What k3s-io/k3s shipped
Written by FoxPlug from the repository's own releases; not affiliated with K3s. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/k3s-io/k3s; K3s did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Released v1.36.5+k3s1, which upgrades the Traefik chart to v40.x and changes the ingress-nginx migration provider name from kubernetesIngressNginx to kubernetesIngressNGINX. Release
- Fixed private registry usage with vagrant-k3s 0.6.0, resolving errors seen in the embeddedmirror and privateregistry end-to-end tests. Pull request #14751
- Fixed local-path persistent volume deletion when SELinux is enforcing, where volume directories kept MCS categories from the pod that labelled them and the delete helper's rm was denied. Pull request #14740
- Added the etcd-snapshot-restrictions option described in issue 14562, ignoring restricted snapshot destination overrides with a warning and using the server-configured values instead. Pull request #14678
- Bumped containerd to v2.3.6 to fix some CVEs. Pull request #14741
- Bumped Traefik to v3.7.14 and gateway-api to 1.6.2 on the 1.37 release branch. Pull request #14757
- Bumped the Traefik image to v3.7.14 and gateway-api to 1.6.2 on the 1.36 release branch. Pull request #14750
- Bumped gateway-api to 1.6.3 on the 1.36 release branch. Pull request #14771
- Bumped containerd to v2.2.9 on the 1.34 release branch. Pull request #14745
- Ran snapshotrestore test entries in parallel on the 1.37 release branch. Pull request #14733
Why it matters
This week brought a tagged v1.36.5+k3s1 release that upgrades the Traefik chart to v40.x, a breaking change for the ingress-nginx migration because the provider name becomes kubernetesIngressNGINX. Users dealing with private registries and SELinux enforcing environments got fixes for vagrant-k3s registry errors and for local-path PVs stuck in Released. Dependency bumps to containerd and gateway-api, plus a new etcd snapshot restriction option, landed across the maintained release branches.
Changelog entry
- Release v1.36.5+k3s1 with Traefik chart v40.x and the kubernetesIngressNGINX provider rename Release
- Bump containerd to v2.3.6 Pull request #14741
- Bump Traefik image to v3.7.14 and gateway-api to 1.6.2 on 1.36 Pull request #14750
- Bump Traefik to v3.7.14 and gateway-api to 1.6.2 on 1.37 Pull request #14757
- Bump gateway-api to 1.6.3 on 1.36 Pull request #14771
- Bump gateway-api to 1.6.3 on 1.37 Pull request #14769
- Bump gateway-api to 1.6.3 on 1.35 Pull request #14773
- Bump gateway-api to 1.6.3 on 1.34 Pull request #14775
- Bump Traefik image and gateway-api on 1.34 Pull request #14755
- Bump Traefik image and gateway-api on 1.35 Pull request #14754
- Bump containerd to v2.2.9 on 1.34 Pull request #14745
- Add etcd snapshot restrictions per issue 14562 Pull request #14678
K3s v1.36.5+k3s1 is out. Traefik chart v40.x changes the ingress-nginx migration provider name to kubernetesIngressNGINX. Also this week: containerd CVE bumps, gateway-api to 1.6.3, fixes for SELinux local-path PV deletion and private registry tests.
This week k3s published v1.36.5+k3s1. The release upgrades the Traefik chart to v40.x, which includes a breaking change for the ingress-nginx migration: the provider name changes from kubernetesIngressNginx to kubernetesIngressNGINX. We also bumped containerd to v2.3.6 on current branches and v2.2.9 on older ones to fix some CVEs, moved gateway-api to 1.6.3, fixed local-path PV deletion under SELinux enforcing, fixed private registry usage with vagrant-k3s 0.6.0, and added an etcd snapshot restrictions option.
Week of September 28, 2026
What shipped
- K3s v1.36.5+k3s1 released, updating Kubernetes to v1.36.5 and fixing multiple issues including CoreDNS, gateway-api, and Traefik image versions. Release
- K3s v1.37.1+k3s1 released, updating Kubernetes to v1.37.1 with fixes for etcd snapshot restore, seccomp support on riscv64, and other improvements. Release
- K3s v1.35.9+k3s1 released with Traefik chart v40.x upgrade; note the breaking change for ingress-nginx provider naming. Release
- K3s v1.34.12+k3s1 released with Traefik chart v40.x upgrade; note the breaking change for ingress-nginx provider naming. Release
- ServiceLB now updates LoadBalancer Service status when node addresses change, fixing DHCP reassignment and node migration scenarios. Pull request #14550
- API server no longer sets default service account signing key flags when service-account-signing-endpoint is configured. Pull request #14719
- Added gateway-api-crd to the disable list available via --help, addressing discovery of this disable option. Pull request #14681
- Clarified etcd snapshot retention flag help text to distinguish between per-node local retention and cluster-wide S3 retention. Pull request #14716
- CI improvement: disabled Go cache on Windows runners to stop unnecessary 15 MB cache entries from Windows jobs. Pull request #14715
- Snapshot restore test entries now run in parallel, improving CI efficiency. Pull request #14710
Why it matters
Four patch releases shipped across multiple K3s versions with Kubernetes updates and bug fixes. Notable fixes address etcd snapshot handling, ServiceLB behavior with changing node addresses, and API server configuration. Traefik chart upgrades in older versions include breaking changes requiring attention.
