k3s-io/k3s v1.37.0-rc1+k3s1 on GitHub

What's Changed

Expand docker upgrade test, sunset E2E upgrade test by @dereknola in #13338
Add firewall section to check-config.sh by @dereknola in #13234
Update golangci-lint and re-enable CI linting step by @brandond in #13343
Fix PR lint checkout depth by @brandond in #13369
Update stable channel to v1.34.3+k3s1 by @rafaelbreno in #13374
Bump actions/download-artifact from 6 to 7 by @dependabot[bot] in #13346
Bump stable to 1.34 and add 1.35 by @brandond in #13373
Enable secret encryption on existing clusters by @dereknola in #13370
Bump Local Path Provisioner version by @github-actions[bot] in #13387
Use Get, not Head for channel page by @dereknola in #13402
Fix typos in documentation by @oglok in #13411
Bump actions/cache from 4 to 5 by @dependabot[bot] in #13347
Replace temporary etcd server with raw mvcc store access by @brandond in #13368
Bump Traefik and CoreDNS - Jan 2025 by @dereknola in #13424
Remove flannel external-ip annotations when disabled by @brandond in #13431
Bump local path provisioner to v0.0.34 by @dereknola in #13430
[main] Publish GA images to staging registry by @rafaelbreno in #13438
Bump cni plugins by @brandond in #13439
Fix atomic write in WriteSubnetFile by @luojiyin1987 in #13380
Bump expr-lang/expr by @brandond in #13440
Bump spegel to v0.6.0 by @brandond in #13198
Update longhorn version in integration test from v1.4.0 to v1.10.1 by @brandond in #13443
Bump kine to v0.14.10 for NATS conformance fixes by @brandond in #13441
Remove download/generate from vulncheck by @brandond in #13445
Bump to coredns 1.14.0 by @mgfritch in #13449
Add Momentum Coach AI to K3S adopters list by @geoffreyPerrin in #13467
Fix lines to satisfy lint and fix CI by @manuelbuil in #13475
Update Traefik version to v3.6.7 by @manuelbuil in #13474
Prevent caching on PR of golangci-lint entries by @dereknola in #13487
Move to rootlesskit v2 by @dereknola in #13486
Bump actions/stale from 10.1.0 to 10.1.1 by @dependabot[bot] in #13296
Fix CVE-2025-54410: Update docker/docker to v25.0.13 by @rahulrairai59 in #13473
Bump golang:alpine image version by @github-actions[bot] in #13345
Update install tests with new images, add alma10 by @dereknola in #13489
Bump etcd to v3.6.7 by @brandond in #13495
Add Percona and Solanica to k3s adopters by @edithturn in #13510
[main] Update to v1.35.0-k3s3 by @rafaelbreno in #13524
Fix restart of control-plane-only nodes attempting to reconcile from local datastore by @brandond in #13534
Fix spegel filter for wildcards by @brandond in #13527
Add IPv6 loopback to kubelet-serving cert by @brandond in #13532
Fix handling of empty token file by @brandond in #13529
Use channel.yaml instead of curling for stable for kubectl install by @dereknola in #13531
Fix VPN node IP not being applied to kubelet by @zijiren233 in #13457
Bump aws-actions/configure-aws-credentials from 4 to 5 by @dependabot[bot] in #13185
Bump scorecard checkout to match all other versions by @dereknola in #13568
Bump kine for list/watch revision fixes by @brandond in #13575
Explicitly close mvcc backend to fix high CPU on initial etcd server after restart by @brandond in #13569
Support commit builds via GHA artifacts by @dereknola in #13559
Bump rancher/mirrored-coredns-coredns image version by @github-actions[bot] in #13499
[main] Update stable channel to v1.34.3+k3s3 by @rafaelbreno in #13554
Bump metrics-server to v0.8.1 by @mgfritch in #13594
[main] Add registry prefix to image-list file by @rafaelbreno in #13603
Bump klipper-helm and klipper-lb images by @brandond in #13613
Fix removal of init node via annotation by @brandond in #13624
[master] Update to v1.35.1-k3s1 and Go 1.25.6 by @rafaelbreno in #13638
Update stable to v1.34.4+k3s1 by @rafaelbreno in #13642
Make artifact URL prefix configurable by @manuelbuil in #13367
Bump kine to v0.14.12 by @brandond in #13661
Install binutils-gold only for arm64 builds by @mmoll in #13654
Rootlesskit Revert + Test Fixes by @dereknola in #13681
Improve resilience of datastore bootstrap reconcile from etcd by @brandond in #13677
