed** — Remove flannel external-ip annotations when disabled
- **changed** — Bump Traefik and CoreDNS to January 2025 versions
- **changed** — Bump local path provisioner to v0.0.34
- **changed** — Bump cni plugins
- **changed** — Bump spegel to v0.6.0
- **changed** — Bump kine to v0.14.10 for NATS conformance fixes
- **changed** — Bump coredns to 1.14.0
- **changed** — Update Traefik version to v3.6.7
- **changed** — Move to rootlesskit v2
- **changed** — Bump etcd to v3.6.7
- **changed** — Bump metrics-server to v0.8.1
- **changed** — Bump klipper-helm and klipper-lb images
- **changed** — Make artifact URL prefix configurable
- **changed** — Bump kine to v0.14.12
- **fixed** — Fix CVE-2025-54410: Update docker/docker to v25.0.13
- **fixed** — Fix atomic write in WriteSubnetFile
- **fixed** — Fix restart of control-plane-only nodes attempting to reconcile from local datastore
- **fixed** — Fix spegel filter for wildcards

##### What's Changed
* Expand docker upgrade test, sunset E2E upgrade test by @dereknola in https://github.com/k3s-io/k3s/pull/13338
* Add firewall section to check-config.sh by @dereknola in https://github.com/k3s-io/k3s/pull/13234
* Update golangci-lint and re-enable CI linting step by @brandond in https://github.com/k3s-io/k3s/pull/13343
* Fix PR lint checkout depth by @brandond in https://github.com/k3s-io/k3s/pull/13369
* Update stable channel to v1.34.3+k3s1 by @rafaelbreno in https://github.com/k3s-io/k3s/pull/13374
* Bump actions/download-artifact from 6 to 7 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13346
* Bump stable to 1.34 and add 1.35 by @brandond in https://github.com/k3s-io/k3s/pull/13373
* Enable secret encryption on existing clusters by @dereknola in https://github.com/k3s-io/k3s/pull/13370
* Bump Local Path Provisioner version by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/13387
* Use Get, not Head for channel page by @dereknola in https://github.com/k3s-io/k3s/pull/13402
* Fix typos in documentation by @oglok in https://github.com/k3s-io/k3s/pull/13411
* Bump actions/cache from 4 to 5 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13347
* Replace temporary etcd server with raw mvcc store access by @brandond in https://github.com/k3s-io/k3s/pull/13368
* Bump Traefik  and CoreDNS - Jan 2025 by @dereknola in https://github.com/k3s-io/k3s/pull/13424
* Remove flannel external-ip annotations when disabled by @brandond in https://github.com/k3s-io/k3s/pull/13431
* Bump local path provisioner to v0.0.34 by @dereknola in https://github.com/k3s-io/k3s/pull/13430
* [main] Publish GA images to staging registry by @rafaelbreno in https://github.com/k3s-io/k3s/pull/13438
* Bump cni plugins by @brandond in https://github.com/k3s-io/k3s/pull/13439
* Fix atomic write in WriteSubnetFile by @luojiyin1987 in https://github.com/k3s-io/k3s/pull/13380
* Bump expr-lang/expr by @brandond in https://github.com/k3s-io/k3s/pull/13440
* Bump spegel to v0.6.0 by @brandond in https://github.com/k3s-io/k3s/pull/13198
* Update longhorn version in integration test from v1.4.0 to v1.10.1 by @brandond in https://github.com/k3s-io/k3s/pull/13443
* Bump kine to v0.14.10 for NATS conformance fixes by @brandond in https://github.com/k3s-io/k3s/pull/13441
* Remove download/generate from vulncheck by @brandond in https://github.com/k3s-io/k3s/pull/13445
* Bump to coredns 1.14.0 by @mgfritch in https://github.com/k3s-io/k3s/pull/13449
* Add Momentum Coach AI to K3S adopters list by @geoffreyPerrin in https://github.com/k3s-io/k3s/pull/13467
* Fix lines to satisfy lint and fix CI by @manuelbuil in https://github.com/k3s-io/k3s/pull/13475
* Update Traefik version to v3.6.7 by @manuelbuil in https://github.com/k3s-io/k3s/pull/13474
* Prevent caching on PR of golangci-lint entries by @dereknola in https://github.com/k3s-io/k3s/pull/13487
* Move to rootlesskit v2 by @dereknola in https://github.com/k3s-io/k3s/pull/13486
* Bump actions/stale from 10.1.0 to 10.1.1 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13296
* Fix CVE-2025-54410: Update docker/docker to v25.0.13 by @rahulrairai59 in https://github.com/k3s-io/k3s/pull/13473
* Bump golang:alpine image version by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/13345
* Update install tests with new images, add alma10 by @dereknola in https://github.com/k3s-io/k3s/pull/13489
* Bump etcd to v3.6.7 by @brandond in https://github.com/k3s-io/k3s/pull/13495
* Add Percona and Solanica to k3s adopters by @edithturn in https://github.com/k3s-io/k3s/pull/13510
* [main] Update to v1.35.0-k3s3 by @rafaelbreno in https://github.com/k3s-io/k3s/pull/13524
* Fix restart of control-plane-only nodes attempting to reconcile from local datastore by @brandond in https://github.com/k3s-io/k3s/pull/13534
* Fix spegel filter for wildcards by @brandond in https://github.com/k3s-io/k3s/pull/13527
* Add IPv6 loopback to kubelet-serving cert by @brandond in https://g

