v1.33.X
Before upgrading from earlier releases, be sure to read the Kubernetes Urgent Upgrade Notes.
Release v1.33.7+k3s3
This release updates Kubernetes to v1.33.7, and fixes a number of issues.
For more details on what's new, see the Kubernetes release notes.
K3s v1.34 Upgrade Warning
This warning targets users who perform upgrades by adding new nodes to the cluster, and removing old ones. If your etcd cluster membership is and has been consistent across versions, you should NOT be affected by this issue.
K3s v1.34 and higher include etcd 3.6. Maintainers of the etcd project have indicated that there no safe path from etcd 3.5 to 3.6 except by upgrading to v3.5.26 first.
In mid December, the project released an announcement indicating that there is NO safe path from etcd 3.5 to 3.6 except by upgrading to v3.5.26 first. Failure to do so can cause the cluster to report “zombie members” (etcd nodes that were removed from the cluster some time ago) re-appearing and joining database consensus, ultimately causing the cluster to lose quorum. This updated blog post contradicts previous announcements on this topic, which indicated that it was safe to upgrade from v3.5.20+ as long as nodes had been restarted at least once, to reconcile membership lists across internal storage layers.
The January releases of K3s v1.32 and v1.33 will include etcd v3.5.26. All users should plan on upgrading to this patch release, prior to upgrading to v1.34 and v1.35.
Changes since v1.33.7+k3s1:
- Add firewall section to check-config.sh (#13392)
- Expand docker upgrade test, sunset E2E upgrade test (#13400)
- Allow k3s secrets-encrypt enable on existing clusters (#13405)
- Chore: Bump charts - Jan 2025 (#13422)
- Bump local path provisioner to v0.0.34 (#13428)
- Bump to coredns 1.14.0 (#13453)
- Backports for 2026-01 (#13448)
- Rootless ports: add support for udp (#13461)
- Update Traefik version to v3.6.7 (#13482)
- Bump etcd to v3.5.26 for zombie member fix (#13493)
- Update to v1.33.7-k3s3 and Go 1.24.11 (#13521)
- Fix restart of control-plane-only nodes attempting to reconcile from local datastore (#13537)
Release v1.33.7+k3s1
This release updates Kubernetes to v1.33.7, and fixes a number of issues.
For more details on what's new, see the Kubernetes release notes.
Changes since v1.33.6+k3s1:
- Update busybox to 1.37.0 (#13240)
- Add multus e2e test (#13265)
- Backports for 2025-12 (#13252)
- Add docker dualstack test
- Fix windows build os
- Fix for clusters with few nodes and a lot of pod churn when webhooks are accessed using egress-selector
- Fix spegel sharing of imported images
- Bump opencontainers/selinux
- Remove remaining references to drone
- Bump actions/checkout from 5 to 6
- Reorganize Executor interface to make CNI startup part of Executor implementation
- Bump kine and etcd
- Bump runc to v1.4.0
- Consolidate test util functions
- Define DefaultHelmJobImage in K3s, overriding what helm-controller defaults to
- Bump actions/setup-go from 5 to 6
- Fix tailscale setup in case of an already running configuration (#13268)
- Update kube-router to v2.6.2 (#13289)
- Update to v1.33.7-k3s1 and Go 1.24.11 (#13307)
- Fix cross-platform image save (#13312)
- Bump kine to v0.14.9 (#13319)
- Fix arm airgap platforms (#13332)
- Fix release CI (#13341)
- Override DefaultHelmJob at build time (#13362)
- Validate collected release artifact list before uploading (#13359)
Release v1.33.6+k3s1
This release updates Kubernetes to v1.33.6, and fixes a number of issues.
For more details on what's new, see the Kubernetes release notes.
