What k3s-io/k3s shipped
Written by FoxPlug from the repository's own releases; not affiliated with K3s. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/k3s-io/k3s; K3s did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- The stable channel now points to v1.37.2+k3s1 at the close of the October release cycle. Pull request #14951
- V1.37.2+k3s1 updates Kubernetes to v1.37.2, bumps containerd to v2.3.6, and adds gateway-api-crd to help. Release
- V1.36.6+k3s1 updates Kubernetes to v1.36.6, bumps containerd to v2.3.6, and updates the Traefik image and gateway-api. Release
- V1.35.10+k3s1 upgrades the Traefik chart to v40.x, which renames the ingress-nginx migration provider to kubernetesIngressNGINX. Release
- V1.34.13+k3s1 upgrades the Traefik chart to v40.x, which renames the ingress-nginx migration provider to kubernetesIngressNGINX. Release
- Install.sh now uses a literal list instead of brace expansion, so the k3s-selinux version lookup runs under dash, and uses command -v for command detection. Pull request #14948
Why it matters
This week brings releases across four Kubernetes lines plus a stable channel update to v1.37.2+k3s1, so users on 1.34, 1.35, 1.36 and 1.37 have new builds. The Traefik chart upgrade carries a breaking rename of the ingress-nginx migration provider name, which matters for anyone migrating from ingress-nginx. The install script fix makes the k3s-selinux version lookup work under dash instead of running only once.
Changelog entry
- Update stable channel to v1.37.2+k3s1 Pull request #14951
- Release v1.37.2+k3s1: update Kubernetes to v1.37.2, bump containerd to v2.3.6, add gateway-api-crd to help Release
- Release v1.36.6+k3s1: update Kubernetes to v1.36.6, bump containerd to v2.3.6, bump Traefik image and gateway-api Release
- Release v1.35.10+k3s1: upgrade Traefik chart to v40.x with provider name change to kubernetesIngressNGINX Release
- Release v1.34.13+k3s1: upgrade Traefik chart to v40.x with provider name change to kubernetesIngressNGINX Release
- Fix bashisms in install.sh: replace brace expansion with a literal list and use command -v for command detection Pull request #14948
Releases out this week: v1.34.13, v1.35.10, v1.36.6 and v1.37.2+k3s1, plus the stable channel updated to v1.37.2+k3s1. Traefik chart v40 renames the ingress-nginx migration provider to kubernetesIngressNGINX, so check your config. install.sh no longer relies on bash brace expansi
This week brings releases across four Kubernetes lines: v1.34.13+k3s1, v1.35.10+k3s1, v1.36.6+k3s1 and v1.37.2+k3s1. The 1.36 and 1.37 releases update Kubernetes to their respective patch versions, bump containerd to v2.3.6, and include help and gateway-api updates. The stable channel now points to v1.37.2+k3s1. If you use Traefik, note that the chart upgrade to v40.x renames the ingress-nginx migration provider from kubernetesIngressNginx to kubernetesIngressNGINX, which is a breaking change. Separately, install.sh no longer uses brace expansion, so the k3s-selinux version lookup runs correctly under dash, and command detection uses command -v.
Week of October 26, 2026
What shipped
- The containerd server and metrics plugin was added back, so metrics can be configured again. Pull request #14903
- Airgap image tarballs are no longer re-imported on every start when the cache uses whole-second timestamps. Pull request #14912
- The pause image name is normalized so it is actually pinned and the intended image gets pulled. Pull request #14929
- The tcpproxy backend connection is now closed when the client connection closes. Pull request #14914
- The supervisor http server on 6443 now sets an IdleTimeout so idle keep-alive connections are closed. Pull request #14904
- The temporary etcd datastore copy is removed when copying or opening it fails. Pull request #14837
- Flannel vxlan VNI and port can be set via environment variables on Linux servers and are passed to agents. Pull request #14939
- Dead community meeting and shell style guide links in the contributor docs were fixed. Pull request #14940
- CI runners are pinned to ubuntu-24.04 so the change to 26.04 with sudo-rs does not break CI scripts. Pull request #14917
- The download path of the rancher.openvex.json artifact was updated. Pull request #14916
Why it matters
This week brings a bugfix for containerd metrics configuration, a fix that stops airgap tarball re-imports on every start, and container image pinning, all of which affect day-to-day cluster behavior. It also adds flannel vxlan VNI and port configuration over environment variables for Linux servers so agents follow the server. Alongside these, release candidates for several versions bump x/net and backport bundled binary build changes, and CI runners and contributor docs were cleaned up.