_[Truncated at 4000 characters — full notes: https://github.com/k3s-io/k3s/releases/tag/v1.37.0-rc1%2Bk3s1]_

### v1.36.4+k3s1

- Date: 2026-08-27
- Version: v1.36.4+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.36.4%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.36.4-k3s1

- **changed** — Upgrade Kubernetes to v1.36.4
- **changed** — Upgrade Traefik chart to v40.x with breaking change for ingress-nginx migration where provider name changes from kubernetesIngressNginx to kubernetesIngressNGINX
- **changed** — Upgrade containerd to v2.3.4-k3s1.36
- **changed** — Upgrade Go to 1.26.7
- **changed** — Upgrade Local Path Provisioner version
- **changed** — Upgrade Kine to v0.16.4
- **changed** — Upgrade SQLite to 3.53.4
- **changed** — Upgrade Etcd to v3.6.14-k3s1
- **changed** — Upgrade Runc to v1.4.2
- **changed** — Upgrade Flannel to v0.28.4
- **changed** — Upgrade Metrics-server to v0.9.0
- **changed** — Upgrade Traefik to v3.7.8
- **changed** — Upgrade CoreDNS to v1.14.6
- **changed** — Upgrade Helm-controller to v0.17.7

<!-- v1.36.4+k3s1 -->
> [!WARNING]
> This release upgrades Traefik chart to v40.x which includes a breaking change for the ingress-nginx migration: the provider name changes from `kubernetesIngressNginx` to `kubernetesIngressNGINX`. Check https://github.com/traefik/traefik-helm-chart/releases/tag/v40.0.0 for more details

This release updates Kubernetes to v1.36.4, and fixes a number of issues.

For more details on what's new, see the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.36.md#changelog-since-v1363).

##### Changes since v1.36.3+k3s1:

* Backport tests changes [(#14517)](https://github.com/k3s-io/k3s/pull/14517)
* Bump Local Path Provisioner version [(#14498)](https://github.com/k3s-io/k3s/pull/14498)
* Bump containerd to v2.3.4-k3s1.36 [(#14512)](https://github.com/k3s-io/k3s/pull/14512)
* Backports for 2026-08 [(#14522)](https://github.com/k3s-io/k3s/pull/14522)
* Update to v1.36.4-k3s1 and Go 1.26.7 [(#14545)](https://github.com/k3s-io/k3s/pull/14545)

