v1.34.X
Upgrade Notice
Before upgrading from earlier releases, be sure to read the Kubernetes Urgent Upgrade Notes.
Release v1.34.8+k3s1
This release updates Kubernetes to v1.34.8, and fixes a number of issues.
For more details on what's new, see the Kubernetes release notes.
Changes since v1.34.7+k3s1:
- Backports for 2026-05 (#14034)
- Update rancher/local-path-provisioner image version (#14044)
- Update to v1.34.8-k3s1 and Go 1.25.9 (#14049)
- Bump klipper-helm image tag (#14057)
Release v1.34.7+k3s1
This release updates Kubernetes to v1.34.7, and fixes a number of issues.
For more details on what's new, see the Kubernetes release notes.
Changes since v1.34.6+k3s1:
- Immutable release changes (#13900)
- Backports for 2026-04 (#13930)
- Bump flannel to v0.28.4 (#13941)
- Bump traefik to 3.6.12 (#13927)
- Update to v1.34.7-k3s1 and Go 1.25.9 (#13947)
- Switch from draft to pre-release (#13949)
- Bump Traefik to 3.6.13 (#13969) (#13971)
- Fix SANs added from comma-separated node-external-ip list (#13991)
- Bump klipper-helm image for revision check fix (#13997)
Release v1.34.6+k3s1
This release updates Kubernetes to v1.34.6, and fixes a number of issues.
For more details on what's new, see the Kubernetes release notes.
Changes since v1.34.5+k3s1:
- Bump to coredns 1.14.2 (#13758)
- Save cluster state before reencrypting secrets with newly created key (#13772)
- Backports for 2026-03 (#13790)
- Bump runc to v1.4.1 (#13798)
- Bump Traefik helm chart version (#13812)
- Bump cni plugins to v1.9.1 (#13823)
- Simplify snapshot compress/decompress logic (#13828)
- Update to v1.34.6-k3s1 and Go 1.24.13 (#13834)
- Chore: Update Trivy version in Dockerfile.dapper (#13850)
- Update to flannel v0.28.2 (#13869)
Release v1.34.5+k3s1
This release updates Kubernetes to v1.34.5, and fixes a number of issues.
For more details on what's new, see the Kubernetes release notes.
Changes since v1.34.4+k3s1:
- Rootlesskit Revert + Test Fixes (#13682)
- Backports for 2026-02 BONUS RELEASE (#13691)
- Bump Traefik to v3.6.9 (#13702)
- Update to v1.34.5-k3s1 and Go 1.24.13 (#13706)
Release v1.34.4+k3s1
This release updates Kubernetes to v1.34.4, and fixes a number of issues.
For more details on what's new, see the Kubernetes release notes.
Changes since v1.34.3+k3s3:
- Explicitly close mvcc backend to fix high CPU on initial etcd server after restart (#13571)
- Backports for 2026-02 (#13581)
- Bump kine for list/watch revision fixes (#13577)
- Fix VPN node IP not being applied to kubelet (#13561)
- Bulk Backports 2026-02 (#13565)
- Bump to coredns 1.14.1 and metrics-server v0.8.1 (#13609)
- Add registry prefix to image-list file (#13601)
- Bump klipper-helm and klipper-lb images (#13620)
- Fix removal of init node (#13631)
- Update to v1.34.4-k3s1 and Go 1.24.12 (#13636)
Release v1.34.3+k3s3
This release updates Kubernetes to v1.34.3, and fixes a number of issues.
For more details on what's new, see the Kubernetes release notes.
Changes since v1.34.3+k3s1:
- Add firewall section to check-config.sh (#13391)
- Expand docker upgrade test, sunset E2E upgrade test (#13399)
- Allow k3s secrets-encrypt enable on existing clusters (#13404)
- Chore: Bump charts - Jan 2025 (#13421)
- Bump local path provisioner to v0.0.34 (#13427)
- Backports for 2026-01 (#13447)
- Bump to coredns 1.14.0 (#13452)
- Rootless ports: add support for udp (#13460)
- Update Traefik version to v3.6.7 (#13483)
- Bump etcd to v3.6.7 (#13496)
- Update to v1.34.3-k3s3 and Go 1.24.11 (#13522)
- Fix restart of control-plane-only nodes attempting to reconcile from local datastore (#13536)
Release v1.34.3+k3s1
This release updates Kubernetes to v1.34.3, and fixes a number of issues.
