What's Changed

• [release-1.37] Disable rke2-multus-crd chart when multus is not selected by @mgfritch in #11168

Full Changelog: v1.37.0-rc2+rke2r1...v1.37.0-rc3+rke2r1

What's Changed

• [Release 1.37] Bump gateway-api-crd version by @manuelbuil in #11164

Full Changelog: v1.37.0-rc1+rke2r1...v1.37.0-rc2+rke2r1

What's Changed

• Use crane to package non-core images by @dereknola in #9440
• Bump rke2-calico to v3.31.3 by @thomasferrandiz in #9452
• CNI bump Jan 2026 by @thomasferrandiz in #9463
• Bump alpine from 3.22 to 3.23 by @dependabot[bot] in #9345
• ADR about security-responder by @manuelbuil in #9006
• Remove Unnecessary GHA tools by @dereknola in #9447
• Bump Ingresses - 2026 Jan by @dereknola in #9479
• Bump snapshot controller and csi-snapshotter by @dereknola in #9491
• Bump github.com/expr-lang/expr from 1.17.6 to 1.17.7 by @dependabot[bot] in #9431
• [master] Publish GA images to staging registry by @rafaelbreno in #9469
• chore: Bump containerd by @dereknola in #9497
• Add check-images build script, fix incorrect image by @dereknola in #9496
• rke2-coredns: Use k8s-style "IANA" names (RFC 6335) by @mgfritch in #9498
• Bump K3s version for main by @brandond in #9512
• [Windows] Adjust directory creation order in rke2-runtime image by @HarrisonWAffel in #9433
• Update to cilium v1.18.6 by @mgfritch in #9518
• Add retry when downloading kubectl in builds by @dereknola in #9520
• Bump Traefik version to v3.6.7 by @manuelbuil in #9539
• Sync chart and image versions with rancher/rke2-charts main by @thomasferrandiz with @Copilot in #9555
• Add e2e test for Calico in eBPF mode by @thomasferrandiz in #9417
• Add el10 for the install script by @vitorsavian in #9557
• Replace deprecated wait.Poll with wait.PollUntilContextTimeout by @luojiyin1987 in #9509
• Add path prefix support to system-default-registry by @ngharo in #9404
• Consolidate vagrant network configuration for the extra interface in one script by @manuelbuil in #9570
• Bump etcd to v3.6.7 by @brandond in #9577
• [master] Update to v1.35.0-rke2r3 by @rafaelbreno in #9598
• Increase time-outs in calico ebpf test by @thomasferrandiz in #9590
• [master] Fix release arm64 by @rafaelbreno in #9603
• [master] Fix manifest and sync-prime steps by @rafaelbreno in #9612
• Revert accidental hardcode of klipper-helm tag by @brandond in #9622
• Fix setup-go cache key creation by @dereknola in #9576
• Bump K3s version for main by @brandond in #9632
• Bump ingress-nginx to v1.14.3-hardened1 by @dereknola in #9637
• Bump rancher/ecm-distro-tools from 0.61.0 to 0.61.1 by @dependabot[bot] in #9552
• [master] Bump stable channel to v1.34.3+rke2r3 by @rafaelbreno in #9651
• Install the kubectl version from stable defined in channels.yaml by @dereknola in #9652
• Update nightly images 2026 by @dereknola in #9615
• Bump Traefik and Snapshot controller by @dereknola in #9658
• Update to CoreDNS chart 1.45.201 by @mgfritch in #9639
• [master] Add -e REGISTRY in Makefile in-docker-% by @rafaelbreno in #9620
• Remove cloud-config arg from kubelet for windows by @adonskoy in #9664
• Update Cilium chart to v1.19.0 by @rbrtbnfgl in #9669
• CNI bumps for the Feb 2026 release by @mgfritch in #9668
• Update to Kubernetes Metrics Server chart 3.13.007 by @mgfritch in #9666
• Bump ingress-nginx to v1.14.3-hardened2 by @dereknola in #9695
• fix: clarified the proper user docs location by @e-minguez in #9693
• [master] Update K8s to v1.35.1 and Go to v1.25.6 by @rafaelbreno in #9704
• Bump k3s/rke2-ccm/klipper-lb/klipper-helm by @brandond in #9707
• Bump aws-actions/configure-aws-credentials from 5 to 6 by @dependabot[bot] in #9670
• Ingress-Nginx to Traefik Docker Test by @dereknola in #9733
• Bump stable to v1.34.4+rke2r1 by @rafaelbreno in #9725
• Bump aquasecurity/trivy-action from 0.33.1 to 0.34.0 by @dependabot[bot] in #9727
• Prevent manifest race in Ingress Migration test by @dereknola in #9742
• Update to cilium v1.19.1 by @mgfritch in #9740
• Change SLES 16 default installation to rpms by @vitorsavian in #9723
• Fix tarball ownership and permissions by @brandond in #9754
• Fix rke2 startup when embedded registry is enabled but not configured by @brandond in #9756
• Bump actions/stale from 10.1.1 to 10.2.0 by @dependabot[bot] in #9766
• Fix to only set the default for SLES 16 and not for SLEMicro 6.2 by @vitorsavian in #9769
• Prevent a node transform from agent/server to server/agent by @manuelbuil in #9729
• Fix package dev broken after dapper removal from rke2-packaging by @vitorsavian in #9798
• Align integration test and coverage file generation by @manuelbuil in #9799
• Bump Traefik to v3.6.9 by @manuelbuil in #9787
• [master] Update to v1.35.2 and Go v1.25.7 by @rafaelbreno in #9813
• Bump ETCD version to v3.6.7-k3s1-20260227 by @vitorsavian in #9823
• Bump k3s for etcd bootstrap fix by @brandond in #9784
• chore: Bump ingress-nginx 2026-Feb by @dereknola in #9828
• Reduce embedded registry peer wait from 60 seconds to 15 by @brandond in #9839
• Bump crictl, runc and containerd to build20260303 by @vitorsavian in #9853
• Bump actions/download-artifact from 7 to 8 by @dependabot[bot] in #9845
• Bump rancher/ecm-distro-tools from 0.61.1 to 0.62.0 by @dependabot[bot] in #9846
• Update PSA namespace exceptions by @dereknola in #9867
• Add prime configuration by @dereknola in #9859
• update channel server to 1.34.5 by @briandowns in #9864
• Bump ingresses 2026 March by @dereknola in #9888
• Update to calico v3.31.4 by @mgfritch in #9773
• Bump snapshot crd for groupsnapshot v1beta2 by @dereknola in #9893
• Update to multus chart v4.2.403 by @mgfritch in #9886
• Update to CoreDNS chart 1.45.205 by @mgfritch in #9884
• Bump flannel with newer busybox image by @dereknola in #9930
• Bump K3s version for main by @brandond in #9925
• Update to canal v3.31.4-build2026031000 by @mgfritch in #9945
• Bump runc to v1.4.1 by @brandond in #9954
• Pass PRIME_REGISTRY env var to make ci steps by @dereknola in #9962
• Add PRIME_REGISTRY passthrough to in-docker-XXXXX targets by @dereknola in #9972
• Bump actions/create-github-app-token from 2 to 3 by @dependabot[bot] in #9960
• Bump docker/login-action from 3 to 4 by @dependabot[bot] in #9874
• Add restorecon if selinux is installed in tar to fix wrong contexts by @vitorsavian in #9923
• Bump K3s version for main by @brandond in #9985
• Bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #9847
• [master] Update to v1.35.3 by @rafaelbreno in #9994
• remove old data dirs after succesful start by @bashilias in #9977
• chore(ci): bump aquasecurity/trivy-action to v0.35.0 by @macedogm in #10002
• Bump ingress nginx to v1.14.5 by @vitorsavian in #10003
• [master] Pin GH Actions to commit sha by @macedogm in #10014
• [master] Add Install Trivy step by @rafaelbreno in #10027
• Fixed Flannel configuration for e2e tests by @rbr...

