Releases: rancher/rke2
Releases · rancher/rke2
Release list
v1.37.0+rke2r1
This release updates Kubernetes to v1.37.0.
Important Note
If your server (control-plane) nodes were not started with the --token CLI flag or config file key, a randomized token was generated during initial cluster startup. This key is used both for joining new nodes to the cluster, and for encrypting cluster bootstrap data within the datastore. Ensure that you retain a copy of this token, as is required when restoring from backup.
You may retrieve the token value from any server already joined to the cluster:
cat /var/lib/rancher/rke2/server/tokenChanges since v1.36.3+rke2r1:
- Validate-charts: validate vsphere prime (hardened) images (#10914)
- Fix package-windows-images platform matching (#10942)
- Add cluster load balancer e2e test to nightly CNI workflow (#10937)
- Bump hardened-crictl to v1.36.0-build20260727 (#10954)
- Bump helm-controller and klipper-helm (#10957)
- Add rke2-security-responder chart (#10935)
- Add rke2-security-responder
- Update rancher-vsphere-csi to 3.7.2-rancher600 and align hardened CSI images (#10983)
- Add nightly kube-vip cluster load balancer E2E test (#10982)
- Update stable channel to v1.35.7+rke2r1 (#10996)
- Add warning about RKE_INGRESS_CONTROLLER deprecation (#11007)
- Bump rke2-metrics-server to 3.13.106 (#11020)
- Nightly-cni: test against master build instead of latest release (#11000)
- Bump systemd-node and use same opensuse/leap base for test target (#10785)
- Fix windows airgap by refactoring rke2-runtime image build+bundle pipeline (#11028)
- Bump the action-deps group across 1 directory with 8 updates (#11030)
- Charts: Bump Harvester CSI driver 0.1.31 (#11034)
- Add updatecli policy for hardened runtime images (#11053)
- Bump HCP 0.2.15 (#11041)
- Update hardened runtime images in Dockerfile (#11054)
- Update ingress-nginx to chart 4.15.107 / image v1.15.1-prime10 (#11052)
- Add a updatecli config for coredns and its 3 images (#11060)
- Bump containerd to v2.3.4-k3s1.36 (#11061)
- Updatecli: add manifest to automate metrics-server chart bumps (#11080)
- Update Flannel chart to v0.28.906 (#11069)
- Update Kubernetes Metrics Server chart 3.14.000 (#11082)
- Bump hardened-snapshot-controller (#11084)
- Ci: extract reusable build-e2e-artifacts workflow (#11078)
- Bump klipper-helm to v0.13.3-build20260820 (#11088)
- Updatecli: create-github-app-token v3.2.0 uses 'client-id' (#11093)
- Update containerd regex to accept -k3s1.XX tags (#11101)
- Bump K3s and CCM for 2026-08 release cycle (#11067)
- Remove leftover nft tables and blackhole route from canal (#10956)
- Remove calico leftover nft tables and blackhole routes when uninstalling rke2
- Fix 'no such image' in Release CI (#11114)
- Update Canal chart to v3.32.1-build2026082700 (#11131)
- Changes for windows 2025 server e2e testing (#11127)
- Add GatewayAPI CRD chart (#11136)
- RKE2 bundles gateway-api crds v1.6.1
- Bump rke2-security-responder to v0.1.5 (#11142)
- Bundle rke2-multus-crd chart and bump multus to v4.3.010 (#10998)
- Bump k8s to v1.37.0, etcd to v3.7.1, vpshere charts (#11147)
- Remove standalone ingress-nginx controller option (#11156)
- Users can no longer select
ingress-controller: ingress-nginx. Onlytraefik, ingress-nginxis still supported to allow a last chance for migration.
