This release updates Kubernetes to v1.37.0.
Important Note
If your server (control-plane) nodes were not started with the --token CLI flag or config file key, a randomized token was generated during initial cluster startup. This key is used both for joining new nodes to the cluster, and for encrypting cluster bootstrap data within the datastore. Ensure that you retain a copy of this token, as is required when restoring from backup.
You may retrieve the token value from any server already joined to the cluster:
cat /var/lib/rancher/rke2/server/tokenChanges since v1.36.3+rke2r1:
- Validate-charts: validate vsphere prime (hardened) images (#10914)
- Fix package-windows-images platform matching (#10942)
- Add cluster load balancer e2e test to nightly CNI workflow (#10937)
- Bump hardened-crictl to v1.36.0-build20260727 (#10954)
- Bump helm-controller and klipper-helm (#10957)
- Add rke2-security-responder chart (#10935)
- Add rke2-security-responder
- Update rancher-vsphere-csi to 3.7.2-rancher600 and align hardened CSI images (#10983)
- Add nightly kube-vip cluster load balancer E2E test (#10982)
- Update stable channel to v1.35.7+rke2r1 (#10996)
- Add warning about RKE_INGRESS_CONTROLLER deprecation (#11007)
- Bump rke2-metrics-server to 3.13.106 (#11020)
- Nightly-cni: test against master build instead of latest release (#11000)
- Bump systemd-node and use same opensuse/leap base for test target (#10785)
- Fix windows airgap by refactoring rke2-runtime image build+bundle pipeline (#11028)
- Bump the action-deps group across 1 directory with 8 updates (#11030)
- Charts: Bump Harvester CSI driver 0.1.31 (#11034)
- Add updatecli policy for hardened runtime images (#11053)
- Bump HCP 0.2.15 (#11041)
- Update hardened runtime images in Dockerfile (#11054)
- Update ingress-nginx to chart 4.15.107 / image v1.15.1-prime10 (#11052)
- Add a updatecli config for coredns and its 3 images (#11060)
- Bump containerd to v2.3.4-k3s1.36 (#11061)
- Updatecli: add manifest to automate metrics-server chart bumps (#11080)
- Update Flannel chart to v0.28.906 (#11069)
- Update Kubernetes Metrics Server chart 3.14.000 (#11082)
- Bump hardened-snapshot-controller (#11084)
- Ci: extract reusable build-e2e-artifacts workflow (#11078)
- Bump klipper-helm to v0.13.3-build20260820 (#11088)
- Updatecli: create-github-app-token v3.2.0 uses 'client-id' (#11093)
- Update containerd regex to accept -k3s1.XX tags (#11101)
- Bump K3s and CCM for 2026-08 release cycle (#11067)
- Remove leftover nft tables and blackhole route from canal (#10956)
- Remove calico leftover nft tables and blackhole routes when uninstalling rke2
- Fix 'no such image' in Release CI (#11114)
- Update Canal chart to v3.32.1-build2026082700 (#11131)
- Changes for windows 2025 server e2e testing (#11127)
- Add GatewayAPI CRD chart (#11136)
- RKE2 bundles gateway-api crds v1.6.1
- Bump rke2-security-responder to v0.1.5 (#11142)
- Bundle rke2-multus-crd chart and bump multus to v4.3.010 (#10998)
- Bump k8s to v1.37.0, etcd to v3.7.1, vpshere charts (#11147)
- Remove standalone ingress-nginx controller option (#11156)
- Users can no longer select
ingress-controller: ingress-nginx. Onlytraefik, ingress-nginxis still supported to allow a last chance for migration.
- Users can no longer select
- Bump gateway-api-crd version (#11164)
- Disable rke2-multus-crd chart when multus is not selected (#11168)
- Rke2-multus: install whereabouts CRDs unconditionally in crd chart (#11177)
- Bump Traefik to v3.7.13 (#11181)
- Fix ingress bootstrap with comma-separated ingress-controller (#11194)
- Bump Traefik to v3.7.13 (grpc CVE fix) (#11198)
- Cnis update for 2026-09 release (#11203)
- Update hardened core, coredns, vsphere, metric images (#11210)
- Bump google.golang.org/grpc to v1.82.2 for CVE-2026-84445 (#11191)
- Bump grpc to v1.83.2 and x/crypto to v0.55.0 (#11217)
- Update klipper-helm, etcd, k8s, and rke2-cloud-provider (#11218)
- Rke2-snapshot-controller: bump image to v8.6.0-build20260909 (#11221)
Charts Versions
| Component | Version |
|---|---|
| rke2-cilium | 1.20.103 |
| rke2-canal | v3.32.2-build2026090900 |
| rke2-calico | v3.32.200 |
| rke2-calico-crd | v3.32.200 |
| rke2-coredns | 1.47.100 |
| rke2-ingress-nginx | 4.15.109 |
| rke2-metrics-server | 3.14.001 |
| rke2-multus | v4.3.101 |
| rancher-vsphere-csi | 3.7.3-rancher300 |
| rancher-vsphere-cpi | 1.16.100 |
| harvester-cloud-provider | 0.2.1500 |
| harvester-csi-driver | 0.1.3100 |
| rke2-snapshot-controller | 5.2.004 |
| rke2-snapshot-controller-crd | 5.2.004 |
| rke2-traefik | 41.2.003 |
| rke2-traefik-crd | 41.2.003 |
Packaged Component Versions
| Component | Version |
|---|---|
| Kubernetes | v1.37.0 |
| Etcd | v3.7.1-k3s1 |
| Containerd | v2.3.4-k3s1 |
| Runc | v1.4.3 |
| Metrics-server | v0.9.0 |
| CoreDNS | v1.14.7 |
| Ingress-Nginx | v1.14.5-hardened2 |
| Helm-controller | v0.17.7 |
| Traefik | v3.7.13 |
Available CNIs
| Component | Version | FIPS Compliant |
|---|---|---|
| Canal (Default) | Flannel v0.28.9 Calico v3.32.2 | Yes |
| Calico | v3.32.2 | No |
| Cilium | v1.20.1 | No |
| Multus | v4.3.1 | No |
Helpful Links
As always, we welcome and appreciate feedback from our community of users. Please feel free to:
- Open issues here
- Join our Slack channel
- Check out our documentation for guidance on how to get started.