k3s v1.36.0-rc1+k3s1 版本更新介绍

发布日期: 2026-04-23
版本号: v1.36.0-rc1+k3s1

本次更新主要包括：升级了Docker、containerd、runc等核心运行时组件及Flannel、Traefik、CoreDNS等网络与负载均衡组件；修复了CVE-2025-54410等安全漏洞；在功能上支持了在现有集群上启用密钥加密、改进了etcd快照与恢复机制、修复了VPN节点IP等问题；更新了GitHub Actions工作流以增强CI/CD安全性与效率；并吸引了14位新贡献者参与。版本号从v1.35.0+k3s1升级至候选版本v1.36.0-rc1+k3s1。

更新内容 （中文）

变更内容

• 由 @dereknola 在 https://github.com/k3s-io/k3s/pull/13338 中扩展Docker升级测试，并弃用E2E升级测试。
• 由 @dereknola 在 https://github.com/k3s-io/k3s/pull/13234 中为 check-config.sh 添加防火墙部分。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13343 中更新 golangci-lint 并重新启用CI代码检查步骤。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13369 中修复PR代码检查的检出深度。
• 由 @rafaelbreno 在 https://github.com/k3s-io/k3s/pull/13374 中将稳定频道更新至 v1.34.3+k3s1。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13346 中将 actions/download-artifact 从 6 升级到 7。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13373 中将稳定版升级到 1.34 并添加 1.35。
• 由 @dereknola 在 https://github.com/k3s-io/k3s/pull/13370 中为现有集群启用密钥加密。
• 由 @github-actions[bot] 在 https://github.com/k3s-io/k3s/pull/13387 中升级本地路径供给器版本。
• 由 @dereknola 在 https://github.com/k3s-io/k3s/pull/13402 中对频道页面使用Get请求而非Head请求。
• 由 @oglok 在 https://github.com/k3s-io/k3s/pull/13411 中修复文档中的拼写错误。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13347 中将 actions/cache 从 4 升级到 5。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13368 中使用原始MVCC存储访问替代临时etcd服务器。
• 由 @dereknola 在 https://github.com/k3s-io/k3s/pull/13424 中升级Traefik和CoreDNS - 2025年1月。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13431 中在禁用时移除flannel外部IP注解。
• 由 @dereknola 在 https://github.com/k3s-io/k3s/pull/13430 中将本地路径供给器升级至 v0.0.34。
• 由 @rafaelbreno 在 https://github.com/k3s-io/k3s/pull/13438 中[main]将GA镜像发布到暂存注册表。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13439 中升级CNI插件。
• 由 @luojiyin1987 在 https://github.com/k3s-io/k3s/pull/13380 中修复WriteSubnetFile中的原子写入。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13440 中升级 expr-lang/expr。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13198 中将spegel升级至 v0.6.0。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13443 中将集成测试中的longhorn版本从 v1.4.0 更新至 v1.10.1。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13441 中升级kine至 v0.14.10 以修复NATS符合性问题。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13445 中从漏洞检查中移除下载/生成步骤。
• 由 @mgfritch 在 https://github.com/k3s-io/k3s/pull/13449 中升级至 coredns 1.14.0。
• 由 @geoffreyPerrin 在 https://github.com/k3s-io/k3s/pull/13467 中添加 Momentum Coach AI 到 K3S 采用者列表。
• 由 @manuelbuil 在 https://github.com/k3s-io/k3s/pull/13475 中修复代码以满足代码检查并修复CI。
• 由 @manuelbuil 在 https://github.com/k3s-io/k3s/pull/13474 中将Traefik版本更新至 v3.6.7。
• 由 @dereknola 在 https://github.com/k3s-io/k3s/pull/13487 中防止PR中golangci-lint条目缓存。
• 由 @dereknola 在 https://github.com/k3s-io/k3s/pull/13486 中迁移至 rootlesskit v2。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13296 中将 actions/stale 从 10.1.0 升级到 10.1.1。
• 由 @rahulrairai59 在 https://github.com/k3s-io/k3s/pull/13473 中修复CVE-2025-54410：将 docker/docker 更新至 v25.0.13。
• 由 @github-actions[bot] 在 https://github.com/k3s-io/k3s/pull/13345 中升级 golang:alpine 镜像版本。
• 由 @dereknola 在 https://github.com/k3s-io/k3s/pull/13489 中使用新镜像更新安装测试，并添加 alma10。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13495 中将etcd升级至 v3.6.7。
• 由 @edithturn 在 https://github.com/k3s-io/k3s/pull/13510 中添加 Percona 和 Solanica 到 k3s 采用者列表。
• 由 @rafaelbreno 在 https://github.com/k3s-io/k3s/pull/13524 中[main]更新至 v1.35.0-k3s3。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13534 中修复仅控制平面节点重启时尝试从本地数据存储协调的问题。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13527 中修复spegel通配符过滤器。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13532 中将IPv6回环地址添加到kubelet服务证书。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13529 中修复空令牌文件的处理。
• 由 @dereknola 在 https://github.com/k3s-io/k3s/pull/13531 中使用channel.yaml替代curl获取稳定版用于kubectl安装。
• 由 @zijiren233 在 https://github.com/k3s-io/k3s/pull/13457 中修复VPN节点IP未应用到kubelet的问题。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13185 中将 aws-actions/configure-aws-credentials 从 4 升级到 5。
• 由 @dereknola 在 https://github.com/k3s-io/k3s/pull/13568 中升级scorecard检出以匹配所有其他版本。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13575 中升级kine以修复列表/监视修订问题。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13569 中显式关闭MVCC后端以修复etcd服务器重启后高CPU使用率问题。
• 由 @dereknola 在 https://github.com/k3s-io/k3s/pull/13559 中支持通过GHA制品进行提交构建。
• 由 @github-actions[bot] 在 https://github.com/k3s-io/k3s/pull/13499 中升级 rancher/mirrored-coredns-coredns 镜像版本。