Bump Traefik to v3.6.9 by @manuelbuil in #13693
[main] Update to v1.35.2-k3s1 and Go 1.25.7 by @rafaelbreno in #13708
Assign github.event to env first by @dereknola in #13715
config: Add default imports to containerd base templates by @fidencio in #13680
update channel server to 1.34.5 by @briandowns in #13732
Add nix-snapshotter support to the embedded containerd by @nuketownada in #13676
Do not create etcd name file if etcd is not in use by @brandond in #13727
Bump actions/download-artifact from 7 to 8 by @dependabot[bot] in #13714
build(deps): bump actions/stale from 10.1.1 to 10.2.0 by @dependabot[bot] in #13670
build(deps): bump aquasecurity/trivy-action from 0.33.1 to 0.34.1 by @dependabot[bot] in #13669
build(deps): bump aws-actions/configure-aws-credentials from 5 to 6 by @dependabot[bot] in #13596
Bump softprops/action-gh-release from 2.2.1 to 2.5.0 by @dependabot[bot] in #13376
Bump rancher/mirrored-coredns-coredns image version by @github-actions[bot] in #13743
Bump klipper-lb and klipper-helm by @brandond in #13761
Bump golang:alpine image version by @github-actions[bot] in #13653
Update packages to remove unmaintained dependencies by @brandond in #13724
Bump DeterminateSystems/nix-installer-action from 17 to 21 by @dependabot[bot] in #13744
Bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #13745
Bump docker/setup-qemu-action from 3 to 4 by @dependabot[bot] in #13746
Bump docker/setup-docker-action from 4 to 5 by @dependabot[bot] in #13747
Save cluster state before reencyrpting secrets with newly created key by @dereknola in #13764
Bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #13748
Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 by @dependabot[bot] in #13713
Bump github.com/docker/cli from 28.3.2+incompatible to 29.2.0+incompatible by @dependabot[bot] in #13730
build(deps): bump github.com/pion/dtls/v3 from 3.0.6 to 3.0.11 by @dependabot[bot] in #13645
Use etcd-snapshot-retention as default for s3 if etcd-s3-retention is not set by @brandond in #13770
Bump traefik and local-path-provisioner by @brandond in #13787
install.sh: Simplify handling for fedora rpm-ostree based distributions by @becarusys in #13712
Bump containerd to v2.2.2 by @brandond in #13788
Bump runc to v1.4.1 by @brandond in #13796
Bump Traefik helm chart version by @manuelbuil in #13805
Fix trivy updatecli config by @manuelbuil in #13816
Bump cni plugins to v1.9.1 by @brandond in #13817
Simplify snapshot compress/decompress logic by @brandond in #13826
build(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #13804
build(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by @dependabot[bot] in #13803
build(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by @dependabot[bot] in #13802
[main] Update to v1.35.3-k3s1 and Go 1.25.7 by @rafaelbreno in #13836
Bump Trivy version by @github-actions[bot] in #13845
Fix typo: overriden -> overridden in snapshot_handler.go in #13847
fix: typo in etcd membership error message by @DT1mote in #13848
Bump helm-controller for job race fix by @brandond in #13853
Add context to controller event recorders by @brandond in #13856
Pin GH Actions to commit sha by @cwayne18 in #13861
Dapper is kill by @cwayne18 in #13860
Update to flannel v0.28.2 by @mgfritch in #13863
[main] Update stable to v1.34.6+k3s1 by @rafaelbreno in #13873
Add sipgate to the list of adopters by @caesarakalaeii in #13881
Add Rocket Technologies to the list of adopters by @BenBo17 in #13890
Make Dockerfile.test more secure by @manuelbuil in #13882
Make tests/integration/Dockerfile.test more secure by @manuelbuil in #13883
Secure the vagrant-setup action.yaml by @manuelbuil in #13884
Secure the e2e yaml GHA by @manuelbuil in #13885
Pin govulncheck GHA version by @manuelbuil in #13887
Verify sha256sum for kubelet, vagrant zip and go binary by @manuelbuil in #13889
Check the k3s-root sha256sum by @manuelbuil in #13888
build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in #13891
build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in #13880
build(deps): bump github/codeql-action from 4.34.1 to 4.35.1 by @dependabot[bot] in #13879
