Embedded Cluster v3 release notes

This topic contains release notes for the Replicated Embedded Cluster v3 installer. The release notes list new features, improvements, bug fixes, known issues, and breaking changes.

Additionally, these release notes list the versions of Kubernetes that are available with each version of Embedded Cluster.

3.15.3-beta.1

Released on October 21, 2026

Version	3.15.3-beta.1+k8s-1.36	3.15.3-beta.1+k8s-1.35	3.15.3-beta.1+k8s-1.34
Kubernetes Version	1.36.4	1.35.8	1.34.11

Improvements

• Updated bundled Kubernetes to patch releases 1.36.4, 1.35.8, and 1.34.11.

Bug Fixes

• Resetting a controller node no longer assumes the node was removed from etcd when reset cannot read the etcd member list. Reset now warns that it could not confirm the removal and shows the remove-node command to run from a remaining controller to remove any stale etcd member.
• Fixed installs failing when a chart uses a resource kind whose CRD is installed by an earlier chart. This issue was introduced in 3.12.0-beta.1.

3.15.2-beta.1

Released on October 20, 2026

Version	3.15.2-beta.1+k8s-1.36	3.15.2-beta.1+k8s-1.35	3.15.2-beta.1+k8s-1.34
Kubernetes Version	1.36.3	1.35.7	1.34.10

Improvements

• Adds Schedules to the saved Velero config so existing schedules are also restored with the cluster.
• Excludes infrastructure namespaces, which are created outside of the restore process, from backups.

Bug fixes

• Fixed Embedded Cluster skipping HelmCharts when multiple charts were defined in one YAML file or an unsupported API version was used. Unsupported versions now report an error.

3.15.1-beta.1

Released on October 19, 2026

Version	3.15.1-beta.1+k8s-1.36	3.15.1-beta.1+k8s-1.35	3.15.1-beta.1+k8s-1.34
Kubernetes Version	1.36.3	1.35.7	1.34.10

Improvements

• Velero plugin configuration for S3 backups no longer needs to be included in Velero's HelmChart spec.

Bug fixes

• Fixes stalled pod traffic between nodes on networks with an MTU below 1500 by sizing the Calico overlay MTU to the host network interface at install.

3.15.0-beta.1

Released on October 17, 2026

Version	3.15.0-beta.1+k8s-1.36	3.15.0-beta.1+k8s-1.35	3.15.0-beta.1+k8s-1.34
Kubernetes Version	1.36.3	1.35.7	1.34.10

New features

• Adds support for Backup and Restore custom resources in application specs.
• Configure web identity for S3 backups through the Disaster recovery page and restore wizard, including a custom service account issuer and public OIDC discovery endpoints.
• Adds support for cluster management in Admin Console.
• Adds ability to update config and redeploy the app from Admin Console.
• Adds ability to view and update license in Admin Console.

Improvements

• Added NODE_MANAGEMENT.md guide documenting single-node and multi-node node removal workflows, including quorum implications and handling unreachable nodes.

Bug fixes

• Improved error messages for reset and remove-node commands to clarify when to run which command and from which node.
• Clarified --force flag behavior: reset --force only skips confirmation (never bypasses etcd safety check), while remove-node --force bypasses quorum check (but never applies to self-removal).
• Fix unreadable text in disaster recovery and restore screens.
• Fixed application installation and upgrades failing because application workloads were not ready within Embedded Cluster timeout.
• Fixed sensitive credentials appearing unredacted in host support bundles.

3.14.0-beta.1

Released on October 5, 2026

Version	3.14.0-beta.1+k8s-1.36	3.14.0-beta.1+k8s-1.35	3.14.0-beta.1+k8s-1.34
Kubernetes Version	1.36.3	1.35.7	1.34.10

New features

• Adds backup and restore orchestration directly to Embedded Cluster using application-packaged Velero. This replaces the prototype disaster recovery extension and its recovery keys; backups from the prototype are not compatible with the new workflow.
• Adds external NFS backup destinations through a dedicated SeaweedFS service, supporting either an NFS export or an existing NFS-mounted host directory.
• Adds backup and restore support for air gap installations, including bootstrapping the internal registry and loading recovery images before restoring the application.
• Automatically rewrites image references in rendered Helm pod specifications, including subcharts, hooks, and init containers, for air gap and bring-your-own registries. Online installations use release image metadata to proxy eligible private images. Images in custom fields or scripts still require explicit template functions.