Changelog entry
- Add containerd server/metrics plugin so metrics can be configured again Pull request #14903
- Fix airgap tarballs being re-imported on every start with.cache.json Pull request #14912
- Normalize pause image to ensure pinning Pull request #14929
- Close tcpproxy backend connection when client connection is closed Pull request #14914
- Set IdleTimeout on the supervisor http server Pull request #14904
- Remove temporary etcd datastore copy when opening it fails Pull request #14837
- Allow configuring flannel vxlan vni and port via env var Pull request #14939
- Fix dead community meeting and shell style guide links Pull request #14940
- Fix typos and smart quotes in contributing and governance docs Pull request #14943
- Pin runners to ubuntu-24.04 Pull request #14917
- Update download path of rancher.openvex.json artifact Pull request #14916
- Bump x/net and pass golang.org/x/ replacements through when building bundled binaries Pull request #14938
This week: containerd metrics plugin restored, airgap tarballs no longer re-imported on every start, pause image pinning fixed, and flannel vxlan VNI and port configurable via env vars. Release candidates for 1.34 through 1.37 also bump x/net.
This week in the repository: the containerd server and metrics plugin was restored so metrics can be configured again, airgap image tarballs are no longer re-imported on every start, the pause image is normalized so pinning works, and tcpproxy closes backend connections when clients disconnect. The supervisor http server now sets an IdleTimeout, and flannel vxlan VNI and port can be configured via environment variables on Linux servers with agents following. Temporary etcd datastore copies are cleaned up on error paths, dead contributor doc links were fixed, CI runners are pinned to ubuntu-24.04, and release candidates for 1.34 through 1.37 bump x/net and pass bundled binary build changes through.
Week of October 12, 2026
What shipped
- Fixed a goroutine leak in the proxy when both directions fail at about the same time. Pull request #14811
- Fixed etcd member removal when etcd is disabled on a server that previously ran embedded etcd. Pull request #14801
- Image pre-pulling now reports read errors from the pre-pull image list instead of ignoring them. Pull request #14732
- Updated kube-router to v2.11.1. Pull request #14730
- Bumped containerd to v2.3.7 on release-1.37. Pull request #14805
- Bumped containerd to v2.3.7 on release-1.36. Pull request #14806
- Bumped containerd to v2.2.10 on release-1.35. Pull request #14807
- Bumped containerd to v2.2.10 on release-1.34. Pull request #14808
- Added Updatecli automation that bumps the bundled Traefik image version. Pull request #14830
- Added a docker test for the gateway-api receiver that enables Traefik's kubernetesGateway provider. Pull request #14802
Why it matters
This week brings several correctness fixes that matter to operators: the proxy goroutine leak, etcd member cleanup when etcd is disabled on an existing server, and error reporting during image pre-pull. Dependency updates to kube-router and containerd across release branches keep the bundled components current, and new automation for Traefik image bumps and a gateway-api test add coverage for the shipping defaults.
