k3s v1.35.8+k3s1 - Kubernetes 1.35.8 And Containerd 2.2.7

k3s v1.35.8+k3s1 shipped on 27 August 2026. The tag moves the embedded Kubernetes tree to v1.35.8 and rebuilds the distro with Go 1.26.7. Operators also get containerd v2.2.7-k3s1 and a Traefik chart v40 provider rename that breaks ingress-nginx migrations still using the old key.

The full release notes and downloads are on the GitHub release page.

#14544 is the version bump, titled Update to v1.35.8-k3s1 and Go 1.26.7. Upstream patch notes live in the Kubernetes changelog since v1.35.7. This is a .8 on the 1.35 train, coming from v1.35.7+k3s1. API deprecations are not the story. kubelet, apiserver, and scheduler fixes are.

Go 1.26.7 is the compiler pin for this tag. That matters if you rebuild k3s, vendor the tree, or track toolchain CVEs against the binary you run on edge nodes. The notes do not say which CVE, if any, forced the Go move. They only pin the toolchain.

#14518 backports test changes. That is CI plumbing. It does not change kubelet behavior. Fork maintainers who replay the k3s test suite will care. Cluster operators will not.

#14523 is labeled Backports for 2026-08. The notes do not enumerate those commits. Treat the PR as a monthly batch into the 1.35 branch, not as a documented runtime change. If a backport bites you, the PR is the place to look. The release text will not tell you.

#14513 sets containerd to v2.2.7-k3s1. The embedded component table on the GitHub release page matches that tag. Batch Jobs and other data plane pods pick up this runtime after the node binary is replaced. The k3s notes do not list containerd fixes. The containerd v2.2.7-k3s1 tag is the place to read those.

#14497 bumps Local Path Provisioner. The table now lists local-path-provisioner at v0.0.37. That binary backs the default StorageClass on many single node and lab clusters. PVC objects that use hostPath dynamic provisioning get the new provisioner after the k3s service restarts. The notes do not describe a behavior change, only the version bump. Do not assume PVC semantics moved unless you read the provisioner tag.

runc is listed at v1.4.2 and has no dedicated PR in this tag. If you were waiting on a runc bump, this release is not it.

Winners are clusters that wanted the 1.35.8 kubelet patch and a current containerd without a Kubernetes minor jump. Losers are GitOps trees that still pin the old Traefik provider string, and anyone who treated Local Path Provisioner as frozen and skipped the provisioner changelog.

The table on the release is a pin list, not a changelog. Kubernetes v1.35.8, containerd v2.2.7-k3s1, and local-path-provisioner v0.0.37 are the versions with explicit PRs. The same table also records Kine v0.16.4, SQLite 3.53.4, etcd v3.6.14-k3s1, runc v1.4.2, Flannel v0.28.4, Traefik v3.7.8, CoreDNS v1.14.6, metrics-server v0.9.0, and helm-controller v0.17.7.

Kine plus SQLite is the embedded datastore for clusters that did not stand up etcd. etcd is the other path. Neither datastore has its own k3s PR in the “Changes since” list. Confirm those pins against what k3s --version and the node image already run. Do not treat this tag as a Kine or etcd upgrade.

Traefik the binary is v3.7.8. That is not the Helm chart v40 line. Mixing those two numbers is how people file the wrong bug.

The release opens with a warning. The Traefik chart moves to v40.x. For the ingress-nginx migration, the provider name changes from kubernetesIngressNginx to kubernetesIngressNGINX. Only the Nginx suffix changes case. Helm values, Terraform, or GitOps overlays that still set kubernetesIngressNginx will stop selecting that provider after upgrade.

The project points at the Traefik Helm chart v40.0.0 notes. Read those before rolling this tag onto a cluster that still uses the nginx ingress provider path. A quiet Helm upgrade that leaves the old string in values looks successful and then drops Ingress objects that used to flow through that provider.

Do not mix up the chart and the binary. This k3s tag still embeds Traefik v3.7.8.

No other breaking API is called out. The Kubernetes move is a patch. Test ingress first if you ever migrated off ingress-nginx. Then replace the k3s binary and confirm kubelet, containerd, and the default StorageClass come up on the new pins.