This release updates Kubernetes to v1.36.4.

Important Note

If your server (control-plane) nodes were not started with the --token CLI flag or config file key, a randomized token was generated during initial cluster startup. This key is used both for joining new nodes to the cluster, and for encrypting cluster bootstrap data within the datastore. Ensure that you retain a copy of this token, as is required when restoring from backup.

You may retrieve the token value from any server already joined to the cluster:

cat /var/lib/rancher/rke2/server/token

Changes since v1.36.3+rke2r1:

• Bump rke2-traefik to 41.1.101 - #11002 (#11006)
• Chore: bump rke2-canal, rke2-flannel (#11015)
• Bump rke2-metrics-server to 3.13.106 (#11027)
• Fix windows airgap by refactoring rke2-runtime image build+bundle pipeline (#11031)
• Charts: Bump Harvester CSI driver 0.1.31 (#11037)
• Bump HCP 0.2.15 (#11045)
• Bump containerd to v2.3.4-k3s1.36 (#11062)
• Bump etcd, crictl, runc and containerd (#11075)
• Bump klipper-helm to v0.13.3-build20260820 (#11089)
• Bumps to runtime images, coredns, k8s metrics server, ingress-nginx, and traefik (#11096)
  • Update CNIs for 2026-08 Release Cycle (#11097)
• Bump K3s and CCM for 2026-08 release cycle (#11071)
• Update to v1.36.4-rke2r1 and Go 1.26.5 (#11106)
• Fix 'no such image' in Release CI (#11113)
• Use rke2-traefik-1.34-1.36 (#11124)
  • Update Canal chart to v3.32.1-build2026082700 (#11132)

Charts Versions

Packaged Component Versions

Available CNIs

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started.

