In this release

Kubernetes 1.35

Read more at https://kubernetes.io/blog/2025/12/17/kubernetes-v1-35-release/

Bugfixes

• Remove deprecated etcd-v2 flag by @berkayoz in #5212
• Allow sockets in cri-containerd AppArmor profile by @bschimke95 in #5218
• Add endpointslice to node rbac by @berkayoz in #5227
• Relax cri-containerd AppArmor restrictions to permit network and signal syscalls by @jadams in #5239
• Use 1.8.1 k8s-dqlite by @ethandcosta in #5304
• Preserve individual environment variables with sudo by @HomayoonAlimohammadi in #5319
• Include IngressClass for determining addon status by @HomayoonAlimohammadi in #5337
• Replace nginx ingress with Traefik in validation and image conf by @HomayoonAlimohammadi in #5339
• Improve compatibility for dashboard installation in different namespaces by @HomayoonAlimohammadi in #5345

Updates

• Update component versions by @HomayoonAlimohammadi in #5318
  • rook-ceph 1.18.7
  • observability stack - Prometheus 77.6.2, Loki 2.10.3, Tempo 1.24.1
  • GPU operator 25.10.0, Network Operator 25.7.0
  • CoreDNS 1.13.1
  • Kubernetes dashboard 7.14.0
  • cert-manager 1.19.1
• Add Kubernetes 1.35 patches by @HomayoonAlimohammadi in #5320
• Bump containerd to 2.1.3 and update build process by @berkayoz in #5321
• Deprecate MinIO by @HomayoonAlimohammadi in canonical/microk8s-core-addons#378
• Replace NGINX ingress with Traefik by @HomayoonAlimohammadi in canonical/microk8s-core-addons#375

New Contributors

• @jadams made their first contribution in #5239

Full Changelog: v1.34...v1.35

What's Changed

• Kubernetes v1.34.0
• k8s-dqlite v1.7.0
• containerd v1.7.28
• runc v1.3.0
• helm v3.18.6
• coredns v1.12.3
• kubernetes dashboard v7.13.0
• ingress controller v1.13.1
• hostpath-storage v1.5.0
• metrics server v0.8.0
• nvidia operator v25.3.2
• metallb v0.15.2
• prometheus kube stack v76.4.1
• cert-manager v1.18.2
• rook-ceph v1.18.0

New Addon

• AMD hardware support

Full Changelog: v1.33...v1.34

In this release

Kubernetes 1.33

Read more at https://kubernetes.io/blog/2025/04/23/kubernetes-v1-33-release/

Bugfixes

• fix: run iptables as sudo on microk8s stop by @berkayoz in #5021
• fix: Always refresh the default hooks during upgrades by @petrutlucian94 in #5009
• fix: flush the CNI-HOSTPORT-DNAT chain on stop by @berkayoz in #4963
• fix: update configure hook to add a newline before adding watchlist flag by @berkayoz in #4946
• Cleanup common non-namespaced resources (Closes #4747) by @LoniasGR in #4779
• scripts: Fix kill-host-pods script by @HomayoonAlimohammadi in #4835
• kill-host-pods.py: filter pods by node by @petrutlucian94 in #4819
• fix: Catches KeyError while enabling SRIOV addon by @Gmerold in canonical/microk8s-community-addons#249

Updates

• Bump component versions by @petrutlucian94 in #4981
• snapcraft.yaml: upgrade to libmnl-1.0.5 by @xypron in #4849
• chore: bump go version to 1.24 by @berkayoz in #5049
• Update addon versions by @petrutlucian94 in canonical/microk8s-core-addons#318
• fix: update ingress-nginx to 1.12.1 by @berkayoz in canonical/microk8s-core-addons#327
• cert-manager: Update to v1.17.1 by @claudiubelu in canonical/microk8s-core-addons#334
• Update dashboard to 7.11.1 by @claudiubelu in canonical/microk8s-core-addons#335
• metallb: Update addon to v1.14.9 by @claudiubelu in canonical/microk8s-core-addons#336
• kube-ovn: Upgrade to v1.13.8 by @claudiubelu in canonical/microk8s-core-addons#338
• Update observability addon to the latest versions by @claudiubelu in canonical/microk8s-core-addons#339
• rook-ceph: Update addon to v1.16.6 by @claudiubelu in canonical/microk8s-core-addons#340
• nvidia: Update addon helm charts to the latest versions by @claudiubelu in canonical/microk8s-core-addons#342
• feat: update addons versions and update list by @berkayoz in canonical/microk8s-core-addons#344
• Dns domain argument by @TecIntelli in canonical/microk8s-core-addons#258

Release Specific Changes

• chore: add updated patches for kubernetes v1.33 by @berkayoz in #5048
• fix: update strict patches for runc 1.2.6 by @berkayoz in #5031