• 由 @rafaelbreno 在 https://github.com/k3s-io/k3s/pull/13554 中[main]将稳定频道更新至 v1.34.3+k3s3。
• 由 @mgfritch 在 https://github.com/k3s-io/k3s/pull/13594 中将metrics-server升级至 v0.8.1。
• 由 @rafaelbreno 在 https://github.com/k3s-io/k3s/pull/13603 中[main]为image-list文件添加注册表前缀。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13613 中升级 klipper-helm 和 klipper-lb 镜像。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13624 中修复通过注解移除初始化节点。
• 由 @rafaelbreno 在 https://github.com/k3s-io/k3s/pull/13638 中[master]更新至 v1.35.1-k3s1 和 Go 1.25.6。
• 由 @rafaelbreno 在 https://github.com/k3s-io/k3s/pull/13642 中将稳定版更新至 v1.34.4+k3s1。
• 由 @manuelbuil 在 https://github.com/k3s-io/k3s/pull/13367 中使制品URL前缀可配置。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13661 中将kine升级至 v0.14.12。
• 由 @mmoll 在 https://github.com/k3s-io/k3s/pull/13654 中仅为arm64构建安装binutils-gold。
• 由 @dereknola 在 https://github.com/k3s-io/k3s/pull/13681 中回退rootlesskit并修复测试。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13677 中增强从etcd引导数据存储协调的弹性。
• 由 @manuelbuil 在 https://github.com/k3s-io/k3s/pull/13693 中将Traefik升级至 v3.6.9。
• 由 @rafaelbreno 在 https://github.com/k3s-io/k3s/pull/13708 中[main]更新至 v1.35.2-k3s1 和 Go 1.25.7。
• 由 @dereknola 在 https://github.com/k3s-io/k3s/pull/13715 中首先将github.event分配到env。
• 由 @fidencio 在 https://github.com/k3s-io/k3s/pull/13680 中config：为containerd基础模板添加默认导入。
• 由 @briandowns 在 https://github.com/k3s-io/k3s/pull/13732 中将频道服务器更新至 1.34.5。
• 由 @nuketownada 在 https://github.com/k3s-io/k3s/pull/13676 中为嵌入式containerd添加nix-snapshotter支持。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13727 中如果不使用etcd则不创建etcd名称文件。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13714 中将 actions/download-artifact 从 7 升级到 8。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13670 中build(deps)：将 actions/stale 从 10.1.1 升级到 10.2.0。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13669 中build(deps)：将 aquasecurity/trivy-action 从 0.33.1 升级到 0.34.1。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13596 中build(deps)：将 aws-actions/configure-aws-credentials 从 5 升级到 6。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13376 中将 softprops/action-gh-release 从 2.2.1 升级到 2.5.0。
• 由 @github-actions[bot] 在 https://github.com/k3s-io/k3s/pull/13743 中升级 rancher/mirrored-coredns-coredns 镜像版本。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13761 中升级 klipper-lb 和 klipper-helm。
• 由 @github-actions[bot] 在 https://github.com/k3s-io/k3s/pull/13653 中升级 golang:alpine 镜像版本。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13724 中更新软件包以移除未维护的依赖项。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13744 中将 DeterminateSystems/nix-installer-action 从 17 升级到 21。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13745 中将 docker/build-push-action 从 6 升级到 7。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13746 中将 docker/setup-qemu-action 从 3 升级到 4。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13747 中将 docker/setup-docker-action 从 4 升级到 5。
• 由 @dereknola 在 https://github.com/k3s-io/k3s/pull/13764 中在使用新创建的密钥重新加密密钥前保存集群状态。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13748 中将 docker/metadata-action 从 5 升级到 6。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13713 中将 go.opentelemetry.io/otel/sdk 从 1.39.0 升级到 1.40.0。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13730 中将 github.com/docker/cli 从 28.3.2+incompatible 升级到 29.2.0+incompatible。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13645 中build(deps)：将 github.com/pion/dtls/v3 从 3.0.6 升级到 3.0.11。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13770 中如果未设置 etcd-s3-retention，则使用 etcd-snapshot-retention 作为S3的默认值。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13787 中升级 traefik 和 local-path-provisioner。
• 由 @becarusys 在 https://github.com/k3s-io/k3s/pull/13712 中install.sh：简化基于fedora rpm-ostree发行版的处理。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13788 中将containerd升级至 v2.2.2。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13796 中将runc升级至 v1.4.1。
• 由 @manuelbuil 在 https://github.com/k3s-io/k3s/pull/13805 中升级Traefik helm chart版本。
• 由 @manuelbuil 在 https://github.com/k3s-io/k3s/pull/13816 中修复trivy updatecli配置。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13817 中将CNI插件升级至 v1.9.1。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13826 中简化快照压缩/解压缩逻辑。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13804 中build(deps)：将 docker/login-action 从 3 升级到 4。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13803 中build(deps)：将 softprops/action-gh-release 从 2.5.0 升级到 2.6.1。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13802 中build(deps)：将 aquasecurity/trivy-action 从 0.34.1 升级到 0.35.0。