For more details on what's new, see the Kubernetes release notes.
Changes since v1.34.2+k3s1:
- Update busybox to 1.37.0 (#13241)
- Add multus e2e test (#13264)
- Backports for 2025-12 (#13251)
- Add docker dualstack test
- Fix windows build os
- Fix for clusters with few nodes and a lot of pod churn when webhooks are accessed using egress-selector
- Fix spegel sharing of imported images
- Bump opencontainers/selinux
- Remove remaining references to drone
- Bump actions/checkout from 5 to 6
- Reorganize Executor interface to make CNI startup part of Executor implementation
- Bump kine and etcd
- Bump runc to v1.4.0
- Consolidate test util functions
- Define DefaultHelmJobImage in K3s, overriding what helm-controller defaults to
- Bump actions/setup-go from 5 to 6
- Fix tailscale setup in case of an already running configuration (#13267)
- Update kube-router to v2.6.2 (#13288)
- Update to v1.34.3-k3s1 and Go 1.24.11 (#13306)
- Fix cross-platform image save (#13310)
- Bump kine to v0.14.9 (#13318)
- Fix arm airgap platforms (#13331)
- Reuse airgap image release action (#13337)
- Fix release workflow (#13339)
- Combine airgap and binary publishing steps (#13340)
- Validate collected release artifact list before uploading (#13350)
- Override DefaultHelmJob at build time (#13361)
Release v1.34.2+k3s1
This release updates Kubernetes to v1.34.2, and fixes a number of issues.
For more details on what's new, see the Kubernetes release notes.
Changes since v1.34.1+k3s1:
- Bump traefik to 3.5.1 (#12957)
- Fix garbled CLI (#13032)
- Update flannel, kube-router and cni plugins (#13040)
- Backports for 2025-10 (#13057)
- Fix netpol fatal error when changing node IP
- Bump dynamiclistener for stacked update fix
- Bump Klipper Helm and Helm Controller version
- Fix IPv6 handling for loadbalancer addresses
- Fix multiple issues with server shutdown sequencing
- Fix etcd member promotion
- Bump spegel to v0.4.0
- Fix kine metrics registration without --kine-tls
- Bump kine to v0.14.2
- Fix: default forward after override imports
- Fix handling of vendored dependencies in version script
- Fix helm controller apiserver address for bootstrap charts on ipv6-only nodes
- Create dynamic-cert-regenerate file in CA cert rotation handler
- Fix ability to rotate server token to an invalid format
- Drop calls to rand.Seed
- Bump kine for postgres object count fix
- Bump kine=v0.14.4, etcd=v3.6.5
- Bump coredns to 1.13.1
- Update dispatch script (#13078)
- Bump helm-controller/klipper-helm (#13091)
- Backports for 2025-11 (#13125)
- Inclusive naming proposal (#13132)
- Migrate release pipelines into GitHub Actions (#13119)
- Bump runc to v1.3.3 (#13144)
- Add Prime assets upload (#13159)
- More backports for 2025-11 (#13177)
- Bump klipper-helm and helm-controller (#13193)
- Update to v1.34.2-k3s1 and Go 1.24.9 (#13199)
- Add id-token (#13208)
Release v1.34.1+k3s1
This release updates Kubernetes to v1.34.1. This is the first k3s release in the 1.34 release line.
For more details on what's new, see the Kubernetes release notes.