Many thanks to our contributors

• @petrutlucian94
• @LoniasGR
• @xypron
• @claudiubelu
• @TecIntelli
• @Gmerold

In this release

Kubernetes 1.32

Read more at https://kubernetes.io/blog/2024/12/11/kubernetes-v1-32-release/

Bugfixes

• Pin k8s-dqlite version by @louiseschmidtgen in #4657
• Prioritize SNAP_CURRENT in containerd paths by @berkayoz in #4710
• fix: ensure nf_conntrack module loaded for kubelite. by @aznashwan in #4705
• fix non sudo enable community addon by @maci3jka in #4714
• Inspect ip route fix by @maci3jka in #4752
• Trivy job fix by @maci3jka in #4760
• Cleans up containers and shims on microk8s stop and snap removal by @claudiubelu in #4755
• kube-ovn: Fix placeholder not being replaced on enable by @HomayoonAlimohammadi in canonical/microk8s-core-addons#307

Updates

• Update calico version to v3.28.1 by @maci3jka in #4638
• K8s-dqlite v1.3.0 (Dqlite LTS) by @louiseschmidtgen in #4756
• Bump runc to v1.1.15 and containerd to v1.6.36 by @berkayoz in #4768
• Bump cni plugins to v1.6.0 by @berkayoz in #4769
• Bump pause image to 3.10 by @berkayoz in #4770
• Bump helm to v3.16.3 by @berkayoz in #4771
• Bump go version to 1.23 by @berkayoz in #4781
• Update Default GPU Operator Version to v24.6.2 by @VariableDeclared in canonical/microk8s-core-addons#305
• Upgrade kube-ovn to v1.12 by @Dakror in canonical/microk8s-core-addons#292

Release Specific Changes

• Add patches for 1.32 by @berkayoz in #4772
• Add updated strict patches for runc by @berkayoz in #4774
• Disable WatchList feature gate by @berkayoz in #4773

Many thanks to our contributors

• @Dakror
• @VariableDeclared
• @aznashwan
• @claudiubelu
• @maci3jka
• @louiseschmidtgen
• @HomayoonAlimohammadi
• @berkayoz

In this release

Kubernetes 1.31

Read more at https://kubernetes.io/blog/2024/08/13/kubernetes-v1-31-release/

Dqlite efficiency

We spent a lot of effort in improving the efficiency of the default datastore, dqlite. You will find improvements in the performance of concurrent queries and open telemetry integration.

Important updates

• helm upgrade to v3.14.4
• cert-manager to v1.14.5
• cilium to v1.15.2
• gopaddle to v5.0
• falco to v4.5.1
• cloudnative pg to v1.23.3

Many thanks to our contributors

• @TecIntelli
• @jasonumiker
• @Gayathri-Bluemeric
• @DLDClodio
• @stalb
• @alphayax
• @o0th
• @ShrishtiKarkera

Featured in this release

Kubernetes 1.30 obviously

Read more at https://kubernetes.io/blog/2024/04/17/kubernetes-v1-30-release/

Dqlite stability

With the help of @miro-balaz we identified and patched a few issued that improve the reliability of our default datastore in resource limiting environments.

Important updates

Most notably

• containerd to v1.6.28 and runc to v.1.1.12
• gpu-operator to v23.9.1

New addon

• Stunner by @smeng9, a Kubernetes media gateway for WebRTC

In detail

What's changed in detail

• Do not set --hostname-override on kube-proxy when joining a cluster by @neoaggelos in #4360
• Use build-snaps instead of manually installing the go snap by @IsaacJT in #4377
• Bump containerd to v1.6.28 and runc to v.1.1.12 by @louiseschmidtgen in #4398
• Fix erroneous microk8s join invocations by adding validation by @skatsaounis in #4397

External contributors

• @IsaacJT made their first contribution in #4377
• @skatsaounis made their first contribution in #4397
• @miro-balaz rewrote the dqlite list query canonical/k8s-dqlite#83
• @smeng9 contributed a new addon Stunner canonical/microk8s-community-addons#223
• @udit-uniyal addressed KubeArmor installation issue canonical/microk8s-community-addons#216

Featured in this release

"Quality of life" improvements

A lot of effort has gone into the datastore, DQlite. In this release we introduced the following improvements:

• DQlite node role reassignment in case of failure domain availability changes
• Optional admission control to ensure performance
• Handling the out-of-disk-space cases
• Performance improvements related to static linking of DQlite and SQL query preparation

New addons by our partners and community members

• Falco: the cloud-native security tool that employs custom rules on kernel events to provide real-time alerts
• CloudNative PG Operator: Leveraging cloud native Postgres for Kubernetes adds speed, efficiency and protection for your infrastructure modernization
• ngrok: Ingress Controller instantly adds connectivity, load balancing, authentication, and observability to your services

