chore(deps): update dependency k3s-io/k3s to v1.36.0+k3s1

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
k3s-io/k3s	minor	v1.34.2+k3s1 → v1.36.0+k3s1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

k3s-io/k3s (k3s-io/k3s)

v1.36.0+k3s1: v1.36.0+k3s1

Compare Source

This release updates Kubernetes to v1.36.0, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.35.0+k3s1:

• Add firewall section to check-config.sh (#​13234)
• Update golangci-lint and re-enable CI linting step (#​13343)
• Enable secret encryption on existing clusters (#​13370)
• Use Get, not Head for channel page (#​13402)
• Replace temporary etcd server with raw mvcc store access (#​13368)
• Remove flannel external-ip annotations when disabled (#​13431)
• Bump local path provisioner to v0.0.34 (#​13430)
• Publish GA images to staging registry (#​13438)
• Fix atomic write in WriteSubnetFile (#​13380)
• Bump expr-lang/expr (#​13440)
• Bump spegel to v0.6.0 (#​13198)
• Update longhorn version in integration test from v1.4.0 to v1.10.1 (#​13443)
• Remove download/generate from vulncheck (#​13445)
• Add Momentum Coach AI to K3S adopters list (#​13467)
  • NONE
• Move to rootlesskit v2 (#​13486)
• Fix CVE-2025-54410: Update docker/docker to v25.0.13 (#​13473)
• Bump etcd to v3.6.7 (#​13495)
• Add Percona and Solanica to k3s adopters (#​13510)
• Fix restart of control-plane-only nodes attempting to reconcile from local datastore (#​13534)
• Fix spegel filter for wildcards (#​13527)
• Add IPv6 loopback to kubelet-serving cert (#​13532)
• Fix handling of empty token file (#​13529)
• Use channel.yaml instead of curling for stable for kubectl install (#​13531)
• Fix VPN node IP not being applied to kubelet (#​13457)
• Bump scorecard checkout to match all other versions (#​13568)
• Explicitly close mvcc backend to fix high CPU on initial etcd server after restart (#​13569)
• Support commit builds via GHA artifacts (#​13559)
• Bump metrics-server to v0.8.1 (#​13594)
• Add registry prefix to image-list file (#​13603)
• Fix removal of init node via annotation (#​13624)
• Make artifact URL prefix configurable (#​13367)
  • Added INSTALL_K3S_ARTIFACT_URL to donwload K3s binary from a different URL
• Install binutils-gold only for arm64 builds (#​13654)
• Rootlesskit Revert + Test Fixes (#​13681)
• Improve resilience of datastore bootstrap reconcile from etcd (#​13677)
• Assign github.event to env first (#​13715)
• Config: Add default imports to containerd base templates (#​13680)
  • Containerd config generated by k3s now includes imports pointing at versioned drop-in directories: config.toml.d for v2 config and config-v3.toml.d for v3 (e.g. /var/lib/rancher/k3s/agent/etc/containerd/config.toml.d/*.toml and .../config-v3.toml.d/*.toml). Additional .toml files in the matching directory are automatically loaded by containerd. Use these directories for drop-in config (e.g. proxy plugins, custom runtimes, or debug settings) without modifying the main config or custom templates.
• Add nix-snapshotter support to the embedded containerd (#​13676)
  • Add nix-snapshotter plugin to the embedded containerd to enable rootless k3s + nix-snapshotter
• Do not create etcd name file if etcd is not in use (#​13727)
• Bump rancher/mirrored-coredns-coredns image version (#​13743)
• Update packages to remove unmaintained dependencies (#​13724)
• Save cluster state before reencyrpting secrets with newly created key (#​13764)
• Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 (#​13713)
• Bump github.com/docker/cli from 28.3.2+incompatible to 29.2.0+incompatible (#​13730)
• Build(deps): bump github.com/pion/dtls/v3 from 3.0.6 to 3.0.11 (#​13645)
• Use etcd-snapshot-retention as default for s3 if etcd-s3-retention is not set (#​13770)
• Install.sh: Simplify handling for fedora rpm-ostree based distributions (#​13712)
• Bump cni plugins to v1.9.1 (#​13817)
• Simplify snapshot compress/decompress logic (#​13826)
• Fix typo: overriden -> overridden in snapshot_handler.go (#​13847)
• Fix: typo in etcd membership error message (#​13848)
• Bump helm-controller for job race fix (#​13853)
• Add context to controller event recorders (#​13856)
• Dapper is kill (#​13860)
• Add sipgate to the list of adopters (#​13881)
• Add Rocket Technologies to the list of adopters (#​13890)
• Pin govulncheck GHA version (#​13887)
• Verify sha256sum for kubelet, vagrant zip and go binary (#​13889)
• Check the k3s-root sha256sum (#​13888)
• Build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#​13891)
• Fix reproducibility of embedded data tarball (#​13875)
• Build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2 (#​13837)
• Build(deps): bump github.com/nats-io/nats-server/v2 from 2.12.2 to 2.12.6 (#​13852)
• Fix S3 test to account for change to s3mock (#​13906)
• Bump runc/spegel/helm-controller/kine (#​13909)
  • Bump runc to v1.4.2
  • Bump spegel to v0.6.0-k3s2
  • Bump helm-controller to v0.17.1
  • Bump kine to v0.14.16
• Fix embedded executor VPN config injection (#​13920)
• Bump containerd to v2.2.3 (#​13931)
• Bump flannel to v0.28.4 (#​13937)
• Immutable release changes (#​13902)
• Bump Traefik to 3.6.13 (#​13969)
• Switch from draft to pre-release (#​13951)
• Fix SANs added from comma-separated node-external-ip list (#​13989)
• Fix docker dualstack test (#​13994)
• Bump klipper-helm image for revision check fix (#​13995)
• Bump upstream to v1.36 (#​13986)
• Fix kubectl exec when using docker (#​14021)