- Users can no longer select
- Bump gateway-api-crd version (#11164)
- Disable rke2-multus-crd chart when multus is not selected (#11168)
- Rke2-multus: install whereabouts CRDs unconditionally in crd chart (#11177)
- Bump Traefik to v3.7.13 (#11181)
- Fix ingress bootstrap with comma-separated ingress-controller (#11194)
- Bump Traefik to v3.7.13 (grpc CVE fix) (#11198)
- Cnis update for 2026-09 release (#11203)
- Update hardened core, coredns, vsphere, metric images (#11210)
- Bump google.golang.org/grpc to v1.82.2 for CVE-2026-84445 (#11191)
- Bump grpc to v1.83.2 and x/crypto to v0.55.0 (#11217)
- Update klipper-helm, etcd, k8s, and rke2-cloud-provider (#11218)
- Rke2-snapshot-controller: bump image to v8.6.0-build20260909 (#11221)
Charts Versions
| Component | Version |
|---|---|
| rke2-cilium | 1.20.103 |
| rke2-canal | v3.32.2-build2026090900 |
| rke2-calico | v3.32.200 |
| rke2-calico-crd | v3.32.200 |
| rke2-coredns | 1.47.100 |
| rke2-ingress-nginx | 4.15.109 |
| rke2-metrics-server | 3.14.001 |
| rke2-multus | v4.3.101 |
| rancher-vsphere-csi | 3.7.3-rancher300 |
| rancher-vsphere-cpi | 1.16.100 |
| harvester-cloud-provider | 0.2.1500 |
| harvester-csi-driver | 0.1.3100 |
| rke2-snapshot-controller | 5.2.004 |
| rke2-snapshot-controller-crd | 5.2.004 |
| rke2-traefik | 41.2.003 |
| rke2-traefik-crd | 41.2.003 |
Packaged Component Versions
| Component | Version |
|---|---|
| Kubernetes | v1.37.0 |
| Etcd | v3.7.1-k3s1 |
| Containerd | v2.3.4-k3s1 |
| Runc | v1.4.3 |
| Metrics-server | v0.9.0 |
| CoreDNS | v1.14.7 |
| Ingress-Nginx | v1.14.5-hardened2 |
| Helm-controller | v0.17.7 |
| Traefik | v3.7.13 |
Available CNIs
| Component | Version | FIPS Compliant |
|---|---|---|
| Canal (Default) | Flannel v0.28.9 [Calico v3.32.2](https://docs.tig... |
v1.37.0-rc7+rke2r1
Contributors
mgfritch
Assets 78
v1.37.0-rc6+rke2r1
What's Changed
- [Release-1.37] Bump grpc to v1.83.2 and x/crypto to v0.55.0 by @dereknola in #11217
- [release-1.37] Update klipper-helm, etcd, k8s, and rke2-cloud-provider by @mgfritch in #11218
Full Changelog: v1.37.0-rc5+rke2r1...v1.37.0-rc6+rke2r1
Contributors
mgfritch and dereknola
Assets 78
v1.37.0-rc5+rke2r1
What's Changed
- [Release 1.37] Cnis update for 2026-09 release by @rbrtbnfgl in #11203
- [Release-1.37] Update hardened core, coredns, vsphere, metric images by @dereknola in #11210
- [release-1.37] Bump google.golang.org/grpc to v1.82.2 for CVE-2026-84445 by @brandond in #11191
Full Changelog: v1.37.0-rc4+rke2r1...v1.37.0-rc5+rke2r1
Contributors
brandond, dereknola, and rbrtbnfgl
Assets 78
v1.37.0-rc4+rke2r1
What's Changed
- [release-1.37] rke2-multus: install whereabouts CRDs unconditionally in crd chart by @mgfritch in #11177
- [Release 1.37] Bump Traefik to v3.7.13 by @manuelbuil in #11181
- [release-1.37] Fix ingress bootstrap with comma-separated ingress-controller by @mgfritch in #11194
- [Release 1.37] Bump Traefik to v3.7.13 (grpc CVE fix) by @manuelbuil in #11198
Full Changelog: v1.37.0-rc3+rke2r1...v1.37.0-rc4+rke2r1
Contributors
mgfritch and manuelbuil
Assets 78
v1.37.0-rc3+rke2r1
Contributors
mgfritch
Assets 78
v1.37.0-rc2+rke2r1
What's Changed
- [Release 1.37] Bump gateway-api-crd version by @manuelbuil in #11164
Full Changelog: v1.37.0-rc1+rke2r1...v1.37.0-rc2+rke2r1
Contributors
manuelbuil
Assets 78
v1.37.0-rc1+rke2r1
What's Changed
- Use crane to package non-core images by @dereknola in #9440
- Bump rke2-calico to v3.31.3 by @thomasferrandiz in #9452
- CNI bump Jan 2026 by @thomasferrandiz in #9463
- Bump alpine from 3.22 to 3.23 by @dependabot[bot] in #9345