##### Embedded Component Versions
| Component | Version |
|---|---|
| Kubernetes | [v1.36.4](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.36.md#v1364) |
| Kine | [v0.16.4](https://github.com/k3s-io/kine/releases/tag/v0.16.4) |
| SQLite | [3.53.4](https://sqlite.org/releaselog/3_53_4.html) |
| Etcd | [v3.6.14-k3s1](https://github.com/k3s-io/etcd/releases/tag/v3.6.14-k3s1) |
| Containerd | [v2.3.4-k3s1.36](https://github.com/k3s-io/containerd/releases/tag/v2.3.4-k3s1.36) |
| Runc | [v1.4.2](https://github.com/opencontainers/runc/releases/tag/v1.4.2) |
| Flannel | [v0.28.4](https://github.com/flannel-io/flannel/releases/tag/v0.28.4) | 
| Metrics-server | [v0.9.0](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.9.0) |
| Traefik | [v3.7.8](https://github.com/traefik/traefik/releases/tag/v3.7.8) |
| CoreDNS | [v1.14.6](https://github.com/coredns/coredns/releases/tag/v1.14.6) | 
| Helm-controller | [v0.17.7](https://github.com/k3s-io/helm-controller/releases/tag/v0.17.7) |
| Local-path-provisioner | [v0.0.37](https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.37) |

##### Helpful Links
As always, we welcome and appreciate feedback from our community of users. Please feel free to:
- [Open issues here](https://github.com/rancher/k3s/issues/new/choose)
- [Join our Slack channel](https://slack.rancher.io/)
- [Check out our documentation](https://rancher.com/docs/k3s/latest/en/) for guidance on how to get started or to dive deep into K3s.
- [Read how you can contribute here](https://github.com/rancher/k3s/blob/master/CONTRIBUTING.md)

### v1.35.8+k3s1

- Date: 2026-08-27
- Version: v1.35.8+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.35.8%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.35.8-k3s1

- **changed** — Upgrade Kubernetes to v1.35.8
- **changed** — Upgrade Traefik chart to v40.x with breaking change to ingress-nginx provider name from kubernetesIngressNginx to kubernetesIngressNGINX
- **changed** — Upgrade containerd to v2.2.7-k3s1
- **changed** — Upgrade Local Path Provisioner version
- **changed** — Upgrade Go to 1.26.7

<!-- v1.35.8+k3s1 -->
> [!WARNING]
> This release upgrades Traefik chart to v40.x which includes a breaking change for the ingress-nginx migration: the provider name changes from `kubernetesIngressNginx` to `kubernetesIngressNGINX`. Check https://github.com/traefik/traefik-helm-chart/releases/tag/v40.0.0 for more details

This release updates Kubernetes to v1.35.8, and fixes a number of issues.

For more details on what's new, see the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.35.md#changelog-since-v1357).

##### Changes since v1.35.7+k3s1:

* Backport tests changes [(#14518)](https://github.com/k3s-io/k3s/pull/14518)
* Bump Local Path Provisioner version [(#14497)](https://github.com/k3s-io/k3s/pull/14497)
* Bump containerd to v2.2.7-k3s1 [(#14513)](https://github.com/k3s-io/k3s/pull/14513)
* Backports for 2026-08 [(#14523)](https://github.com/k3s-io/k3s/pull/14523)
* Update to v1.35.8-k3s1 and Go 1.26.7 [(#14544)](https://github.com/k3s-io/k3s/pull/14544)

##### Embedded Component Versions
| Component | Version |
|---|---|
| Kubernetes | [v1.35.8](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.35.md#v1358) |
| Kine | [v0.16.4](https://github.com/k3s-io/kine/releases/tag/v0.16.4) |
| SQLite | [3.53.4](https://sqlite.org/releaselog/3_53_4.html) |
| Etcd | [v3.6.14-k3s1](https://github.com/k3s-io/etcd/releases/tag/v3.6.14-k3s1) |
| Containerd | [v2.2.7-k3s1](https://github.com/k3s-io/containerd/releases/tag/v2.2.7-k3s1) |
| Runc | [v1.4.2](https://github.com/opencontainers/runc/releases/tag/v1.4.2) |
| Flannel | [v0.28.4](https://github.com/flannel-io/flannel/releases/tag/v0.28.4) | 
| Metrics-server | [v0.9.0](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.9.0) |
| Traefik | [v3.7.8](https://github.com/traefik/traefik/releases/tag/v3.7.8) |
| CoreDNS | [v1.14.6](https://github.com/coredns/coredns/releases/tag/v1.14.6) | 
| Helm-controller | [v0.17.7](https://github.com/k3s-io/helm-controller/releases/tag/v0.17.7) |
| Local-path-provisioner | [v0.0.37](https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.37) |