Embedded Component Versions

Component	Version
Kubernetes	v1.36.0
Kine	v0.14.16
SQLite	3.51.3
Etcd	v3.6.7-k3s1
Containerd	v2.2.3-k3s1
Runc	v1.4.2
Flannel	v0.28.4
Metrics-server	v0.8.1
Traefik	v3.6.13
CoreDNS	v1.14.2
Helm-controller	v0.17.1
Local-path-provisioner	v0.0.35

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.35.4+k3s1: v1.35.4+k3s1

Compare Source

This release updates Kubernetes to v1.35.4, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.35.3+k3s1:

• Immutable release changes (#​13901)
• Backports for 2026-04 (#​13929)
• Bump flannel to v0.28.4 (#​13939)
• Bump traefik to 3.6.12 (#​13928)
• Update to v1.35.4-k3s1 and Go 1.25.9 (#​13945)
• Switch from draft to pre-release (#​13950)
• Bump Traefik to 3.6.13 (#​13969) (#​13970)
• Fix SANs added from comma-separated node-external-ip list (#​13990)
• Bump klipper-helm image for revision check fix (#​13996)

Embedded Component Versions

Component	Version
Kubernetes	v1.35.4
Kine	v0.14.16
SQLite	3.51.3
Etcd	v3.6.7-k3s1
Containerd	v2.2.3-k3s1
Runc	v1.4.2
Flannel	v0.28.4
Metrics-server	v0.8.1
Traefik	v3.6.13
CoreDNS	v1.14.2
Helm-controller	v0.17.1
Local-path-provisioner	v0.0.35

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.35.3+k3s1: v1.35.3+k3s1

Compare Source

This release updates Kubernetes to v1.35.3, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.35.2+k3s1:

• • Bump to coredns 1.14.2 (#​13757)
• Save cluster state before reencyrpting secrets with newly created key (#​13771)
• Backports for 2026-03 (#​13789)
• Bump runc to v1.4.1 (#​13797)
• Bump Traefik helm chart version (#​13815)
• Bump cni plugins to v1.9.1 (#​13822)
• Simplify snapshot compress/decompress logic (#​13827)
• Update to v1.35.3-k3s1 and Go 1.25.7 (#​13835)
• Chore: Update Trivy version in Dockerfile.dapper (#​13851)
• • Update to flannel v0.28.2 (#​13868)