Changes since v1.33.5+k3s1:
- Bump traefik to 3.5.1 (#12958)
- Fix garbled CLI (#13033)
- Update flannel, kube-router and cni plugins (#13041)
- Backports for 2025-10 (#13058)
- Fix netpol fatal error when changing node IP
- Bump dynamiclistener for stacked update fix
- Bump Klipper Helm and Helm Controller version
- Bump Local Path Provisioner version
- Fix IPv6 handling for loadbalancer addresses
- Fix multiple issues with server shutdown sequencing
- Fix etcd member promotion
- Bump spegel to v0.4.0
- Fix kine metrics registration without --kine-tls
- Bump kine to v0.14.2
- Fix: default forward after override imports
- Fix handling of vendored dependencies in version script
- Fix helm controller apiserver address for bootstrap charts on ipv6-only nodes
- Create dynamic-cert-regenerate file in CA cert rotation handler
- Fix ability to rotate server token to an invalid format
- Drop calls to rand.Seed
- Bump kine for postgres object count fix
- Bump kine=v0.14.5
- Bump coredns to 1.13.1
- Update dispatch script (#13077)
- Bump helm-controller/klipper-helm (#13092)
- Backports for 2025-11 (#13126)
- Inclusive naming proposal (#13133)
- Migrate release pipeline into GitHub Actions (#13116)
- Bump runc to v1.3.3 (#13145)
- Add Prime assets upload (#13158)
- More backports for 2025-11 (#13178)
- Bump klipper-helm and helm-controller (#13194)
- Update to v1.33.6-k3s1 and Go 1.24.9 (#13200)
- Add id-token (#13207)
Release v1.33.5+k3s1
This release updates Kubernetes to v1.33.5, and fixes a number of issues.
For more details on what's new, see the Kubernetes release notes.
Changes since v1.33.4+k3s1:
- Backports for 2025-09 (#12885)
- Bump rancher libs: wrangler/lasso/remotedialer
- Wire cri-dockerd --log-level=debug up to k3s --debug flag
- Fix spegel logging and startup sequence
- Update to runc v1.3.0
- Do not bootstrap etcd-only nodes from existing supervisor
- Add retry on etcd MemberAdd timeout
- Bump containerd to v2.1.4
- Retry CRD creation in case of conflict
- Wire up kine metrics
- Wire up remotedialer metrics
- Fix etcd join timeout handling
- Bump k3s-root to v0.15.0
- Add opencontainers/runc pin to v1.3.1
- Move data dir into position before creating CNI symlinks
- Update to v1.33.5-k3s1 and Go 1.24.6 (#12895)
Release v1.33.4+k3s1
This release updates Kubernetes to v1.33.4, and fixes a number of issues.
For more details on what's new, see the Kubernetes release notes.
Changes since v1.33.3+k3s1:
- Add retention flag specific for s3 (#12694)
- Backports for August (#12718)
- Bump coredns to 1.12.3 (#12728)
-
- Bump metrics-server to v0.8.0 (#12741)
- Fix cert startup check events (#12746)
- Emit certs OK event on startup, if no certs need renewal (#12760)
- Update to v1.33.4-k3s1 and Go 1.24.5 (#12758)
- Update metric help to be more descriptive. (#12764)
Release v1.33.3+k3s1
This release updates Kubernetes to v1.33.3, and fixes a number of issues.
For more details on what's new, see the Kubernetes release notes.
Changes since v1.33.2+k3s1:
- Add usage description for etcd-snapshot (#12573)
- Refac shell completion to a better command structure (#12605)
- K3s completion shell command will now be separate to specific subcommands for bash and zsh
- GHA + Testing Backports (#12608)
- Backports for 2025-07 (#12631)
- Update to v1.33.3-k3s1 (#12652)
Release v1.33.2+k3s1
This release updates Kubernetes to v1.33.2, and fixes a number of issues.
For more details on what's new, see the Kubernetes release notes.
Changes since v1.33.1+k3s1:
- GHCR image release (#12462)
- Backports for 2025-06 (#12492)
- Bump helm-controller (#12518)
- Update network components (#12512)
- Update to v1.33.2-k3s1 and Go 1.24.4 (#12529)
Release v1.33.1+k3s1
This release updates Kubernetes to v1.33.1, and fixes a number of issues.
For more details on what's new, see the Kubernetes release notes.
Changes since v1.33.0+k3s1:
- Backports for May (#12319)
- Backports for 2025-05 (#12325)
- Fix authorization-config/authentication-config handling (#12344)
- Fix secretsencrypt race conditions (#12355)
- Update to v1.33.1-k3s1 (#12360)
- Fix startup e2e test (#12370)
Release v1.33.0+k3s1
This release updates Kubernetes to v1.33.0, and fixes a number of issues.
For more details on what's new, see the Kubernetes release notes.
Changes since v1.32.4+k3s1
- Build k3s overhaul (#12200)
- Fix sonobuoy conformance testing (#12214)
- Update k8s version to 1.33 (#12221)
- Remove ghcr from drone (#12229)