Detail list of updates since last release

Kubernetes core services

• Kubernetes 1.29

Usability Improvements

• Improved messaging in joining nodes
• Fix the default IP shown in ‘microk8s add-node’ output when using FRR (thanks @nihr23)
• Improve connectivity check in installers, thank you @smithyuk
• Handle out of low disk capacity on dqlite nodes
• Admission control to protect from dqlite performance degradation
• Failure domain control plain datastore rebalance
• Memory argument warning in installer, thank you @eddiesimeon

Addon updates

• New addon: nvidia, allows for enabling the gpu and network operators
• New addon: Falco v3.7.1, thank you @jasonumiker
• New addon: CloudNativePG, thank you @sxd
• New addon: ngrok, thank you @russorat
• Added default-class option to hostpath-storage, thank you @overtfuture
• Upgraded sosivio to v1.7.1, thank you @DanArlowski
• Upgrade linkerd to v2.14.3, thank you @balchua
• Upgraded KWasm operator to version v0.3.0, thank you @0xE282B0
• Upgrade keda to v2.12.0, thank you @balchua
• Upgraded hostpath-storage to v1.5.0
• Upgraded MICROCKS to v1.8.0, thank you @yada
• hostpath-storage option not to be set as the default storage class, courtesy of @overtfuture
• Removed ondat addon from the community repository

microk8s version: 1.28
kubectl version: 1.28.3
multipass version: 1.12.2
installer version: 2.3.4

Featured in this release

Dual stack support and CIDR configuration made easy

In the past, community members provided instructions on how to configure dual-stack in MicroK8s clusters. From this release onwards, dual-stack along with the respective CIDR configuration can be easily setup with launch configurations even at install time.

You can read more on dual stack over at:

• https://microk8s.io/docs/explain-dual-stack
• https://microk8s.io/docs/how-to-dual-stack

Improve security and CIS compliance

Full CIS compliance can be achieved with a single call: microk8s enable cis-hardening. For auditors and those interested in what each CIS recommendation is about we have assembled a detailed list of each recommendation and how we comply with it. Some of the CIS hardening suggestions have been adopted as default setup options in MicroK8s, for example the authentication of users is now done via x509 certificates instead of tokens.

For the work on this feature you can read:

• https://microk8s.io/docs/cis-compliance
• https://microk8s.io/docs/how-to-cis-harden

Ceph and MicroK8s

Try this microk8s enable rook-ceph to get the Rook Ceph operator on your cluster. We found that pairing MicroCeph, the low ops Ceph distribution, with MicroK8s produces a great setup in terms of feature richenss, stability and effectiveness. In our docs we have a guide showing how to testdirve this combination on a single node cluster.

Read more at:

• https://microk8s.io/docs/how-to-ceph
• https://canonical-microceph.readthedocs-hosted.com/en/latest/
• https://rook.io/

New partner joining our addons ecosystem

Two addons joined our ecosystems:

• KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operations) of pods, containers, and nodes at the system level.

• MICROCKS is a CNCF project designed to simplify and streamline API mocking and testing, with support for many different types of API and integrations for GitHub, Gitlab, Jenkins and more.

Detail list of updates since last release

Kubernetes core services

• Kubernetes v1.28
• Calico CNI updated to v3.25.1

Usability Improvements

• microk8s status will return an error code in case the cluster is not yet ready.
• microk8s join no longer fails if nodes cannot resolve each other’s hostnames. This limitation has been lifted by updating the default arguments of kube-apiserver.
• fixes iptables rule with custom CIDR, thanks @Dunge
• Certificate based authentication replaces token auth
• kubelet certificate authority set to the cluster CA by default
• RBAC rules for kubelet webhook auth-mode loaded by default
• EventRateLimit is enabled by default
• Kubelet now does not serialize image pulls by default, which should result in faster image pulls (thanks @ghboutry)
• Attempt to increase inotify and async IO limits if found too low

Addon updates

• New addon: kubearmor, thanks to @nyrahul and @webdevgopi
• New addon: microcks, thank you @yada
• Update ArgoCD to v2.7.2 and add support for ARM64, thank you @alirezaghey
• Coredns updated to v1.10.1
• cilium updated to 1.13.4 now supporting multi-node clusters
• gopapdle updated to v4.2.9, added support for ARM64, renamed to goppadle from goppadle-lite, thank you @Gayathri-Bluemeric
• Metrics server updated to v0.6.3
• Ingress updated to v1.8.0
• linkerd updated to v2.13.5, thank you @balchua
• keda updated to v2.11.1, thank you @balchua
• kata addon expects to find a runtime and does not use the kata-runtime snap anymore
• trivy addon updated tov 0.15.1
• Metallb updated to v0.13.10, thank you @jadams
• Istio updated to v1.18.2, thank you @aalonsolopez