k3s v1.37.0+k3s1 - Kubernetes 1.37 and Embedded Components

k3s v1.37.0+k3s1 was published on 14 September 2026 at 15:50 UTC. The build updates Kubernetes to v1.37.0 and refreshes the components packaged with it, including etcd, kine, containerd, CoreDNS, and Traefik. The k3s changes that show up on a running cluster are the apiserver certificate SAN fix, the airgap image retag fix, and production builds that compile without Go coverage instrumentation.

The full release notes and downloads are on the GitHub release page. The note covers changes since v1.36.3+k3s1.

The embedded component table pins Kubernetes at v1.37.0. That bump is pull 14509. Pull 14457 updates the k3s-io/kubernetes reference and the Go references that travel with the fork. Scheduler, kubelet, and API default changes for the minor are in the upstream Kubernetes 1.37 changelog. Read that changelog before a production roll.

Critools move to v1.37 in pull 14579, so the packaged CRI tools match the Kubernetes minor. That pull is version alignment.

Pull 14465 stops production builds from always enabling Go coverage instrumentation. A release binary compiled with coverage keeps counters on paths that should stay plain. That costs CPU and complicates profiles. Production builds in this tag compile without that instrumentation. Losing accidental cover data from a server binary is the right tradeoff.

Two etcd version strings show up in the same note. Pull 14460 records a bump to v3.6.14. The embedded component table lists etcd v3.7.1-k3s1 (etcd release). Compare a running server to the table. Pull 14488 adds etcd client locking. The notes give the title, and the locked calls are in that diff.

Kine in the table is v0.17.0. Pull 14521 calls out a bump to v0.16.4 for a NATS replay fix. Treat the table as the module this tag embeds, and the pull as the replay fix named in the changelog. SQLite in the table is 3.53.4. Clusters that point kine at NATS are the ones that pick up the replay fix.

Pull 14459 requires the node password informer to sync before k3s uses that cache. A cold start waits for the sync, then reads. Pull 14405 simplifies WriteSubnetFile cleanup and makes the write atomic. Pull 14382 bumps dynamiclistener for an atomic write fix. Both file changes replace the target in one step.

Pull 14516 adds --advertise-address to the subject alternative names before k3s generates the apiserver certificate. The serving certificate was omitting that flag value. The fix runs at generation time. Confirm the SAN list on the next generated certificate if clients connect to the advertise address. A new serving certificate also changes a fingerprint pinned outside the cluster.

The server flag --write-kubeconfig-name lands in pull 14440. It sets the cluster name, the user name, and the context name in the generated kubeconfig.

Image retagging stops when the image is already hosted by the destination registry (pull 14484). Airgap imports could fail with an “already exists” error, or accumulate duplicate image tags on every restart, when system-default-registry matched the registry the images were already tagged for. Retest with one import, one server restart, and a tag list that stays the same size.

Traefik ships as v3.7.13 in pull 14606. Pull 14573 bundles the Gateway API CRDs with the Traefik bump. Pull 14586 moves those CRDs to version 3, which includes the keep annotation. Bundled CRDs cover a cluster that has no Gateway API install. A chart that already installs those CRDs needs a diff before both copies apply.

CoreDNS is v1.14.7. The image bumps are pull 14415 and pull 14577. Pull 14503 makes the CoreDNS customization location explicit. The path is in that pull.

metrics-server is v0.9.0 (pull 14416). local-path-provisioner is v0.0.37 (pull 14496). helm-controller is v0.17.7. Pull 14446 adds --force-conflicts support in klipper-helm, so a Helm release can take fields another manager owns. Pull 14403 and pull 14474 are further controller bumps in the same range.

Containerd in the table is v2.3.4-k3s1 (containerd release). Pull 14510 titles the bump v2.3.4-k3s1.36. Runc is v1.4.2. Flannel is v0.28.4. The pause image moves to 3.10.2 in pull 14339.

google.golang.org/grpc moves to v1.83.2 for CVE-2026-84445 in pull 14614. Pull 14619 corrects an earlier bump that targeted v1.82.2. The module version in this release is v1.83.2.

v1.37.0+k3s1 is a stable tag, not a prerelease.

SLES packages in this release come from slemicro RPMs. Pull 14472 replaces the microos RPM source. Hosts installed from the microos packages need the new package set. Package file names are in the pull.

The stable channel update in this changelog points at v1.36.3+k3s1 (pull 14492). Pin v1.37.0+k3s1 from the GitHub release page when this minor is the install you want.

Most of the remaining entries are CI and repository work. GitHub Action dependency bumps, updatecli manifest edits, unit test wiring, a rootless uidmap apt cache fix, the multus end to end chart install, Docker 29 in CI, dockerfile stage cleanup, issue filtering, two typo fixes, and an adopters list entry for Project Bluefin leave a running server unchanged.