k3s v1.36.5+k3s1 - grpc CVE, Flannel Flag, and Traefik v40

k3s v1.36.5+k3s1 was published on 30 September 2026 at 16:10 UTC. The breaking change is the Traefik chart upgrade to v40.x: the ingress-nginx provider name changes from kubernetesIngressNginx to kubernetesIngressNGINX. The tag also advances the 1.36 line from v1.36.4+k3s1 to Kubernetes v1.36.5.

The full release notes and downloads are on the GitHub release page.

#14567 moves the Traefik image to 3.7.12 and gateway-api to 1.6.1. #14610 then moves Traefik to v3.7.13, which matches the embedded component table. gateway-api 1.6.1 stays in the change list only. The table does not repeat it.

The warning is about the chart, not the image tag. The packaged Traefik chart goes to v40.x. For the ingress-nginx migration, the provider name changes from kubernetesIngressNginx to kubernetesIngressNGINX. The delta is capitalization: trailing Nginx becomes NGINX. Config that still selects the old name will not match the new chart. The k3s note has no values diff. It points at the Traefik chart v40.0.0 release.

#14534 bumps the rancher/mirrored-coredns-coredns image. The table lists CoreDNS v1.14.7. #14685 bumps helm-controller, pinned in the table at v0.17.9. Neither bullet describes a behavior change inside those projects.

#14620 bumps google.golang.org/grpc to v1.83.2 for CVE-2026-84445. The note names the module, the version, and the CVE id. It does not describe the bug class or the affected RPC. The dependency update is the fix shipped in this tag.

#14702 rejects anonymous access on the supervisor router for spegel, pprof, and metrics. Clients that called those routes with no credentials will fail. The note does not name the credential that replaces anonymous access.

#14706 improves CA hash validation. No new flag or hash algorithm is named. #14673 is a separate startup rule: the node password informer must sync before that cache is used. The server is not supposed to read the cache while the informer is still syncing. The note does not connect that barrier to the supervisor auth change.

#14694 bumps k3s-io/kubernetes and the Go references. That pull is the vehicle for Kubernetes v1.36.5. Upstream fixes are not listed here. They are in the changelog since v1.36.4 and the v1.36.5 section.

#14632 is the September 2026 backport bundle. Some entries change runtime behavior. The rest are module bumps or test wiring.

Restore from a compressed etcd snapshot is fixed, noted as #14528. The text does not name the compression format or the error string. Retest the snapshot file that failed on v1.36.4+k3s1.

--flannel-cni-conf was not reaching the embedded flannel process, noted as #14598. A custom CNI conf passed with that flag never arrived. The backport wires the flag through. The table still lists Flannel v0.28.4, and the change list does not call that a flannel version bump. The fix is the handoff inside k3s.

The deploy controller was not applying manifests again when mtime was pinned to the Unix epoch, noted as #14568. A timestamp of 0 made the controller skip the apply. The backport corrects that check.

ServiceLB gains multiple pools, written as “Servicelb multiple lbpools” and noted as #14547. The release text documents no annotation, flag, or pool field. Do not script against the word lbpools until the pull shows the key.

minio.Object is closed after read, noted as #14580. The caller is not named. check-config suppresses colors when stdout is not a terminal, noted as #14595. Piped output from that command no longer includes color codes. riscv64 builds enable seccomp, noted as #14529. Other architectures get nothing from that line.

etcd is bumped to v3.7.1-k3s3 for nonblocking logging, noted as #14628. kine is bumped to v0.17.1, noted as #14627. The embedded table in the same release lists etcd v3.6.14-k3s3 and kine v0.16.5. Those are different minor lines, not a patch digit. The release does not say which pair is inside the published binaries.

Tests move to the ginkgo CLI, noted as #14531. k3s-io/api moves to v0.2.0, noted as #14570. k3s-io/apis is bumped again, noted as #14589. Those three are internal. They add no server flag and they do not change a packaged manifest.

Replace kubernetesIngressNginx with kubernetesIngressNGINX where that string selects the ingress-nginx provider. Do that before the node rolls onto the new chart. Chart details are on the Traefik chart v40.0.0 release. Traefik image v3.7.13 is a separate bump from the chart major. Taking the image without updating the provider string is how this patch breaks an ingress-nginx migration.

Anonymous access to supervisor spegel, pprof, and metrics is rejected after #14702. Plan a credential for those routes. The release does not name one.

Backport text says etcd v3.7.1-k3s3 and kine v0.17.1. The embedded table says etcd v3.6.14-k3s3 and kine v0.16.5. Check the running binary after install. The release text does not mark which list matches the binaries.

The table also pins Kubernetes v1.36.5, SQLite 3.53.4, containerd v2.3.4-k3s1.36, runc v1.4.2, Flannel v0.28.4, metrics-server v0.9.0, and local-path-provisioner v0.0.37. The change list is silent on diffs inside SQLite, runc, Flannel, metrics server, and the local path provisioner.

The GitHub release is not marked as a prerelease.