Changelog entry
- Fix goroutine leak in the proxy when both directions fail at about the same time Pull request #14811
- Fix etcd member removal when etcd is disabled on an existing server Pull request #14801
- Report errors reading the pre-pull image list when pre-pulling images Pull request #14732
- Update kube-router to v2.11.1 Pull request #14730
- Bump containerd to v2.3.7 on release-1.37 Pull request #14805
- Bump containerd to v2.3.7 on release-1.36 Pull request #14806
- Bump containerd to v2.2.10 on release-1.35 Pull request #14807
- Bump containerd to v2.2.10 on release-1.34 Pull request #14808
- Add Updatecli automation for Traefik image bumps Pull request #14830
- Add docker test for the gateway-api receiver Pull request #14802
- Remove unused replace directives Pull request #14691
- Make the etcdsnapshot restrictions integration test respect the test lock Pull request #14820
This week: fixed a proxy goroutine leak, fixed etcd member removal when etcd is disabled on an existing server, and image pre-pull now reports list read errors. Also kube-router v2.11.1, containerd bumps across release branches, Updatecli automation for Traefik, and a new gateway
This week in K3s: we fixed a goroutine leak in the proxy when both directions fail at about the same time, fixed etcd member removal when etcd is disabled on a server that previously ran embedded etcd, and made image pre-pulling report read errors from the pre-pull image list. On the dependency side, kube-router moved to v2.11.1 and containerd was bumped to v2.3.7 on release-1.36 and release-1.37 and to v2.2.10 on release-1.34 and release-1.35. We also added Updatecli automation to bump the bundled Traefik image, added a docker test for the gateway-api receiver, and removed unused replace directives.
Week of October 5, 2026
What shipped
- Released v1.36.5+k3s1, which upgrades the Traefik chart to v40.x and changes the ingress-nginx migration provider name from kubernetesIngressNginx to kubernetesIngressNGINX. Release
- Fixed private registry usage with vagrant-k3s 0.6.0, resolving errors seen in the embeddedmirror and privateregistry end-to-end tests. Pull request #14751
- Fixed local-path persistent volume deletion when SELinux is enforcing, where volume directories kept MCS categories from the pod that labelled them and the delete helper's rm was denied. Pull request #14740
- Added the etcd-snapshot-restrictions option described in issue 14562, ignoring restricted snapshot destination overrides with a warning and using the server-configured values instead. Pull request #14678
- Bumped containerd to v2.3.6 to fix some CVEs. Pull request #14741
- Bumped Traefik to v3.7.14 and gateway-api to 1.6.2 on the 1.37 release branch. Pull request #14757
- Bumped the Traefik image to v3.7.14 and gateway-api to 1.6.2 on the 1.36 release branch. Pull request #14750
- Bumped gateway-api to 1.6.3 on the 1.36 release branch. Pull request #14771
- Bumped containerd to v2.2.9 on the 1.34 release branch. Pull request #14745
- Ran snapshotrestore test entries in parallel on the 1.37 release branch. Pull request #14733
Why it matters
This week brought a tagged v1.36.5+k3s1 release that upgrades the Traefik chart to v40.x, a breaking change for the ingress-nginx migration because the provider name becomes kubernetesIngressNGINX. Users dealing with private registries and SELinux enforcing environments got fixes for vagrant-k3s registry errors and for local-path PVs stuck in Released. Dependency bumps to containerd and gateway-api, plus a new etcd snapshot restriction option, landed across the maintained release branches.
Changelog entry
- Release v1.36.5+k3s1 with Traefik chart v40.x and the kubernetesIngressNGINX provider rename Release
- Bump containerd to v2.3.6 Pull request #14741
- Bump Traefik image to v3.7.14 and gateway-api to 1.6.2 on 1.36 Pull request #14750
- Bump Traefik to v3.7.14 and gateway-api to 1.6.2 on 1.37 Pull request #14757
- Bump gateway-api to 1.6.3 on 1.36 Pull request #14771
- Bump gateway-api to 1.6.3 on 1.37 Pull request #14769
- Bump gateway-api to 1.6.3 on 1.35 Pull request #14773
- Bump gateway-api to 1.6.3 on 1.34 Pull request #14775
- Bump Traefik image and gateway-api on 1.34 Pull request #14755
- Bump Traefik image and gateway-api on 1.35 Pull request #14754
- Bump containerd to v2.2.9 on 1.34 Pull request #14745
- Add etcd snapshot restrictions per issue 14562 Pull request #14678
K3s v1.36.5+k3s1 is out. Traefik chart v40.x changes the ingress-nginx migration provider name to kubernetesIngressNGINX. Also this week: containerd CVE bumps, gateway-api to 1.6.3, fixes for SELinux local-path PV deletion and private registry tests.