Improvements

• Preserves saved installation settings during restore, including the network CIDR, data directory, and API port, while allowing explicit replacement values. Host-specific settings such as proxy configuration and TLS certificates can be supplied for the replacement environment.
• Publishes keyless Sigstore signatures for installer binaries and release archives, SLSA build provenance, and a signed source-dependency SBOM. For verification instructions, see Verify Embedded Cluster v3 release files.
• Shows support bundle guidance when installation of the Kubernetes runtime fails or an upgrade encounters an error, helping operators collect diagnostics before attempting recovery.

Bug fixes

• Applies application-provided redactor specifications to support bundles, including redactor templates that reference application configuration.
• Resumes failed application preflight checks after a configuration correction without repeating completed host checks and infrastructure installation.
• Applies values supplied through --config-values even when the configuration item's when condition hides it.
• Reports configuration input that cannot be applied instead of silently discarding it, and detects references to undefined configuration items. Preserves uploaded file contents when only the filename changes.
• Waits for replacement hosts to become ready before installing infrastructure during a multi-node restore.
• Fixes restore --headless to support the complete restore workflow.

3.13.0-beta.1

Released on September 16, 2026

Version	3.13.0-beta.1+k8s-1.36	3.13.0-beta.1+k8s-1.35	3.13.0-beta.1+k8s-1.34
Kubernetes Version	1.36.3	1.35.7	1.34.10

New features

• Adds a Disaster Recovery entry to the Admin Console for applications that include the lifecycle disaster recovery extension.
• Displays application health reported by the Replicated SDK on the installation and upgrade completion screens and in the Admin Console.

Improvements

• Displays join command expiration in the UI and reports expired join tokens with instructions to generate a new bundle, instead of returning an authentication error or timing out.

Bug fixes

• Prevents reset from hanging indefinitely when the container runtime stops responding. Reset times out the stalled Kubernetes cleanup and continues host teardown.
• Allows operators to bypass eligible failed preflight checks in the install and upgrade UI without setting CLI flags. Checks that fail to execute cannot be bypassed.
• Honors strict preflight failures when the preflight result marks them as required, preventing bypass through either the UI or headless flags.
• Resets the support bundle Share button for each newly generated bundle so that an unshared bundle is not incorrectly marked as sent.
• Returns users to the correct installation step after login and prevents configuration changes to an already deployed revision from being saved for a later upgrade.
• Stops worker reset from attempting to delete its own Kubernetes Node object without permission. Remove the node from a controller using remove-node.
• Makes kubectl available in the debug shell on newly joined nodes.
• Adds periodic cleanup of SeaweedFS change logs and abandoned registry uploads. Existing accumulated storage still requires a one-time manual purge and vacuum to reclaim disk space.

3.12.0-beta.1

Released on August 21, 2026

Version	3.12.0-beta.1+k8s-1.36	3.12.0-beta.1+k8s-1.35	3.12.0-beta.1+k8s-1.34
Kubernetes Version	1.36.3	1.35.7	1.34.10

Bug fixes

• Tightens the permissions on the license file, which is now written as 0600 instead of 0644. Upgrading updates the permissions on existing installations.

3.11.1-beta.1

Released on August 11, 2026

Version	3.11.1-beta.1+k8s-1.36	3.11.1-beta.1+k8s-1.35	3.11.1-beta.1+k8s-1.34
Kubernetes Version	1.36.3	1.35.7	1.34.10

Bug fixes

• Fixes config validation so that a required item that is hidden (hidden: true) no longer fails with an error when left empty.

3.11.0-beta.1

Released on August 10, 2026

Version	3.11.0-beta.1+k8s-1.36	3.11.0-beta.1+k8s-1.35	3.11.0-beta.1+k8s-1.34
Kubernetes Version	1.36.3	1.35.7	1.34.10

New features

• Adds the KubernetesVersion, KubernetesMajorVersion, and KubernetesMinorVersion template functions, matching the existing KOTS functions of the same name.
• Adds a --force flag to upgrade and node upgrade to bypass the new safeguard that refuses to start an upgrade while a previous one on the same target is still incomplete.