Changes since v1.33.0+k3s1:
- Update certification renew alert to 120 days (#12232)
- Renew alert for certification will be 120 days
- Add anonymous-auth to flags gated on empty authorization-config value (#12246)
- Add CLI flag and config file for s3 bucket lookup type (#12247)
- Add support for conditional image tarball imports (#12237)
- Implement certificate check with file-oriented view and usage types (#12226)
- Implement certificate check with file-oriented view and usage types
- Add generation for kube-scheduler and kube-controller-manager certs (#12285)
- Flannel: Use custom type for network mode (IPv4, IPv6, dual-stack) (#12240)
- Bump kine and enable sqlite dbstat (#12293)
- Docs: Remove references to deprecated Vagrantfile (#12252)
- Bump wharfie to v0.7.0 (#12322)
- Fix authorization-config/authentication-config handling (#12338)
- Fix secretsencrypt race conditions (#12351)
- Remove references to master node-role label and taints/tolerations (#12395)
- WAdd Uffizzi as adopter (#12348)
- Fix secrets encryption rotation timeout causing false failures (#12392)
- Improve shebang of bash completion script (#12303)
- Add GHCR image publishing to K3s release (#12389)
- Convert all nightly conformance to golang test framework (#12422)
- Fix: error on distros without VERSION_ID on /etc/os-release (#12440)
- Fix K3s not validating datastore connection when no token is set (#12396)
- Add new topologySpreadConstraints to coredns (#12434)
- Fix conformance labeling on CI, no tty (#12450)
- Switch from endpoints to endpointslices (#12420)
- Define missing top level permissions in CI (#12469)
- Bump dynamiclistener to v0.7.0 (#12481)
- Fix sqlite-etcd migration (#12482)
- Update network components (#12502)
- Fix Nightly Conformance (#12527)
- Fix: Remove unused legacy certificates (#12541)
- Clean up client-kube-proxy.crt and client-k3s-controller.crt certificate files on start
- Add etcdmigration e2e test (#12528)
- Docs: Fix broken links in markdown documentation (#12550)
- Bump alpine from 3.21 to 3.22 in /package (#12429)
- Add usage description for etcd-snapshot (#12557)
- Update to new CRDs (#12580)
- Add basic fuzz test + Enable codeql on GHA (#12596)
- Refac shell completion to a better command structure (#12590)
- K3s completion shell command will now be separate to specific subcommands for bash and zsh
- Add retry around common timeout for hardened docker test (#12601)
- Update kine and use config defaults helper (#12599)
- Bump helm-controller and image (#12630)
- Bump helm to v3.18.4 for GHSA-557j-xg8c-q2mm
- Bump alpine version in Dockerfile.local (#12644)
- Enable branch protection checks for openssf (#12640)
- Emit certs OK event on startup, if no certs need renewal (#12645)
- Update metric help to be more descriptive. (#12654)
- Remove master toleration from manifests (#12663)
- Tolerations for the
node-role.kubernetes.io/mastertaint have been removed from packaged manifests. Themasterlabel and taint have been unused by upstream Kubernetes since 1.26, and are now being removed from K3s as well.
- Tolerations for the
- Bump cri-dockerd to v0.3.19-k3s1 (#12649)
- Fix a couple of small nits in README (#12665)
- Add retention flag specific for s3 (#12669)
- Refactor: replace go-bindata with native embed package (#12676)
- Bump k3s-io/api to fix etcdsnapshotfile status columns (#12685)
- Fix completion command in e2e (#12693)
- Fix fallback DNS for IMDS and IPV6-only (#12692)
- K3s no longer falls back to google DNS (8.8.8.8) as the upstream nameserver when the GCP instance metadata IP is configured as nameserver in the host's resolv.conf.
- K3s now includes an IPv6 address for google DNS when the host's resolv.conf does not contain a valid upstream nameserver.
- Fix --docker with --container-runtime-endpoint (#12705)
- Fix PID tracking for Nightly Conformance (#12714)
- Bump coredns to 1.12.3 (#12724)
- Bump Local Path Provisioner version (#12710)
- Bump metrics-server to v0.8.0 (#12726)
- Fix cert startup check events (#12744)
- Bump rancher libs: wrangler/lasso/remotedialer (#12784)
- Wire cri-dockerd
--log-level=debugup to k3s--debugflag (#12755) - Fix spegel logging and startup sequence (#12796)
- Do not bootstrap etcd-only nodes from existing supervisor (#12754)
- Add retry on etcd MemberAdd timeout (#12815)
- Bump containerd to v2.1.4 (#12788)
- Retry CRD creation in case of conflict (#12814)
- Bump actions/checkout from 4 to 5 (#12773)
- Wire up kine metrics (#12831)
- Fix etcd join timeout handling (#12833)
- Wire up remotedialer metrics (#12832)
- Bump k3s-root to v0.15.0 (#12853)
- The bundled userspace binaries are now built from the buildroot 2025.02 LTS branch.
- The bundled nft binary now supports json output, required for compatibility with kube-proxy's nft proxier.
- Update to Kubernetes v1.34 (#12854)
- Add opencontainers/runc pin to v1.3.1 (#12864)
- Move data dir into position before creating CNI symlinks (#12876)
- Update to v1.34.1 and Go 1.24.6 (#12896)