build(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by @dependabot[bot] in #13878
build(deps): bump updatecli/updatecli-action from 2.100.0 to 3.0.0 by @dependabot[bot] in #13876
Fix reproducibility of embedded data tarball by @jonhermansen in #13875
build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2 by @dependabot[bot] in #13837
build(deps): bump github.com/nats-io/nats-server/v2 from 2.12.2 to 2.12.6 by @dependabot[bot] in #13852
Fix S3 test to account for change to s3mock by @brandond in #13906
Bump klipper helm to v0.9.16-build20260410 by @vitorsavian in #13908
Bump runc/spegel/helm-controller/kine by @brandond in #13909
build(deps): bump actions/github-script from 8.0.0 to 9.0.0 by @dependabot[bot] in #13914
build(deps): bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 by @dependabot[bot] in #13915
build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #13916
build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 by @dependabot[bot] in #13917
build(deps): bump docker/build-push-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #13918
Bump traefik to 3.6.12 by @manuelbuil in #13912
Fix embedded executor VPN config injection by @brandond in #13920
Bump containerd to v2.2.3 by @brandond in #13931
Bump flannel to v0.28.4 by @thomasferrandiz in #13937
[main] Update to v1.35.4-k3s1 and Go 1.25.9 by @rafaelbreno in #13946
[main] Immutable release changes by @rafaelbreno in #13902
Bump Traefik to 3.6.13 by @cwayne18 in #13969
[main] Switch from draft to pre-release by @rafaelbreno in #13951
Fix SANs added from comma-separated node-external-ip list by @brandond in #13989
Fix docker dualstack test by @brandond in #13994
Bump klipper-helm image for revision check fix by @brandond in #13995
Bump upstream to v1.36 by @vitorsavian in #13986
Add k8gb to adopters list in ADOPTERS.md by @ytsarev in #13978
Bump Klipper LB version by @github-actions[bot] in #13976
Update stable to v1.35.4+k3s1 and add v1.36 entry by @rafaelbreno in #14016
Replace PreparingExecutor with explicit embedded executor init by @brandond in #14000
Bump spegel to v0.7.0 by @brandond in #14003
Bump rancher/mirrored-coredns-coredns image version by @github-actions[bot] in #14005
Fix kubectl exec when using docker by @vitorsavian in #14019
Improve K3s BUILDING and CONTRIBUTING guides by @manuelbuil in #13985
Bump Klipper LB version by @github-actions[bot] in #14026
[main] Fix s3 path by @rafaelbreno in #14015
add lost return by @nameearly in #14020
Bump kine to v0.15.0 by @brandond in #14030
Bump Local Path Provisioner version by @github-actions[bot] in #14038
Update Orlin's mail by @OrlinVasilev in #14047
[main] Update to v1.36.1-k3s1 and Go 1.26.2 by @rafaelbreno in #14052
Fix cron to run everyday at 6PM UTC by @rafaelbreno in #14041
Bump klipper-helm image tag by @brandond in #14054
chore: fix duplicated "the" in etcd/s3 and permissions doc comments by @quyentonndbs in #14072
Add AI contribution guide by @brandond in #14090
[main] Update stable channel to v1.35.5+k3s1 by @rafaelbreno in #14091
fix: use same package manager for k3s-selinux removal as for installation by @becarusys in #13711
Nit: Wrong integration test name by @manuelbuil in #14097
Use 0600 permissions for compressed etcd snapshots by @eran132 in #14092
fix: populate IfaceName in LookupExtInterface for VXLAN recreation by @jkubo in #14086
Fix token delete argument handling by @elysia090 in #14076
Skip bridge-nf-call sysctls when kube-proxy and flannel are disabled by @eran132 in #14093
build(deps): bump updatecli/updatecli-action from 3.0.0 to 3.1.2 by @dependabot[bot] in #13980
build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in #13982
build(deps): bump docker/login-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #13981
Bump kine to v0.16.0 by @brandond in #14123
Bump spegel to v0.7.1 for libp2p-kad-dht panic fix by @brandond in #14128
Bump Traefik to v3.7.1 by @manuelbuil in #14134
Bump kine for t4 fixes by @brandond in #14132
build(deps): bump actions/cache from 5.0.4 to 5.0.5 by @dependabot[bot] in #13979
Stop opening depedabot PRs for GitHub Action patch versions by @dereknola in #14143