• 由 @rafaelbreno 在 https://github.com/k3s-io/k3s/pull/13836 中[main]更新至 v1.35.3-k3s1 和 Go 1.25.7。
• 由 @github-actions[bot] 在 https://github.com/k3s-io/k3s/pull/13845 中升级Trivy版本。
• 由 https://github.com/k3s-io/k3s/pull/13847 中修复snapshot_handler.go中的拼写错误：overriden -> overridden。
• 由 @DT1mote 在 https://github.com/k3s-io/k3s/pull/13848 中修复etcd成员错误消息中的拼写错误。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13853 中升级helm-controller以修复作业竞态条件。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13856 中为控制器事件记录器添加上下文。
• 由 @cwayne18 在 https://github.com/k3s-io/k3s/pull/13861 中将GH Actions固定到提交SHA。
• 由 @cwayne18 在 https://github.com/k3s-io/k3s/pull/13860 中Dapper被终止。
• 由 @mgfritch 在 https://github.com/k3s-io/k3s/pull/13863 中更新至 flannel v0.28.2。
• 由 @rafaelbreno 在 https://github.com/k3s-io/k3s/pull/13873 中[main]将稳定版更新至 v1.34.6+k3s1。
• 由 @caesarakalaeii 在 https://github.com/k3s-io/k3s/pull/13881 中添加 sipgate 到采用者列表。
• 由 @BenBo17 在 https://github.com/k3s-io/k3s/pull/13890 中添加 Rocket Technologies 到采用者列表。
• 由 @manuelbuil 在 https://github.com/k3s-io/k3s/pull/13882 中使Dockerfile.test更安全。
• 由 @manuelbuil 在 https://github.com/k3s-io/k3s/pull/13883 中使tests/integration/Dockerfile.test更安全。
• 由 @manuelbuil 在 https://github.com/k3s-io/k3s/pull/13884 中保护vagrant-setup action.yaml。
• 由 @manuelbuil 在 https://github.com/k3s-io/k3s/pull/13885 中保护e2e yaml GHA。
• 由 @manuelbuil 在 https://github.com/k3s-io/k3s/pull/13887 中固定govulncheck GHA版本。
• 由 @manuelbuil 在 https://github.com/k3s-io/k3s/pull/13889 中验证kubelet、vagrant zip和go二进制文件的sha256sum。
• 由 @manuelbuil 在 https://github.com/k3s-io/k3s/pull/13888 中检查 k3s-root sha256sum。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13891 中build(deps)：将 github.com/go-jose/go-jose/v4 从 4.1.3 升级到 4.1.4。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13880 中build(deps)：将 actions/upload-artifact 从 6.0.0 升级到 7.0.0。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13879 中build(deps)：将 github/codeql-action 从 4.34.1 升级到 4.35.1。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13878 中build(deps)：将 docker/setup-buildx-action 从 3.12.0 升级到 4.0.0。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13876 中build(deps)：将 updatecli/updatecli-action 从 2.100.0 升级到 3.0.0。
• 由 @jonhermansen 在 https://github.com/k3s-io/k3s/pull/13875 中修复嵌入式数据压缩包的可重现性。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13837 中build(deps)：将 github.com/buger/jsonparser 从 1.1.1 升级到 1.1.2。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13852 中build(deps)：将 github.com/nats-io/nats-server/v2 从 2.12.2 升级到 2.12.6。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13906 中修复S3测试以适应对s3mock的更改。
• 由 @vitorsavian 在 https://github.com/k3s-io/k3s/pull/13908 中将klipper helm升级至 v0.9.16-build20260410。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13909 中升级 runc/spegel/helm-controller/kine。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13914 中build(deps)：将 actions/github-script 从 8.0.0 升级到 9.0.0。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13915 中build(deps)：将 aws-actions/configure-aws-credentials 从 6.0.0 升级到 6.1.0。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13916 中build(deps)：将 actions/upload-artifact 从 7.0.0 升级到 7.0.1。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13917 中build(deps)：将 softprops/action-gh-release 从 2.6.1 升级到 3.0.0。
• 由 @dependabot[bot] 在 https://github.com/k3s-io/k3s/pull/13918 中build(deps)：将 docker/build-push-action 从 7.0.0 升级到 7.1.0。
• 由 @manuelbuil 在 https://github.com/k3s-io/k3s/pull/13912 中将traefik升级至 3.6.12。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13920 中修复嵌入式执行器VPN配置注入。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13931 中将containerd升级至 v2.2.3。
• 由 @thomasferrandiz 在 https://github.com/k3s-io/k3s/pull/13937 中将flannel升级至 v0.28.4。
• 由 @rafaelbreno 在 https://github.com/k3s-io/k3s/pull/13946 中[main]更新至 v1.35.4-k3s1 和 Go 1.25.9。
• 由 @rafaelbreno 在 https://github.com/k3s-io/k3s/pull/13902 中[main]不可变发布变更。
• 由 @cwayne18 在 https://github.com/k3s-io/k3s/pull/13969 中将Traefik升级至 3.6.13。
• 由 @rafaelbreno 在 https://github.com/k3s-io/k3s/pull/13951 中[main]从草稿切换到预发布。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13989 中修复从逗号分隔的 node-external-ip 列表添加的SANs。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13994 中修复docker双栈测试。
• 由 @brandond 在 https://github.com/k3s-io/k3s/pull/13995 中升级klipper-helm镜像以修复修订检查。