Embedded Component Versions

Component	Version
Kubernetes	v1.35.3
Kine	v0.14.14
SQLite	3.51.2
Etcd	v3.6.7-k3s1
Containerd	v2.2.2-k3s1
Runc	v1.4.1
Flannel	v0.28.2
Metrics-server	v0.8.1
Traefik	v3.6.10
CoreDNS	v1.14.2
Helm-controller	v0.16.17
Local-path-provisioner	v0.0.35

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.35.2+k3s1: v1.35.2+k3s1

Compare Source

This release updates Kubernetes to v1.35.2, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.35.1+k3s1:

• Rootlesskit Revert + Test Fixes (#​13689)
• Backports for 2026-02 BONUS RELEASE (#​13690)
• Bump Traefik to v3.6.9 (#​13703)
• Update to v1.35.2-k3s1 and Go 1.25.7 (#​13707)

Embedded Component Versions

Component	Version
Kubernetes	v1.35.2
Kine	v0.14.12
SQLite	3.51.2
Etcd	v3.6.7-k3s1
Containerd	v2.1.5-k3s1
Runc	v1.4.0
Flannel	v0.28.0
Metrics-server	v0.8.1
Traefik	v3.6.9
CoreDNS	v1.14.1
Helm-controller	v0.16.17
Local-path-provisioner	v0.0.34

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.35.1+k3s1: v1.35.1+k3s1

Compare Source

This release updates Kubernetes to v1.35.1, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.35.0+k3s3:

• Bulk Backports 2026-02 (#​13564)
• Explicitly close mvcc backend to fix high CPU on initial etcd server after restart (#​13570)
• Backports for 2026-02 (#​13580)
• Bump kine for list/watch revision fixes (#​13576)
• Fix VPN node IP not being applied to kubelet (#​13560)
• • Bump to coredns 1.14.1 and metrics-server v0.8.1 (#​13608)
• Add registry prefix to image-list file (#​13602)
• Bump klipper-helm and klipper-lb images (#​13619)
• Fix removal of init node (#​13630)
• Update to v1.35.1-k3s1 and Go 1.25.6 (#​13637)

Embedded Component Versions

Component	Version
Kubernetes	v1.35.1
Kine	v0.14.11
SQLite	3.51.1
Etcd	v3.6.7-k3s1
Containerd	v2.1.5-k3s1
Runc	v1.4.0
Flannel	v0.28.0
Metrics-server	v0.8.1
Traefik	v3.6.7
CoreDNS	v1.14.1
Helm-controller	v0.16.17
Local-path-provisioner	v0.0.34

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.35.0+k3s3: v1.35.0+k3s3

Compare Source

This release updates Kubernetes to v1.35.0, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.35.0+k3s1:

• Add firewall section to check-config.sh (#​13390)
• Expand docker upgrade test, sunset E2E upgrade test (#​13398)
• Allow k3s secrets-encrypt enable on existing clusters (#​13403)
• Chore: Bump charts - Jan 2025 (#​13420)
• Bump local path provisioner to v0.0.34 (#​13426)
• Backports for 2026-01 (#​13446)
• Bump to coredns 1.14.0 (#​13451)
• Update Traefik version to v3.6.7 (#​13484)
• Bump etcd to v3.6.7 (#​13497)
• Update to v1.35.0-k3s3 (#​13523)
• Fix restart of control-plane-only nodes attempting to reconcile from local datastore (#​13535)

Embedded Component Versions

Component	Version
Kubernetes	v1.35.0
Kine	v0.14.10
SQLite	3.51.1
Etcd	v3.6.7-k3s1
Containerd	v2.1.5-k3s1
Runc	v1.4.0
Flannel	v0.28.0
Metrics-server	v0.8.0
Traefik	v3.6.7
CoreDNS	v1.14.0
Helm-controller	v0.16.17
Local-path-provisioner	v0.0.34

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.35.0+k3s1: v1.35.0+k3s1

Compare Source

This release updates Kubernetes to v1.35.0, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.34.2+k3s1:

