k3s v1.34.12+k3s1 - Traefik Chart Renames the Ingress Provider

k3s v1.34.12+k3s1 was published on 30 September 2026. The Traefik chart moves to v40.x and renames the ingress-nginx migration provider from kubernetesIngressNginx to kubernetesIngressNGINX. Embedded Kubernetes updates to v1.34.12. The notes list changes since v1.34.11+k3s1.

The full release notes and downloads are on the GitHub release page.

The warning at the top of the notes is the upgrade risk. Chart v40 changes the provider name for the ingress-nginx migration. kubernetesIngressNginx becomes kubernetesIngressNGINX. The suffix changes from Nginx to NGINX. Config that still sets the old name misses the provider after the chart upgrade.

Chart details are in the Traefik Helm chart v40.0.0 release. The k3s notes name the new provider and stop there.

Traefik the program is a separate version from chart v40. #14612 bumps Traefik to v3.7.13. #14585 bumps gateway-api and the Traefik image tags. #14532 bumps the mirrored rancher/mirrored-coredns-coredns image. The component table lists CoreDNS v1.14.7 and Traefik at that same v3.7.13.

#14704 rejects anonymous access on the supervisor router. The routes in the title are spegel, pprof, and metrics. Clients that called those paths with no credentials get denied. Attach credentials before the roll. Otherwise the scrape fails while the node still serves traffic.

#14708 improves CA hash validation. The notes give no algorithm and no flag name. Retest agent join and any CA rotation you automate. A hash accepted on v1.34.11+k3s1 can be rejected on this tag.

#14622 bumps google.golang.org/grpc to v1.83.2 for CVE-2026-84445. The pull is a module bump. Forks and custom builds need that module version or they keep the older library.

#14675 uses the node password cache only after the informer has synced. Treat process start and cache sync as two events when you watch a rollout.

Datastore fixes sit in the September backport, #14634.

Restore from a compressed etcd snapshot is fixed (#14528). Retest any job that restores a .gz snapshot.

minio.Object is closed after read (#14580). The handle was left open. Servers that pull snapshots from MinIO or another S3 API on a schedule are the processes that accumulate those handles. Snapshot bytes are unchanged.

The deploy controller skipped reapply when manifest mtime was pinned to the epoch (#14568). A zero timestamp shows up when a build or a git archive forces a fixed time. This tag applies those files again. A reapply can overwrite live objects that drifted from the bundled manifest. Diff epoch mtime manifests before the upgrade.

The backport text and the component table name different datastore versions. The backport says etcd moves to v3.7.1-k3s3 for nonblocking logging (#14628) and kine moves to v0.17.1 (#14627). The table lists Etcd v3.6.14-k3s3 and Kine v0.16.5. The notes never reconcile the two strings. Read k3s --version plus the etcd and kine binaries in the artifact you install, and record that output.

#14687 bumps helm-controller. The table lists it at v0.16.27. #14693 bumps k3s-io/kubernetes and the Go references. Kubernetes on this tag is v1.34.12. Upstream edits since v1.34.11 are in the Kubernetes changelog.

Seccomp is enabled for riscv64 builds (#14529). check-config suppresses color when stdout is not a terminal (#14595). The ginkgo CLI test switch (#14531), the k3s-io/api move to v0.2.0 (#14570), and the second apis bump (#14589) are test and module maintenance.

--flannel-cni-conf was not reaching embedded flannel (#14598, under the same backport). This tag forwards the flag value. After the roll, read the config embedded flannel writes. It can differ from the file the previous build left on the node.

Servicelb gains multiple lbpools (#14547). Pool syntax is absent from the release notes. Keep the current single pool through this upgrade. Add another pool later, separate from the Traefik chart roll.

The table also publishes containerd v2.2.7-k3s1, runc v1.4.2, flannel v0.28.4, metrics-server v0.9.0, SQLite 3.53.4, and local-path-provisioner v0.0.37. The change list is silent on new behavior for that set.

Set the ingress-nginx migration provider to kubernetesIngressNGINX on this roll. Chart details are in the Traefik Helm chart v40.0.0 release. Artifacts for the k3s tag are on the GitHub release page.

Put credentials on supervisor calls for spegel, pprof, and metrics. Anonymous requests are rejected.

Restore one compressed etcd snapshot in a scratch cluster. Rejoin one agent after a CA rotation so the hash check runs on a real certificate. Manifests with an epoch mtime can be applied again by the deploy controller.

Record etcd and kine versions from the installed binary. The backport lines and the component table publish different versions.

Leave the ginkgo CLI switch out of the upgrade plan. It is test runner work.