新贡献者

• @oglok 在 https://github.com/k3s-io/k3s/pull/13411 中做出了首次贡献。
• @luojiyin1987 在 https://github.com/k3s-io/k3s/pull/13380 中做出了首次贡献。
• @geoffreyPerrin 在 https://github.com/k3s-io/k3s/pull/13467 中做出了首次贡献。
• @rahulrairai59 在 https://github.com/k3s-io/k3s/pull/13473 中做出了首次贡献。
• @edithturn 在 https://github.com/k3s-io/k3s/pull/13510 中做出了首次贡献。
• @zijiren233 在 https://github.com/k3s-io/k3s/pull/13457 中做出了首次贡献。
• @mmoll 在 https://github.com/k3s-io/k3s/pull/13654 中做出了首次贡献。
• @fidencio 在 https://github.com/k3s-io/k3s/pull/13680 中做出了首次贡献。
• @nuketownada 在 https://github.com/k3s-io/k3s/pull/13676 中做出了首次贡献。
• @becarusys 在 https://github.com/k3s-io/k3s/pull/13712 中做出了首次贡献。
• @DT1mote 在 https://github.com/k3s-io/k3s/pull/13848 中做出了首次贡献。
• @caesarakalaeii 在 https://github.com/k3s-io/k3s/pull/13881 中做出了首次贡献。
• @BenBo17 在 https://github.com/k3s-io/k3s/pull/13890 中做出了首次贡献。
• @jonhermansen 在 https://github.com/k3s-io/k3s/pull/13875 中做出了首次贡献。