This week k3s published v1.36.5+k3s1. The release upgrades the Traefik chart to v40.x, which includes a breaking change for the ingress-nginx migration: the provider name changes from kubernetesIngressNginx to kubernetesIngressNGINX. We also bumped containerd to v2.3.6 on current branches and v2.2.9 on older ones to fix some CVEs, moved gateway-api to 1.6.3, fixed local-path PV deletion under SELinux enforcing, fixed private registry usage with vagrant-k3s 0.6.0, and added an etcd snapshot restrictions option.
Week of September 28, 2026
What shipped
- K3s v1.36.5+k3s1 released, updating Kubernetes to v1.36.5 and fixing multiple issues including CoreDNS, gateway-api, and Traefik image versions. Release
- K3s v1.37.1+k3s1 released, updating Kubernetes to v1.37.1 with fixes for etcd snapshot restore, seccomp support on riscv64, and other improvements. Release
- K3s v1.35.9+k3s1 released with Traefik chart v40.x upgrade; note the breaking change for ingress-nginx provider naming. Release
- K3s v1.34.12+k3s1 released with Traefik chart v40.x upgrade; note the breaking change for ingress-nginx provider naming. Release
- ServiceLB now updates LoadBalancer Service status when node addresses change, fixing DHCP reassignment and node migration scenarios. Pull request #14550
- API server no longer sets default service account signing key flags when service-account-signing-endpoint is configured. Pull request #14719
- Added gateway-api-crd to the disable list available via --help, addressing discovery of this disable option. Pull request #14681
- Clarified etcd snapshot retention flag help text to distinguish between per-node local retention and cluster-wide S3 retention. Pull request #14716
- CI improvement: disabled Go cache on Windows runners to stop unnecessary 15 MB cache entries from Windows jobs. Pull request #14715
- Snapshot restore test entries now run in parallel, improving CI efficiency. Pull request #14710
Why it matters
Four patch releases shipped across multiple K3s versions with Kubernetes updates and bug fixes. Notable fixes address etcd snapshot handling, ServiceLB behavior with changing node addresses, and API server configuration. Traefik chart upgrades in older versions include breaking changes requiring attention.
Changelog entry
- V1.36.5+k3s1: Updated Kubernetes to v1.36.5, bumped CoreDNS, gateway-api, and Traefik image versions Release
- V1.37.1+k3s1: Updated Kubernetes to v1.37.1, fixed etcd snapshot restore, enabled seccomp on riscv64 Release
- V1.35.9+k3s1: Upgraded Traefik chart to v40.x (breaking change: kubernetesIngressNginx → kubernetesIngressNGINX) Release
- V1.34.12+k3s1: Upgraded Traefik chart to v40.x (breaking change: kubernetesIngressNginx → kubernetesIngressNGINX) Release
- ServiceLB updates LoadBalancer Service status when node addresses change Pull request #14550
- API server omits default service account key flags when service-account-signing-endpoint is set Pull request #14719
- Added gateway-api-crd to the list of components that can be disabled Pull request #14681
- Clarified etcd snapshot retention flags: local retention is per-node, S3 retention is cluster-wide Pull request #14716
K3s v1.36.5+k3s1, v1.37.1+k3s1, v1.35.9+k3s1, and v1.34.12+k3s1 released. Updates include Kubernetes patches, ServiceLB improvements, etcd fixes, and Traefik chart upgrades.
This week brought patch releases across the K3s version line: v1.36.5, v1.37.1, v1.35.9, and v1.34.12 (all +k3s1). Highlights include Kubernetes updates, a fix for ServiceLB status updates when node addresses change, etcd snapshot restore improvements, and Traefik chart v40.x upgrades. Note that Traefik v40.x includes a breaking change for ingress-nginx provider naming that requires attention for affected deployments.