• Add id-token (#​13209)
• Fix windows build os (#​13201)
• Tunnel: handle pod IP reuse (#​13212)
  • Fix for clusters with few nodes and a lot of pod churn when webhooks are accessed using egress-selector
• Add multus e2e test (#​13216)
• Fix spegel sharing of imported images (#​13221)
• Bump opencontainers/selinux (#​13253)
• Update channels to 1.33.6 (#​13246)
• Remove remaining references to drone (#​13254)
• Bump actions/checkout from 5 to 6 (#​13256)
• Update busybox image version to 1.37.0 (#​13237)
• Update kube-router to v2.6.2 (#​13280)
• Consolidate test util functions (#​13281)
• Define DefaultHelmJobImage in K3s, overriding what helm-controller defaults to. (#​13258)
• Reorganize Executor interface to make CNI startup part of Executor implementation (#​13262)
• Bump kine and etcd (#​13297)
• Bump runc to v1.4.0 (#​13298)
• Bump kine to v0.14.8 (#​13303)
• Bump kube-router to v2.6.3-k3s1 (#​13304)
• Fix cross-platform image save (#​13311)
• Update to v1.34.3-k3s1 and Go 1.24.11 (#​13308)
• Bump kine to v0.14.9 (#​13314)
• Override DefaultHelmJob at build time (#​13351)
• Fix arm airgap platforms (#​13330)
• Bump actions/upload-artifact from 5 to 6 (#​13348)
• Update to kubernetes v1.35.0 and golang v1.25.5 (#​13334)

Embedded Component Versions

Component	Version
Kubernetes	v1.35.0
Kine	v0.14.9
SQLite	3.50.4
Etcd	v3.6.6-k3s1
Containerd	v2.1.5-k3s1
Runc	v1.4.0
Flannel	v0.27.4
Metrics-server	v0.8.0
Traefik	v3.5.1
CoreDNS	v1.13.1
Helm-controller	v0.16.17
Local-path-provisioner	v0.0.32

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.34.7+k3s1: v1.34.7+k3s1

Compare Source

This release updates Kubernetes to v1.34.7, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.34.6+k3s1:

• Immutable release changes (#​13900)
• Backports for 2026-04 (#​13930)
• Bump flannel to v0.28.4 (#​13941)
• Bump traefik to 3.6.12 (#​13927)
• Update to v1.34.7-k3s1 and Go 1.25.9 (#​13947)
• Switch from draft to pre-release (#​13949)
• Bump Traefik to 3.6.13 (#​13969) (#​13971)
• Fix SANs added from comma-separated node-external-ip list (#​13991)
• Bump klipper-helm image for revision check fix (#​13997)

Embedded Component Versions

Component	Version
Kubernetes	v1.34.7
Kine	v0.14.16
SQLite	3.51.3
Etcd	v3.6.7-k3s1
Containerd	v2.2.3-k3s1
Runc	v1.4.2
Flannel	v0.28.4
Metrics-server	v0.8.1
Traefik	v3.6.13
CoreDNS	v1.14.2
Helm-controller	v0.17.1
Local-path-provisioner	v0.0.35

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.34.6+k3s1: v1.34.6+k3s1

Compare Source

This release updates Kubernetes to v1.34.6, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.34.5+k3s1:

• • Bump to coredns 1.14.2 (#​13758)
• Save cluster state before reencyrpting secrets with newly created key (#​13772)
• Backports for 2026-03 (#​13790)
• Bump runc to v1.4.1 (#​13798)
• Bump Traefik helm chart version (#​13812)
• Bump cni plugins to v1.9.1 (#​13823)
• Simplify snapshot compress/decompress logic (#​13828)
• Update to v1.34.6-k3s1 and Go 1.24.13 (#​13834)
• Chore: Update Trivy version in Dockerfile.dapper (#​13850)
• • Update to flannel v0.28.2 (#​13869)