完整变更日志：https://github.com/k3s-io/k3s/compare/v1.35.0+k3s1…v1.36.0-rc1+k3s1

更新内容 （原始）

What’s Changed

• Expand docker upgrade test, sunset E2E upgrade test by @dereknola in https://github.com/k3s-io/k3s/pull/13338
• Add firewall section to check-config.sh by @dereknola in https://github.com/k3s-io/k3s/pull/13234
• Update golangci-lint and re-enable CI linting step by @brandond in https://github.com/k3s-io/k3s/pull/13343
• Fix PR lint checkout depth by @brandond in https://github.com/k3s-io/k3s/pull/13369
• Update stable channel to v1.34.3+k3s1 by @rafaelbreno in https://github.com/k3s-io/k3s/pull/13374
• Bump actions/download-artifact from 6 to 7 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13346
• Bump stable to 1.34 and add 1.35 by @brandond in https://github.com/k3s-io/k3s/pull/13373
• Enable secret encryption on existing clusters by @dereknola in https://github.com/k3s-io/k3s/pull/13370
• Bump Local Path Provisioner version by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/13387
• Use Get, not Head for channel page by @dereknola in https://github.com/k3s-io/k3s/pull/13402
• Fix typos in documentation by @oglok in https://github.com/k3s-io/k3s/pull/13411
• Bump actions/cache from 4 to 5 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13347
• Replace temporary etcd server with raw mvcc store access by @brandond in https://github.com/k3s-io/k3s/pull/13368
• Bump Traefik and CoreDNS - Jan 2025 by @dereknola in https://github.com/k3s-io/k3s/pull/13424
• Remove flannel external-ip annotations when disabled by @brandond in https://github.com/k3s-io/k3s/pull/13431
• Bump local path provisioner to v0.0.34 by @dereknola in https://github.com/k3s-io/k3s/pull/13430
• [main] Publish GA images to staging registry by @rafaelbreno in https://github.com/k3s-io/k3s/pull/13438
• Bump cni plugins by @brandond in https://github.com/k3s-io/k3s/pull/13439
• Fix atomic write in WriteSubnetFile by @luojiyin1987 in https://github.com/k3s-io/k3s/pull/13380
• Bump expr-lang/expr by @brandond in https://github.com/k3s-io/k3s/pull/13440
• Bump spegel to v0.6.0 by @brandond in https://github.com/k3s-io/k3s/pull/13198
• Update longhorn version in integration test from v1.4.0 to v1.10.1 by @brandond in https://github.com/k3s-io/k3s/pull/13443
• Bump kine to v0.14.10 for NATS conformance fixes by @brandond in https://github.com/k3s-io/k3s/pull/13441
• Remove download/generate from vulncheck by @brandond in https://github.com/k3s-io/k3s/pull/13445
• Bump to coredns 1.14.0 by @mgfritch in https://github.com/k3s-io/k3s/pull/13449
• Add Momentum Coach AI to K3S adopters list by @geoffreyPerrin in https://github.com/k3s-io/k3s/pull/13467
• Fix lines to satisfy lint and fix CI by @manuelbuil in https://github.com/k3s-io/k3s/pull/13475
• Update Traefik version to v3.6.7 by @manuelbuil in https://github.com/k3s-io/k3s/pull/13474
• Prevent caching on PR of golangci-lint entries by @dereknola in https://github.com/k3s-io/k3s/pull/13487
• Move to rootlesskit v2 by @dereknola in https://github.com/k3s-io/k3s/pull/13486
• Bump actions/stale from 10.1.0 to 10.1.1 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13296
• Fix CVE-2025-54410: Update docker/docker to v25.0.13 by @rahulrairai59 in https://github.com/k3s-io/k3s/pull/13473
• Bump golang:alpine image version by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/13345
• Update install tests with new images, add alma10 by @dereknola in https://github.com/k3s-io/k3s/pull/13489
• Bump etcd to v3.6.7 by @brandond in https://github.com/k3s-io/k3s/pull/13495
• Add Percona and Solanica to k3s adopters by @edithturn in https://github.com/k3s-io/k3s/pull/13510
• [main] Update to v1.35.0-k3s3 by @rafaelbreno in https://github.com/k3s-io/k3s/pull/13524
• Fix restart of control-plane-only nodes attempting to reconcile from local datastore by @brandond in https://github.com/k3s-io/k3s/pull/13534
• Fix spegel filter for wildcards by @brandond in https://github.com/k3s-io/k3s/pull/13527
• Add IPv6 loopback to kubelet-serving cert by @brandond in https://github.com/k3s-io/k3s/pull/13532
• Fix handling of empty token file by @brandond in https://github.com/k3s-io/k3s/pull/13529
• Use channel.yaml instead of curling for stable for kubectl install by @dereknola in https://github.com/k3s-io/k3s/pull/13531
• Fix VPN node IP not being applied to kubelet by @zijiren233 in https://github.com/k3s-io/k3s/pull/13457
• Bump aws-actions/configure-aws-credentials from 4 to 5 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13185
• Bump scorecard checkout to match all other versions by @dereknola in https://github.com/k3s-io/k3s/pull/13568
• Bump kine for list/watch revision fixes by @brandond in https://github.com/k3s-io/k3s/pull/13575
• Explicitly close mvcc backend to fix high CPU on initial etcd server after restart by @brandond in https://github.com/k3s-io/k3s/pull/13569
