Releases · k3s-io/k3s

What's Changed

• Expand docker upgrade test, sunset E2E upgrade test by @dereknola in #13338
• Add firewall section to check-config.sh by @dereknola in #13234
• Update golangci-lint and re-enable CI linting step by @brandond in #13343
• Fix PR lint checkout depth by @brandond in #13369
• Update stable channel to v1.34.3+k3s1 by @rafaelbreno in #13374
• Bump actions/download-artifact from 6 to 7 by @dependabot[bot] in #13346
• Bump stable to 1.34 and add 1.35 by @brandond in #13373
• Enable secret encryption on existing clusters by @dereknola in #13370
• Bump Local Path Provisioner version by @github-actions[bot] in #13387
• Use Get, not Head for channel page by @dereknola in #13402
• Fix typos in documentation by @oglok in #13411
• Bump actions/cache from 4 to 5 by @dependabot[bot] in #13347
• Replace temporary etcd server with raw mvcc store access by @brandond in #13368
• Bump Traefik and CoreDNS - Jan 2025 by @dereknola in #13424
• Remove flannel external-ip annotations when disabled by @brandond in #13431
• Bump local path provisioner to v0.0.34 by @dereknola in #13430
• [main] Publish GA images to staging registry by @rafaelbreno in #13438
• Bump cni plugins by @brandond in #13439
• Fix atomic write in WriteSubnetFile by @luojiyin1987 in #13380
• Bump expr-lang/expr by @brandond in #13440
• Bump spegel to v0.6.0 by @brandond in #13198
• Update longhorn version in integration test from v1.4.0 to v1.10.1 by @brandond in #13443
• Bump kine to v0.14.10 for NATS conformance fixes by @brandond in #13441
• Remove download/generate from vulncheck by @brandond in #13445
• Bump to coredns 1.14.0 by @mgfritch in #13449
• Add Momentum Coach AI to K3S adopters list by @geoffreyPerrin in #13467
• Fix lines to satisfy lint and fix CI by @manuelbuil in #13475
• Update Traefik version to v3.6.7 by @manuelbuil in #13474
• Prevent caching on PR of golangci-lint entries by @dereknola in #13487
• Move to rootlesskit v2 by @dereknola in #13486
• Bump actions/stale from 10.1.0 to 10.1.1 by @dependabot[bot] in #13296
• Fix CVE-2025-54410: Update docker/docker to v25.0.13 by @rahulrairai59 in #13473
• Bump golang:alpine image version by @github-actions[bot] in #13345
• Update install tests with new images, add alma10 by @dereknola in #13489
• Bump etcd to v3.6.7 by @brandond in #13495
• Add Percona and Solanica to k3s adopters by @edithturn in #13510
• [main] Update to v1.35.0-k3s3 by @rafaelbreno in #13524
• Fix restart of control-plane-only nodes attempting to reconcile from local datastore by @brandond in #13534
• Fix spegel filter for wildcards by @brandond in #13527
• Add IPv6 loopback to kubelet-serving cert by @brandond in #13532
• Fix handling of empty token file by @brandond in #13529
• Use channel.yaml instead of curling for stable for kubectl install by @dereknola in #13531
• Fix VPN node IP not being applied to kubelet by @zijiren233 in #13457
• Bump aws-actions/configure-aws-credentials from 4 to 5 by @dependabot[bot] in #13185
• Bump scorecard checkout to match all other versions by @dereknola in #13568
• Bump kine for list/watch revision fixes by @brandond in #13575
• Explicitly close mvcc backend to fix high CPU on initial etcd server after restart by @brandond in #13569
• Support commit builds via GHA artifacts by @dereknola in #13559
• Bump rancher/mirrored-coredns-coredns image version by @github-actions[bot] in #13499
• [main] Update stable channel to v1.34.3+k3s3 by @rafaelbreno in #13554
• Bump metrics-server to v0.8.1 by @mgfritch in #13594
• [main] Add registry prefix to image-list file by @rafaelbreno in #13603
• Bump klipper-helm and klipper-lb images by @brandond in #13613
• Fix removal of init node via annotation by @brandond in #13624
• [master] Update to v1.35.1-k3s1 and Go 1.25.6 by @rafaelbreno in #13638
• Update stable to v1.34.4+k3s1 by @rafaelbreno in #13642
• Make artifact URL prefix configurable by @manuelbuil in #13367
• Bump kine to v0.14.12 by @brandond in #13661
• Install binutils-gold only for arm64 builds by @mmoll in #13654
• Rootlesskit Revert + Test Fixes by @dereknola in #13681
• Improve resilience of datastore bootstrap reconcile from etcd by @brandond in #13677
• Bump Traefik to v3.6.9 by @manuelbuil in #13693
• [main] Update to v1.35.2-k3s1 and Go 1.25.7 by @rafaelbreno in #13708
• Assign github.event to env first by @dereknola in #13715
• config: Add default imports to containerd base templates by @fidencio in #13680
• update channel server to 1.34.5 by @briandowns in #13732
• Add nix-snapshotter support to the embedded containerd by @nuketownada in #13676
• Do not create etcd name file if etcd is not in use by @brandond in #13727
• Bump actions/download-artifact from 7 to 8 by @dependabot[bot] in #13714
• build(deps): bump actions/stale from 10.1.1 to 10.2.0 by @dependabot[bot] in #13670
• build(deps): bump aquasecurity/trivy-action from 0.33.1 to 0.34.1 by @dependabot[bot] in #13669
• build(deps): bump aws-actions/configure-aws-credentials from 5 to 6 by @dependabot[bot] in #13596
• Bump softprops/action-gh-release from 2.2.1 to 2.5.0 by @dependabot[bot] in #13376
• Bump rancher/mirrored-coredns-coredns image version by @github-actions[bot] in #13743
• Bump klipper-lb and klipper-helm by @brandond in #13761
• Bump golang:alpine image version by @github-actions[bot] in #13653
• Update packages to remove unmaintained dependencies by @brandond in #13724
• Bump DeterminateSystems/nix-installer-action from 17 to 21 by @dependabot[bot] in #13744
• Bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #13745
• Bump docker/setup-qemu-action from 3 to 4 by @dependabot[bot] in #13746
• Bump docker/setup-docker-action from 4 to 5 by @dependabot[bot] in #13747
• Save cluster state before reencyrpting secrets with newly created key by @dereknola in #13764
• Bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #13748
• Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 by @dependabot[bot] in #13713
• Bump github.com/docker/cli from 28.3.2+incompatible to 29.2.0+incompatible by @dependabot[bot] in #13730
• build(deps): bump github.com/pion/dtls/v3 from 3.0.6 to 3.0.11 by @dependabot[bot] in #13645
• Use etcd-snapshot-retention as default for s3 if etcd-s3-retention is not set by @brandond in #13770
• Bump traefik and local-path-provisioner by @brandond in #13787
• install.sh: Simplify handling for fedora rpm-ostree based distributions by @becarusys in #13712
• Bump containerd to v2.2.2 by @brandond in #13788
• Bump runc to v1.4.1 by @brandond in #13796
• Bump Traefik helm chart version by @manuelbuil in #13805
• Fix trivy updatecli config by @manuelbuil in #13816
• Bump cni plugins to v1.9.1 by @brandond in #13817
• Simplify snapshot compress/decompress logic by @brandond in #13826
• buil...