Improvements

• Replaces Kubernetes jargon with plain, customer-facing language throughout the install and upgrade wizards and headless CLI output (for example, node becomes host, controller becomes primary host, and worker becomes secondary host).
• Uses "upgrade" instead of "migration" in the v2-to-v3 upgrade CLI output, matching the docs terminology.
• Bumps bundled Kubernetes component versions (k0s, kube-proxy, calico, CoreDNS, and metrics-server) to clear CVEs.

Bug fixes

• Fixes install so that it can resume after being interrupted at any phase (for example, by Ctrl+C, a crash, or a host reboot). Rerunning install with the same arguments now picks up where it left off instead of requiring a destructive reset and reinstall.

3.10.0-beta.1

Released on July 10, 2026

Version	3.10.0-beta.1+k8s-1.36	3.10.0-beta.1+k8s-1.35	3.10.0-beta.1+k8s-1.34
Kubernetes Version	1.36.1	1.35.4	1.34.8

Improvements

• Blocks install on nodes that already have an Embedded Cluster v2 installation, directing users to run upgrade instead.
• Adds a host preflight that fails install when the node hostname exceeds 54 characters, preventing an etcd member label overflow that previously crashlooped the controller with no clear signal.

Bug fixes

• Fixes an issue where an interactive upgrade failed with a port conflict error when the persistent admin console was already running. The console now drives the upgrade instead.
• Fixes the config UI so that a dropdown's default value hint shows the option's title instead of its underlying name.
• Fixes v2-to-v3 upgrade to regenerate the TLS certificate when the v2 console's hostname is an in-cluster service name, instead of carrying forward a cert for an unreachable address.
• Fixes an error that blocked install, upgrade, and v2-to-v3 upgrade when a release did not include a kots.io/v1beta1 Application manifest.
• Fixes an error that blocked install, upgrade, and v2-to-v3 upgrade when a release did not include a kots.io/v1beta1 Config manifest.

3.9.0-beta.1

Released on June 22, 2026

Version	3.9.0-beta.1+k8s-1.36	3.9.0-beta.1+k8s-1.35	3.9.0-beta.1+k8s-1.34
Kubernetes Version	1.36.1	1.35.4	1.34.14

New features

• Adds support for Kubernetes 1.36 and removes support for Kubernetes 1.33.

Improvements

• Adds host support bundle collectors and analyzers that detect when endpoint security tools, such as CrowdStrike Falcon and Illumio VEN, have flushed the iptables rules that cluster networking depends on.
• Renders app preflight specs through Helm so that chart value defaults, template helpers, and .Chart.Name conditionals resolve the same way they do at install time.
• Tightens host preflights to require a 4.5 or later Linux kernel and cgroup v2 on Kubernetes 1.35 and later. Hosts that do not meet these requirements no longer pass preflight.

3.8.0-beta.1

Released on June 15, 2026

Version	3.8.0-beta.1+k8s-1.35	3.8.0-beta.1+k8s-1.34	3.8.0-beta.1+k8s-1.33
Kubernetes Version	1.35.4	1.34.7	1.33.11

New features

• Adds support for Kubernetes 1.35 and removes support for Kubernetes 1.32.

Improvements

• Ties the app install and upgrade progress bar to per-chart status.

Bug fixes

• Fixes an issue where resetting a node with the persistent admin console installed could cause subsequent installs on that node to fail.

3.7.0-beta.1

Released on June 11, 2026

Version	3.7.0-beta.1+k8s-1.34	3.7.0-beta.1+k8s-1.33	3.7.0-beta.1+k8s-1.32
Kubernetes Version	1.34.4	1.33.8	1.32.12

New features

• Adds the ability to upload a generated support bundle directly to the Vendor Portal from the persistent admin console, eliminating the need to download and share the bundle manually. For more information, see Upload to the vendor portal.

3.6.0-beta.1

Released on June 10, 2026

Version	3.6.0-beta.1+k8s-1.34	3.6.0-beta.1+k8s-1.33	3.6.0-beta.1+k8s-1.32
Kubernetes Version	1.34.4	1.33.8	1.32.12

New features

• Adds the ability to declare Kubernetes node taints on a custom role. Every node that carries the role receives the taints automatically at install or join time. For more information, see roles in Embedded Cluster Config.

