本文档采用自动化机器翻译技术翻译。 尽管我们力求提供准确的译文，但不对翻译内容的完整性、准确性或可靠性作出任何保证。 若出现任何内容不一致情况，请以原始 英文 版本为准，且原始英文版本为权威文本。

v1.35.X

Release v1.35.4+rke2r1

This release updates Kubernetes to v1.35.4.

Important Note

If your server (control-plane) nodes were not started with the --token CLI flag or config file key, a randomized token was generated during initial cluster startup. This key is used both for joining new nodes to the cluster, and for encrypting cluster bootstrap data within the datastore. Ensure that you retain a copy of this token, as is required when restoring from backup.

You may retrieve the token value from any server already joined to the cluster:

cat /var/lib/rancher/rke2/server/token

Changes since v1.35.3+rke2r3:

  • Charts: bump Harvester CSI Driver 0.1.28 (#10110)

      • Fix the race-condition issue during a huge pod respawn simultaneously

      • Support both Harvester v1.7/v1.8 Cluster

      • Support Backup

  • Checksum verification for Dockerfiles (#10125)

  • Test-suite: fix vault action failure (#10136)

  • Make releases immutable (#10042)

  • Bump images to build20260410 (#10143)

    • CNI bumps for the Apr 2026 release (#10155)

  • Update Flannel and Canal chart with updated images (#10170)

  • Bump rke2-multus to v4.2.408 (#10174)

  • Update Traefik to v3.6.12 (#10167)

    • Update Kubernetes Metrics Server chart 3.13.008 (#10185)

    • Update to CoreDNS chart 1.45.208 (#10191)

  • Bump etcd for CVE reasons (#10195) (#10203)

    • Bump to snapshot-controller v8.5.0 (#10215)

    • CNI bumps for the Apr 2026 release (part deux) (#10229)

  • K3s bump and backports for 2026-04 (#10206)

  • Update to v1.35.4 and Go v1.25.9 (#10234)

  • Bump ingress-nginx to fix CVEs (#10242)

  • Bump Traefik v3.6.13 (#10251)

    • Update to CoreDNS chart 1.45.209 (#10266)

  • Bump k3s and klipper-helm (#10284)

Charts Versions

| Component | Version | | — | — | | rke2-cilium | 1.19.300 | | rke2-canal | v3.31.5-build2026041500 | | rke2-calico | v3.31.500 | | rke2-calico-crd | v3.31.500 | | rke2-coredns | 1.45.209 | | rke2-ingress-nginx | 4.14.504 | | rke2-metrics-server | 3.13.008 | | rancher-vsphere-csi | 3.6.0-rancher100 | | rancher-vsphere-cpi | 1.13.000 | | harvester-cloud-provider | 0.2.1100 | | harvester-csi-driver | 0.1.2800 | | rke2-snapshot-controller | 4.2.003 | | rke2-snapshot-controller-crd | 4.2.003 | | rke2-traefik | 39.0.701 | | rke2-traefik-crd | 39.0.701 |

Release v1.35.3+rke2r3

This release updates Kubernetes to v1.35.3.

Important Note

If your server (control-plane) nodes were not started with the --token CLI flag or config file key, a randomized token was generated during initial cluster startup. This key is used both for joining new nodes to the cluster, and for encrypting cluster bootstrap data within the datastore. Ensure that you retain a copy of this token, as is required when restoring from backup.

You may retrieve the token value from any server already joined to the cluster:

cat /var/lib/rancher/rke2/server/token

Changes since v1.35.3+rke2r1:

Charts Versions

| Component | Version | | — | — | | rke2-cilium | 1.19.101 | | rke2-canal | v3.31.4-build2026032700 | | rke2-calico | v3.31.400 | | rke2-calico-crd | v3.31.400 | | rke2-coredns | 1.45.205 | | rke2-ingress-nginx | 4.14.503 | | rke2-metrics-server | 3.13.007 | | rancher-vsphere-csi | 3.6.0-rancher100 | | rancher-vsphere-cpi | 1.13.000 | | harvester-cloud-provider | 0.2.1100 | | harvester-csi-driver | 0.1.2500 | | rke2-snapshot-controller | 4.2.002 | | rke2-snapshot-controller-crd | 4.2.002 | | rke2-snapshot-validation-webhook | 0.0.0 | | rke2-traefik | 39.0.502 | | rke2-traefik-crd | 39.0.502 |

Release v1.35.3+rke2r1

This release updates Kubernetes to v1.35.3.