• Support commit builds via GHA artifacts by @dereknola in https://github.com/k3s-io/k3s/pull/13559
• Bump rancher/mirrored-coredns-coredns image version by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/13499
• [main] Update stable channel to v1.34.3+k3s3 by @rafaelbreno in https://github.com/k3s-io/k3s/pull/13554
• Bump metrics-server to v0.8.1 by @mgfritch in https://github.com/k3s-io/k3s/pull/13594
• [main] Add registry prefix to image-list file by @rafaelbreno in https://github.com/k3s-io/k3s/pull/13603
• Bump klipper-helm and klipper-lb images by @brandond in https://github.com/k3s-io/k3s/pull/13613
• Fix removal of init node via annotation by @brandond in https://github.com/k3s-io/k3s/pull/13624
• [master] Update to v1.35.1-k3s1 and Go 1.25.6 by @rafaelbreno in https://github.com/k3s-io/k3s/pull/13638
• Update stable to v1.34.4+k3s1 by @rafaelbreno in https://github.com/k3s-io/k3s/pull/13642
• Make artifact URL prefix configurable by @manuelbuil in https://github.com/k3s-io/k3s/pull/13367
• Bump kine to v0.14.12 by @brandond in https://github.com/k3s-io/k3s/pull/13661
• Install binutils-gold only for arm64 builds by @mmoll in https://github.com/k3s-io/k3s/pull/13654
• Rootlesskit Revert + Test Fixes by @dereknola in https://github.com/k3s-io/k3s/pull/13681
• Improve resilience of datastore bootstrap reconcile from etcd by @brandond in https://github.com/k3s-io/k3s/pull/13677
• Bump Traefik to v3.6.9 by @manuelbuil in https://github.com/k3s-io/k3s/pull/13693
• [main] Update to v1.35.2-k3s1 and Go 1.25.7 by @rafaelbreno in https://github.com/k3s-io/k3s/pull/13708
• Assign github.event to env first by @dereknola in https://github.com/k3s-io/k3s/pull/13715
• config: Add default imports to containerd base templates by @fidencio in https://github.com/k3s-io/k3s/pull/13680
• update channel server to 1.34.5 by @briandowns in https://github.com/k3s-io/k3s/pull/13732
• Add nix-snapshotter support to the embedded containerd by @nuketownada in https://github.com/k3s-io/k3s/pull/13676
• Do not create etcd name file if etcd is not in use by @brandond in https://github.com/k3s-io/k3s/pull/13727
• Bump actions/download-artifact from 7 to 8 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13714
• build(deps): bump actions/stale from 10.1.1 to 10.2.0 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13670
• build(deps): bump aquasecurity/trivy-action from 0.33.1 to 0.34.1 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13669
• build(deps): bump aws-actions/configure-aws-credentials from 5 to 6 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13596
• Bump softprops/action-gh-release from 2.2.1 to 2.5.0 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13376
• Bump rancher/mirrored-coredns-coredns image version by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/13743
• Bump klipper-lb and klipper-helm by @brandond in https://github.com/k3s-io/k3s/pull/13761
• Bump golang:alpine image version by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/13653
• Update packages to remove unmaintained dependencies by @brandond in https://github.com/k3s-io/k3s/pull/13724
• Bump DeterminateSystems/nix-installer-action from 17 to 21 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13744
• Bump docker/build-push-action from 6 to 7 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13745
• Bump docker/setup-qemu-action from 3 to 4 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13746
• Bump docker/setup-docker-action from 4 to 5 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13747
• Save cluster state before reencyrpting secrets with newly created key by @dereknola in https://github.com/k3s-io/k3s/pull/13764
• Bump docker/metadata-action from 5 to 6 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13748
• Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13713
• Bump github.com/docker/cli from 28.3.2+incompatible to 29.2.0+incompatible by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13730
• build(deps): bump github.com/pion/dtls/v3 from 3.0.6 to 3.0.11 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13645
• Use etcd-snapshot-retention as default for s3 if etcd-s3-retention is not set by @brandond in https://github.com/k3s-io/k3s/pull/13770
• Bump traefik and local-path-provisioner by @brandond in https://github.com/k3s-io/k3s/pull/13787
• install.sh: Simplify handling for fedora rpm-ostree based distributions by @becarusys in https://github.com/k3s-io/k3s/pull/13712
• Bump containerd to v2.2.2 by @brandond in https://github.com/k3s-io/k3s/pull/13788
• Bump runc to v1.4.1 by @brandond in https://github.com/k3s-io/k3s/pull/13796
• Bump Traefik helm chart version by @manuelbuil in https://github.com/k3s-io/k3s/pull/13805
• Fix trivy updatecli config by @manuelbuil in https://github.com/k3s-io/k3s/pull/13816