- ADR about security-responder by @manuelbuil in #9006
- Remove Unnecessary GHA tools by @dereknola in #9447
- Bump Ingresses - 2026 Jan by @dereknola in #9479
- Bump snapshot controller and csi-snapshotter by @dereknola in #9491
- Bump github.com/expr-lang/expr from 1.17.6 to 1.17.7 by @dependabot[bot] in #9431
- [master] Publish GA images to staging registry by @rafaelbreno in #9469
- chore: Bump containerd by @dereknola in #9497
- Add check-images build script, fix incorrect image by @dereknola in #9496
- rke2-coredns: Use k8s-style "IANA" names (RFC 6335) by @mgfritch in #9498
- Bump K3s version for main by @brandond in #9512
- [Windows] Adjust directory creation order in rke2-runtime image by @HarrisonWAffel in #9433
- Update to cilium v1.18.6 by @mgfritch in #9518
- Add retry when downloading kubectl in builds by @dereknola in #9520
- Bump Traefik version to v3.6.7 by @manuelbuil in #9539
- Sync chart and image versions with rancher/rke2-charts main by @thomasferrandiz with @Copilot in #9555
- Add e2e test for Calico in eBPF mode by @thomasferrandiz in #9417
- Add el10 for the install script by @vitorsavian in #9557
- Replace deprecated wait.Poll with wait.PollUntilContextTimeout by @luojiyin1987 in #9509
- Add path prefix support to
system-default-registryby @ngharo in #9404 - Consolidate vagrant network configuration for the extra interface in one script by @manuelbuil in #9570
- Bump etcd to v3.6.7 by @brandond in #9577
- [master] Update to v1.35.0-rke2r3 by @rafaelbreno in #9598
- Increase time-outs in calico ebpf test by @thomasferrandiz in #9590
- [master] Fix release arm64 by @rafaelbreno in #9603
- [master] Fix manifest and sync-prime steps by @rafaelbreno in #9612
- Revert accidental hardcode of klipper-helm tag by @brandond in #9622
- Fix setup-go cache key creation by @dereknola in #9576
- Bump K3s version for main by @brandond in #9632
- Bump ingress-nginx to v1.14.3-hardened1 by @dereknola in #9637
- Bump rancher/ecm-distro-tools from 0.61.0 to 0.61.1 by @dependabot[bot] in #9552
- [master] Bump stable channel to
v1.34.3+rke2r3by @rafaelbreno in #9651 - Install the kubectl version from stable defined in channels.yaml by @dereknola in #9652
- Update nightly images 2026 by @dereknola in #9615
- Bump Traefik and Snapshot controller by @dereknola in #9658
- Update to CoreDNS chart 1.45.201 by @mgfritch in #9639
- [master] Add
-e REGISTRYin Makefilein-docker-%by @rafaelbreno in #9620 - Remove cloud-config arg from kubelet for windows by @adonskoy in #9664
- Update Cilium chart to v1.19.0 by @rbrtbnfgl in #9669
- CNI bumps for the Feb 2026 release by @mgfritch in #9668
- Update to Kubernetes Metrics Server chart 3.13.007 by @mgfritch in #9666
- Bump ingress-nginx to v1.14.3-hardened2 by @dereknola in #9695
- fix: clarified the proper user docs location by @e-minguez in #9693
- [master] Update K8s to v1.35.1 and Go to v1.25.6 by @rafaelbreno in #9704
- Bump k3s/rke2-ccm/klipper-lb/klipper-helm by @brandond in #9707
- Bump aws-actions/configure-aws-credentials from 5 to 6 by @dependabot[bot] in #9670
- Ingress-Nginx to Traefik Docker Test by @dereknola in #9733
- Bump stable to
v1.34.4+rke2r1by @rafaelbreno in #9725 - Bump aquasecurity/trivy-action from 0.33.1 to 0.34.0 by @dependabot[bot] in #9727
- Prevent manifest race in Ingress Migration test by @dereknola in #9742
- Update to cilium v1.19.1 by @mgfritch in #9740
- Change SLES 16 default installation to rpms by @vitorsavian in #9723
- Fix tarball ownership and permissions by @brandond in #9754
- Fix rke2 startup when embedded registry is enabled but not configured by @brandond in #9756