3.5.0-beta.1

Released on June 10, 2026

Version	3.5.0-beta.1+k8s-1.34	3.5.0-beta.1+k8s-1.33	3.5.0-beta.1+k8s-1.32
Kubernetes Version	1.34.4	1.33.8	1.32.12

New features

• Adds the ability to generate and download a support bundle from the persistent admin console, without SSH access to the controller.

Improvements

• Reduces dashboard clutter when many releases are available: the Available updates panel now shows only the 3 most recent, with a Show all toggle for the rest.

Bug fixes

• Fixes a gateway timeout that could occur when uploading large airgap releases through the persistent admin console.

3.4.0-beta.1

Released on June 9, 2026

Version	3.4.0-beta.1+k8s-1.34	3.4.0-beta.1+k8s-1.33	3.4.0-beta.1+k8s-1.32
Kubernetes Version	1.34.4	1.33.8	1.32.12

New features

• Adds air gap support to the persistent admin console. Release archives can be uploaded directly through the dashboard and applied without SSH access to the controller. Uploads are resumable across browser sessions, and the currently-installed release can be re-uploaded to update its bundled license or restore a missing copy needed for redeploy.

Improvements

• Aligns the Replicated SDK's dockerconfigjson with the active registry mode. When a Bring Your Own (BYO) registry is configured, the secret now carries credentials keyed by the BYO registry host instead of the unused proxy.replicated.com and registry.replicated.com defaults.

Bug fixes

• Forwards the host CA bundle ConfigMap and native proxy values to the Replicated SDK chart so the SDK can communicate with replicated.app through a MITM proxy. Previously only proxy environment variables were passed, causing TLS verification failures when the SDK contacted replicated.app.

3.3.2-beta.1

Released on June 4, 2026

Version	3.3.2-beta.1+k8s-1.34	3.3.2-beta.1+k8s-1.33	3.3.2-beta.1+k8s-1.32
Kubernetes Version	1.34.4	1.33.8	1.32.12

New features

• Adds support for changing the Bring Your Own (BYO) registry configuration on upgrade. The upgrade command now accepts the --registry, --registry-username, --registry-password, --registry-ca-cert, --registry-tls-cert, and --registry-tls-key flags. Flags use patch semantics: omit to keep the existing value, pass a new value to update, or pass an empty string (for example, --registry="") to clear. Passing --registry="" reverts the cluster to the default registry mode.

Bug fixes

• Updates the installer landing page login button text to match the operation mode: Continue for the persistent admin console and Continue to Upgrade for upgrades. Install mode is unchanged.

3.3.1-beta.1

Released on June 3, 2026

Version	3.3.1-beta.1+k8s-1.34	3.3.1-beta.1+k8s-1.33	3.3.1-beta.1+k8s-1.32
Kubernetes Version	1.34.4	1.33.8	1.32.12

Bug fixes

• Fixes the persistent admin console landing page, which was incorrectly framed as the "Upgrade Wizard." When the console is enabled, the page now reads "Admin Console" with console-appropriate "What's Next" steps.
• Allows retrying an upgrade when the target version is itself listed as a required release and matches the currently-incomplete revision. The previous behavior incorrectly blocked the retry with a "must install X before X" error.
• Removes an invalid journalctl troubleshooting tip from the host-unreachable warning on the upgrade preparation screen. The tip was rendering the application's display name instead of its slug, producing an unusable command.

3.3.0-beta.1

Released on June 2, 2026

Version	3.3.0-beta.1+k8s-1.34	3.3.0-beta.1+k8s-1.33	3.3.0-beta.1+k8s-1.32
Kubernetes Version	1.34.4	1.33.8	1.32.12

New features

• Adds the persistent admin console, an opt-in, always-on web UI for browser-driven upgrades and operations. Enable it by running console install on a controller after installation.

3.2.3-beta.1

Released on June 1, 2026

Version	3.2.3-beta.1+k8s-1.34	3.2.3-beta.1+k8s-1.33	3.2.3-beta.1+k8s-1.32
Kubernetes Version	1.34.4	1.33.8	1.32.12

Bug fixes

• Fixes a failure in the Lookup template function when the kubeconfig has not yet been created on the node. Lookup now returns an empty map in that case instead of erroring.