Bump klipper-helm to v0.11 for helmv4 by @brandond in #14145
Bump containerd to v2.3.1 by @brandond in #14136
bump etcd to v3.6.12 by @brandond in #14149
Agentic workflows by @dereknola in #14129
Use of CNCF Runners in CI by @dereknola in #14144
Optimize Test order by @dereknola in #14186
Bump v3.7.4 Traefik by @manuelbuil in #14192
test(kubeflags): add K3sCleanup between server restarts to fix flake by @amaanx86 in #14189
Passthru KINE_ environment variables in install.sh and added new hash by @dnoland1 in #14188
Bump golang.org/x/net to v0.55.0 to fix CVE-2026-39821 by @jimmykarily in #14203
Reduce GRPC console spam by @brandond in #14202
build(deps): bump docker/metadata-action from 6.0.0 to 6.1.0 by @dependabot[bot] in #14147
build(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 by @dependabot[bot] in #14139
build(deps): bump github/codeql-action from 4.35.2 to 4.36.1 by @dependabot[bot] in #14148
Fix cloud-controller-manager exiting due to missing core RBAC by @brandond in #14201
Bump k3s-root to v0.15.2 by @brandond in #14205
Bump rancher/mirrored-coredns-coredns image version by @github-actions[bot] in #14208
Address new linting requirements by @dereknola in #14210
Revert "Add runtime checking of golang version" by @brandond in #14219
Dualstack spegel by @dereknola in #13831
Update github actions in a single grouped PR every month by @dereknola in #14221
Bump klipper-helm for CVE reasons by @cwayne18 in #14235
Bump containerd with the fix for []byte envvar value by @vitorsavian in #14240
[main] Update to v1.36.2-k3s1 and Go 1.26.4 by @rafaelbreno in #14231
Use built-in etcd bootstrap defrag threshold if specified by @alexander-demicev in #14099
build(deps): bump the action-deps group with 7 updates by @dependabot[bot] in #14226
build(deps): bump ubuntu from 24.04 to 26.04 in /tests/e2e/scripts by @dependabot[bot] in #14040
build(deps): bump alpine from 3.22 to 3.24 in /package by @dependabot[bot] in #14225
Unit test expansion by @dereknola in #14249
Fix codecov reports for E2E and Integration tests by @dereknola in #14252
Bump containerd to v2.3.2-k3s1 by @vitorsavian in #14253
Add image names to file cache by @brandond in #14266
Bump cri-api and containerd for upstream env string fix by @brandond in #14276
[main] Update stable channel to v1.36.2+k3s1 by @rafaelbreno in #14281
Add Sophotech to the list of adopters by @archy-rock3t-cloud in #14285
Migrate from local targets to defaults by @dereknola in #14204
Fix image-endpoint assignment in run_linux.go by @neiltalap in #14246
Preserve logical paths for symlinked manifests by @immanuwell in #14087
Bump dynamiclistener to v0.9.0-rc.2 for wildcard tls-san support by @Eshaan-Lumba in #14280
fix: pre-apply feature gates before embedded API server starts by @SebTardif in #14287
Add helm-controller-arg flag by @manuelbuil in #14185
Bump kine to v0.16.3 for perf improvements by @brandond in #14310
Bump spegel to v0.7.2 by @brandond in #14311
fix: re-import airgap images when timestamp changes even if size is same by @bheemareddy in #14288
Use xx for multiarch builds without emulation by @dereknola in #14291
Bump golang:alpine image version by @github-actions[bot] in #14247
Add backoff to initial snapshot reconcile by @brandond in #14322
Synchronize egress map and CIDR trie reads in tunnel dialBackend by @archy-rock3t-cloud in #14341
Redact single-dash secret flags in the node args annotation by @archy-rock3t-cloud in #14340
Emit events attached to node when snapshot retention fails by @brandond in #14345
Run Conformance tests nightly by @dereknola in #14338
Bump Traefik to v3.7.7 by @manuelbuil in #14326
Bump mirrored-pause to 3.10.2 by @dereknola in #14339
build(deps): bump the action-deps group with 14 updates by @dependabot[bot] in #14394
Bump dynamiclistener for atomic write fix by @brandond in #14382
Bump helm-controller/klipper-helm by @brandond in #14403
Simplify WriteSubnetFile cleanup and make atomic by @brandond in #14405
Fix typo in snapshot prune event by @brandond in #14410
