K3s v1.35.7+k3s1 - Production Build and Helm Fixes

K3s v1.35.7+k3s1, published August 4, 2026, updates embedded Kubernetes to v1.35.7 and corrects production builds that had always enabled Go coverage instrumentation. Platform operators should also treat Traefik chart v40 as an upgrade boundary because its ingress-nginx migration provider has a new name.

The full release notes and downloads are on the GitHub release page.

The bundled Traefik version is v3.7.8, and its chart moves to the v40 series. That chart changes the ingress-nginx migration provider from kubernetesIngressNginx to kubernetesIngressNGINX. The capitalization difference is small, but it is a breaking configuration change.

Any Helm values, generated manifests, or deployment automation that still emits the old provider name needs an update. The release notes give no compatibility alias or automatic migration step. Search rendered configuration as well as source values, since templating can hide the final key from a simple repository scan. The Traefik update pull request identifies the v3.7.8 bump, while the release warning covers the chart level break.

This is the main upgrade risk for clusters using the ingress-nginx migration provider. Clusters that do not enable that provider still receive the Traefik update, but the named configuration break does not apply to them.

One fix stops production builds from always enabling Go coverage instrumentation. The release notes do not quantify runtime impact, so this is best treated as a build profile correctness fix rather than a promised performance gain. Operators that build K3s from source should check that their build process picks up the corrected behavior. Users of published artifacts gain the fix by moving to this tag.

The release also updates helm-controller and klipper-helm, with support for --force-conflicts called out in the controller update. This gives operators a direct option when field ownership conflicts stop reconciliation. The tradeoff is in the flag name: forcing a conflict can replace fields held by another manager. Use it for a known ownership problem, not as a default response to every failed Helm reconciliation.

Two controller bumps appear in the change list. The notes provide little operator detail beyond the new conflict option, so the remaining controller work should be read as component maintenance rather than a new workflow.

Kubernetes moves from the prior K3s base to v1.35.7. The K3s notes defer the detailed patch list to the Kubernetes 1.35 changelog, which is the relevant review point for API server, scheduler, and kubelet behavior.

Several embedded services also move. Etcd is v3.6.14-k3s1, CoreDNS is v1.14.6, metrics server is v0.9.0, and the mirrored pause image is 3.10.2. These versions matter for private registries, admission rules, and image allow lists. Compare the release matrix with mirrored artifacts before rolling nodes, especially where an offline registry requires every image in advance.

The change list also includes July testing backports and build rework. Those entries are mostly internal and carry no specific operator migration step in the notes. The snapshot prune event change fixes a typo; it does not document a change to snapshot pruning behavior.

Check for kubernetesIngressNginx before upgrading and replace it with kubernetesIngressNGINX where the Traefik ingress-nginx migration provider is enabled. Render the chart with production values before rollout, then confirm that the new provider key appears in the resulting configuration.

Review mirrored component images at the same time. For source builds, verify that production artifacts are created without unintended Go coverage instrumentation. If --force-conflicts is required, document which field manager it is expected to override before enabling it.