- Bump actions/stale from 10.1.1 to 10.2.0 by @dependabot[bot] in #9766
- Fix to only set the default for SLES 16 and not for SLEMicro 6.2 by @vitorsavian in #9769
- Prevent a node transform from agent/server to server/agent by @manuelbuil in #9729
- Fix package dev broken after dapper removal from rke2-packaging by @vitorsavian in #9798
- Align integration test and coverage file generation by @manuelbuil in #9799
- Bump Traefik to v3.6.9 by @manuelbuil in #9787
- [master] Update to v1.35.2 and Go v1.25.7 by @rafaelbreno in #9813
- Bump ETCD version to v3.6.7-k3s1-20260227 by @vitorsavian in #9823
- Bump k3s for etcd bootstrap fix by @brandond in #9784
- chore: Bump ingress-nginx 2026-Feb by @dereknola in #9828
- Reduce embedded registry peer wait from 60 seconds to 15 by @brandond in #9839
- Bump crictl, runc and containerd to build20260303 by @vitorsavian in #9853
- Bump actions/download-artifact from 7 to 8 by @dependabot[bot] in #9845
- Bump rancher/ecm-distro-tools from 0.61.1 to 0.62.0 by @dependabot[bot] in #9846
- Update PSA namespace exceptions by @dereknola in #9867
- Add
primeconfiguration by @dereknola in #9859 - update channel server to 1.34.5 by @briandowns in #9864
- Bump ingresses 2026 March by @dereknola in #9888
- Update to calico v3.31.4 by @mgfritch in #9773
- Bump snapshot crd for groupsnapshot v1beta2 by @dereknola in #9893
- Update to multus chart v4.2.403 by @mgfritch in #9886
- Update to CoreDNS chart 1.45.205 by @mgfritch in #9884
- Bump flannel with newer busybox image by @dereknola in #9930
- Bump K3s version for main by @brandond in #9925
- Update to canal v3.31.4-build2026031000 by @mgfritch in #9945
- Bump runc to v1.4.1 by @brandond in #9954
- Pass PRIME_REGISTRY env var to
make cisteps by @dereknola in #9962 - Add PRIME_REGISTRY passthrough to in-docker-XXXXX targets by @dereknola in #9972
- Bump actions/create-github-app-token from 2 to 3 by @dependabot[bot] in #9960
- Bump docker/login-action from 3 to 4 by @dependabot[bot] in #9874
- Add restorecon if selinux is installed in tar to fix wrong contexts by @vitorsavian in #9923
- Bump K3s version for main by @brandond in #9985
- Bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #9847
- [master] Update to v1.35.3 by @rafaelbreno in #9994
- remove old data dirs after succesful start by @bashilias in #9977
- chore(ci): bump aquasecurity/trivy-action to v0.35.0 by @macedogm in #10002
- Bump ingress nginx to v1.14.5 by @vitorsavian in #10003
- [master] Pin GH Actions to commit sha by @macedogm in #10014
- [master] Add Install Trivy step by @rafaelbreno in #10027
- Fixed Flannel configuration for e2e tests by @rbr...
Contributors
e-minguez, brandond, and 25 other contributors
Assets 78
v1.36.4+rke2r1
Warning
Upstream ingress-nginx Retirement & Transition to Traefik
Because ingress-nginx was retired upstream as of March 2026, Traefik is now the default for new clusters starting in v1.36 (existing clusters will keep their current ingress upon upgrade to avoid breakage). This transition brings the following structural changes:
- Airgapped Environments: The
rke2-images-coretarball now contains Traefik images instead ofingress-nginx. The standalonerke2-images-traefiktarball has been removed. Users who must continue usingingress-nginxwill now need to manually provide therke2-images-ingress-nginxtarball. - Future Removal: The
ingress-nginxchart will not receive any additional updates and will be completely removed in v1.37 for community users. - Prime Customers: Please refer to the official product documentation for specific Prime considerations.