Embedded Component Versions

Component	Version
Kubernetes	v1.34.6
Kine	v0.14.14
SQLite	3.51.2
Etcd	v3.6.7-k3s1
Containerd	v2.2.2-bd1.34
Runc	v1.4.1
Flannel	v0.28.2
Metrics-server	v0.8.1
Traefik	v3.6.10
CoreDNS	v1.14.2
Helm-controller	v0.16.17
Local-path-provisioner	v0.0.35

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.34.5+k3s1: v1.34.5+k3s1

Compare Source

This release updates Kubernetes to v1.34.5, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.34.4+k3s1:

• Rootlesskit Revert + Test Fixes (#​13682)
• Backports for 2026-02 BONUS RELEASE (#​13691)
• Bump Traefik to v3.6.9 (#​13702)
• Update to v1.34.5-k3s1 and Go 1.24.13 (#​13706)

Embedded Component Versions

Component	Version
Kubernetes	v1.34.5
Kine	v0.14.12
SQLite	3.51.2
Etcd	v3.6.7-k3s1
Containerd	v2.1.5-k3s1
Runc	v1.4.0
Flannel	v0.28.0
Metrics-server	v0.8.1
Traefik	v3.6.9
CoreDNS	v1.14.1
Helm-controller	v0.16.17
Local-path-provisioner	v0.0.34

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.34.4+k3s1: v1.34.4+k3s1

Compare Source

This release updates Kubernetes to v1.34.4, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.34.3+k3s3:

• Explicitly close mvcc backend to fix high CPU on initial etcd server after restart (#​13571)
• Backports for 2026-02 (#​13581)
• Bump kine for list/watch revision fixes (#​13577)
• Fix VPN node IP not being applied to kubelet (#​13561)
• Bulk Backports 2026-02 (#​13565)
• • Bump to coredns 1.14.1 and metrics-server v0.8.1 (#​13609)
• Add registry prefix to image-list file (#​13601)
• Bump klipper-helm and klipper-lb images (#​13620)
• Fix removal of init node (#​13631)
• Update to v1.34.4-k3s1 and Go 1.24.12 (#​13636)

Embedded Component Versions

Component	Version
Kubernetes	v1.34.4
Kine	v0.14.11
SQLite	3.51.1
Etcd	v3.6.7-k3s1
Containerd	v2.1.5-k3s1
Runc	v1.4.0
Flannel	v0.28.0
Metrics-server	v0.8.1
Traefik	v3.6.7
CoreDNS	v1.14.1
Helm-controller	v0.16.17
Local-path-provisioner	v0.0.34

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started or to dive deep into K3s.
• Read how you can contribute here

v1.34.3+k3s3: v1.34.3+k3s3

Compare Source

This release updates Kubernetes to v1.34.3, and fixes a number of issues.

For more details on what's new, see the Kubernetes release notes.

Changes since v1.34.3+k3s1:

• Add firewall section to check-config.sh (#​13391)
• Expand docker upgrade test, sunset E2E upgrade test (#​13399)
• Allow k3s secrets-encrypt enable on existing clusters (#​13404)
• Chore: Bump charts - Jan 2025 (#​13421)
• Bump local path provisioner to v0.0.34 (#​13427)
• Backports for 2026-01 (#​13447)
• Bump to coredns 1.14.0 (#​13452)
• Rootless ports: add support for udp (#​13460)
• Update Traefik version to v3.6.7 (#​13483)
• Bump etcd to v3.6.7 (#​13496)
• Update to v1.34.3-k3s3 and Go 1.24.11 (#​13522)
• Fix restart of control-plane-only nodes attempting to reconcile from local datastore (#​13536)

Embedded Component Versions

Component	Version
Kubernetes	v1.34.3
Kine	v0.14.10
SQLite	3.51.1
Etcd	v3.6.7-k3s1
Containerd	v2.1.5-k3s1
Runc	v1.4.0
Flannel	v0.28.0
Metrics-server	v0.8.0
Traefik	v3.6.7
CoreDNS	v1.14.0
Helm-controller	v0.16.17
Local-path-provisioner	v0.0.34

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• [Open issues here](https://redirect.github.com/rancher/k3s/issues/new/choo

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.