What's Changed

• [Release-1.36] - Update Canal chart to v3.32.1-build2026082700 by @mgfritch in #11132

Full Changelog: v1.36.4-rc3+rke2r1...v1.36.4-rc4+rke2r1

This release updates Kubernetes to v1.35.8.

Important Note

If your server (control-plane) nodes were not started with the --token CLI flag or config file key, a randomized token was generated during initial cluster startup. This key is used both for joining new nodes to the cluster, and for encrypting cluster bootstrap data within the datastore. Ensure that you retain a copy of this token, as is required when restoring from backup.

You may retrieve the token value from any server already joined to the cluster:

cat /var/lib/rancher/rke2/server/token

Changes since v1.35.7+rke2r1:

• Chore: bump rke2-canal, rke2-flannel (#11017)
• Bump rke2-metrics-server to 3.13.106 (#11025)
• Fix windows airgap by refactoring rke2-runtime image build+bundle pipeline (#11032)
• Charts: Bump Harvester CSI driver 0.1.31 (#11036)
• Bump HCP 0.2.15 (#11044)
• Bump containerd to v2.2.7-k3s1 (#11065)
• Bump etcd, crictl, runc and containerd (#11076)
• Bump klipper-helm to v0.13.3-build20260820 (#11090)
  • Update CNIs for 2026-08 Release Cycle (#11098)
• Bumps to runtime images, coredns, k8s metrics server, ingress-nginx, and traefik (#11094)
• Bump K3s and CCM for 2026-08 release cycle (#11072)
• Update to v1.35.8-rke2r1 and Go 1.26.5 (#11105)
• Fix 'no such image' in Release CI (#11112)
• Use rke2-traefik-1.34-1.36 (#11125)
  • Update Canal chart to v3.32.1-build2026082700 (#11133)

Charts Versions

Packaged Component Versions

Available CNIs

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started.

What's Changed

• [Release-1.35] - Update Canal chart to v3.32.1-build2026082700 by @mgfritch in #11133

Full Changelog: v1.35.8-rc3+rke2r1...v1.35.8-rc4+rke2r1

This release updates Kubernetes to v1.34.11.

Important Note

If your server (control-plane) nodes were not started with the --token CLI flag or config file key, a randomized token was generated during initial cluster startup. This key is used both for joining new nodes to the cluster, and for encrypting cluster bootstrap data within the datastore. Ensure that you retain a copy of this token, as is required when restoring from backup.

You may retrieve the token value from any server already joined to the cluster:

cat /var/lib/rancher/rke2/server/token

Changes since v1.34.10+rke2r1:

• Chore: bump rke2-canal, rke2-flannel (#11019)
• Bump rke2-metrics-server to 3.13.106 (#11023)
• Fix windows airgap by refactoring rke2-runtime image build+bundle pipeline (#11033)
• Charts: Bump Harvester CSI driver 0.1.31 (#11035)
• Bump HCP 0.2.15 (#11042)
• Bump containerd to v2.2.7-k3s1 (#11063)
• Bump etcd, crictl, runc and containerd (#11077)
• Bump klipper-helm to v0.13.3-build20260820 (#11091)
• Bumps to runtime images, coredns, k8s metrics server, ingress-nginx, and traefik (#11095)
  • Update CNIs for 2026-08 Release Cycle (#11099)
• Bump K3s and CCM for 2026-08 release cycle (#11073)
• Update to v1.34.11-rke2r1 and Go 1.26.5 (#11104)
• Fix 'no such image' in Release CI (#11111)
• Ensure correct containerd socket address (#11121)
• Fix release.yml syntax (#11122)
• Update image pull command to run per image (#11123)
• Use rke2-traefik-1.34-1.36 (#11126)
  • Update Canal chart to v3.32.1-build2026082700 (#11134)

Charts Versions

Packaged Component Versions

Available CNIs

Helpful Links

As always, we welcome and appreciate feedback from our community of users. Please feel free to:

• Open issues here
• Join our Slack channel
• Check out our documentation for guidance on how to get started.

What's Changed

• [Release-1.34] - Update Canal chart to v3.32.1-build2026082700 by @mgfritch in #11134

Full Changelog: v1.34.11-rc6+rke2r1...v1.34.11-rc7+rke2r1

What's Changed

• Use rke2-traefik-1.34-1.36 by @thomasferrandiz in #11124

Full Changelog: v1.36.4-rc2+rke2r1...v1.36.4-rc3+rke2r1