• Bump cni plugins to v1.9.1 by @brandond in https://github.com/k3s-io/k3s/pull/13817
• Simplify snapshot compress/decompress logic by @brandond in https://github.com/k3s-io/k3s/pull/13826
• build(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13804
• build(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13803
• build(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13802
• [main] Update to v1.35.3-k3s1 and Go 1.25.7 by @rafaelbreno in https://github.com/k3s-io/k3s/pull/13836
• Bump Trivy version by @github-actions[bot] in https://github.com/k3s-io/k3s/pull/13845
• Fix typo: overriden -> overridden in snapshot_handler.go in https://github.com/k3s-io/k3s/pull/13847
• fix: typo in etcd membership error message by @DT1mote in https://github.com/k3s-io/k3s/pull/13848
• Bump helm-controller for job race fix by @brandond in https://github.com/k3s-io/k3s/pull/13853
• Add context to controller event recorders by @brandond in https://github.com/k3s-io/k3s/pull/13856
• Pin GH Actions to commit sha by @cwayne18 in https://github.com/k3s-io/k3s/pull/13861
• Dapper is kill by @cwayne18 in https://github.com/k3s-io/k3s/pull/13860
• Update to flannel v0.28.2 by @mgfritch in https://github.com/k3s-io/k3s/pull/13863
• [main] Update stable to v1.34.6+k3s1 by @rafaelbreno in https://github.com/k3s-io/k3s/pull/13873
• Add sipgate to the list of adopters by @caesarakalaeii in https://github.com/k3s-io/k3s/pull/13881
• Add Rocket Technologies to the list of adopters by @BenBo17 in https://github.com/k3s-io/k3s/pull/13890
• Make Dockerfile.test more secure by @manuelbuil in https://github.com/k3s-io/k3s/pull/13882
• Make tests/integration/Dockerfile.test more secure by @manuelbuil in https://github.com/k3s-io/k3s/pull/13883
• Secure the vagrant-setup action.yaml by @manuelbuil in https://github.com/k3s-io/k3s/pull/13884
• Secure the e2e yaml GHA by @manuelbuil in https://github.com/k3s-io/k3s/pull/13885
• Pin govulncheck GHA version by @manuelbuil in https://github.com/k3s-io/k3s/pull/13887
• Verify sha256sum for kubelet, vagrant zip and go binary by @manuelbuil in https://github.com/k3s-io/k3s/pull/13889
• Check the k3s-root sha256sum by @manuelbuil in https://github.com/k3s-io/k3s/pull/13888
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13891
• build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13880
• build(deps): bump github/codeql-action from 4.34.1 to 4.35.1 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13879
• build(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13878
• build(deps): bump updatecli/updatecli-action from 2.100.0 to 3.0.0 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13876
• Fix reproducibility of embedded data tarball by @jonhermansen in https://github.com/k3s-io/k3s/pull/13875
• build(deps): bump github.com/buger/jsonparser from 1.1.1 to 1.1.2 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13837
• build(deps): bump github.com/nats-io/nats-server/v2 from 2.12.2 to 2.12.6 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13852
• Fix S3 test to account for change to s3mock by @brandond in https://github.com/k3s-io/k3s/pull/13906
• Bump klipper helm to v0.9.16-build20260410 by @vitorsavian in https://github.com/k3s-io/k3s/pull/13908
• Bump runc/spegel/helm-controller/kine by @brandond in https://github.com/k3s-io/k3s/pull/13909
• build(deps): bump actions/github-script from 8.0.0 to 9.0.0 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13914
• build(deps): bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13915
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13916
• build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13917
• build(deps): bump docker/build-push-action from 7.0.0 to 7.1.0 by @dependabot[bot] in https://github.com/k3s-io/k3s/pull/13918
• Bump traefik to 3.6.12 by @manuelbuil in https://github.com/k3s-io/k3s/pull/13912
• Fix embedded executor VPN config injection by @brandond in https://github.com/k3s-io/k3s/pull/13920
• Bump containerd to v2.2.3 by @brandond in https://github.com/k3s-io/k3s/pull/13931
• Bump flannel to v0.28.4 by @thomasferrandiz in https://github.com/k3s-io/k3s/pull/13937
• [main] Update to v1.35.4-k3s1 and Go 1.25.9 by @rafaelbreno in https://github.com/k3s-io/k3s/pull/13946
• [main] Immutable release changes by @rafaelbreno in https://github.com/k3s-io/k3s/pull/13902
• Bump Traefik to 3.6.13 by @cwayne18 in https://github.com/k3s-io/k3s/pull/13969
• [main] Switch from draft to pre-release by @rafaelbreno in https://github.com/k3s-io/k3s/pull/13951
• Fix SANs added from comma-separated node-external-ip list by @brandond in https://github.com/k3s-io/k3s/pull/13989
• Fix docker dualstack test by @brandond in https://github.com/k3s-io/k3s/pull/13994
• Bump klipper-helm image for revision check fix by @brandond in https://github.com/k3s-io/k3s/pull/13995