Important Note

If your server (control-plane) nodes were not started with the --token CLI flag or config file key, a randomized token was generated during initial cluster startup. This key is used both for joining new nodes to the cluster, and for encrypting cluster bootstrap data within the datastore. Ensure that you retain a copy of this token, as is required when restoring from backup.

You may retrieve the token value from any server already joined to the cluster:

cat /var/lib/rancher/rke2/server/token

Changes since v1.35.2+rke2r1:

  • Add prime configuration (#9878)

  • Bump ingresses 2026 March (#9889)

  • Bump snapshot crd for groupsnapshot v1beta2 (#9902)

    • Update to multus chart v4.2.403 (#9910)

    • Update to CoreDNS chart 1.45.205 (#9918)

  • Update PSA namespace exceptions (#9927)

  • Bump flannel with newer busybox image (#9935)

  • Version bumps and backports for 2026-03 (#9926)

    • Update to canal v3.31.4-build2026031000 (#9950)

  • Bump runc to v1.4.1 (#9955)

  • Pass PRIME_REGISTRY env var to make ci steps (#9963)

  • Add PRIME_REGISTRY passthrough to in-docker-XXXXX targets (#9973)

  • Bump K3s version (#9986)

  • Update to v1.35.3 (#9993)

  • Bump ingress nginx to 1.14.5 (#10004)

  • Add Install Trivy step (#10026)

  • Pin GH Actions to commit sha (#10019)

Charts Versions

| Component | Version | | — | — | | rke2-cilium | 1.19.101 | | rke2-canal | v3.31.4-build2026032700 | | rke2-calico | v3.31.400 | | rke2-calico-crd | v3.31.400 | | rke2-coredns | 1.45.205 | | rke2-ingress-nginx | 4.14.501 | | rke2-metrics-server | 3.13.007 | | rancher-vsphere-csi | 3.6.0-rancher100 | | rancher-vsphere-cpi | 1.13.000 | | harvester-cloud-provider | 0.2.1100 | | harvester-csi-driver | 0.1.2500 | | rke2-snapshot-controller | 4.2.002 | | rke2-snapshot-controller-crd | 4.2.002 | | rke2-snapshot-validation-webhook | 0.0.0 | | rke2-traefik | 39.0.502 | | rke2-traefik-crd | 39.0.502 |

Release v1.35.2+rke2r1

This release updates Kubernetes to v1.35.2.

Important Note

If your server (control-plane) nodes were not started with the --token CLI flag or config file key, a randomized token was generated during initial cluster startup. This key is used both for joining new nodes to the cluster, and for encrypting cluster bootstrap data within the datastore. Ensure that you retain a copy of this token, as is required when restoring from backup.

You may retrieve the token value from any server already joined to the cluster:

cat /var/lib/rancher/rke2/server/token

Changes since v1.35.1+rke2r1:

  • Ingress-Nginx to Traefik Docker Test (#9735)

  • Prevent a node transform from agent/server to server/agent (#9778)

  • Fix package dev broken after dapper removal from rke2-packaging (#9804)

  • Bump Traefik to v3.6.9 (#9822)

  • Update to v1.35.2 and Go v1.25.7 (#9812)

  • Bump k3s for etcd bootstrap fix (#9793)

  • Bump ETCD version to v3.6.7-k3s1-20260227 (#9824)

  • Chore: Bump ingress-nginx 2026-Feb (#9829)

  • Backports for 2026-02 BONUS RELEASE (#9840)

  • Bump crictl, runc and containerd to build20260303 (#9852)