3.2.2-beta.1

Released on June 1, 2026

Version	3.2.2-beta.1+k8s-1.34	3.2.2-beta.1+k8s-1.33	3.2.2-beta.1+k8s-1.32
Kubernetes Version	1.34.4	1.33.8	1.32.12

New features

• Adds support for the KOTS Lookup template function, which queries resources in the running cluster from templates.

Improvements

• Skips the airgap images.tar preload when a Bring Your Own (BYO) registry is configured.

3.2.1-beta.1

Released on May 23, 2026

Version	3.2.1-beta.1+k8s-1.34	3.2.1-beta.1+k8s-1.33	3.2.1-beta.1+k8s-1.32
Kubernetes Version	1.34.4	1.33.8	1.32.12

Improvements

• Pins the cluster TLS certificate's public key in the node-join curl command so the join bundle download cannot be intercepted by an attacker on the network path.

3.2.0-beta.1

Released on May 22, 2026

Version	3.2.0-beta.1+k8s-1.34	3.2.0-beta.1+k8s-1.33	3.2.0-beta.1+k8s-1.32
Kubernetes Version	1.34.4	1.33.8	1.32.12

New features

• Automates multi-node upgrades. All remote nodes are upgraded as part of a single cluster upgrade, removing the per-node CLI commands required in earlier versions. Clusters with any node older than 3.2.0-beta.1 fall back to the manual upgrade flow automatically.
• Adds TLS client certificate (mTLS) authentication for Bring Your Own (BYO) registries with the --registry-tls-cert and --registry-tls-key install flags.

3.1.0-beta.1

Released on May 19, 2026

Version	3.1.0-beta.1+k8s-1.34	3.1.0-beta.1+k8s-1.33	3.1.0-beta.1+k8s-1.32
Kubernetes Version	1.34.4	1.33.8	1.32.12

New features

• Adds support for vendor-defined custom node roles. Roles are declared in the EC config with associated labels, and one or more roles can be assigned to a node at install or join time. See roles in Embedded Cluster Config.
• Adds an external HTTP API on port 30081 (configurable with --api-port) for headless installs, programmatic node joins, and cluster-state polling. See External API.
• Adds Bring Your Own (BYO) registry support during install.
• Allows joining new nodes to the cluster during an upgrade.
• Adds nftables support for Linux kernel 6.17+.

Improvements

• Unifies runtime suppression of when-gated and readonly config items.
• Applies templating to status informers.

Bug fixes

• Adds detection of orphaned containerd tmpmounts to upgrade preflights.
• Verifies the installer UI port is free before prompting on install or upgrade.

3.0.0-beta.4

Released on April 30, 2026

Version	3.0.0-beta.4+k8s-1.34	3.0.0-beta.4+k8s-1.33	3.0.0-beta.4+k8s-1.32
Kubernetes Version	1.34.4	1.33.8	1.32.12

New features

• Adds SELinux analyzer to host support bundle.

Improvements

• Runs app preflights during upgrades.
• Validates client-side regex on the config screen of the install and upgrade wizards.

Bug fixes

• Fixes an issue where the "continue" modal on the "Add Nodes" page had a black overlay.
• Respects readonly config fields in the UI.
• Redirects embedded web server output to /var/log//web.log.
• Fixes missing version on the Embedded Cluster upgrade completion screen.
• Clears install and upgrade errors when retrying.
• Sets default Kubernetes CLI namespace for the shell command.
• Supports Helm alias field for Replicated SDK dependency renaming.
• Resolves air gap image reference mismatch bugs.

3.0.0-beta.2

Released on April 17, 2026

Version	3.0.0-beta.2+k8s-1.34	3.0.0-beta.2+k8s-1.33	3.0.0-beta.2+k8s-1.32
Kubernetes Version	1.34.4	1.33.8	1.32.12

Bug fixes

• Persists config values on headless install without --config-values.

3.0.0-beta.1

Released on April 15, 2026

Version	3.0.0-beta.1+k8s-1.34	3.0.0-beta.1+k8s-1.33	3.0.0-beta.1+k8s-1.32
Kubernetes Version	1.34.4	1.33.8	1.32.12

New features

• Simplifies image template functions. See Embedded Cluster template functions.