跳到主要内容

v1.36.X

Upgrade Notice

Before upgrading from earlier releases, be sure to read the Kubernetes Urgent Upgrade Notes.

VersionRelease dateKubernetesKineSQLiteEtcdContainerdRuncFlannelMetrics-serverTraefikCoreDNSHelm-controllerLocal-path-provisioner
v1.36.5+k3s1Sep 30 2026v1.36.5v0.16.53.53.4v3.6.14-k3s3v2.3.4-k3s1.36v1.4.2v0.28.4v0.9.0v3.7.13v1.14.7v0.17.9v0.0.37
v1.36.4+k3s1Aug 27 2026v1.36.4v0.16.43.53.4v3.6.14-k3s1v2.3.4-k3s1.36v1.4.2v0.28.4v0.9.0v3.7.8v1.14.6v0.17.7v0.0.37
v1.36.3+k3s1Aug 04 2026v1.36.3v0.16.33.53.2v3.6.14-k3s1v2.3.2-k3s2v1.4.2v0.28.4v0.9.0v3.7.8v1.14.6v0.17.7v0.0.36
v1.36.2+k3s1Jun 24 2026v1.36.2v0.16.13.53.0v3.6.12-k3s1v2.3.2-k3s2v1.4.2v0.28.4v0.8.1v3.7.4v1.14.4v0.17.1v0.0.36
v1.36.1+k3s1May 20 2026v1.36.1v0.15.03.53.0v3.6.7-k3s1v2.2.3-k3s1v1.4.2v0.28.4v0.8.1v3.6.13v1.14.3v0.17.1v0.0.36
v1.36.0+k3s1May 06 2026v1.36.0v0.14.163.51.3v3.6.7-k3s1v2.2.3-k3s1v1.4.2v0.28.4v0.8.1v3.6.13v1.14.2v0.17.1v0.0.35

Release v1.36.5+k3s1​

Warning

This release upgrades Traefik chart to v40.x which includes a breaking change for the ingress-nginx migration: the provider name changes from kubernetesIngressNginx to kubernetesIngressNGINX. Check https://github.com/traefik/traefik-helm-chart/releases/tag/v40.0.0 for more details

This release updates Kubernetes to v1.36.5, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.36.4+k3s1:​

  • Bump rancher/mirrored-coredns-coredns image version (#14534)
  • Bump gateway-api and traefik image versions for K3s 1.36 (#14567)
    • Bump Traefik image to 3.7.12 and gateway-api to 1.6.1
  • Bump Traefik to v3.7.13 (#14610)
  • Bump google.golang.org/grpc to v1.83.2 for CVE-2026-84445 (#14620)
  • Backports for 2026-09 (#14632)
    • Fix restore from compressed etcd snapshot #14528
    • Enable seccomp in riscv64 builds #14529
    • Use ginkgo CLI to run tests #14531
    • Bump k3s-io/api to v0.2.0 #14570
    • Servicelb multiple lbpools #14547
    • Close minio.Object after read #14580
    • Bump k3s-io/apis again #14589
    • Fix --flannel-cni-conf not reaching the embedded flannel #14598
    • Check-config: suppress colors when stdout is not a terminal #14595
    • Fix deploy controller not re-applying manifests when mtime is pinned to the epoch #14568
    • Bump etcd to v3.7.1-k3s3 for nonblocking logging support #14628
    • Bump kine to v0.17.1 #14627
  • Require node password informer sync before using cache (#14673)
  • Bump helm-controller (#14685)
  • Bump k3s-io/kubernetes and Go references (#14694)
  • Reject anonymous access to supervisor router (spegel/pprof/metrics) (#14702)
  • Improve CA hash validation (#14706)

Release v1.36.4+k3s1​

Warning

This release upgrades Traefik chart to v40.x which includes a breaking change for the ingress-nginx migration: the provider name changes from kubernetesIngressNginx to kubernetesIngressNGINX. Check https://github.com/traefik/traefik-helm-chart/releases/tag/v40.0.0 for more details

This release updates Kubernetes to v1.36.4, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.36.3+k3s1:​

Release v1.36.3+k3s1​

Warning

This release upgrades Traefik chart to v40.x which includes a breaking change for the ingress-nginx migration: the provider name changes from kubernetesIngressNginx to kubernetesIngressNGINX. Check https://github.com/traefik/traefik-helm-chart/releases/tag/v40.0.0 for more details