Charts Versions

| Component | Version | | — | — | | rke2-cilium | 1.19.100 | | rke2-canal | v3.31.3-build2026020600 | | rke2-calico | v3.31.300 | | rke2-calico-crd | v3.31.300 | | rke2-coredns | 1.45.201 | | rke2-ingress-nginx | 4.14.303 | | rke2-metrics-server | 3.13.007 | | rancher-vsphere-csi | 3.6.0-rancher100 | | rancher-vsphere-cpi | 1.13.000 | | harvester-cloud-provider | 0.2.1100 | | harvester-csi-driver | 0.1.2500 | | rke2-snapshot-controller | 4.2.001 | | rke2-snapshot-controller-crd | 4.2.001 | | rke2-snapshot-validation-webhook | 0.0.0 | | rke2-traefik | 39.0.002 | | rke2-traefik-crd | 39.0.002 |

Release v1.35.1+rke2r1

This release updates Kubernetes to v1.35.1.

Important Note

If your server (control-plane) nodes were not started with the --token CLI flag or config file key, a randomized token was generated during initial cluster startup. This key is used both for joining new nodes to the cluster, and for encrypting cluster bootstrap data within the datastore. Ensure that you retain a copy of this token, as is required when restoring from backup.

You may retrieve the token value from any server already joined to the cluster:

cat /var/lib/rancher/rke2/server/token

Changes since v1.35.0+rke2r3:

  • Bump k3s + Bulk Backports 2026-02 (#9654)

    • Update to CoreDNS chart 1.45.201 (#9644)

  • Remove cloud-config arg from kubelet for windows (#9673)

  • CNI bumps for the Feb 2026 release (#9679)

    • Update Kubernetes Metrics Server chart 3.13.007 (#9687)

  • Bump ingress-nginx to v1.14.3-hardened2 (#9696)

  • Update K8s to v1.35.1 and Go to v1.25.6 (#9703)

  • Bump k3s/rke2-ccm/klipper-lb/klipper-helm (#9708)

Charts Versions

| Component | Version | | — | — | | rke2-cilium | 1.19.001 | | rke2-canal | v3.31.3-build2026020600 | | rke2-calico | v3.31.300 | | rke2-calico-crd | v3.31.300 | | rke2-coredns | 1.45.201 | | rke2-ingress-nginx | 4.14.302 | | rke2-metrics-server | 3.13.007 | | rancher-vsphere-csi | 3.6.0-rancher100 | | rancher-vsphere-cpi | 1.13.000 | | harvester-cloud-provider | 0.2.1100 | | harvester-csi-driver | 0.1.2500 | | rke2-snapshot-controller | 4.2.001 | | rke2-snapshot-controller-crd | 4.2.001 | | rke2-snapshot-validation-webhook | 0.0.0 | | rke2-traefik | 39.0.000 | | rke2-traefik-crd | 39.0.000 |

Release v1.35.0+rke2r3

This release updates Kubernetes to v1.35.0.

Important Note

If your server (control-plane) nodes were not started with the --token CLI flag or config file key, a randomized token was generated during initial cluster startup. This key is used both for joining new nodes to the cluster, and for encrypting cluster bootstrap data within the datastore. Ensure that you retain a copy of this token, as is required when restoring from backup.

You may retrieve the token value from any server already joined to the cluster:

cat /var/lib/rancher/rke2/server/token

Changes since v1.35.0+rke2r1:

  • Use crane to package non-core images (#9446)

  • Bump calico chart to v3.31.300 (#9461)

  • CNI bump Jan 2026 (#9471)

  • Bump Ingresses - 2026 Jan (#9480)

  • Bulk Backports - 2026 Jan (#9492)

  • Rke2-coredns: Use k8s-style "IANA" names (RFC 6335) (#9503)

  • K3s bump and backports for 2026-01 (#9513)

  • Adjust Windows directory creation order (#9525)

  • Bump Traefik version to v3.6.7 (#9551)

  • Update chart and container image versions (#9558)

  • Add e2e test for Calico in eBPF mode (#9569)

  • Bump etcd to v3.6.7 (#9578)

  • Update to v1.35.0-rke2r3 (#9597)

  • Fix release arm64 (#9602)

  • Backport: Increase timeouts in Calico eBPF tests (#9607)

  • Fix manifest and sync-prime steps (#9611)

  • Revert accidental hardcode of klipper-helm tag (#9623)