New Contributors

• @oglok made their first contribution in https://github.com/k3s-io/k3s/pull/13411
• @luojiyin1987 made their first contribution in https://github.com/k3s-io/k3s/pull/13380
• @geoffreyPerrin made their first contribution in https://github.com/k3s-io/k3s/pull/13467
• @rahulrairai59 made their first contribution in https://github.com/k3s-io/k3s/pull/13473
• @edithturn made their first contribution in https://github.com/k3s-io/k3s/pull/13510
• @zijiren233 made their first contribution in https://github.com/k3s-io/k3s/pull/13457
• @mmoll made their first contribution in https://github.com/k3s-io/k3s/pull/13654
• @fidencio made their first contribution in https://github.com/k3s-io/k3s/pull/13680
• @nuketownada made their first contribution in https://github.com/k3s-io/k3s/pull/13676
• @becarusys made their first contribution in https://github.com/k3s-io/k3s/pull/13712
• @DT1mote made their first contribution in https://github.com/k3s-io/k3s/pull/13848
• @caesarakalaeii made their first contribution in https://github.com/k3s-io/k3s/pull/13881
• @BenBo17 made their first contribution in https://github.com/k3s-io/k3s/pull/13890
• @jonhermansen made their first contribution in https://github.com/k3s-io/k3s/pull/13875

Full Changelog: https://github.com/k3s-io/k3s/compare/v1.35.0+k3s1...v1.36.0-rc1+k3s1

下载链接

• k3s
• k3s-airgap-images-amd64.tar
• k3s-airgap-images-amd64.tar.gz
• k3s-airgap-images-amd64.tar.zst
• k3s-airgap-images-arm.tar
• k3s-airgap-images-arm.tar.gz
• k3s-airgap-images-arm.tar.zst
• k3s-airgap-images-arm64.tar
• k3s-airgap-images-arm64.tar.gz
• k3s-airgap-images-arm64.tar.zst
• k3s-arm64
• k3s-armhf
• k3s-images.txt
• sha256sum-amd64.txt
• sha256sum-arm.txt
• sha256sum-arm64.txt