##### Helpful Links
As always, we welcome and appreciate feedback from our community of users. Please feel free to:
- [Open issues here](https://github.com/rancher/k3s/issues/new/choose)
- [Join our Slack channel](https://slack.rancher.io/)
- [Check out our documentation](https://rancher.com/docs/k3s/latest/en/) for guidance on how to get started or to dive deep into K3s.
- [Read how you can contribute here](https://github.com/rancher/k3s/blob/master/CONTRIBUTING.md)

### v1.34.11+k3s1

- Date: 2026-08-27
- Version: v1.34.11+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.34.11%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.34.11-k3s1

- **changed** — Upgrade Traefik chart to v40.x with breaking change for ingress-nginx migration: the provider name changes from kubernetesIngressNginx to kubernetesIngressNGINX
- **changed** — Update Kubernetes to v1.34.11
- **changed** — Update containerd to v2.2.7-k3s1
- **changed** — Update to Go 1.26.7

<!-- v1.34.11+k3s1 -->
> [!WARNING]
> This release upgrades Traefik chart to v40.x which includes a breaking change for the ingress-nginx migration: the provider name changes from `kubernetesIngressNginx` to `kubernetesIngressNGINX`. Check https://github.com/traefik/traefik-helm-chart/releases/tag/v40.0.0 for more details

This release updates Kubernetes to v1.34.11, and fixes a number of issues.

For more details on what's new, see the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.34.md#changelog-since-v13410).

##### Changes since v1.34.10+k3s1:

* Backport tests changes [(#14519)](https://github.com/k3s-io/k3s/pull/14519)
* Bump Local Path Provisioner version [(#14494)](https://github.com/k3s-io/k3s/pull/14494)
* Bump containerd to v2.2.7-k3s1 [(#14520)](https://github.com/k3s-io/k3s/pull/14520)
* Backports for 2026-08 [(#14524)](https://github.com/k3s-io/k3s/pull/14524)
* Update to v1.34.11-k3s1 and Go 1.26.7 [(#14543)](https://github.com/k3s-io/k3s/pull/14543)

##### Embedded Component Versions
| Component | Version |
|---|---|
| Kubernetes | [v1.34.11](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.34.md#v13411) |
| Kine | [v0.16.4](https://github.com/k3s-io/kine/releases/tag/v0.16.4) |
| SQLite | [3.53.4](https://sqlite.org/releaselog/3_53_4.html) |
| Etcd | [v3.6.14-k3s1](https://github.com/k3s-io/etcd/releases/tag/v3.6.14-k3s1) |
| Containerd | [v2.2.7-k3s1](https://github.com/k3s-io/containerd/releases/tag/v2.2.7-k3s1) |
| Runc | [v1.4.2](https://github.com/opencontainers/runc/releases/tag/v1.4.2) |
| Flannel | [v0.28.4](https://github.com/flannel-io/flannel/releases/tag/v0.28.4) | 
| Metrics-server | [v0.9.0](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.9.0) |
| Traefik | [v3.7.8](https://github.com/traefik/traefik/releases/tag/v3.7.8) |
| CoreDNS | [v1.14.6](https://github.com/coredns/coredns/releases/tag/v1.14.6) | 
| Helm-controller | [v0.16.26](https://github.com/k3s-io/helm-controller/releases/tag/v0.16.26) |
| Local-path-provisioner | [v0.0.37](https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.37) |

##### Helpful Links
As always, we welcome and appreciate feedback from our community of users. Please feel free to:
- [Open issues here](https://github.com/rancher/k3s/issues/new/choose)
- [Join our Slack channel](https://slack.rancher.io/)
- [Check out our documentation](https://rancher.com/docs/k3s/latest/en/) for guidance on how to get started or to dive deep into K3s.
- [Read how you can contribute here](https://github.com/rancher/k3s/blob/master/CONTRIBUTING.md)

### v1.36.4-rc1+k3s1

- Date: 2026-08-21
- Version: v1.36.4-rc1+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.36.4-rc1%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.36.4-rc1-k3s1
- Labels: Pre-release

- **changed** — Bump containerd to v2.3.4-k3s1.36
- **changed** — Update to Go 1.26.7