Changelog entry
- V1.36.5+k3s1: Updated Kubernetes to v1.36.5, bumped CoreDNS, gateway-api, and Traefik image versions Release
- V1.37.1+k3s1: Updated Kubernetes to v1.37.1, fixed etcd snapshot restore, enabled seccomp on riscv64 Release
- V1.35.9+k3s1: Upgraded Traefik chart to v40.x (breaking change: kubernetesIngressNginx → kubernetesIngressNGINX) Release
- V1.34.12+k3s1: Upgraded Traefik chart to v40.x (breaking change: kubernetesIngressNginx → kubernetesIngressNGINX) Release
- ServiceLB updates LoadBalancer Service status when node addresses change Pull request #14550
- API server omits default service account key flags when service-account-signing-endpoint is set Pull request #14719
- Added gateway-api-crd to the list of components that can be disabled Pull request #14681
- Clarified etcd snapshot retention flags: local retention is per-node, S3 retention is cluster-wide Pull request #14716
K3s v1.36.5+k3s1, v1.37.1+k3s1, v1.35.9+k3s1, and v1.34.12+k3s1 released. Updates include Kubernetes patches, ServiceLB improvements, etcd fixes, and Traefik chart upgrades.
This week brought patch releases across the K3s version line: v1.36.5, v1.37.1, v1.35.9, and v1.34.12 (all +k3s1). Highlights include Kubernetes updates, a fix for ServiceLB status updates when node addresses change, etcd snapshot restore improvements, and Traefik chart v40.x upgrades. Note that Traefik v40.x includes a breaking change for ingress-nginx provider naming that requires attention for affected deployments.
Week of September 21, 2026
What shipped
- Released v1.37.1-rc2+k3s1 with security fixes for anonymous access to supervisor router and improved CA hash validation. Release
- Released v1.36.5-rc2+k3s1 with security fixes for anonymous access to supervisor router and improved CA hash validation. Release
- Released v1.35.9-rc2+k3s1 with security fixes for anonymous access to supervisor router and improved CA hash validation. Release
- Released v1.34.12-rc2+k3s1 with security fixes for anonymous access to supervisor router and improved CA hash validation. Release
- Fixed agent CA bundle validation to only trust root CAs with matching hash when join token includes CA hash instead of trusting all certs in the bundle. Pull request #14699
- Bumped cadvisor to v0.60.5-k3s1 to improve access to the argContainerdRuntime variable in cadvisor lib/containerd. Pull request #14697
- Bumped helm-controller for Harvester webhook workarounds fixing ConfigMap creation issues during cluster upgrade or cold start. Pull request #14684
- Fixed issue where unsynced cache would cause multiple node password secret create attempts during startup with spurious errors. Pull request #14675
Why it matters
Security fixes for anonymous access control and CA validation are released across four supported release branches. The CA bundle validation fix addresses a CVE affecting how agents trust certificates during cluster join. Supporting component updates improve stability during cluster operations.
Changelog entry
- Reject anonymous access to supervisor router endpoints for spegel, pprof, and metrics Pull request #14701
- Improve CA hash validation for agent certificate trust Pull request #14705
- Bump cadvisor to v0.60.5-k3s1 Pull request #14697
- Bump helm-controller with Harvester webhook fixes Pull request #14684
- Require node password informer sync before using cache to prevent spurious errors during startup Pull request #14675
K3s v1.37.1-rc2, v1.36.5-rc2, v1.35.9-rc2, and v1.34.12-rc2 are now available with security fixes for supervisor router access and CA hash validation improvements.
K3s has released candidate versions across four release branches (v1.37.1-rc2, v1.36.5-rc2, v1.35.9-rc2, v1.34.12-rc2) with important security updates. These releases fix anonymous access to supervisor endpoints and improve CA hash validation during agent join. Additional improvements address ConfigMap creation during cluster upgrades and node password management.
Week of September 14, 2026
What shipped
- Kubernetes v1.37.0 is now available in K3s as v1.37.0+k3s1. Release
- KMS providers are now excluded from apiserver readiness checks, allowing kubelet to start before KMS providers are available. Pull request #14635
- K3s now waits up to 60 seconds for a default network route to appear during startup instead of failing immediately. Pull request #14527
- Release 1.37 branch received backports including network route detection and KMS provider fixes. Pull request #14631
- Release 1.36 branch received backports for etcd store fix and network improvements. Pull request #14632
- Release 1.35 branch received backports for etcd store fix and network improvements. Pull request #14633
- Release 1.34 branch received backports for etcd store fix and network improvements. Pull request #14634
Why it matters
K3s v1.37.0 ships with Kubernetes 1.37.0 and fixes startup reliability issues when network routes or KMS providers are not immediately available. These fixes are backported across multiple release branches to address real-world deployment scenarios.
Changelog entry
- Kubernetes updated to v1.37.0 Release
- KMS providers excluded from apiserver readiness check to allow kubelet startup before KMS providers are available Pull request #14635
- Added 60-second wait for default network route during host interface detection to prevent startup failures Pull request #14527
K3s v1.37.0+k3s1 is available, updating Kubernetes to v1.37.0 with fixes for network route detection and KMS provider startup handling.
K3s v1.37.0+k3s1 is now available with Kubernetes v1.37.0. This release improves startup reliability with fixes for network route detection and KMS provider initialization, ensuring K3s clusters can start reliably in varied network environments.