Bump rancher/mirrored-coredns-coredns image version by @github-actions[bot] in #14415
Add updatecli manifest to bump Kubernetes across multiple release branches by @rafaelbreno in #14402
Use new Traefik v3.7.8 by @manuelbuil in #14404
Bump metrics-server to v0.9.0 by @mgfritch in #14416
updatecli: relax metrics-server semver filter et al. by @mgfritch in #14429
updatecli: add missing requiredEnv by @mgfritch in #14434
Bump helm-controller and klipper-helm for --force-conflicts support by @brandond in #14446
[main] Bump k3s-io/kubernetes and Go references by @github-actions[bot] in #14457
Bump etcd to v3.6.14 by @brandond in #14460
Fix production builds always enabling Go coverage instrumentation by @mgfritch in #14465
feat: support custom kubeconfig name by @kasefuchs in #14440
Require node password informer sync before using cache by @brandond in #14459
Bump helm-controller and klipper-helm by @brandond in #14474
Enable unit tests by @manuelbuil in #14480
fix: change sles to use slemicro rpms instead of microos by @vitorsavian in #14472
tests: make rootless uidmap install robust against stale apt cache by @mgfritch in #14490
[main] Update stable channel to v1.36.3+k3s1 by @rafaelbreno in #14492
Etcd client locking by @dcermak in #14488
tests: Install rke2-multus-crd chart for multus e2e test by @mgfritch in #14489
Filter large untemplated issues by @dereknola in #14435
Fix typo in spegel deferred store comment by @Lcos-000 in #14485
make explicit where coredns customizations should be made by @turettn in #14503
Bump docker version in CI to 29 by @brandond in #14506
Don't retag images for a registry they are already hosted by by @boothb in #14484
Tidy dockerfile and build stages by @brandond in #14511
Add advertise-address to SANs before generating apiserver cert by @somaz94 in #14516
[main] Bump Local Path Provisioner version by @github-actions[bot] in #14496
Bump containerd to v2.3.4-k3s1.36 by @vitorsavian in #14510
Bump kine to v0.16.4 for nats replay fix by @brandond in #14521
updatecli: remove release-1.33 branch by @mgfritch in #14537
[main] Update to v1.36.4-k3s1 and Go 1.26.7 by @rafaelbreno in #14546
feat: Add Project Bluefin to adopters list by @castrojo in #14549
Bump k8s to v1.37 by @vitorsavian in #14509
Bump Traefik and bundle gateway-api crds by @manuelbuil in #14573

New Contributors

@oglok made their first contribution in #13411
@luojiyin1987 made their first contribution in #13380
@geoffreyPerrin made their first contribution in #13467
@rahulrairai59 made their first contribution in #13473
@edithturn made their first contribution in #13510
@zijiren233 made their first contribution in #13457
@mmoll made their first contribution in #13654
@fidencio made their first contribution in #13680
@nuketownada made their first contribution in #13676
@becarusys made their first contribution in #13712
@DT1mote made their first contribution in #13848
@caesarakalaeii made their first contribution in #13881
@BenBo17 made their first contribution in #13890
@jonhermansen made their first contribution in #13875
@ytsarev made their first contribution in #13978
@nameearly made their first contribution in #14020
@quyentonndbs made their first contribution in #14072
@eran132 made their first contribution in #14092
@jkubo made their first contribution in #14086
@elysia090 made their first contribution in #14076
@amaanx86 made their first contribution in #14189
@jimmykarily made their first contribution in #14203
@alexander-demicev made their first contribution in #14099
@archy-rock3t-cloud made their first contribution in #14285
@neiltalap made their first contribution in #14246
@immanuwell made their first contribution in #14087
@SebTardif made their first contribution in #14287
@bheemareddy made their first contribution in #14288
@kasefuchs made their first contribution in #14440
@Lcos-000 made their first contribution in #14485
@turettn made their first contribution in #14503
@boothb made their first contribution in #14484
@somaz94 made their first contribution in #14516
@castrojo made their first contribution in #14549

Full Changelog: v1.35.0+k3s1...v1.37.0-rc1+k3s1