This release upgrades Traefik chart to v40.x which includes a breaking change for the ingress-nginx migration: the provider name changes from kubernetesIngressNginx to kubernetesIngressNGINX. Check https://github.com/traefik/traefik-helm-chart/releases/tag/v40.0.0 for more details
This release updates Kubernetes to v1.36.4.
Important Note
If your server (control-plane) nodes were not started with the --token CLI flag or config file key, a randomized token was generated during initial cluster startup. This key is used both for joining new nodes to the cluster, and for encrypting cluster bootstrap data within the datastore. Ensure that you retain a copy of this token, as is required when restoring from backup.
You may retrieve the token value from any server already joined to the cluster:
cat /var/lib/rancher/rke2/server/tokenChanges since v1.36.3+rke2r1:
- Bump rke2-traefik to 41.1.101 - #11002 (#11006)
- Chore: bump rke2-canal, rke2-flannel (#11015)
- Bump rke2-metrics-server to 3.13.106 (#11027)
- Fix windows airgap by refactoring rke2-runtime image build+bundle pipeline (#11031)
- Charts: Bump Harvester CSI driver 0.1.31 (#11037)
- Bump HCP 0.2.15 (#11045)
- Bump containerd to v2.3.4-k3s1.36 (#11062)
- Bump etcd, crictl, runc and containerd (#11075)
- Bump klipper-helm to v0.13.3-build20260820 (#11089)
- Bumps to runtime images, coredns, k8s metrics server, ingress-nginx, and traefik (#11096)
- Update CNIs for 2026-08 Release Cycle (#11097)
- Bump K3s and CCM for 2026-08 release cycle (#11071)
- Update to v1.36.4-rke2r1 and Go 1.26.5 (#11106)
- Fix 'no such image' in Release CI (#11113)
- Use rke2-traefik-1.34-1.36 (#11124)
- Update Canal chart to v3.32.1-build2026082700 (#11132)
Charts Versions
| Component | Version |
|---|---|
| rke2-cilium | 1.19.601 |
| rke2-canal | v3.32.1-build2026082700 |
| rke2-calico | v3.32.100 |
| rke2-calico-crd | v3.32.100 |
| rke2-coredns | 1.47.003 |
| rke2-ingress-nginx | 4.15.109 |
| rke2-metrics-server | 3.14.000 |
| rke2-multus | v4.3.008 |
| rancher-vsphere-csi | 3.7.2-rancher700 |
| rancher-vsphere-cpi | 1.15.300 |
| harvester-cloud-provider | 0.2.1500 |
| harvester-csi-driver | 0.1.3100 |
| rke2-snapshot-controller | 5.2.003 |
| rke2-snapshot-controller-crd | 5.2.003 |
| rke2-traefik | 40.1.010 |
| rke2-traefik-crd | 40.1.010 |
Packaged Component Versions
| Component | Version |
|---|---|
| Kubernetes | v1.36.4 |
| Etcd | v3.6.14-k3s1 |
| Containerd | v2.3.4-k3s1.36 |
| Runc | v1.4.3 |
| Metrics-server | v0.9.0 |
| CoreDNS | v1.14.7 |
| Ingress-Nginx | v1.14.5-hardened2 |
| Helm-controller | v0.17.7 |
| Traefik | v3.7.11 |
Available CNIs
| Component | Version | FIPS Compliant |
|---|---|---|
| Canal (Default) | Flannel v0.28.9 Calico v3.32.1 |
Yes |
| Calico | v3.32.1 | No |
| Cilium | v1.19.6 | No |
| Multus | v4.3.0 | No |
Helpful Links
As always, we welcome and appreciate feedback from our community of users. Please feel free to:
- Open issues here
- Join our Slack channel
- Check out our documentation for guidance on how to get started.
v1.36.4-rc4+rke2r1
Contributors
mgfritch