  • Bump K3s version for etcd reconcile fix (#9628)

  • Bump ingress-nginx to v1.14.3-hardened1 (#9633)

Charts Versions

| Component | Version | | — | — | | rke2-cilium | 1.18.601 | | rke2-canal | v3.31.3-build2026011900 | | rke2-calico | v3.31.300 | | rke2-calico-crd | v3.31.300 | | rke2-coredns | 1.45.008 | | rke2-ingress-nginx | 4.14.301 | | rke2-metrics-server | 3.13.006 | | rancher-vsphere-csi | 3.6.0-rancher100 | | rancher-vsphere-cpi | 1.13.000 | | harvester-cloud-provider | 0.2.1100 | | harvester-csi-driver | 0.1.2500 | | rke2-snapshot-controller | 4.2.000 | | rke2-snapshot-controller-crd | 4.2.000 | | rke2-snapshot-validation-webhook | 0.0.0 | | rke2-traefik | 38.0.201 | | rke2-traefik-crd | 38.0.201 |

Release v1.35.0+rke2r1

This release updates Kubernetes to v1.35.0.

Important Note

If your server (control-plane) nodes were not started with the --token CLI flag or config file key, a randomized token was generated during initial cluster startup. This key is used both for joining new nodes to the cluster, and for encrypting cluster bootstrap data within the datastore. Ensure that you retain a copy of this token, as is required when restoring from backup.

You may retrieve the token value from any server already joined to the cluster:

cat /var/lib/rancher/rke2/server/token

Changes since v1.34.2+rke2r1:

  • Bump actions/checkout from 5 to 6 (#9310)

  • Bump rke2-multus to v4.2.303 (#9315)

  • Bump rke2-coredns to 1.45.002 (#9314)

  • Remove redundant cleanup function definition (#9331)

  • Update CNI to the latest versions (#9322)

  • Bump actions/stale from 10.1.0 to 10.1.1 (#9344)

  • Update to multus chart version v4.2.305 (#9348)

  • Update to CoreDNS chart 1.45.003 and Kubernetes Metrics Server chart 3.13.004 (#9347)

  • Bump images for 2025-12 (#9372)

  • Move Windows CNI startup into CNI function (#9339)

  • Bump traefik version to v3.6.4 (#9376)

    • Bump Traefik to v3.6.4

  • Update to v1.34.3 and Go v1.24.11 (#9389)

  • Bump rancher/ecm-distro-tools from 0.58.4 to 0.60.1 (#9256)

  • Bump ingress-nginx and vsphere-csi (#9398)

  • Bump kine to v0.14.9 (#9405)

  • Bump rancher/ecm-distro-tools from 0.60.1 to 0.61.0 (#9415)

  • Bump actions/download-artifact from 6 to 7 (#9414)

  • Bump actions/upload-artifact from 5 to 6 (#9413)

  • Bump actions/cache from 4 to 5 (#9412)

  • Bump klipper-helm to v0.9.12 (#9399)

  • Revert "Remove FlannelBackend from config" (#9420)

  • Update stable channel to v1.34.3+rke2r1 (#9436)

  • Remove dapper (#9429)

  • Bump stable to 1.34 and add 1.35 (#9437)

  • Update to kubernetes v1.35.0 and golang v1.25.5 (#9435)

Charts Versions

| Component | Version | | — | — | | rke2-cilium | 1.18.401 | | rke2-canal | v3.31.2-build2025120500 | | rke2-calico | v3.31.200 | | rke2-calico-crd | v3.31.200 | | rke2-coredns | 1.45.003 | | rke2-ingress-nginx | 4.13.500 | | rke2-metrics-server | 3.13.004 | | rancher-vsphere-csi | 3.6.0-rancher100 | | rancher-vsphere-cpi | 1.13.000 | | harvester-cloud-provider | 0.2.1100 | | harvester-csi-driver | 0.1.2500 | | rke2-snapshot-controller | 4.0.003 | | rke2-snapshot-controller-crd | 4.0.003 | | rke2-snapshot-validation-webhook | 0.0.0 | | rke2-traefik | 37.4.001 | | rke2-traefik-crd | 37.4.001 |