##### What's Changed
* [Release-1.36] Backport tests changes by @vitorsavian in https://github.com/k3s-io/k3s/pull/14517
* [release-1.36] Bump Local Path Provisioner version by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/14498
* [Release-1.36] Bump containerd to v2.3.4-k3s1.36 by @vitorsavian in https://github.com/k3s-io/k3s/pull/14512
* [release-1.36] Backports for 2026-08 by @brandond in https://github.com/k3s-io/k3s/pull/14522
* [release-1.36] Update to v1.36.4-k3s1 and Go 1.26.7 by @rafaelbreno in https://github.com/k3s-io/k3s/pull/14545


**Full Changelog**: https://github.com/k3s-io/k3s/compare/v1.36.3+k3s1...v1.36.4-rc1+k3s1

### v1.34.11-rc1+k3s1

- Date: 2026-08-21
- Version: v1.34.11-rc1+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.34.11-rc1%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.34.11-rc1-k3s1
- Labels: Pre-release

- **changed** — Bump Local Path Provisioner version
- **changed** — Bump containerd to v2.2.7-k3s1
- **changed** — Update to Go 1.26.7

##### What's Changed
* [Release-1.34] Backport tests changes by @vitorsavian in https://github.com/k3s-io/k3s/pull/14519
* [release-1.34] Bump Local Path Provisioner version by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/14494
* [Release-1.34] Bump containerd to v2.2.7-k3s1 by @vitorsavian in https://github.com/k3s-io/k3s/pull/14520
* [release-1.34] Backports for 2026-08 by @brandond in https://github.com/k3s-io/k3s/pull/14524
* [release-1.34] Update to v1.34.11-k3s1 and Go 1.26.7 by @rafaelbreno in https://github.com/k3s-io/k3s/pull/14543


**Full Changelog**: https://github.com/k3s-io/k3s/compare/v1.34.10+k3s1...v1.34.11-rc1+k3s1

### v1.35.8-rc1+k3s1

- Date: 2026-08-21
- Version: v1.35.8-rc1+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.35.8-rc1%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.35.8-rc1-k3s1
- Labels: Pre-release

- **changed** — Bump containerd to v2.2.7-k3s1
- **changed** — Update Go to 1.26.7
- **changed** — Bump Local Path Provisioner version

##### What's Changed
* [Release-1.35] Backport tests changes  by @vitorsavian in https://github.com/k3s-io/k3s/pull/14518
* [release-1.35] Bump Local Path Provisioner version by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/14497
* [Release-1.35] Bump containerd to v2.2.7-k3s1 by @vitorsavian in https://github.com/k3s-io/k3s/pull/14513
* [release-1.35] Backports for 2026-08 by @brandond in https://github.com/k3s-io/k3s/pull/14523
* [release-1.35] Update to v1.35.8-k3s1 and Go 1.26.7 by @rafaelbreno in https://github.com/k3s-io/k3s/pull/14544


**Full Changelog**: https://github.com/k3s-io/k3s/compare/v1.35.7+k3s1...v1.35.8-rc1+k3s1

### v1.36.3+k3s1

- Date: 2026-08-04
- Version: v1.36.3+k3s1
- Original notes: https://github.com/k3s-io/k3s/releases/tag/v1.36.3%2Bk3s1
- Permalink: https://whatsnew.fyi/product/k3s/releases/v1.36.3-k3s1

- **added** — Add support for wildcard domains in --tls-san (e.g. --tls-san=*.example.com)
- **changed** — Upgrade Traefik chart to v40.x with breaking change: ingress-nginx provider name changes from kubernetesIngressNginx to kubernetesIngressNGINX
- **changed** — Bump dynamiclistener to v0.9.0-rc.2 for wildcard tls-san support
- **changed** — Bump mirrored-pause to 3.10.2
- **changed** — Bump Traefik to v3.7.8
- **changed** — Bump helm-controller and klipper-helm for --force-conflicts support
- **changed** — Bump etcd to v3.6.14
- **changed** — Update Kubernetes to v1.36.3
- **fixed** — Fix typo in snapshot prune event
- **fixed** — Fix production builds always enabling Go coverage instrumentation

<!-- v1.36.3+k3s1 -->
> [!WARNING]
> This release upgrades Traefik chart to v40.x which includes a breaking change for the ingress-nginx migration: the provider name changes from `kubernetesIngressNginx` to `kubernetesIngressNGINX`. Check https://github.com/traefik/traefik-helm-chart/releases/tag/v40.0.0 for more details

This release updates Kubernetes to v1.36.3, and fixes a number of issues.