This release updates Kubernetes to v1.36.3, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.36.2+k3s1:​

  • Bump dynamiclistener to v0.9.0-rc.2 for wildcard tls-san support (#14312)
    • Add support for wildcard domains in --tls-san (e.g. --tls-san=*.example.com).
  • July Testing Backports (#14328)
  • July K3s Build Rework + GHA bumps (#14332)
  • Backports for 2026-07 (#14348)
  • Bump mirrored-pause to 3.10.2 (#14389)
  • Bump Traefik to v3.7.7 (#14381)
  • More backports for 2026-07 (#14406)
  • Fix typo in snapshot prune event (#14411)
  • Bump rancher/mirrored-coredns-coredns image version (#14424)
  • Bump golang:alpine image version (#14432)
  • Bump rancher/mirrored-metrics-server image version (#14437)
  • Use new Traefik v3.7.8 (#14426)
  • Bump helm-controller and klipper-helm for --force-conflicts support (#14442)
  • Bump k3s-io/kubernetes and Go references (#14456)
  • Bump etcd to v3.6.14 (#14461)
  • Fix production builds always enabling Go coverage instrumentation (#14466)
  • Bump helm-controller and klipper-helm (#14475)

Release v1.36.2+k3s1​

Warning

This release upgrades Traefik chart to v40.x which includes a breaking change for the ingress-nginx migration: the provider name changes from kubernetesIngressNginx to kubernetesIngressNGINX. Check https://github.com/traefik/traefik-helm-chart/releases/tag/v40.0.0 for more details

This release updates Kubernetes to v1.36.2, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.36.1+k3s1:​

  • Backport GitHub Action SHA pin updates from main (#14127)
  • Backports for 2026-06 (#14151)
  • Bump v3.7.4 Traefik (#14193)
  • More backports for 2026-06 (#14211)
  • Testing Backports 2026-06 (#14213)
  • Bump klipper-helm for CVE reasons (#14235) (#14236)
  • Bump containerd with the fix for []byte (#14243)
  • Update to v1.36.2-k3s1 and Go 1.26.4 (#14230)
  • Bump containerd to v2.3.2-k3s1 (#14254)
  • Bump cri-api and containerd for upstream env string fix (#14277)

Release v1.36.1+k3s1​

This release updates Kubernetes to v1.36.1, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.36.0+k3s1:​

  • Backports for 2026-05 (#14032)
  • Update rancher/local-path-provisioner image version (#14042)
  • Update to v1.36.1-k3s1 and Go 1.26.2 (#14051)
  • Bump klipper-helm image tag (#14055)

Release v1.36.0+k3s1​

This release updates Kubernetes to v1.36.0, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.35.3+k3s1:​

  • Add sipgate to the list of adopters (#13881)
  • Add Rocket Technologies to the list of adopters (#13890)
  • Make Dockerfile.test more secure (#13882)
  • Make tests/integration/Dockerfile.test more secure (#13883)
  • Secure the e2e yaml GHA (#13885)
  • Pin govulncheck GHA version (#13887)
  • Verify sha256sum for kubelet, vagrant zip and go binary (#13889)
  • Check the k3s-root sha256sum (#13888)
  • Fix reproducibility of embedded data tarball (#13875)
  • Fix S3 test to account for change to s3mock (#13906)
  • Bump runc/spegel/helm-controller/kine (#13909)
    • Bump runc to v1.4.2
    • Bump spegel to v0.6.0-k3s2
    • Bump helm-controller to v0.17.1
    • Bump kine to v0.14.16
  • Fix embedded executor VPN config injection (#13920)
  • Bump containerd to v2.2.3 (#13931)
  • Bump flannel to v0.28.4 (#13937)
  • Immutable release changes (#13902)
  • Bump Traefik to 3.6.13 (#13969)
  • Switch from draft to pre-release (#13951)
  • Fix SANs added from comma-separated node-external-ip list (#13989)
  • Fix docker dualstack test (#13994)
  • Bump klipper-helm image for revision check fix (#13995)
  • Bump upstream to v1.36 (#13986)
  • Fix kubectl exec when using docker (#14021)