From 96870af92f802a134bedf65673854a3e7593781f Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Fri, 23 Oct 2026 23:18:51 +0200 Subject: [PATCH] docs: prepare microk8s 1.36 Nothing changes in microk8s between 1.35 and 1.36 for this setup. The stable channels lag upstream patches, including the CVE-2026-2270 fix, so the snap gets held and patch updates become a deliberate step. --- docs/upgrade-k8s-1.33.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/docs/upgrade-k8s-1.33.md b/docs/upgrade-k8s-1.33.md index 45318ad..249184e 100644 --- a/docs/upgrade-k8s-1.33.md +++ b/docs/upgrade-k8s-1.33.md @@ -261,7 +261,22 @@ original is in `~/hosts.toml.docker.io.bak`. warnings and no hosts.toml errors; all workloads, apps, certificates, volumes and both status pages green; LISTs 92-166 ms, no slow lease updates -- [ ] `sudo snap refresh microk8s --channel=1.36/stable`, addons repo, Calico +Checked for 1.36 on 2026-10-23: default args, containerd template and +configure hook unchanged from 1.35; containerd 2.2 only drops registry +`mirrors`/`configs`/`auths` (in 2.3), and the template uses `config_path`; +every component supports 1.36; only the core/v1 Endpoints API is still in +use as a deprecated API. + +The microk8s stable channels lag upstream: 1.35/stable is v1.35.6 and +1.36/stable v1.36.2 (both from early July), while upstream is at v1.35.9 +and v1.36.5. Only 1.36/edge has CVE-2026-2270 fixed (StatefulSet +controller, cross-namespace pod creation; fixed in 1.35.9/1.36.5). Chosen: +1.36/stable with the snap held, so updates only happen on purpose +(`sudo snap refresh microk8s` once stable passes v1.36.5). Before the hold, +snapd refreshed microk8s within its channel four times a day. + +- [ ] `ssh -t ruben@192.168.1.204 ./microk8s-1.36.sh`: dbctl backup, `snap + refresh` to 1.36/stable, addons repo, `snap refresh --hold microk8s` ### Shrink the database