k3s v1.35.9+k3s1 - Snapshot Restore and Supervisor Auth

k3s v1.35.9+k3s1 was published on 30 September 2026. It is a stable release, not a prerelease, beta, or alpha. Kubernetes moves to v1.35.9, and the break in the upgrade warning is the Traefik chart v40 rename of the ingress-nginx provider from kubernetesIngressNginx to kubernetesIngressNGINX.

The full release notes and downloads are on the GitHub release page. The diff is taken from v1.35.8+k3s1. Upstream patches since v1.35.8 are in the Kubernetes changelog. The k3s notes do not restate that list. The embedded table records Kubernetes v1.35.9.

The packaged Traefik chart moves to v40.x. Clusters on the ingress-nginx migration provider must spell that provider kubernetesIngressNGINX. The old spelling, kubernetesIngressNginx, stops matching. Only the last four letters change case. Config that still carries the old string will not attach to the provider the new chart registers. The chart writeup is the Traefik chart v40.0.0 release.

The Traefik process version is not v40. #14611 bumps Traefik to v3.7.13, which matches Traefik v3.7.13 in the embedded table. Chart major and binary version are different numbers. #14584 also bumps gateway-api and Traefik image tags. No gateway-api version is printed. #14533 bumps the rancher/mirrored-coredns-coredns image. The table lists CoreDNS v1.14.7. That image pull request does not repeat the version, so read the digest from the running pod if you pin it.

#14703 rejects anonymous access on the supervisor router. The paths named there are spegel, pprof, and metrics. A scrape or debug client that hit those routes with no credentials will be refused. The notes do not name a replacement header, certificate, or flag. Read that pull request before you point a monitor at the supervisor port.

#14621 bumps google.golang.org/grpc to v1.83.2 for CVE-2026-84445. The release text does not describe the bug class or the call path. The result is a higher gRPC floor inside the k3s binary, not a Kubernetes API change.

#14707 improves CA hash validation and then stops. A stricter comparison can reject a hash an older build accepted. Keep the CA hash from server install, and compare it if a node fails to join after this roll.

#14674 requires the node password informer to sync before that cache is used. Startup waits on the sync. No timeout is stated.

The September backport bundle is #14633. Restore from a compressed etcd snapshot is fixed (#14528). The notes do not name the compression format, and they do not say whether plain snapshots were affected. If a rebuild uses compressed snapshots, restore one on a spare node with this binary before you retire v1.35.8+k3s1.

--flannel-cni-conf was not reaching the embedded Flannel process (#14598). The flag on the k3s command line did not deliver the file. This tag wires the flag through. After the roll, confirm embedded Flannel loaded that file. An argument present in the unit is not that confirmation.

Servicelb gains multiple lbpools (#14547). No flag and no sample manifest are in the notes. A single pool needs no new setting. A cluster that already splits ServiceLB addresses across pools should watch which pool a Service lands in.

Two smaller fixes sit in the same bundle. The client closes minio.Object after read (#14580), so the object is not left open. The deploy controller applies manifests again when mtime is pinned to the epoch (#14568). Those manifests were skipped before.

The backport and the version table disagree. Backport text sets etcd to v3.7.1-k3s3 for nonblocking logging (#14628) and kine to v0.17.1 (#14627). The table lists Etcd v3.6.14-k3s3 (tagged release) and Kine v0.16.5 (tagged release). Both pairs are in the same notes. Nonblocking etcd logging is present only when the installed artifact is v3.7.1-k3s3. Read the binary or the image labels. Default SQLite clusters go through kine, so check that version the same way.

The rest of the backport is narrow. seccomp is enabled in riscv64 builds (#14529) and is silent on other architectures. check-config suppresses colors when stdout is not a terminal (#14595). Switching tests to the ginkgo CLI (#14531) does not change the server binary. k3s-io/api moves to v0.2.0 (#14570). A further apis bump (#14589) prints no version. #14696 bumps k3s-io Kubernetes sources and Go references without a Go version. #14686 bumps helm-controller. The table lists that controller at v0.17.9 (tagged release).

Search config for kubernetesIngressNginx and replace it with kubernetesIngressNGINX where the packaged chart uses the ingress-nginx provider. The Traefik chart v40.0.0 release is the detailed note. Clusters that never enabled that provider still receive Traefik v3.7.13.

On the first server, confirm four facts before the rest of the fleet moves. Anonymous calls to supervisor spegel, pprof, and metrics fail. A compressed etcd snapshot restores. A node started with --flannel-cni-conf shows that file in use by embedded Flannel. Etcd reports either v3.7.1-k3s3 or v3.6.14-k3s3, and the artifact tells you which.

Other embedded pins for this tag are Containerd v2.2.7-k3s1 (tagged release), runc v1.4.2, Flannel v0.28.4, SQLite 3.53.4, metrics-server v0.9.0 (tagged release), and local-path-provisioner v0.0.37 (tagged release). The notes give versions, not per project diffs.