Week of September 21, 2026
What shipped
- Released v1.37.1-rc2+k3s1 with security fixes for anonymous access to supervisor router and improved CA hash validation. Release
- Released v1.36.5-rc2+k3s1 with security fixes for anonymous access to supervisor router and improved CA hash validation. Release
- Released v1.35.9-rc2+k3s1 with security fixes for anonymous access to supervisor router and improved CA hash validation. Release
- Released v1.34.12-rc2+k3s1 with security fixes for anonymous access to supervisor router and improved CA hash validation. Release
- Fixed agent CA bundle validation to only trust root CAs with matching hash when join token includes CA hash instead of trusting all certs in the bundle. Pull request #14699
- Bumped cadvisor to v0.60.5-k3s1 to improve access to the argContainerdRuntime variable in cadvisor lib/containerd. Pull request #14697
- Bumped helm-controller for Harvester webhook workarounds fixing ConfigMap creation issues during cluster upgrade or cold start. Pull request #14684
- Fixed issue where unsynced cache would cause multiple node password secret create attempts during startup with spurious errors. Pull request #14675
Why it matters
Security fixes for anonymous access control and CA validation are released across four supported release branches. The CA bundle validation fix addresses a CVE affecting how agents trust certificates during cluster join. Supporting component updates improve stability during cluster operations.
Changelog entry
- Reject anonymous access to supervisor router endpoints for spegel, pprof, and metrics Pull request #14701
- Improve CA hash validation for agent certificate trust Pull request #14705
- Bump cadvisor to v0.60.5-k3s1 Pull request #14697
- Bump helm-controller with Harvester webhook fixes Pull request #14684
- Require node password informer sync before using cache to prevent spurious errors during startup Pull request #14675
K3s v1.37.1-rc2, v1.36.5-rc2, v1.35.9-rc2, and v1.34.12-rc2 are now available with security fixes for supervisor router access and CA hash validation improvements.
K3s has released candidate versions across four release branches (v1.37.1-rc2, v1.36.5-rc2, v1.35.9-rc2, v1.34.12-rc2) with important security updates. These releases fix anonymous access to supervisor endpoints and improve CA hash validation during agent join. Additional improvements address ConfigMap creation during cluster upgrades and node password management.
Week of September 14, 2026
What shipped
- Kubernetes v1.37.0 is now available in K3s as v1.37.0+k3s1. Release
- KMS providers are now excluded from apiserver readiness checks, allowing kubelet to start before KMS providers are available. Pull request #14635
- K3s now waits up to 60 seconds for a default network route to appear during startup instead of failing immediately. Pull request #14527
- Release 1.37 branch received backports including network route detection and KMS provider fixes. Pull request #14631
- Release 1.36 branch received backports for etcd store fix and network improvements. Pull request #14632
- Release 1.35 branch received backports for etcd store fix and network improvements. Pull request #14633
- Release 1.34 branch received backports for etcd store fix and network improvements. Pull request #14634
Why it matters
K3s v1.37.0 ships with Kubernetes 1.37.0 and fixes startup reliability issues when network routes or KMS providers are not immediately available. These fixes are backported across multiple release branches to address real-world deployment scenarios.
Changelog entry
- Kubernetes updated to v1.37.0 Release
- KMS providers excluded from apiserver readiness check to allow kubelet startup before KMS providers are available Pull request #14635
- Added 60-second wait for default network route during host interface detection to prevent startup failures Pull request #14527
K3s v1.37.0+k3s1 is available, updating Kubernetes to v1.37.0 with fixes for network route detection and KMS provider startup handling.
K3s v1.37.0+k3s1 is now available with Kubernetes v1.37.0. This release improves startup reliability with fixes for network route detection and KMS provider initialization, ensuring K3s clusters can start reliably in varied network environments.