For more details on what's new, see the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.36.md#changelog-since-v1362).

##### Changes since v1.36.2+k3s1:

* Bump dynamiclistener to v0.9.0-rc.2 for wildcard tls-san support [(#14312)](https://github.com/k3s-io/k3s/pull/14312)
  * Add support for wildcard domains in `--tls-san` (e.g. `--tls-san=*.example.com`).
* July Testing Backports [(#14328)](https://github.com/k3s-io/k3s/pull/14328)
* July K3s Build Rework + GHA bumps [(#14332)](https://github.com/k3s-io/k3s/pull/14332)
* Backports for 2026-07 [(#14348)](https://github.com/k3s-io/k3s/pull/14348)
* Bump mirrored-pause to 3.10.2 [(#14389)](https://github.com/k3s-io/k3s/pull/14389)
* Bump Traefik to v3.7.7 [(#14381)](https://github.com/k3s-io/k3s/pull/14381)
* More backports for 2026-07 [(#14406)](https://github.com/k3s-io/k3s/pull/14406)
* Fix typo in snapshot prune event [(#14411)](https://github.com/k3s-io/k3s/pull/14411)
* Bump rancher/mirrored-coredns-coredns image version [(#14424)](https://github.com/k3s-io/k3s/pull/14424)
* Bump golang:alpine image version [(#14432)](https://github.com/k3s-io/k3s/pull/14432)
* Bump rancher/mirrored-metrics-server image version [(#14437)](https://github.com/k3s-io/k3s/pull/14437)
* Use new Traefik v3.7.8 [(#14426)](https://github.com/k3s-io/k3s/pull/14426)
* Bump helm-controller and klipper-helm for `--force-conflicts` support [(#14442)](https://github.com/k3s-io/k3s/pull/14442)
* Bump k3s-io/kubernetes and Go references [(#14456)](https://github.com/k3s-io/k3s/pull/14456)
* Bump etcd to v3.6.14 [(#14461)](https://github.com/k3s-io/k3s/pull/14461)
* Fix production builds always enabling Go coverage instrumentation [(#14466)](https://github.com/k3s-io/k3s/pull/14466)
* Bump helm-controller and klipper-helm [(#14475)](https://github.com/k3s-io/k3s/pull/14475)

##### Embedded Component Versions
| Component | Version |
|---|---|
| Kubernetes | [v1.36.3](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.36.md#v1363) |
| Kine | [v0.16.3](https://github.com/k3s-io/kine/releases/tag/v0.16.3) |
| SQLite | [3.53.2](https://sqlite.org/releaselog/3_53_2.html) |
| Etcd | [v3.6.14-k3s1](https://github.com/k3s-io/etcd/releases/tag/v3.6.14-k3s1) |
| Containerd | [v2.3.2-k3s2](https://github.com/k3s-io/containerd/releases/tag/v2.3.2-k3s2) |
| Runc | [v1.4.2](https://github.com/opencontainers/runc/releases/tag/v1.4.2) |
| Flannel | [v0.28.4](https://github.com/flannel-io/flannel/releases/tag/v0.28.4) | 
| Metrics-server | [v0.9.0](https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.9.0) |
| Traefik | [v3.7.8](https://github.com/traefik/traefik/releases/tag/v3.7.8) |
| CoreDNS | [v1.14.6](https://github.com/coredns/coredns/releases/tag/v1.14.6) | 
| Helm-controller | [v0.17.7](https://github.com/k3s-io/helm-controller/releases/tag/v0.17.7) |
| Local-path-provisioner | [v0.0.36](https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.36) |

##### Helpful Links
As always, we welcome and appreciate feedback from our community of users. Please feel free to:
- [Open issues here](https://github.com/rancher/k3s/issues/new/choose)
- [Join our Slack channel](https://slack.rancher.io/)
- [Check out our documentation](https://rancher.com/docs/k3s/latest/en/) for guidance on how to get started or to dive deep into K3s.
- [Read how you can contribute here](https://github.com/rancher/k3s/blob/master/CONTRIBUTING.md)